Overview

overview

7

Static

static

3

gdreqbot-1...up.exe

windows11-21h2-x64

7

gdreqbot-1...up.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    153s
  • max time network
    166s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 15:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    gdreqbot-1.2.2.Setup.exe
  • Size 139.1MB
  • Sample260808-teekcazepe
  • SHA256 cd4b79362fd648e4507bed028f9f2d4c84c67fa398bbb8f51cbf41222286fc78
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\gdreqbot-1.2.2.Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\gdreqbot-1.2.2.Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5508
    • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\Squirrel.exe
        "C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
        3⤵
        • Executes dropped EXE
        PID:3964
      • C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe
        "C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe" --squirrel-install 1.2.2
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3500
        • C:\Users\Admin\AppData\Local\gdreqbot\Update.exe
          C:\Users\Admin\AppData\Local\gdreqbot\Update.exe --createShortcut=gdreqbot.exe
          4⤵
          • Executes dropped EXE
          PID:4924
        • C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe
          "C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\gdreqbot" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,9279192707459110435,11021076875949115399,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1888 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6004
        • C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe
          "C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\gdreqbot" --field-trial-handle=1892,i,9279192707459110435,11021076875949115399,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2316 /prefetch:11
          4⤵
          • Executes dropped EXE
          PID:3600
        • C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe
          "C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdreqbot" --app-user-model-id=com.squirrel.gdreqbot.gdreqbot --app-path="C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1892,i,9279192707459110435,11021076875949115399,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2900 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6948
      • C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe
        "C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe" --squirrel-firstrun
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2592
        • C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe
          "C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\gdreqbot" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1804,i,15089412058759297414,6266641092339334140,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1800 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4128
        • C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe
          "C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\gdreqbot" --field-trial-handle=1804,i,15089412058759297414,6266641092339334140,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2296 /prefetch:11
          4⤵
          • Executes dropped EXE
          PID:1020
        • C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe
          "C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdreqbot" --app-user-model-id=com.squirrel.gdreqbot.gdreqbot --app-path="C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1804,i,15089412058759297414,6266641092339334140,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2872 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5796
        • C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe
          "C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\gdreqbot.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\gdreqbot" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1804,i,15089412058759297414,6266641092339334140,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2524 /prefetch:10
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:3352

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        RELEASES
        • Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
        • Size 79B
        • SHA256 66d286d5934b1cd05888aa40c33341e0433f448ec30e417653df8c1224dc16ea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Update.exe
        • Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
        • Size 1.8MB
        • SHA256 76359cd4b0349a83337b941332ad042c90351c2bb0a4628307740324c97984cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        background.gif
        • Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
        • Size 43KB
        • SHA256 ce636d201ef86ffbf4ee8c8762b4d9dc255be9d5f490d0a22e36fe0c938f7244
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        5cf542f7-8265-44b8-8b30-e5a2d08d4893.tmp.ico
        • Path C:\Users\Admin\AppData\Local\Temp\5cf542f7-8265-44b8-8b30-e5a2d08d4893.tmp.ico
        • Size 529KB
        • SHA256 e8e0c9c08288aac094e2b8131e896095fda7a55ffc15ef94acbfd45874fdf4ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        D3DCompiler_47.dll
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\D3DCompiler_47.dll
        • Size 4.5MB
        • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_100_percent.pak
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\chrome_100_percent.pak
        • Size 112KB
        • SHA256 cbe052e9bd36032cde9d0ad7496d611c6a3c98a130b960e1298d490254be1159
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_200_percent.pak
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\chrome_200_percent.pak
        • Size 182KB
        • SHA256 6593ba8ece63001a3fb77bd1d872566edeb26213a1be8e852dd956f6d0e2c93e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxcompiler.dll
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\dxcompiler.dll
        • Size 24.4MB
        • SHA256 1565adbd62a0e8ba2a8b25b3da5d2e2a45032c13aeffdd061228abc3ee5c1585
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxil.dll
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\dxil.dll
        • Size 1.4MB
        • SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffmpeg.dll
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\ffmpeg.dll
        • Size 2.9MB
        • SHA256 26eed00c4da27de095ba76030b47bc0436ba659a7443e05f11ee162dc225e828
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\icudtl.dat
        • Size 10.3MB
        • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libegl.dll
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\libegl.dll
        • Size 503KB
        • SHA256 61ebcd780d17d37ec09a5eb7ff7399ad67726a5a1ff73be1c37734551c3ef1fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libglesv2.dll
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\libglesv2.dll
        • Size 7.6MB
        • SHA256 b35d3337ef4cad5423f4e11a06e280763deae634f7e39c7844e4f0fcb455b3e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\locales\en-US.pak
        • Size 537KB
        • SHA256 ef30389492cc2d31bc5c162056fe68c27a5d57b0a69f5f878562325f795c5185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resources.pak
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\resources.pak
        • Size 6.1MB
        • SHA256 ce5c35017fd7aa648fe44381711cbf42eff5f6923b11241a4789058dbc5b27aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        .env
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\resources\.env
        • Size 340B
        • SHA256 74d9214684fe7271ae4ee8abfda6243dcd8d84f2f2963ca88b86d51760d865ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        app.asar
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\resources\app.asar
        • Size 46.4MB
        • SHA256 cc9287fcc95ec8ea0fdc71d24f37a569dfa78be6f131454af6910c7f1088817c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        v8_context_snapshot.bin
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\v8_context_snapshot.bin
        • Size 696KB
        • SHA256 1df86ae706c6fc60bb6f4e60d76c5a3f56affa54e6b1442f51127bedc589d089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vk_swiftshader.dll
        • Path C:\Users\Admin\AppData\Local\gdreqbot\app-1.2.2\vk_swiftshader.dll
        • Size 5.4MB
        • SHA256 a638bd2235309493f50adfcae707675bb6c3615a2ac44ccefeca7c7085389d49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gdreqbot.exe
        • Path C:\Users\Admin\AppData\Local\gdreqbot\gdreqbot.exe
        • Size 779KB
        • SHA256 52b11d2a97888ab05cc303470e2d8532449807cfc8d60566cd1e404da05d63dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default.exc
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\Code Cache\js\index
        • Size 24B
        • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\Code Cache\js\index-dir\temp-index
        • Size 72B
        • SHA256 8ee74a8f80afd30702fe7105982ee105b9babdb7145a452da2d8c50aee507fd6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        the-real-index
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\Code Cache\js\index-dir\the-real-index
        • Size 48B
        • SHA256 1364e42bb64cd7b9ba64fc123f0f711b52f7725c72bb5485c767f29518d1d450
        • MD5 SHA1 SHA512
        Submit Download

        the-real-index
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\Code Cache\wasm\index-dir\the-real-index
        • Size 48B
        • SHA256 15667751457055419ec63d42f22f72bfd90a6a4699d7d038cda64f017fbd3451
        • MD5 SHA1 SHA512
        Submit Download

        data_1
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\DawnWebGPUCache\data_1
        • Size 264KB
        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        index
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\DawnWebGPUCache\index
        • Size 256KB
        • SHA256 1a1e33e19debe4402ef31375d598e42d7e1c78b52d66224c589b4b5bbff60b46
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_0
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\GPUCache\data_0
        • Size 8KB
        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_1
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\GPUCache\data_1
        • Size 264KB
        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_2
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\GPUCache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_3
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\GPUCache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        index
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\GPUCache\index
        • Size 256KB
        • SHA256 833dcd6657d7b9130b6a91a29b00a280c026e7c1cb0273570b8a19fc787884ed
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Local State
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\Local State
        • Size 434B
        • SHA256 0513fea577a56ab75d6e12aa02ba399e97438f78cc519fba491ea3622a3db794
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        000003.log
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\Local Storage\leveldb\000003.log
        • Size 30B
        • SHA256 8bd2ea70a0b70c91de138a5b87c7936c6a6fa7c4275c54b97f4ef0ccc5b79bb4
        • MD5 SHA1 SHA512
        Submit Download

        LOG
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\Local Storage\leveldb\LOG
        • Size 249B
        • SHA256 b9349e163acf364139857b9cc05002d33f7b0b00dd9128ed54879a59612c01b1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Network Persistent State
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\Network\Network Persistent State
        • Size 548B
        • SHA256 2bc57035f01d0efd79d133f65cca05c91e8308e2a27fcee03dd0ceea7db0a998
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Network Persistent State
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\Network\Network Persistent State
        • Size 111B
        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Preferences
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\Preferences
        • Size 93B
        • SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CURRENT
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        MANIFEST-000001
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\Session Storage\MANIFEST-000001
        • Size 41B
        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
        • MD5 SHA1 SHA512
        Submit Download

        data.db
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\data\data.db
        • Size 380B
        • SHA256 595b40947c489469df305e4dcd4807718c7010a98db488ff2c963703907a140c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        out.log
        • Path C:\Users\Admin\AppData\Roaming\gdreqbot\logs\out.log
        • Size 448B
        • SHA256 b3c88612f38e527be823c0392f01d632de5efecfc804aa47cb1088e220c86589
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3352-365-0x000001DC65A80000-0x000001DC65A81000-memory.dmp
        Download

        memory/3352-371-0x000001DC65A80000-0x000001DC65A81000-memory.dmp
        Download

        memory/3352-372-0x000001DC65A80000-0x000001DC65A81000-memory.dmp
        Download

        memory/3352-373-0x000001DC65A80000-0x000001DC65A81000-memory.dmp
        Download

        memory/3352-370-0x000001DC65A80000-0x000001DC65A81000-memory.dmp
        Download

        memory/3352-374-0x000001DC65A80000-0x000001DC65A81000-memory.dmp
        Download

        memory/3352-369-0x000001DC65A80000-0x000001DC65A81000-memory.dmp
        Download

        memory/3352-363-0x000001DC65A80000-0x000001DC65A81000-memory.dmp
        Download

        memory/4532-113-0x0000000020E00000-0x0000000020E3E000-memory.dmp
        Download

        memory/4532-9-0x00000000000E0000-0x00000000002B6000-memory.dmp
        Download

        memory/4532-114-0x000000001B230000-0x000000001B23E000-memory.dmp
        Download

        memory/4924-160-0x000000001AE50000-0x000000001AE70000-memory.dmp
        Download

        memory/6948-199-0x00007FF972730000-0x00007FF972731000-memory.dmp
        Download

        memory/6948-200-0x00007FF971570000-0x00007FF971571000-memory.dmp
        Download