0dfdc6ca2abd297670fc50ed541af007b82280459520bc2995e13345d9280386

Analysis

max time kernel
901s
max time network
692s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Verdent-2.5.6-Windows-x64.exe
Size 168.8MB
Sample260629-trwpdsa18n
SHA256 0dfdc6ca2abd297670fc50ed541af007b82280459520bc2995e13345d9280386
MD5 69e23073276da9ee65928133229a2c07
SHA1 6a47d3374c3eb80a34455d83caca6706b7b4c5ec
SHA512 3084ddc886d39e545ea5712e63768523f5a944e0355687dff100091cadef691a9919adaefdfa8a74ea2d3060c46cd83299aead0a12d57bb9ba68d35d5e650028
SSDEEP 3145728:sU/SsFtSRihi1OIAT/nVm1ZqZnKNL2ynuIlaxQGZZP7MyIn7Ut+gyT:1asLSRWi1ORm1ZMnKVgQkZDMyIDd
TLSH
T1818833155631609BC831BBF6492286F164382E9B36035D268CF5F7F3FE896096CD8BE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
6708	tasklist.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	Verdent.exe

Executes dropped EXE 6 IoCs

pid	Process
5424	Verdent.exe
6560	Verdent.exe
1296	Verdent.exe
4584	Verdent.exe
6552	Verdent.exe
3972	Verdent.exe

Loads dropped DLL 25 IoCs

pid	Process
1088	Verdent-2.5.6-Windows-x64.exe
1088	Verdent-2.5.6-Windows-x64.exe
1088	Verdent-2.5.6-Windows-x64.exe
1088	Verdent-2.5.6-Windows-x64.exe
1088	Verdent-2.5.6-Windows-x64.exe
1088	Verdent-2.5.6-Windows-x64.exe
1088	Verdent-2.5.6-Windows-x64.exe
1088	Verdent-2.5.6-Windows-x64.exe
1088	Verdent-2.5.6-Windows-x64.exe
1088	Verdent-2.5.6-Windows-x64.exe
1088	Verdent-2.5.6-Windows-x64.exe
1088	Verdent-2.5.6-Windows-x64.exe
5424	Verdent.exe
1296	Verdent.exe
5424	Verdent.exe
1296	Verdent.exe
1296	Verdent.exe
1296	Verdent.exe
1296	Verdent.exe
1296	Verdent.exe
1296	Verdent.exe
6552	Verdent.exe
3972	Verdent.exe
3972	Verdent.exe
3972	Verdent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Verdent-2.5.6-Windows-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Verdent.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Verdent.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Verdent.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Verdent.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Verdent.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Verdent.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Verdent.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Verdent.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Verdent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Verdent.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
6596	taskkill.exe
2316	taskkill.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\verdent\shell\open\command	Verdent.exe
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\verdent\shell	Verdent.exe
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\verdent\shell\open	Verdent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\verdent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Verdent\\Verdent.exe\" \"%1\""	Verdent.exe
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\verdent	Verdent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\verdent\URL Protocol	Verdent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\verdent\ = "URL:verdent"	Verdent.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1088	Verdent-2.5.6-Windows-x64.exe
1088	Verdent-2.5.6-Windows-x64.exe
6708	tasklist.exe
6708	tasklist.exe
3972	Verdent.exe
3972	Verdent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6596	taskkill.exe
Token: SeDebugPrivilege	6708	tasklist.exe
Token: SeSecurityPrivilege	1088	Verdent-2.5.6-Windows-x64.exe
Token: SeDebugPrivilege	2316	taskkill.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe
Token: SeShutdownPrivilege	5424	Verdent.exe
Token: SeCreatePagefilePrivilege	5424	Verdent.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 6596	1088	Verdent-2.5.6-Windows-x64.exe	90
PID 1088 wrote to memory of 6332	1088	Verdent-2.5.6-Windows-x64.exe	93
PID 6332 wrote to memory of 6708	6332	cmd.exe	95
PID 6332 wrote to memory of 6620	6332	cmd.exe	96
PID 1088 wrote to memory of 2316	1088	Verdent-2.5.6-Windows-x64.exe	97
PID 5424 wrote to memory of 7084	5424	Verdent.exe	101
PID 7084 wrote to memory of 6248	7084	cmd.exe	103
PID 5424 wrote to memory of 6560	5424	Verdent.exe	104
PID 5424 wrote to memory of 1296	5424	Verdent.exe	105
PID 5424 wrote to memory of 1296	5424	Verdent.exe	105
PID 5424 wrote to memory of 4584	5424	Verdent.exe	106
PID 5424 wrote to memory of 6924	5424	Verdent.exe	107
PID 5424 wrote to memory of 6820	5424	Verdent.exe	108
PID 5424 wrote to memory of 2952	5424	Verdent.exe	109
PID 5424 wrote to memory of 5696	5424	Verdent.exe	110
PID 5424 wrote to memory of 5068	5424	Verdent.exe	111
PID 5424 wrote to memory of 1368	5424	Verdent.exe	112
PID 5424 wrote to memory of 3468	5424	Verdent.exe	113
PID 5424 wrote to memory of 1944	5424	Verdent.exe	114
PID 5424 wrote to memory of 6584	5424	Verdent.exe	115
PID 5424 wrote to memory of 6060	5424	Verdent.exe	116
PID 5424 wrote to memory of 2868	5424	Verdent.exe	117
PID 5424 wrote to memory of 4260	5424	Verdent.exe	118
PID 5424 wrote to memory of 1304	5424	Verdent.exe	119
PID 5424 wrote to memory of 4728	5424	Verdent.exe	121
PID 5424 wrote to memory of 1468	5424	Verdent.exe	123
PID 2952 wrote to memory of 1172	2952	cmd.exe	137
PID 5696 wrote to memory of 3208	5696	cmd.exe	138
PID 6820 wrote to memory of 5364	6820	cmd.exe	139
PID 5068 wrote to memory of 6892	5068	cmd.exe	140
PID 1468 wrote to memory of 2240	1468	cmd.exe	141
PID 4260 wrote to memory of 3132	4260	cmd.exe	142
PID 6584 wrote to memory of 5972	6584	cmd.exe	143
PID 2868 wrote to memory of 6112	2868	cmd.exe	144
PID 6060 wrote to memory of 1264	6060	cmd.exe	145
PID 6924 wrote to memory of 1340	6924	cmd.exe	146
PID 1944 wrote to memory of 1164	1944	cmd.exe	147
PID 1368 wrote to memory of 3372	1368	cmd.exe	148
PID 1304 wrote to memory of 5832	1304	cmd.exe	149
PID 3468 wrote to memory of 6232	3468	cmd.exe	150
PID 4728 wrote to memory of 2212	4728	cmd.exe	151
PID 5424 wrote to memory of 6552	5424	Verdent.exe	152
PID 5424 wrote to memory of 6552	5424	Verdent.exe	152
PID 5424 wrote to memory of 1764	5424	Verdent.exe	153
PID 5424 wrote to memory of 1228	5424	Verdent.exe	155
PID 5424 wrote to memory of 3972	5424	Verdent.exe	157
PID 5424 wrote to memory of 2060	5424	Verdent.exe	159
PID 5424 wrote to memory of 2820	5424	Verdent.exe	160
PID 5424 wrote to memory of 6044	5424	Verdent.exe	161
PID 5424 wrote to memory of 2472	5424	Verdent.exe	162
PID 5424 wrote to memory of 6252	5424	Verdent.exe	163
PID 5424 wrote to memory of 5552	5424	Verdent.exe	164
PID 5424 wrote to memory of 4612	5424	Verdent.exe	165
PID 5424 wrote to memory of 6732	5424	Verdent.exe	166
PID 5424 wrote to memory of 2360	5424	Verdent.exe	167
PID 5424 wrote to memory of 6672	5424	Verdent.exe	168
PID 5424 wrote to memory of 1980	5424	Verdent.exe	169
PID 5424 wrote to memory of 4224	5424	Verdent.exe	170
PID 5424 wrote to memory of 6592	5424	Verdent.exe	171
PID 5424 wrote to memory of 6844	5424	Verdent.exe	172
PID 5424 wrote to memory of 3716	5424	Verdent.exe	173
PID 2060 wrote to memory of 288	2060	cmd.exe	190
PID 5552 wrote to memory of 4748	5552	cmd.exe	189
PID 4224 wrote to memory of 6296	4224	cmd.exe	192

C:\Users\Admin\AppData\Local\Temp\Verdent-2.5.6-Windows-x64.exe
"C:\Users\Admin\AppData\Local\Temp\Verdent-2.5.6-Windows-x64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /f /t /im "Verdent.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Verdent.exe" /FO csv | "C:\Windows\system32\find.exe" "Verdent.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6332
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Verdent.exe" /FO csv
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6708
- - C:\Windows\SysWOW64\find.exe
    "C:\Windows\system32\find.exe" "Verdent.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6620
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /f /t /im "Verdent.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2316

C:\Users\Admin\AppData\Local\Programs\Verdent\Verdent.exe
"C:\Users\Admin\AppData\Local\Programs\Verdent\Verdent.exe"
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7084
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:6248
- C:\Users\Admin\AppData\Local\Programs\Verdent\Verdent.exe
  C:\Users\Admin\AppData\Local\Programs\Verdent\Verdent.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Verdent /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Verdent\Crashpad --url=https://f.a.k/e --annotation=_productName=Verdent --annotation=_version=2.5.6 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=39.8.7 --initial-client-data=0x52c,0x544,0x53c,0x47c,0x540,0x7ff6b6c4f66c,0x7ff6b6c4f678,0x7ff6b6c4f688
  2⤵
  - Executes dropped EXE
  PID:6560
- C:\Users\Admin\AppData\Local\Programs\Verdent\Verdent.exe
  "C:\Users\Admin\AppData\Local\Programs\Verdent\Verdent.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Verdent" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,5893212066512544447,562780228340007486,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1296
- C:\Users\Admin\AppData\Local\Programs\Verdent\Verdent.exe
  "C:\Users\Admin\AppData\Local\Programs\Verdent\Verdent.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Verdent" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1848,i,5893212066512544447,562780228340007486,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where code 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6924
- - C:\Windows\system32\where.exe
    where code
    3⤵
    PID:1340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where cursor 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6820
- - C:\Windows\system32\where.exe
    where cursor
    3⤵
    PID:5364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where windsurf 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\system32\where.exe
    where windsurf
    3⤵
    PID:1172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where agy 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Windows\system32\where.exe
    where agy
    3⤵
    PID:3208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where idea 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\system32\where.exe
    where idea
    3⤵
    PID:6892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where webstorm 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\system32\where.exe
    where webstorm
    3⤵
    PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where goland 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\system32\where.exe
    where goland
    3⤵
    PID:6232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where subl 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\system32\where.exe
    where subl
    3⤵
    PID:1164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where atom 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6584
- - C:\Windows\system32\where.exe
    where atom
    3⤵
    PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where vim 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Windows\system32\where.exe
    where vim
    3⤵
    PID:1264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where nvim 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\system32\where.exe
    where nvim
    3⤵
    PID:6112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where emacs 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\system32\where.exe
    where emacs
    3⤵
    PID:3132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where zed 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\system32\where.exe
    where zed
    3⤵
    PID:5832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where explorer 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\system32\where.exe
    where explorer
    3⤵
    PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where start 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\system32\where.exe
    where start
    3⤵
    PID:2240
- C:\Users\Admin\AppData\Local\Programs\Verdent\Verdent.exe
  "C:\Users\Admin\AppData\Local\Programs\Verdent\Verdent.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Verdent" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-user-model-id=ai.verdent.deck --app-path="C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1782755215737004 --launch-time-ticks=572758109 --field-trial-handle=1848,i,5893212066512544447,562780228340007486,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "git --version"
  2⤵
  PID:1764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "git --version"
  2⤵
  PID:1228
- C:\Users\Admin\AppData\Local\Programs\Verdent\Verdent.exe
  "C:\Users\Admin\AppData\Local\Programs\Verdent\Verdent.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Verdent" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,5893212066512544447,562780228340007486,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3808 /prefetch:10
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where code 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\system32\where.exe
    where code
    3⤵
    PID:288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where cursor 2>NUL"
  2⤵
  PID:2820
- - C:\Windows\system32\where.exe
    where cursor
    3⤵
    PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where windsurf 2>NUL"
  2⤵
  PID:6044
- - C:\Windows\system32\where.exe
    where windsurf
    3⤵
    PID:5944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where agy 2>NUL"
  2⤵
  PID:2472
- - C:\Windows\system32\where.exe
    where agy
    3⤵
    PID:3320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where idea 2>NUL"
  2⤵
  PID:6252
- - C:\Windows\system32\where.exe
    where idea
    3⤵
    PID:588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where webstorm 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Windows\system32\where.exe
    where webstorm
    3⤵
    PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where goland 2>NUL"
  2⤵
  PID:4612
- - C:\Windows\system32\where.exe
    where goland
    3⤵
    PID:5400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where subl 2>NUL"
  2⤵
  PID:6732
- - C:\Windows\system32\where.exe
    where subl
    3⤵
    PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where atom 2>NUL"
  2⤵
  PID:2360
- - C:\Windows\system32\where.exe
    where atom
    3⤵
    PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where vim 2>NUL"
  2⤵
  PID:6672
- - C:\Windows\system32\where.exe
    where vim
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where nvim 2>NUL"
  2⤵
  PID:1980
- - C:\Windows\system32\where.exe
    where nvim
    3⤵
    PID:4268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where emacs 2>NUL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\system32\where.exe
    where emacs
    3⤵
    PID:6296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where zed 2>NUL"
  2⤵
  PID:6592
- - C:\Windows\system32\where.exe
    where zed
    3⤵
    PID:1748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where explorer 2>NUL"
  2⤵
  PID:6844
- - C:\Windows\system32\where.exe
    where explorer
    3⤵
    PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where start 2>NUL"
  2⤵
  PID:3716
- - C:\Windows\system32\where.exe
    where start
    3⤵
    PID:4852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:664

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\Verdent\D3DCompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Verdent\chrome_100_percent.pak
Size 112KB
SHA256 45d14a4278b1e152b363197401a5604aa5a3cee6512a6b52df978038fa521a0f
MD5 e7bbddff3081eeecf7f56e76ce1d48e4
SHA1 eb83b418ad0e8f502f12a339cabc2fef8ec06cb4
SHA512 2caaa851d095d1a641b959cf092a2ce02328298aafdfadafc773eb0a0054054ae54c41574328694f6a37928203509a0c7e38f3beff1f4fd2ded00b5ed5531d85
SSDEEP 3072:z84PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:zRYWFUbGz8LI1TnjQBQCrC
TLSH
T13AB3D0D7B7B0AD7DDA474BB783560170FCB30B2D0682120A5A99E479653AF88C8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Verdent\chrome_200_percent.pak
Size 182KB
SHA256 aafc61b89748d17fcbc9fecd9844a77be2c584529a81714c98e0c4d453ea9496
MD5 1e1744b9410d29e7d1ed28c4f67d6317
SHA1 4f3fcf3db1f8a1eeefd5a4c2f3f2d2b34c094a82
SHA512 10fbcc89ae3251f4c163beea1dd3a53bca239486e1ed7a997e9b04d3a6193266cd96db4a1f8b753942429305ae9ee28b1e9d3fee7e2ddfee847a4db40c8cea93
SSDEEP 3072:dl4J8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:tGQ+N6uSZQDQYakvyAkcjQBQNd4
TLSH
T13804F1D373B8AD3DDA570B73926610E0FD7A20291EB3110A5A9F98397925E8CD9CD343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\Verdent\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Programs\Verdent\libGLESv2.dll
Size 8.0MB
SHA256 8d1b6bf1c09fba0e138249a3096406a26da811bf10ffbf6d005adbc71c8c2b1c
MD5 c25a6b8be1b2cc150824682663703fb6
SHA1 2a09593a07b1bedd413e0aa11576c5871dfb709b
SHA512 bc2491040801e24e16711b88049443a33b44f70b584158b6fa715b307ae2f3c8504d10203faf3a9b20879caad3a2fbb5c1aa05c0319036a25f59384deef015e2
SSDEEP 49152:TMSIp4LMyGtIulf/eBbJ22SabhdW+jEgo5WsEgY1SAgkIUVs4S1ZU/zAkIYfWFyr:wn5XmGY0wm713KWsNohEsNnxWLp
TLSH
T16A867C03F69581D8C05DE2B8875BA227FA31B8490734B6CF2A9413152F6BFE0A77E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Programs\Verdent\libegl.dll
Size 492KB
SHA256 92712fd93c2aa137908864f4b4f94a0b27e218421827a12d6c14d8cee1ad718a
MD5 adcdebd11a9fb018b6ef8d69b776c879
SHA1 35a07bc6d48cb4ba62e2eff3070f622687df7148
SHA512 03ace79bcced32e6c5202696322cb8058f477713a9d3d95c9c8bb81fdb03678bcec08323e0a0a1f2c7d7910208161fb2cf1b1b291f70daa9a4cdb92a485aa813
SSDEEP 6144:BtqwvC8uRreZw/ebZyu5sIAeoZPw1ODZ6R3/8cWqR/H2p5HoSJhg:XqwvC8SrZmNEIsPwa6R3/8cWqt0HoS8
TLSH
T1DEB49D15F3E945A8E06AD4348B534603DA7278560B65FAEF03E092793F37BE45B3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\Verdent\locales\en-US.pak
Size 524KB
SHA256 bfa782c9efae2c9cd2c0214dae1bbb3c259d4d4c38d920b06677b9c4cf4f813d
MD5 bfbb69222dcc50ca860b6a80a3da4f4c
SHA1 51200c9bd18b0999ba38033662c5e319485e7420
SHA512 940a2855b5de5f1545abbfed5dad0cfe81e74e847a60f65b4a8df54860649502062ff8941c0fbb248c203fbe6b883ecae8b21e91215b07c1231129a914008a28
SSDEEP 6144:njtGVh0jMRG0PTMP9QQo94faYQ6TFB+5P2jdnngP8/s1wf:jEVhmOTMCQo9+C5Ojawf
TLSH
T160B44C1FF744122A05A352627F0995A2FF32D06CA35112663CBD812C3376B6AD3B77E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources.pak
Size 6.0MB
SHA256 40af4117b0bd35da141aa599255b879013bfda5968401feccb5c43cb372cdae6
MD5 bc041e16180d671ae720a4a799e106ce
SHA1 b286bbcc059a31c8f44cca7443f88d60a4790737
SHA512 da141f2e6c2ac36dc924f1c72616db08927fd6277c7d7b12ca97dcf43a1f6ce906d269d6b6d9cf9cd957c432f5374f9be126111e006d88644f5c98ca33309fb5
SSDEEP 196608:ccLBR5ltjL+WkrYtJ/eGDi/F7MeZFFfD5CcowhJT:cOT5n1krI/7i/BZfD5N1b
TLSH
T19D5633B3F760243FC088477942D087755B3C594A2A41A0174AECF265CE6A24F6BC6BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

better_sqlite3.node

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node
Size 1.8MB
SHA256 77bf71bf17440884fa33e72fff0c8e35a481fa4b271f289d9d995dceb4b5998e
MD5 d35ae642d3f744012e20b83fd6dd7b8d
SHA1 0ac9469a334545e787576a07572ea69a8b22a11e
SHA512 2a1de6d0d3487771c8e7eb63e0573d87d954667750a1c287b855931dcf7bd329170e66f6fb4e238ead63741e8a169390cc7c2509879df5b120550a52137b5109
SSDEEP 49152:20wj9Qzn4yxv4Na0xU+aA9Vv6r3o/LZykcmn8oCcHyVHcvC:2O74yxvr0xU+aALv3
TLSH
T1E6958C4BE2B400FDC1A7C0B9C51B160BEB76B40517749BDB1590CAA96F63FE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

database.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
Size 4KB
SHA256 02ea23bdd23d7ac5de0675a2f32fc686e76d5c6a32bd3e3891f360e72e07f61f
MD5 952ebcfa3d8727e8b1d7b681c9f5bf32
SHA1 6168b5f5ed77669b3c6c1f1d526f0eb116bd3a43
SHA512 d2dc310d2e4a491903988ed88228d35e9688e48c9b6180c797fb58f84d1105724ab3933ade92be0e73c8a27fb6f3064449bfe00cfa1dc92919ad53a81af2680e
SSDEEP 48:+FzYIUZFeVxWy3h9zxIEXMOK0ZHQZ27euTqQaqE8E+LC7yIGrtRxtjFvcLd3s03M:ac1ZFjQBG1oQZi9qSvNRBkLveomRz
TLSH
T1EA818388DBF5611247EB30D4A674A48D6234D27971AD08E0D8CBC3F531E60C9BBE3B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
Size 110B
SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
MD5 26660b3078523a953ee252b4e86e1c8b
SHA1 f7c22bdc8183f6a9cb73a9b4a735a5bab7ca01b4
SHA512 d4f32ba712ff15e8b6a1634eee089057a4716318b90e932b95a1c1cd30945ba708e7e725316fc824107637d2e97a2a64193ae81c0a3d2484651f52122bace99f
TLSH
T16EB012CF1BF0B18F26A44184E9618493D8C2E466841A40208F05CFFFA484CC42FE2DE1
MD5 SHA1 SHA512 TLSH

Submit Download

aggregate.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
Size 1KB
SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
MD5 25fdd950809b2b22d0ba6917fe014c35
SHA1 5555b3223918668b5bf244e892b1d6a258f0099a
SHA512 50516a2d2265513dd7ee727cf9cf21d118601a0ee2b9de61111c6f5fd8933915f3029ef6f764f7803cf5438725c6017002d7f58cc36988d97cc1bdb805dd42c1
TLSH
T142412121E2D2221605DB24E07097F909EA7ED720B54DB4F0C92EA7E910D1DCDE9E7A80
MD5 SHA1 SHA512 TLSH

Submit Download

backup.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
Size 2KB
SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
MD5 69638dc10c19961a0c05350ae333d6a4
SHA1 5941988b67c6fa083358002ba36538f1e39ad03b
SHA512 495ecffdadbc8c9bb2e886f9f7a93668fa5b2192a0ba79a7e1a9d3c2640e0520e39f2d2c6f3a26b55c72ff882bff43ed6439c0ad7c7622461e6ccaf1ee8f119a
TLSH
T171413158F39E5169436734C04490E00EE93DD6B6313E09F1AC8953F022C66CDE9DBBC5
MD5 SHA1 SHA512 TLSH

Submit Download

function.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
Size 1KB
SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
MD5 1036ce624efbb9fbbb387fec25fd1bcb
SHA1 35395f7ef4c18b845582b9289bc802d87c9e3c11
SHA512 7d65a4bc5bf5c9b97dce021cdb8c888cf975ad24613b12b239db1e03a98dda89faf7b1b204c906f6dde5439d22414d9b4410554d01eea8fc121287ed8821f9a0
TLSH
T1E021C911F2A6214246DB24E0B0ABF909E97AD765B44C74F0C58B97FC40A1DCED8E3A81
MD5 SHA1 SHA512 TLSH

Submit Download

inspect.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
Size 174B
SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
MD5 21784edff107eaec0e9ef7e66e83552b
SHA1 6b59caa4cc8a568a8ed3f184a075d66c68f17d08
SHA512 9bf6d36dbc01dbad11d5d01c0b662620bf6c0cebd85c0065882e8ec57e3304bc4d301add25bf57ea425a270f3ace6a44fcb958dcc8bf993f411eb81a5369adfa
TLSH
T125C0800973F1B465554F30D5955FD00451E5F0242CC450420D1DC684CD708697F3790F
MD5 SHA1 SHA512 TLSH

Submit Download

pragma.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
Size 536B
SHA256 8b1c54475bd4340b15e25c50d53d06308be65f8f919ecbe4aa9d285ca859ad5a
MD5 9354074a096ee1cf58905ca8dabfd60c
SHA1 63e6c02339c45c252ae3bb24267610a636117eb6
SHA512 32bdf8866d1c4e3db8a2ca65df2c1bd0d33c064d4cc526e264587cbf9c09ba7b97c8adc430a9dc019d9863e0e90b4318442ffb5cd08e0de52cdd4f081b5150b5
TLSH
T155F0C91602F245530BFF14C094E5F534F4B7C668B50E94F0D99E83FE41808DAEA83E95
MD5 SHA1 SHA512 TLSH

Submit Download

serialize.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
Size 625B
SHA256 7a10ee5c2735384b7f0c361811bc6d017db29f62b203fd3c68a35f667e2c2605
MD5 41cfeffe67a2975f68aeeaaed0bf384c
SHA1 321f3f817bc095c34b76d060d706ed2cc48f204d
SHA512 8a0ad9732b5a07866eee742b2e884e521111f213af9ae39ebd92fa029d88f087c43f8826672d1fac5c571d14b284f20ae25e12aa4058a7881d6fd5e93c0b0a0c
TLSH
T1F5F0783A3365564B0997A0C050E1B429E9B5D324312D68A0E989C3F511D48CEEAF7B9F
MD5 SHA1 SHA512 TLSH

Submit Download

table.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
Size 6KB
SHA256 97c42d9ded1aa96c7d916b5b92f96b4e59581d50eaf629cd2c7afb78ff26a9ea
MD5 43137a36158617045d106a2ff534edaa
SHA1 f365ee98f7e36d1bab09e58187d467dd5f73b6f3
SHA512 f4330d881ae76d41083d3ba9d0056697abd634638a9951a4ebe4044fb79eceff4da034d22d9ba2ad4cd1a208fb0ec1c47855da781d9c9dabc34979f6f7f9eff3
SSDEEP 96:bJx7JBAUU6VtWpzwukGy2K3rN6gYMNEXxulo+yrgrm+IttSXFJ:bJx7J25PUyKb0+UklovOQk1J
TLSH
T18BE12308A7E17A13404B7095BC58605EEDBC98B27C1C48F5B8DC45E92491CBEF9EAF26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

transaction.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
Size 2KB
SHA256 bc8624a3ef689d8f78e5669020ad121e17acbc93b1d5ee5afe26860b1084c66c
MD5 6b77badde74e5a5b854041134e62041d
SHA1 47f5883e26f1aedb2bc1557cef9dd21c26e0e0ef
SHA512 d5be3aed74a9c9a948afbf6f03c19e21ec6d5a86f5f277de85d9d7374136fab4cf68bca1a6e752e5d41ba6b48c00577ca26ebacabd5bec51491da28affb3719d
TLSH
T1EB514312F67ADE7063E23088FA0B630EF5299A49E03494B0E760EB4A3A958CD8117D53
MD5 SHA1 SHA512 TLSH

Submit Download

wrappers.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
Size 1KB
SHA256 a150a6271d23f4e5f8953b129f370ff096c7cdc4b812afbf080a6cf4ab741bcf
MD5 9e2ba6058f66127065c27ea3e81b8e68
SHA1 92346423dab9536ca4afa50e7ef171843d5eba5d
SHA512 2b6644404fea27117b74f904bc608fa42e36e3b100f51010394ef917df7c48f40af018e5b06243d31d7ccba5ab05cb32541566e79775df482e09a107524d091d
TLSH
T187213A8A72E6F162D31530309DCFD184FCF9B861694C64BCE47497922DE007942DEDB8
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite-error.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
Size 717B
SHA256 2582d61c27680dead168543f392eb102be621dfbef282a4ca4c7c21aa5e7c75d
MD5 e1372372ca8f94dd66666d886a81f9b5
SHA1 437034e71dedf15013967b540db157cbe3eac3ef
SHA512 5bbfce635aa1b10b30f1703eded4256224500705e3b14c7cefcd522ad703596d15d6cfee7914dd70700827afd01a50d61bef1954d29b8788bf6347f96e9cd8d4
TLSH
T1660168C69F7099BB01E15884FC116806996C5678C021B5E4B6C8DD9F2DF0087CDA56A0
MD5 SHA1 SHA512 TLSH

Submit Download

util.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
Size 331B
SHA256 92b2e39e2151b43a2252e10b6d6de876ecaf0008336a4fa1dfe1317b20f1916f
MD5 a5d75fb36bedb4938a8b9dc6525fd515
SHA1 b5270aef455a7de04d31d19713ed7dfceb55fa06
SHA512 c181b25f5b991826159125a4f7af8ec0f8a7bbceba674121f144f401295670136daa64598d4e0f48cb8ea2849000ac8e7f59881220f6a30a4905ce9309db8067
TLSH
T1E6E0261BDAD2876511AB30862E8EE404DE6CD2A6746854F0682AB64970C84B4EA8B25A
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
Size 935B
SHA256 17681159c1c50443f57d594bef7424acb7f10627a971f426de1a7a3a76486fa4
MD5 53fd4ec3d45d775b742eb79a57715386
SHA1 fa8e4a01b84359653c605d2eac0f8a4bb56b9ef1
SHA512 79a5201491efd588b5128adf3973cd1958544b9d31d02024b7a3015524f651572ee4ba6a242a70148d94670efd686d4e87afe9fa67d61d5ed96ef5744b899f2d
TLSH
T192115CA0CE258DF32AC569D5BCB91182B22148078CA4FC1C3387466D9F4E4BF21BD67E
MD5 SHA1 SHA512 TLSH

Submit Download

env-map.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\dugite\build\lib\env-map.js
Size 1KB
SHA256 901e7256ea0b34c6e9524fee33bed62fc6b7b9922906bae63fb63a7d761a4bab
MD5 315f3f596b748a9ae911cfa25cad06ff
SHA1 51db89bd482a758ad2f89662f1c6af1c90b789d9
SHA512 4e2c5f2e9ab1f7ee1d36416672ababe3d5e07d97758990e0e7934e49e6755afde9fc1c597ce3404f75ca92d38831d97b65f19762ea8e06d192d1e11da48f7201
TLSH
T14B318D8ADAF3A451D12772B90A4ED2C1B678D0176529DFAC3D1C13E58F8083418F5FB8
MD5 SHA1 SHA512 TLSH

Submit Download

errors.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\dugite\build\lib\errors.js
Size 12KB
SHA256 44d52ff75b7e638f05148c7c316babd0c4e66ea375dfab82a38fdaf8d32b242a
MD5 a9ec5fb633b867ca58be27cdcf4d3382
SHA1 1afceeebcd47f49e97d8bf2a862fe750d3767e10
SHA512 eca6d587947b493c7ee2c17ef10f22ede6e5bf9c8995c5f6f615b649ed6bd5c85fa35f3666765ccc66b837a7c9bc83ce91ae894f346c4aa169845f15f8e3bfee
SSDEEP 384:4T3iU/8RLKQ1tq3AySBW2HLyIOvTUdOuthh0DN:4TItq3AySgMdOu7h0J
TLSH
T143422FFA13CF052786D283C7AA94C415A510413B35A0AA563CAD4C7B5F6C4ECFDB7A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exec.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\dugite\build\lib\exec.js
Size 2KB
SHA256 1698f7ea20499a1f5992c25588a0aff28e2e2337137f64f221cff85af99e3378
MD5 3539c0e086a7a47a66b980a30185c721
SHA1 fcb304a72a97e07f51eebb2b01a34834232052c3
SHA512 a085fac3d8bb81e69a76320e39db660fb2acba462eea6809f0c234fbfd4c9e7994c68df7f38d045c7a3d19303c17970f0e148c25714657ec67d3471bb6b8ad8a
TLSH
T11C41200B65A1233013F375D4E59B50BA5466C23366B8DAA47C1DC3A89F4245893F27E7
MD5 SHA1 SHA512 TLSH

Submit Download

git-environment.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\dugite\build\lib\git-environment.js
Size 6KB
SHA256 f8fb53f30acd35a7d17ff02aa0e33b6c9ba3353f782205f68d78a068300cd452
MD5 996c1b9c9d656f7bd78aa28c0ceda611
SHA1 492e49011d259fda0fe52b1e5c4111042be9e5bf
SHA512 2cf7248412b309dc05decc9311f17e24fb677524e94f97800d0d4ef7930a1787f4e063f77417e853e422dc58b4019b43c3cb1476957107078510aae97346295a
SSDEEP 192:0xk9D7vWWvKxy2NS+v2NdY2NXjjWKv6C1GL1IFiQq:0xmn2NSe2Ne2N/W6o
TLSH
T133D185C69AF7747403F2B5A8E38E0015AEB992171318D164391C8764BF627F863B1FDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ignore-closed-input-stream.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\dugite\build\lib\ignore-closed-input-stream.js
Size 2KB
SHA256 84fef43e9df70beb82581065adf08e086bff7b5c9baae5e877f7af91d9f30e21
MD5 4410f65cb75ee71e71a6d67de1dcd385
SHA1 4b90c5651121a0af8529c7a2e11d535f4872ccf2
SHA512 a261f0d8adb2350445123a12a85c0a91c63077cb02ebb3db5803740746704f1c62d4f64927677dc8b1e11b455dfdaf3387ed51168aa4aa6fcb66b41bee6a3b45
TLSH
T15A51415BB668133314B211B0D38CA2F5D30A857B5271C0807CAF833C2F01598A639FE9
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\dugite\build\lib\index.js
Size 1KB
SHA256 466730a7bb4dd2122a654f87cdb267799bad8f9abce9ca01839cc9db65f8baeb
MD5 25787d8f360e26f2687b0590f94d96c0
SHA1 c4a2a1ab794a805a28ca8e44a15724bffe31bf91
SHA512 8af9aded8e02bbebfb0efe67f07c58f22300bbdc22824c978a05c56ad176350deb730fe9400b8b60b684e720fdd0bdeb5513597e0b7519e9a50de78dcfdffad0
TLSH
T1F5211D5B7AA8B8F292F830F85B1BE143FAA5557300305214A65CE7F1EE644CA89F4C25
MD5 SHA1 SHA512 TLSH

Submit Download

parse-bad-config-value-error-info.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\dugite\build\lib\parse-bad-config-value-error-info.js
Size 711B
SHA256 90e0b06125db10f48822e6011d0e286cc7ca15e56d1bdcc2b613da9208797ef5
MD5 a55fea6569e24e1f7862eee5c1b7fa31
SHA1 ec51b8721c38b5f25fd823d3880350b49f20c7aa
SHA512 5c3ad8dc7a4059098f27284cd8cfb1cce47b7d839a8344d439a8052162996bf28c30667f0fa28456948633d28f2c295c8efecd43ba6ec45c443036b875124738
TLSH
T1A3019E9D6EF7144B437722F9C90B805A68398B031219C76DB51CBB622F30524CF636A5
MD5 SHA1 SHA512 TLSH

Submit Download

parse-error.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\dugite\build\lib\parse-error.js
Size 382B
SHA256 83d146886e49b05cfacdf374f9f719c11024e6fd9436b78138e93afd69d86e38
MD5 f4d09e47439c10bbd24a873aeec63c10
SHA1 068e9228995ee55ba256727e971d41d683bb4785
SHA512 b25c9a8860d0dadb23c407febac28daa80ac47c07d16af882408190e044b6ab43884c6b48e4451df669b6b2dc7a3ae90a9a0876bd1dc12e618506e8b987b410c
TLSH
T122E0C04BAE30A5570DB207EDF615DCE7D1424413783A553467AB35B33CF0D09DC12A21
MD5 SHA1 SHA512 TLSH

Submit Download

spawn.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\dugite\build\lib\spawn.js
Size 950B
SHA256 c151a417e1954b3362dd89c30e23bdf977cbedb12d6314f0f41f0569572e179e
MD5 3c649fe7efc515bd079d852f086f4812
SHA1 02a785325617a0e71408cafc5bad709e8d53ee71
SHA512 485e5076463afbf2d2a4efd39b26c663e4caf909b17197688c1c28a742baeae78e5b0aa86a5af8def29c09735eaef99c35a99db3fb67733d69413638e01441ef
TLSH
T15D11E10BA776277812F20480974FBCB21DCAA11676F1D164F5B8C1564F4084C176AD9E
MD5 SHA1 SHA512 TLSH

Submit Download

git-upload-pack.exe

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\dugite\git\mingw64\bin\git-upload-pack.exe
Size 45KB
SHA256 9fa0ea3f361832a1f7f8648d270e4bff59f9a243d5fccf9d3d0c59f663945510
MD5 fc18cb24330d680f97290ca9a81430cc
SHA1 048ef66b2a9e2a5828303dd11dd04de39d289254
SHA512 fee5e9dba5d13fd6e24c208967039ed655040add75cb56686fe22ced2cbc37db61e08ad79c33ecacd3cb3f3eebc0c1131dfad8d67e00ff736c88269b07b4b080
SSDEEP 768:d2w/6Pk17Nk5WNIGiVehh4GsE/u9AmbL/ER:LiPk1Jth4/LVER
TLSH
T187236C47E71510E8D746C538B9E6C7B3AC30BC551E38AA6E5910CA387C61EE1CF68E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COPYING

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\dugite\git\mingw64\share\licenses\libtasn1\COPYING
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
TLSH
T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COPYING.LESSER

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\dugite\git\mingw64\share\licenses\libtasn1\COPYING.LESSER
Size 25KB
SHA256 dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551
MD5 4fbd65380cdd255951079008b364516c
SHA1 01a6b4bf79aca9b556822601186afab86e8c4fbf
SHA512 1bca76c9f2f559a7851c278650125cd4f44a7ae4a96ceee6a6ba81d34d28fe7d6125c5ee459fef729b6a2a0eba3075c0841c8a156b3a26f66194f77f7d49151c
SSDEEP 384:LE56OuAbnn0UReX6wFDVxnFw7xqsvzt+z/k8E9HinIhFkspcM9bc7ups0CZuQW:LE5trLeDnFMz1ReScmc7GshZuQW
TLSH
T1FAC2953EB70113B206C206916A0FA4DFE32BD07932675964749DC15D23AB93543FBBEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_log_list.cnf

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\dugite\git\usr\ssl\ct_log_list.cnf
Size 412B
SHA256 f1c1803d13d1d0b755b13b23c28bd4e20e07baf9f2b744c9337ba5866aa0ec3b
MD5 5b561a90362b8eb9127c792c3f5902e0
SHA1 a2587c4e97408b64274e5e052b74e3754892c13a
SHA512 ce307f87b90e0a0d09335577283ab4509802b43d14725d76c65139f6625f7e4fe636f41c9c398ccc9a2c70b229a34fd796b8ae0e9f5f3720e43f727a60232167
TLSH
T123E0AB8AF88C24BE27648599319A24B5F60EF19E741749B771C941492383F35C5D4683
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\dugite\package.json
Size 698B
SHA256 2a021a6e2f136793b5fe411ef9b4bf7c8ef74782826380f64732e01bbe5fe286
MD5 bad7e0d7a7b3fb104313ebc5af0f64e8
SHA1 52208217d8be1a9cefab7a21fe47373197841449
SHA512 b5dfb0178f8bfdfb5ca9c021e121b202493d10ef9a2dc46bc0767265e3a333085298e383337454a372f7602bca56baeb044c4e2737d3a12a2f5a6a51ba1a20d9
TLSH
T1A5017B75CC6899630AD826D0EC7A1242B2314C07C914BC0833D2422CC74C6AF11FE76C
MD5 SHA1 SHA512 TLSH

Submit Download

keytar.node

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\keytar\build\Release\keytar.node
Size 691KB
SHA256 90e35de89ab5e5f9290e4ff1bbadcf221a82b2aa0d9b922187dc980adff3c831
MD5 c5c99144e2e1589628e14999ba59ad73
SHA1 9c80f8de6b5cdaf38677d5368b5287bacb9e465a
SHA512 0bcb99953397c6604d8e08bf2ba89248ee82f92436c2dcc779157b65227b0e1350927273a1b6d150a9db914d0a8830680df05ef651ee291b40657a3025a721c5
SSDEEP 12288:cRInDhSzUpqDDa2XX05VNpk4th460iQlp1Qk5wUFPcvKKR0JQQ8jKOx8:cOnDHpqnaskrdx
TLSH
T1EAE48E6637E811A6D0BBD13FC9978F59EAB1BC140720A7CB01D442A92E13BE85E3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytar.js

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\keytar\lib\keytar.js
Size 1KB
SHA256 e858194902d632e217b60b913829865749568fd43aee2d65bf7ffcefd7b1d6ae
MD5 c02c937c0597ff8d0fe9824fb7a7ae9a
SHA1 ac0a580385a7d812c6e1eed071ccbd6c7ead4488
SHA512 eb1cf4966e868c5997e59e7862d6857e0a6b85315e2e196704e999fb64523318ff160570aaba78b48dcc498667fde928fc26b597a1fb9122750a2cd6ac033d8b
TLSH
T117118E5126E45836231396D9BC978628B01CE4CB060D2A0EBBF481B86FF7D7F06C3865
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\app.asar.unpacked\node_modules\keytar\package.json
Size 891B
SHA256 01669e30d6ab8090eec8461ebbce8d65828e0e9b182021b603ad42e87820027c
MD5 f26e40d525c8f09a4c8e4afb51d218c6
SHA1 7044b56ae30d72483aaeebc48b2d14185bd93432
SHA512 306761a69704aae53de2e9639db36a472a91fcb292cdcaca6198082c0e5242e94ece000ad8e8aa2ef0ac9d3654e30c30fb44245603145371982b908db055d4ed
TLSH
T180114C62CD648DA319EB1AE49D7A0343A22048438E84BC0D33DB921C8F0C92F32BD66D
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Programs\Verdent\resources\locales\en\messages.json
Size 125KB
SHA256 ecba32b67ac0fe426adcc229f92128f7eb85d060ebafc69ee4dda792aea5f656
MD5 960e52ca1ab7e205d2967ee70611c992
SHA1 f28bc9b7532b3d03fb5293d0d0e02f27718e6469
SHA512 01f7dc1c08ad7bcd8ec7ee8645450bd581e485829ebfa12e01f11c3f5f5db490cd6597b2973ae509338fcfde9e99913c108054d7a3dfdd64930e384dd46cfb15
SSDEEP 3072:CdiYx54iE06fBe3iYkn62JkDLq/H35GXZiMM5t08JBO9cV6AxuLZqmDs0:Cdi2Ycun60R+wM+u4AZZs0
TLSH
T11CC32B2FA354673B1FE22393F48519B1BE2D436963445439CABCC03C47DB579A2BB192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\Verdent\v8_context_snapshot.bin
Size 758KB
SHA256 1fa1cdd08423809344fe15fac2d9d1ec604cc3ea5af4b944d89a51b1e98c8665
MD5 00f69a4fa2169454a5601261a9c7245f
SHA1 b6d3d33b615fe050b7b2d009695a2a6e4e7c12a6
SHA512 abe8e379e1842d00c71a7c9cae3bd4d3a1d6ab4679f8c6d850dfee3f91affa23cbb4e0b35c035bf2832adb5f0cf5a8fe4fb21a7a377babf190fd6f11ce67e4c8
SSDEEP 6144:tU0ckYOkGt+OcqCvpWoNyuZaVaBgJjdOSkvh8mQu/INZV/peyWBOI:y1RNvMoNyerT8mQuANZhcOI
TLSH
T10EF48565F74ECF2ACA4537B86DE547463835B04A6F8BD21BB518233E38B65B00E3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Programs\Verdent\vulkan-1.dll
Size 922KB
SHA256 10b2947fd48514be76bd0b57f27112c8cb241bcb28ac18c5db6fd3db5484f498
MD5 fdf9bedd39aea85b2e42d36b893fe7ed
SHA1 c2e4a7645ac7815b2c5a20936fafe610bb9b52d4
SHA512 524595be020ad8956d4e46df770353ecac2d5f09f13a44b2605428231d27a1db6a26c61ca75287a22520df79370def390729d86ee3e8e93fbaa58b8da2a5dfa1
SSDEEP 24576:kGVzDeAVM7N/L0H6tDVj3sF6Z5WGc4DYsHQDy6g3P0zAk79oOHAF:kGlDeAq7N/L0H6FVLsF6Z5WGc4DYsHQ6
TLSH
T1F8156D23965485A9D47AD034D9D28707C9B174822326B9CF42A81708BF6FFF47B3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nscBD8F.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nscBD8F.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nscBD8F.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nscBD8F.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nscBD8F.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nscBD8F.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nscBD8F.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Verdent\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Verdent\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Verdent\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Verdent\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Verdent\Network\Network Persistent State
Size 327B
SHA256 3db155ced54921d93cb7606b41831b67bd5bcf120db35525a8330fdf27aaa1bc
MD5 65432cf1535dd3db21033c97d8d5ef8a
SHA1 d5a8f7ad403e7649fe45651dece8ff68e15ea376
SHA512 815336dac08e1b1b5784fdfea07e97e3179096dca4460af1945ed5c8adf4babed4889d2f7bc4ac4b8c44e03a6fb16ab3a8157609c807ee5a908649dd08ee315d
TLSH
T195E07DD7C2D58ABD479583F01F242923C6BE084A53295D0AC6D47F1E53B187C590044E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a6449.TMP

Path C:\Users\Admin\AppData\Roaming\Verdent\Network\Network Persistent State~RFe5a6449.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Verdent\Preferences
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe596642.TMP

Path C:\Users\Admin\AppData\Roaming\Verdent\Preferences~RFe596642.TMP
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

scope_v3.json

Path C:\Users\Admin\AppData\Roaming\Verdent\sentry\scope_v3.json
Size 9KB
SHA256 9b6f436cc1dc92700d18c582e24a6f717fc7dfe6c149136a3381468b95494159
MD5 7d0da3cebe55e05f7cd0cf7a236cfeb7
SHA1 d8cbb765ba222713b44499dc6419c4db39b513bc
SHA512 114716319ab7f17f1d908644c1ce44817b483973dabecacb51a88d011e80bb8b9db03b596bbb59a10382f06cd8fb4e6d782ac8d05511bfe993ea2c1b826db52b
SSDEEP 192:SBqyBYWlWIDWjkTNW3xrWo2KozkIlk+Kkb4gnEhkPk6m:SBqyBYWlWIDWjkTNW3pWlKozkIlkfjg4
TLSH
T18E1244216D6CED792BB2B9C9348A2E9FC3F63106D7812CD605A8DE0C952E1EB211D477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3972-1837-0x00000275A01E0000-0x00000275A01E1000-memory.dmp

Download

memory/3972-1835-0x00000275A01E0000-0x00000275A01E1000-memory.dmp

Download

memory/3972-1845-0x00000275A01E0000-0x00000275A01E1000-memory.dmp

Download

memory/3972-1844-0x00000275A01E0000-0x00000275A01E1000-memory.dmp

Download

memory/3972-1843-0x00000275A01E0000-0x00000275A01E1000-memory.dmp

Download

memory/3972-1842-0x00000275A01E0000-0x00000275A01E1000-memory.dmp

Download

memory/3972-1846-0x00000275A01E0000-0x00000275A01E1000-memory.dmp

Download

memory/3972-1847-0x00000275A01E0000-0x00000275A01E1000-memory.dmp

Download

memory/6552-1346-0x00007FFD1EAC0000-0x00007FFD1EAC1000-memory.dmp

Download

memory/6552-1347-0x00007FFD1DFB0000-0x00007FFD1DFB1000-memory.dmp

Download