8c52953d71a3d290f94e472553219ac51d9b56e4dcd72dc468633842bf45924c

Analysis

max time kernel
150s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
03/07/2025, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
Size 4.3MB
Sample250703-gnmabsvnt6
SHA256 8c52953d71a3d290f94e472553219ac51d9b56e4dcd72dc468633842bf45924c
MD5 a67ff9d45f5af20b47da40162fba61cf
SHA1 c0913b35528a5b99b49d1f43b7e5b1a36a0f3f42
SHA512 4fae31818be89b175817fa85c0d927ee39bbadd4697cf1c4c5877d98bbf43f7e171b2c5a4a3e3e835dad2c0b3aeb1190fac53a3e6925c17834077b7c4ee43524
SSDEEP 49152:tx9egtsrW4x8cCkSfW5GSdDRTCkJGJuYlAWGs5F8XSUgry+UABmtPz0TIlMCKgzk:/9eFrWo5GSxRvJEuOG6GS++UVd0TKk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3625340254-1625357543-1797847221-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3625340254-1625357543-1797847221-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 9 IoCs

pid	Process
1532	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
4684	icsys.icn.exe
4816	explorer.exe
3824	spoolsv.exe
6052	svchost.exe
4132	spoolsv.exe
4400	explorer.exe
4408	svchost.exe
6060	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe

Loads dropped DLL 5 IoCs

pid	Process
6060	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
6060	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
6060	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
6060	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
6060	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4684	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4816	explorer.exe
6052	svchost.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
4684	icsys.icn.exe
4684	icsys.icn.exe
4816	explorer.exe
4816	explorer.exe
3824	spoolsv.exe
3824	spoolsv.exe
6052	svchost.exe
6052	svchost.exe
4132	spoolsv.exe
4132	spoolsv.exe
4408	svchost.exe
4408	svchost.exe
4400	explorer.exe
4400	explorer.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 1532	3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe	78
PID 3196 wrote to memory of 1532	3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe	78
PID 3196 wrote to memory of 1532	3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe	78
PID 3196 wrote to memory of 4684	3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe	79
PID 3196 wrote to memory of 4684	3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe	79
PID 3196 wrote to memory of 4684	3196	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe	79
PID 4684 wrote to memory of 4816	4684	icsys.icn.exe	81
PID 4684 wrote to memory of 4816	4684	icsys.icn.exe	81
PID 4684 wrote to memory of 4816	4684	icsys.icn.exe	81
PID 4816 wrote to memory of 3824	4816	explorer.exe	82
PID 4816 wrote to memory of 3824	4816	explorer.exe	82
PID 4816 wrote to memory of 3824	4816	explorer.exe	82
PID 3824 wrote to memory of 6052	3824	spoolsv.exe	83
PID 3824 wrote to memory of 6052	3824	spoolsv.exe	83
PID 3824 wrote to memory of 6052	3824	spoolsv.exe	83
PID 6052 wrote to memory of 4132	6052	svchost.exe	84
PID 6052 wrote to memory of 4132	6052	svchost.exe	84
PID 6052 wrote to memory of 4132	6052	svchost.exe	84
PID 5024 wrote to memory of 4400	5024	cmd.exe	89
PID 5024 wrote to memory of 4400	5024	cmd.exe	89
PID 5024 wrote to memory of 4400	5024	cmd.exe	89
PID 4108 wrote to memory of 4408	4108	cmd.exe	90
PID 4108 wrote to memory of 4408	4108	cmd.exe	90
PID 4108 wrote to memory of 4408	4108	cmd.exe	90
PID 1532 wrote to memory of 6060	1532	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe	91
PID 1532 wrote to memory of 6060	1532	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe	91
PID 1532 wrote to memory of 6060	1532	2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe	91

C:\Users\Admin\AppData\Local\Temp\2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
"C:\Users\Admin\AppData\Local\Temp\2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196
- \??\c:\users\admin\appdata\local\temp\2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
  c:\users\admin\appdata\local\temp\2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:1532
- - \??\c:\users\admin\appdata\local\temp\2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
    "c:\users\admin\appdata\local\temp\2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe "
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:6060
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4684
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3824
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:6052
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\resources\svchost.exe RO
1⤵
- Suspicious use of WriteProcessMemory
PID:4108
- \??\c:\windows\resources\svchost.exe
  c:\windows\resources\svchost.exe RO
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\resources\themes\explorer.exe RO
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe RO
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60
MD5 e192462f281446b5d1500d474fbacc4b
SHA1 5ed0044ac937193b78f9878ad7bac5c9ff7534ff
SHA512 cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3
MD5 SHA1 SHA512

Submit Download

35076BA397ED1CE26646CEA1808F8933

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35076BA397ED1CE26646CEA1808F8933
Size 104KB
SHA256 12b22f80aab73e3cf465c5d687c701b8c78ce56c3df658424000c8caf41944bb
MD5 02bb13de5ae49bff6c6e1b1dd107707a
SHA1 66bf5e04463a8928087d6b3e36d916d663fcc649
SHA512 33cddd3cc0aa1b167f7c041e09223c3caa58ed4a865eaaca871bbc4c06e4d5a735202356b1c564379d4fd86b21ae9900667efe71973ad9d8f5b87729b15f1943
SSDEEP 1536:NaoCzKy6MrF0IgGwloA0t9/xhdzB3YGMPEaTzOTsc9vJpIrPey:NaJvhg7aA0ZhVKphqpJ2ey
MD5 SHA1 SHA512 SSDEEP

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 a88278c166c68a7d2c21d2879946531b744512ec64ac8452f776e90e51b3916a
MD5 6fce6beb50887500e1bb752b205b1425
SHA1 35c22abaa126d99a5d2c1c3b282ee64d2d03f2d4
SHA512 50513b209e906879414100fa7834a2330a4f66c2b5687dff23f443da7a79e0ccf85d28d4c49ed6fc86642878596ce67858a9293bcaf6f3e8f3e2180d27105d77
MD5 SHA1 SHA512

Submit Download

35076BA397ED1CE26646CEA1808F8933

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35076BA397ED1CE26646CEA1808F8933
Size 248B
SHA256 73984e359b4539b0e635874754f7ad75e651e1b5c5b5adad6b712a246179636d
MD5 38c2c340299382ae75c9af5dd1f9a84a
SHA1 40e38ea2d9d3ffc1772f477cf85569c62d3e5b5b
SHA512 e7364e12d723ea9bb2faef42d0d4131705c19e892e8ee235ef797cf8771dd2de0a63bff3bca8946d569b41f867b6600fd8be350577e5aca5cec4de7e4e60a500
MD5 SHA1 SHA512

Submit Download

2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe

Path C:\Users\Admin\AppData\Local\Temp\2025-07-03_a67ff9d45f5af20b47da40162fba61cf_amadey_black-basta_coinminer_darkgate_elex_hijackloader_.exe
Size 4.2MB
SHA256 26a1351146bfbd064fa12b6003dfb90e188b997f564b9bfa6f5eacdb27e82856
MD5 52757e5e8b61a0e01f029b4644852086
SHA1 064e34456ae5842fc2fcfd34eb63ebc010f67cf3
SHA512 5d48198212a51d9bd365de100b72d8b621705ef07c507db12ac6c48621dec0173a27928314688c316952a9cdcecb01c4be53dde8bb12c5a2397f916cb3fefe8f
SSDEEP 49152:h9egtsrW4x8cCkSfW5GSdDRTCkJGJuYlAWGs5F8XSUgry+UABmtPz0TIlMCKgzgY:h9eFrWo5GSxRvJEuOG6GS++UVd0TKx
MD5 SHA1 SHA512 SSDEEP

Submit Download

steamservice.dll

Path C:\Users\Admin\AppData\Local\Temp\bin\steamservice.dll
Size 3.5MB
SHA256 027a5bf5ffa796f3c06100322387d6eaa74e95e3665f2610133a02f30bd3fb5a
MD5 719f0a523390aa15fa6f4c27fa026330
SHA1 ce4a7556b34445634e09a1ae7b386ae834b99767
SHA512 93397858077d6def1a98d1f3a42214dc3e8419ea9593c0e62325ea0b2a3c4136b7a53247f3ee58d462c95069359ed9a2f40960c59ea2fa1dfc272c3d295054d9
SSDEEP 49152:VwnUJJSyQnM5gLw1G6KSCKmsvGiUqQmG4U7DX+q4FdtPZ7SevcDmxSCDbFmYfdy9:VwnjnMCLw062KmSGZ17X+qC77S+2
MD5 SHA1 SHA512 SSDEEP

Submit Download

steamservice.exe

Path C:\Users\Admin\AppData\Local\Temp\bin\steamservice.exe
Size 2.8MB
SHA256 e15db20daecdcb1cca827da9dd13ab0241bcd9fad147ee513330068e46104888
MD5 6d5683096ee41a3fee118992eeadac85
SHA1 87f46a1b0d2811d6431144b799376dd2bd4a9a72
SHA512 717cda75a2b4843fc712dd71a0e96fdbfd9b79c10aa2ac70f2eff69a4ec59afc06b437502a88700950f56507c7d8fa73d332833ae84e8538e1d8dd5113a47631
SSDEEP 49152:Nivv0QV2yGh5jxLG7GLVxOG1/zvWdlpMtPvyPV5amNVlwMicwS:NivcrJGaLVQGpzvWdMFyPamL
MD5 SHA1 SHA512 SSDEEP

Submit Download

crashhandler.dll

Path C:\Users\Admin\AppData\Local\Temp\crashhandler.dll
Size 382KB
SHA256 0de3a2cfef95138a09c4d48fc7e7778e3fc9138d2daac11d4b64baed19c7e6d9
MD5 7749c0f15e949357544a43f3f1adf239
SHA1 4a78923abfd5045be7e6cc062af72b36d5c32dfb
SHA512 c4b8dd77b4225e183d8dc87fb0e14b85c3952b78d4cd7c731c566988487bba2a9147fb001be441fc134f7a71b8bbca93ceb74b726af836ddde69860185da3099
SSDEEP 6144:e3XNzhc0d1g/34Fv6jHXUkjKqgepvu9+jZ+2MhpsJHJlgPZk63IavOGgq6cAOfoB:Qdz71g/QvslHvu9+jZi7sJQP13eq6cNC
MD5 SHA1 SHA512 SSDEEP

Submit Download

steam_cmd_win32.manifest

Path C:\Users\Admin\AppData\Local\Temp\package\steam_cmd_win32.manifest
Size 2KB
SHA256 ed5cc567ae21d265681a1da02c4ec1d758a39994b1ac033bcfbbbdfb77c79b61
MD5 d5f6a80b2bcb1302acf1d0e6f1b31dd2
SHA1 a27d5c90ed3fa49d2897160198bbf112a3bc2cd0
SHA512 10e6795b3d112c90f47497c06fd8307490cff18a22a7f46e6320328dbde7f56dca67ebabe444e4791697c17af25e9a747e3d8f1a4a66e997dba24a2064c97d65
MD5 SHA1 SHA512

Submit Download

steamcmd_bins_win32.zip.vz.92ee9e26ad3ca8d831fb8ddbf875c2bd6cb54568_13243489

Path C:\Users\Admin\AppData\Local\Temp\package\steamcmd_bins_win32.zip.vz.92ee9e26ad3ca8d831fb8ddbf875c2bd6cb54568_13243489
Size 12.6MB
SHA256 07c1e2c5c9bc1dfe49ee49b61393768146c38328c9bc51131070c7def914c608
MD5 e7d9251b5d03c1b9de63073dac707bf9
SHA1 92ee9e26ad3ca8d831fb8ddbf875c2bd6cb54568
SHA512 0d6405acded8382a4f8849faa93d8c38e2c0aecd3c5b7d5c3697dc021efe08053771fd9c8f650a5da653431ca45234fc175263a2bba9aa7e56abfa5f13f37d21
SSDEEP 393216:Fe9I9Z2HBGko/iztigG99juCP8lJIbBtu:D9Z2HBGko/iz4gG/juS8lJCu
MD5 SHA1 SHA512 SSDEEP

Submit Download

steamcmd_public_all.zip.8ff3a926fbf646c69eff070955916d6f6b719f22

Path C:\Users\Admin\AppData\Local\Temp\package\steamcmd_public_all.zip.8ff3a926fbf646c69eff070955916d6f6b719f22
Size 57KB
SHA256 2bbbac12f0a0fd10e33e79706abd6d34be9f45e25412d37d2d9325f4736083b8
MD5 1f83646a6b50aa947896ccf51c04aa32
SHA1 8ff3a926fbf646c69eff070955916d6f6b719f22
SHA512 71ac96ae2f608a7e24c77cd40c774a19f700666a700b465eaaa2f5c934effaad995ba2fdad6fe9822bf9d7bb2407081e5f5543c6463d172d521ecbe87ee0e2f9
SSDEEP 768:E13Qfb2Xzf9v6z5CoP91RPNAyBD0/tfvgMeEFtauYLU7cMt3LQymxHAKmRn6UOgw:EobPzBP91BNWgtEi4axJvUOA2
MD5 SHA1 SHA512 SSDEEP

Submit Download

steamcmd_siteserverui_win32.zip.vz.63735e9b350fc0c11c96ec44288a13534349f079_27780545

Path C:\Users\Admin\AppData\Local\Temp\package\steamcmd_siteserverui_win32.zip.vz.63735e9b350fc0c11c96ec44288a13534349f079_27780545
Size 26.5MB
SHA256 00f88b82998db0b9f932af775f0dbc1dd409057905f9d1ff6b383fe59fa89fa8
MD5 3345d83b58a95d16b9225525f334bce0
SHA1 63735e9b350fc0c11c96ec44288a13534349f079
SHA512 251d751bbf566f3d1e68daff325c26076f49fc7b405ebbc75961cd6e0f5a194bc1051ed228fbdd42704553fccc27a610194f272ad0a8cd5a57079a9715692c39
SSDEEP 786432:jrx63aXF8C6CB51UVfDb+l+cG1cdK1Lvd2:jd6q+C6CB51UVbjcG6dK1zM
MD5 SHA1 SHA512 SSDEEP

Submit Download

steamcmd_steamerrorreporter_win32.zip.d03a3bad13add21e6d56e3906ff1a2d2c6357087

Path C:\Users\Admin\AppData\Local\Temp\package\steamcmd_steamerrorreporter_win32.zip.d03a3bad13add21e6d56e3906ff1a2d2c6357087
Size 172KB
SHA256 73fdcee568ef565ea70b28cc5130e01cbdecf2f3d00301000b36969f4bdaf686
MD5 438c3c9c6100bacf7feec0fbd11555c9
SHA1 d03a3bad13add21e6d56e3906ff1a2d2c6357087
SHA512 b8645387ab561cda5013dcd80ee93577613a2e14aa123e24610248d5fb759ee9aa5b52791958cb38771dc633e4cd242484c800f2aa907f93d845c8de829346f2
SSDEEP 3072:/OiP6H3OqFNOZOYZ0Lp7RWeUonh3ZpIc+35EhPY20CdIbNRJ9icqfWsvNmay:/BP83LnY6RWeVnlZKc+35EhPiCd4NbQm
MD5 SHA1 SHA512 SSDEEP

Submit Download

steamcmd_steamservice_win32.zip.vz.0948d276a6fd3b1312c655411181e8f692ec0a77_1770488

Path C:\Users\Admin\AppData\Local\Temp\package\steamcmd_steamservice_win32.zip.vz.0948d276a6fd3b1312c655411181e8f692ec0a77_1770488
Size 1.7MB
SHA256 a40a3f9a2e24cc249100b991a7f613a1ede69cfc04d8ea37c17612c0c2f372ad
MD5 ded83addc8b6440e7da149ad91337ee7
SHA1 0948d276a6fd3b1312c655411181e8f692ec0a77
SHA512 e549b29682570efc64b99565ca8be7d7e5b92b358f5ec527edc29fb5701f5fcaa8a394e279b3ce04fba4372cd3e2e00c46f0986df18a6b315698e33c290e5e49
SSDEEP 49152:uiXDS7E0LofPsDmbRtl6NvZjXY9H1g9N+u6:uYeQ56XXYR1gHN6
MD5 SHA1 SHA512 SSDEEP

Submit Download

steamcmd_win32.zip.vz.7fc43f3256c29bac6013835ac95fca078f99e4f7_1763703

Path C:\Users\Admin\AppData\Local\Temp\package\steamcmd_win32.zip.vz.7fc43f3256c29bac6013835ac95fca078f99e4f7_1763703
Size 1.7MB
SHA256 66a0f8c99ab7a28de03aaf383ca02d62c826cc29a998340f4d2fb09356dcc5ee
MD5 bdc1cb22e9eb96f6a524ec571a5ec66f
SHA1 7fc43f3256c29bac6013835ac95fca078f99e4f7
SHA512 823a1ae1bf3a4e5121badcd5feb71560246ffd059b633378f8e5c2bfa43a1dbac767a33034d3274cf4dcb094ae8adefd352ce3f46f69a249eac547ad914c2ec5
SSDEEP 49152:Z55+EKG8UuzlWG2iOKV3KiW4BX3DOtwrGHlrd:E5/lWB3KV3KwBXHrYR
MD5 SHA1 SHA512 SSDEEP

Submit Download

steambootstrapper_english.txt

Path C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt
Size 4KB
SHA256 fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b
MD5 27993eb75894ca4894db266ad9b5e61b
SHA1 4def653ee04b0514822b690052598435ec25e686
SHA512 eaebeee5b1a7dfb9bdf661623554793d7ef7e15d9f9cf01f94da1eb0b84b88c8f24176463d15c407ebf670c5b7fd4052daea33ba43e75c1de2979487c4987bab
SSDEEP 96:hSlb0IG997a8ICgARZ2pWHxUBnXPz5dc6LzIIivI/BxkHLs06706XDQH:8lHmbICgAr2oHaJc6LkIiQ/DOLsV7VTc
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-console-l1-1-0.dll
Size 18KB
SHA256 94a5df1227818edbfd0d5091c6a48f86b4117c38550343f780c604eee1cd6231
MD5 502263c56f931df8440d7fd2fa7b7c00
SHA1 523a3d7c3f4491e67fc710575d8e23314db2c1a2
SHA512 633efab26cded9c3a5e144b81cbbd3b6adf265134c37d88cfd5f49bb18c345b2fc3a08ba4bbc917b6f64013e275239026829ba08962e94115e94204a47b80221
SSDEEP 192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-datetime-l1-1-0.dll
Size 17KB
SHA256 90fae0e7c3644a6754833c42b0ac39b6f23859f9a7cf4b6c8624820f59b9dad3
MD5 cb978304b79ef53962408c611dfb20f5
SHA1 eca42f7754fb0017e86d50d507674981f80bc0b9
SHA512 369798cd3f37fbae311b6299da67d19707d8f770cf46a8d12d5a6c1f25f85fc959ac5b5926bc68112fa9eb62b402e8b495b9e44f44f8949d7d648ea7c572cf8c
SSDEEP 192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-debug-l1-1-0.dll
Size 17KB
SHA256 c310cc91464c9431ab0902a561af947fa5c973925ff70482d3de017ed3f73b7d
MD5 88ff191fd8648099592ed28ee6c442a5
SHA1 6a4f818b53606a5602c609ec343974c2103bc9cc
SHA512 942ae86550d4a4886dac909898621dab18512c20f3d694a8ad444220aead76fa88c481df39f93c7074dbbc31c3b4daf97099cfed86c2a0aaa4b63190a4b307fd
SSDEEP 384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-errorhandling-l1-1-0.dll
Size 17KB
SHA256 a97dcca76cdb12e985dff71040815f28508c655ab2b073512e386dd63f4da325
MD5 6d778e83f74a4c7fe4c077dc279f6867
SHA1 f5d9cf848f79a57f690da9841c209b4837c2e6c3
SHA512 02ef01583a265532d3970b7d520728aa9b68f2b7c309ee66bd2b38baf473ef662c9d7a223acf2da722587429da6e4fbc0496253ba5c41e214bea240ce824e8a2
SSDEEP 192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-file-l1-1-0.dll
Size 21KB
SHA256 7ea06b7050f9ea2bcc12af34374bdf1173646d4e5ebf66ad690b37f4df5f3d4e
MD5 94ae25c7a5497ca0be6882a00644ca64
SHA1 f7ac28bbc47e46485025a51eeb6c304b70cee215
SHA512 83e570b79111706742d0684fc16207ae87a78fa7ffef58b40aa50a6b9a2c2f77fe023af732ef577fb7cd2666e33ffaf0e427f41ca04075d83e0f6a52a177c2b0
SSDEEP 384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-file-l1-2-0.dll
Size 17KB
SHA256 c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03
MD5 e2f648ae40d234a3892e1455b4dbbe05
SHA1 d9d750e828b629cfb7b402a3442947545d8d781b
SHA512 18d4e7a804813d9376427e12daa444167129277e5ff30502a0fa29a96884bf902b43a5f0e6841ea1582981971843a4f7f928f8aecac693904ab20ca40ee4e954
SSDEEP 192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-file-l2-1-0.dll
Size 17KB
SHA256 c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719
MD5 e479444bdd4ae4577fd32314a68f5d28
SHA1 77edf9509a252e886d4da388bf9c9294d95498eb
SHA512 2afab302fe0f7476a4254714575d77b584cd2dc5330b9b25b852cd71267cda365d280f9aa8d544d4687dc388a2614a51c0418864c41ad389e1e847d81c3ab744
SSDEEP 192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-handle-l1-1-0.dll
Size 17KB
SHA256 945cc64ee04b1964c1f9fcdc3124dd83973d332f5cfb696cdf128ca5c4cbd0e5
MD5 6db54065b33861967b491dd1c8fd8595
SHA1 ed0938bbc0e2a863859aad64606b8fc4c69b810a
SHA512 aa6f0bcb760d449a3a82aed67ca0f7fb747cbb82e627210f377af74e0b43a45ba660e9e3fe1ad4cbd2b46b1127108ec4a96c5cf9de1bdec36e993d0657a615b6
SSDEEP 384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-heap-l1-1-0.dll
Size 17KB
SHA256 44f6df4280c8ecc9c6e609b1a4bfee041332d337d84679cfe0d6678ce8f2998a
MD5 2ea3901d7b50bf6071ec8732371b821c
SHA1 e7be926f0f7d842271f7edc7a4989544f4477da7
SHA512 6bffac8e157a913c5660cd2fabd503c09b47d25f9c220dce8615255c9524e4896edf76fe2c2cc8bdef58d9e736f5514a53c8e33d8325476c5f605c2421f15c7d
SSDEEP 192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-interlocked-l1-1-0.dll
Size 17KB
SHA256 deccd75fc3fc2bb31338b6fe26deffbd7914c6cd6a907e76fd4931b7d141718c
MD5 d97a1cb141c6806f0101a5ed2673a63d
SHA1 d31a84c1499a9128a8f0efea4230fcfa6c9579be
SHA512 0e3202041def9d2278416b7826c61621dced6dee8269507ce5783c193771f6b26d47feb0700bbe937d8aff9f7489890b5263d63203b5ba99e0b4099a5699c620
SSDEEP 192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-libraryloader-l1-1-0.dll
Size 18KB
SHA256 bb25ccf8694d1fcfce85a7159dcf6985fdb54728d29b021cb3d14242f65909ce
MD5 d0873e21721d04e20b6ffb038accf2f1
SHA1 9e39e505d80d67b347b19a349a1532746c1f7f88
SHA512 4b7f2ad9ead6489e1ea0704cf5f1b1579baf1061b193d54cc6201ffdda890a8c8facb23091dfd851dd70d7922e0c7e95416f623c48ec25137ddd66e32df9a637
SSDEEP 384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-localization-l1-2-0.dll
Size 20KB
SHA256 03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97
MD5 eff11130bfe0d9c90c0026bf2fb219ae
SHA1 cf4c89a6e46090d3d8feeb9eb697aea8a26e4088
SHA512 8133fb9f6b92f498413db3140a80d6624a705f80d9c7ae627dfd48adeb8c5305a61351bf27bbf02b4d3961f9943e26c55c2a66976251bb61ef1537bc8c212add
SSDEEP 384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-memory-l1-1-0.dll
Size 18KB
SHA256 bb33a9e906a5863043753c44f6f8165afe4d5edb7e55efa4c7e6e1ed90778eca
MD5 d500d9e24f33933956df0e26f087fd91
SHA1 6c537678ab6cfd6f3ea0dc0f5abefd1c4924f0c0
SHA512 c89023eb98bf29adeebfbcb570427b6df301de3d27ff7f4f0a098949f987f7c192e23695888a73f1a2019f1af06f2135f919f6c606a07c8fa9f07c00c64a34b5
SSDEEP 384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-namedpipe-l1-1-0.dll
Size 17KB
SHA256 c4f60f911068ab6d7f578d449ba7b5b9969f08fc683fd0ce8e2705bbf061f507
MD5 6f6796d1278670cce6e2d85199623e27
SHA1 8aa2155c3d3d5aa23f56cd0bc507255fc953ccc3
SHA512 6e7b134ca930bb33d2822677f31eca1cb6c1dff55211296324d2ea9ebdc7c01338f07d22a10c5c5e1179f14b1b5a4e3b0bafb1c8d39fcf1107c57f9eaf063a7b
SSDEEP 192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-processenvironment-l1-1-0.dll
Size 18KB
SHA256 96898930ffb338da45497be019ae1adcd63c5851141169d3023e53ce4c7a483e
MD5 5f73a814936c8e7e4a2dfd68876143c8
SHA1 d960016c4f553e461afb5b06b039a15d2e76135e
SHA512 77987906a9d248448fa23db2a634869b47ae3ec81ea383a74634a8c09244c674ecf9aadcde298e5996cafbb8522ede78d08aaa270fd43c66bede24115cdbdfed
SSDEEP 192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-processthreads-l1-1-0.dll
Size 18KB
SHA256 9dab884071b1f7d7a167f9bec94ba2bee875e3365603fa29b31de286c6a97a1d
MD5 a2d7d7711f9c0e3e065b2929ff342666
SHA1 a17b1f36e73b82ef9bfb831058f187535a550eb8
SHA512 d436b2192c4392a041e20506b2dfb593fe5797f1fdc2cdeb2d7958832c4c0a9e00d3aea6aa1737d8a9773817feadf47ee826a6b05fd75ab0bdae984895c2c4ef
SSDEEP 384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-processthreads-l1-1-1.dll
Size 18KB
SHA256 91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a
MD5 d0289835d97d103bad0dd7b9637538a1
SHA1 8ceebe1e9abb0044808122557de8aab28ad14575
SHA512 97c47b2e1bfd45b905f51a282683434ed784bfb334b908bf5a47285f90201a23817ff91e21ea0b9ca5f6ee6b69acac252eec55d895f942a94edd88c4bfd2dafd
SSDEEP 384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-profile-l1-1-0.dll
Size 17KB
SHA256 8eb5270fa99069709c846db38be743a1a80a42aa1a88776131f79e1d07cc411c
MD5 fee0926aa1bf00f2bec9da5db7b2de56
SHA1 f5a4eb3d8ac8fb68af716857629a43cd6be63473
SHA512 0958759a1c4a4126f80aa5cdd9df0e18504198aec6828c8ce8eb5f615ad33bf7ef0231b509ed6fd1304eeab32878c5a649881901abd26d05fd686f5ebef2d1c3
SSDEEP 192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 17KB
SHA256 2257fea1e71f7058439b3727ed68ef048bd91dcacd64762eb5c64a9d49df0b57
MD5 fdba0db0a1652d86cd471eaa509e56ea
SHA1 3197cb45787d47bac80223e3e98851e48a122efa
SHA512 e5056d2bd34dc74fc5f35ea7aa8189aaa86569904b0013a7830314ae0e2763e95483fabdcba93f6418fb447a4a74ab0f07712ed23f2e1b840e47a099b1e68e18
SSDEEP 384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-string-l1-1-0.dll
Size 17KB
SHA256 7670fdede524a485c13b11a7c878015e9b0d441b7d8eb15ca675ad6b9c9a7311
MD5 12cc7d8017023ef04ebdd28ef9558305
SHA1 f859a66009d1caae88bf36b569b63e1fbdae9493
SHA512 f62303d98ea7d0ddbe78e4ab4db31ac283c3a6f56dbe5e3640cbcf8c06353a37776bf914cfe57bbb77fc94ccfa48fac06e74e27a4333fbdd112554c646838929
SSDEEP 384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-synch-l1-1-0.dll
Size 19KB
SHA256 5dd4ccd63e6ed07ca3987ab5634ca4207d69c47c2544dfefc41935617652820f
MD5 71af7ed2a72267aaad8564524903cff6
SHA1 8a8437123de5a22ab843adc24a01ac06f48db0d3
SHA512 7ec2e0febc89263925c0352a2de8cc13da37172555c3af9869f9dbb3d627dd1382d2ed3fdad90594b3e3b0733f2d3cfdec45bc713a4b7e85a09c164c3dfa3875
SSDEEP 384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-synch-l1-2-0.dll
Size 18KB
SHA256 30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1
MD5 0d1aa99ed8069ba73cfd74b0fddc7b3a
SHA1 ba1f5384072df8af5743f81fd02c98773b5ed147
SHA512 6b1a87b1c223b757e5a39486be60f7dd2956bb505a235df406bcf693c7dd440e1f6d65ffef7fde491371c682f4a8bb3fd4ce8d8e09a6992bb131addf11ef2bf9
SSDEEP 384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-sysinfo-l1-1-0.dll
Size 18KB
SHA256 4b704b36e1672ae02e697efd1bf46f11b42d776550ba34a90cd189f6c5c61f92
MD5 19a40af040bd7add901aa967600259d9
SHA1 05b6322979b0b67526ae5cd6e820596cbe7393e4
SHA512 5cc4d55350a808620a7e8a993a90e7d05b441da24127a00b15f96aae902e4538ca4fed5628d7072358e14681543fd750ad49877b75e790d201ab9baff6898c8d
SSDEEP 384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-timezone-l1-1-0.dll
Size 17KB
SHA256 24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca
MD5 babf80608fd68a09656871ec8597296c
SHA1 33952578924b0376ca4ae6a10b8d4ed749d10688
SHA512 3ffffd90800de708d62978ca7b50fe9ce1e47839cda11ed9e7723acec7ab5829fa901595868e4ab029cdfb12137cf8ecd7b685953330d0900f741c894b88257b
SSDEEP 384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-core-util-l1-1-0.dll
Size 17KB
SHA256 f7d450a0f59151bcefb98d20fcae35f76029df57138002db5651d1b6a33adc86
MD5 0f079489abd2b16751ceb7447512a70d
SHA1 679dd712ed1c46fbd9bc8615598da585d94d5d87
SHA512 92d64299ebde83a4d7be36f07f65dd868da2765eb3b39f5128321aff66abd66171c7542e06272cb958901d403ccf69ed716259e0556ee983d2973faa03c55d3e
SSDEEP 192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-crt-conio-l1-1-0.dll
Size 18KB
SHA256 9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2
MD5 6ea692f862bdeb446e649e4b2893e36f
SHA1 84fceae03d28ff1907048acee7eae7e45baaf2bd
SHA512 9661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7
SSDEEP 384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-crt-convert-l1-1-0.dll
Size 21KB
SHA256 3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1
MD5 72e28c902cd947f9a3425b19ac5a64bd
SHA1 9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7
SHA512 58ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff
SSDEEP 384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-crt-environment-l1-1-0.dll
Size 18KB
SHA256 c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382
MD5 ac290dad7cb4ca2d93516580452eda1c
SHA1 fa949453557d0049d723f9615e4f390010520eda
SHA512 b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8
SSDEEP 192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-crt-filesystem-l1-1-0.dll
Size 19KB
SHA256 7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2
MD5 aec2268601470050e62cb8066dd41a59
SHA1 363ed259905442c4e3b89901bfd8a43b96bf25e4
SHA512 0c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f
SSDEEP 384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-crt-heap-l1-1-0.dll
Size 18KB
SHA256 f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d
MD5 93d3da06bf894f4fa21007bee06b5e7d
SHA1 1e47230a7ebcfaf643087a1929a385e0d554ad15
SHA512 72bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6
SSDEEP 192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-crt-locale-l1-1-0.dll
Size 18KB
SHA256 565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33
MD5 a2f2258c32e3ba9abf9e9e38ef7da8c9
SHA1 116846ca871114b7c54148ab2d968f364da6142f
SHA512 e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe
SSDEEP 192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-crt-math-l1-1-0.dll
Size 28KB
SHA256 bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed
MD5 8b0ba750e7b15300482ce6c961a932f0
SHA1 71a2f5d76d23e48cef8f258eaad63e586cfc0e19
SHA512 fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a
SSDEEP 384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-crt-multibyte-l1-1-0.dll
Size 25KB
SHA256 66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735
MD5 35fc66bd813d0f126883e695664e7b83
SHA1 2fd63c18cc5dc4defc7ea82f421050e668f68548
SHA512 65f8397de5c48d3df8ad79baf46c1d3a0761f727e918ae63612ea37d96adf16cc76d70d454a599f37f9ba9b4e2e38ebc845df4c74fc1e1131720fd0dcb881431
SSDEEP 384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-crt-private-l1-1-0.dll
Size 71KB
SHA256 65ded8d2ce159b2f5569f55b2caf0e2c90f3694bd88c89de790a15a49d8386b9
MD5 9910a1bfdc41c5b39f6af37f0a22aacd
SHA1 47fa76778556f34a5e7910c816c78835109e4050
SHA512 a9788d0f8b3f61235ef4740724b4a0d8c0d3cf51f851c367cc9779ab07f208864a7f1b4a44255e0de8e030d84b63b1bdb58f12c8c20455ff6a55ef6207b31a91
SSDEEP 1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-crt-process-l1-1-0.dll
Size 18KB
SHA256 c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b
MD5 8d02dd4c29bd490e672d271700511371
SHA1 f3035a756e2e963764912c6b432e74615ae07011
SHA512 d44ef51d3aaf42681659fffff4dd1a1957eaf4b8ab7bb798704102555da127b9d7228580dced4e0fc98c5f4026b1bab242808e72a76e09726b0af839e384c3b0
SSDEEP 192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-crt-runtime-l1-1-0.dll
Size 22KB
SHA256 c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b
MD5 41a348f9bedc8681fb30fa78e45edb24
SHA1 66e76c0574a549f293323dd6f863a8a5b54f3f9b
SHA512 8c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204
SSDEEP 384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-crt-stdio-l1-1-0.dll
Size 23KB
SHA256 b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7
MD5 fefb98394cb9ef4368da798deab00e21
SHA1 316d86926b558c9f3f6133739c1a8477b9e60740
SHA512 57476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8
SSDEEP 384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\siteserverui\win32\api-ms-win-crt-string-l1-1-0.dll
Size 22KB
SHA256 73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c
MD5 404604cd100a1e60dfdaf6ecf5ba14c0
SHA1 58469835ab4b916927b3cabf54aee4f380ff6748
SHA512 da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4
SSDEEP 384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 4b6d0798160821bd46bbecc07b0fdfd7894ba3efc07a1fde9854f30b0a97b73a
MD5 072e9249c19d4bc72e590438298a1860
SHA1 6dc4095380d214b579be1b868b973363f63edaee
SHA512 ee828a45b9635387dd94b524e0dea3bdcc543e78da05caa9a18f8c2c2d6ab50b201ad2e2869302f091026bb39da2d90bba70aa8201f1fe9acd969ef9e09a34d2
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVITHe:UVqoCl/YgjxEufVU0TbTyDDalMHe
MD5 SHA1 SHA512 SSDEEP

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 368e990f26ae23635ba4bf8086d18b38ae6629ab3488fff68738e719844eda54
MD5 e76d8e4ae062d384a0a86513ed03ec24
SHA1 1ba68103d1fc2e61a0dda08d96b48ad56415ae22
SHA512 802431fe52e185052846d28f31f035c86bcaff5d9f5342e00c3f17ee77463719cecb193f681a330d5f3d25cbd83cd4cf4a603b618defecab8a21178fd0f1e35e
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVITHe:UVqoCl/YgjxEufVU0TbTyDDalMHe
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 719a2f1fd2e60512d0e37d12c4c099695722beeac8c93a94bbc58c6b9b7a5740
MD5 d4c8ce4f1937da01bb29b5ccbbf201bc
SHA1 530e0e34ac52d019b3238f7693fb88302a860268
SHA512 09da9053a399ba6aad991773fa1bd65ff988c04252af1651a056e9df211cac18dbc9cf3bd54879c854a4eee80e9f1a623b6747e3b04accd0561a516f4adb5353
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVITHF:UVqoCl/YgjxEufVU0TbTyDDalMHF
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 9fa603eaf69afdae0a71d72ed18538eba5873d121e2010a078df9f9447633b04
MD5 a3a38ef6fb50999c8feff420896f9c80
SHA1 60e905896f0513e0bcf514fbdacb29809c1b82ec
SHA512 47f92db05339cdda1da42dd42c69c820928f9b07d43e23029f0b5e04e4eeb479daa879243538600538fa36ae2089381b4814f2dd1cef2c981d1406039e124718
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVITHU:UVqoCl/YgjxEufVU0TbTyDDalMHU
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootstrap_log.txt

Path \??\c:\users\admin\appdata\local\temp\logs\bootstrap_log.txt
Size 20KB
SHA256 116a315876c3f93be6f08ef3868773293509ed351b9f7d0ba1a73aa529cdcbec
MD5 4b4eb60ab679a0e486caec7878f4639a
SHA1 8c3b5394b31a50832cc748008203e48f5c5b149f
SHA512 4da670886ec1d2bcb7b76da412b6592d30ca129cb2f126f60c6b7b5c8bc4d1a50e11751f46c7aab4f2a9468781d4dbd7ef2000e681627c7d356ee7a80a254d00
SSDEEP 192:Ymn6a5fUS5ISPdH5dGRzofax+ts6sg/PlrUsZOvJeI5mfSvnwM:s25I85gxxUPlJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

steam_cmd_metrics.bin

Path \??\c:\users\admin\appdata\local\temp\package\steam_cmd_metrics.bin
Size 1KB
SHA256 453f841112cc9d4a316bd3e0c8e58f20d7e9a2dcd2833b1b6dc82ec0ddaba4f4
MD5 151dd2ed9ccfe4d8b01ca2779aca8b6c
SHA1 1ee68507c7381f4fa14869747062e3301a3d141f
SHA512 22f172e620dd97cdbde0a603f672fc4bcaf5a521ff7893b147b0df78dcb1e535eec820fcb88ca6bfeb6ad3738398c73db482aa237695c54a65637c8239ec1739
MD5 SHA1 SHA512

Submit Download

steam_cmd_win32.installed

Path \??\c:\users\admin\appdata\local\temp\package\steam_cmd_win32.installed
Size 10KB
SHA256 b0d7ccdced6d2c2dd1b9e4dbb9acd43381dd27a08806cb5f12f932d1774f4baf
MD5 80ef07105f6c5123f59283984392d03e
SHA1 f9ed14a1a0333c340421d52d9b2b7567738255f7
SHA512 b5855b7d7bdb23a542a0cfd9695ad9c6a5f2884e99c65c5748238fadfee9e4c377335fd8d19f75d120f481c5e562cfbeee8e9bdf3c45e20122dbc58b08943304
SSDEEP 192:AuKSeYQJC8mZhoMF4/M6ogq7PIWdJLCV7iEKk:AuaYjSM73z+8I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3196-45-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3196-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3824-43-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4132-42-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4400-55-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4408-54-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4684-44-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4816-445-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6052-489-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6060-490-0x00000000728F0000-0x0000000073CBA000-memory.dmp

Download

memory/6060-491-0x00000000728F0000-0x0000000073CBA000-memory.dmp

Download

memory/6060-492-0x00000000728F0000-0x0000000073CBA000-memory.dmp

Download

memory/6060-493-0x00000000728F0000-0x0000000073CBA000-memory.dmp

Download

memory/6060-494-0x00000000728F0000-0x0000000073CBA000-memory.dmp

Download

memory/6060-495-0x00000000728F0000-0x0000000073CBA000-memory.dmp

Download

memory/6060-496-0x00000000728F0000-0x0000000073CBA000-memory.dmp

Download