71b0c4dd832beff92a73fb849c1fc730d65e9be3e24676b4a0e29332bc6b3391

Resubmissions

25/09/2026, 18:31

260925-w51xdatdrc7

25/09/2026, 18:23

260925-w1g9gatz6r7

25/09/2026, 18:13

260925-wtx2cage327

Analysis

user interaction
yes
max time kernel
149s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RexadorInstaller.msi
Size 129.2MB
Sample260925-w51xdatdrc
SHA256 71b0c4dd832beff92a73fb849c1fc730d65e9be3e24676b4a0e29332bc6b3391
MD5 8354e8f89f41d1780b7213249d31eb2f
SHA1 b72af281d1df1523a8cffc1ac893dffdf755a695
SHA512 8fb5471b2212db2a455873c7d5aa1c496281c79d3c4aedd5a26a01ca86f5994cea6eac9fd3f319660d46a3aeb7d07ec04c987a9c36c1d71575f6124cc9b995d6
SSDEEP 3145728:vm65CFQ7f7UN+d7O6kozGwhthTXm0CQqJqsZYcGz:vBU27rdK64wtCQqDG1
TLSH
T199583322784CDC12E9B36874D12347F6856B6E10CF9DC843E66C7E11BDB3AD0F52A25A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
4504	MsiExec.exe
4504	MsiExec.exe
2516	MsiExec.exe
2516	MsiExec.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\vulkan-1.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\koi	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\System.Threading.Overlapped.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\tr\Rexador Gladiatus Bot.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\System.Text.Json.xml	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\Dropbox.Api.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.pdb	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\kn.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\af.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\Dropbox.Api.xml	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\rexador.ico	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\en-GB.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.BrowserSubprocess.exe	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\System.ValueTuple.xml	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\d3dcompiler_47.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\vk_swiftshader_icd.json	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\vk_swiftshader.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\ja.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\libGLESv2.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.Core.Runtime.pdb	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\id.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\pt-PT.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\sr.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.Core.Runtime.xml	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.Core.Runtime.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\de.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\resources.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\user-settings\bot-credentials.ini	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\System.Memory.xml	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\Rexador Gladiatus Bot.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\lv.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\System.Runtime.CompilerServices.Unsafe.xml	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\mr.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\fi.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\ta.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\it.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\libEGL.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\ar.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.BrowserSubprocess.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\bg.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\fil.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\uk.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\libcef.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\Bunifu_UI_v1.5.3.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\DeviceId.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\Rexador Gladiatus Bot.exe	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\he.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\nb.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\sl.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\ko.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\Microsoft.Bcl.AsyncInterfaces.xml	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\ml.pak	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\System.Runtime.Serialization.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\DeviceId.xml	msiexec.exe
File created	C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\sk.pak	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e592001.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e592001.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2300.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{24071C19-6750-4F60-A23C-92BF5B5ABB22}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C0A.tmp	msiexec.exe
File created	C:\Windows\Installer\e592004.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21B7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3092	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e01e56c99d3b8eb00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e01e56c90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e01e56c9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae01e56c9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de01e56c9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies registry class 49 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	7zG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	7zG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	7zG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	7zG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	7zG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	7zG.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	7zG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	7zG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	7zG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000a75a660dff41dd0182708d500842dd01ff3c92500842dd0114000000	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	7zG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	7zG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	7zG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	7zG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	7zG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "6"	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	7zG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	7zG.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4892	msiexec.exe
4892	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3092	msiexec.exe
Token: SeSecurityPrivilege	4892	msiexec.exe
Token: SeCreateTokenPrivilege	3092	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3092	msiexec.exe
Token: SeLockMemoryPrivilege	3092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3092	msiexec.exe
Token: SeMachineAccountPrivilege	3092	msiexec.exe
Token: SeTcbPrivilege	3092	msiexec.exe
Token: SeSecurityPrivilege	3092	msiexec.exe
Token: SeTakeOwnershipPrivilege	3092	msiexec.exe
Token: SeLoadDriverPrivilege	3092	msiexec.exe
Token: SeSystemProfilePrivilege	3092	msiexec.exe
Token: SeSystemtimePrivilege	3092	msiexec.exe
Token: SeProfSingleProcessPrivilege	3092	msiexec.exe
Token: SeIncBasePriorityPrivilege	3092	msiexec.exe
Token: SeCreatePagefilePrivilege	3092	msiexec.exe
Token: SeCreatePermanentPrivilege	3092	msiexec.exe
Token: SeBackupPrivilege	3092	msiexec.exe
Token: SeRestorePrivilege	3092	msiexec.exe
Token: SeShutdownPrivilege	3092	msiexec.exe
Token: SeDebugPrivilege	3092	msiexec.exe
Token: SeAuditPrivilege	3092	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3092	msiexec.exe
Token: SeChangeNotifyPrivilege	3092	msiexec.exe
Token: SeRemoteShutdownPrivilege	3092	msiexec.exe
Token: SeUndockPrivilege	3092	msiexec.exe
Token: SeSyncAgentPrivilege	3092	msiexec.exe
Token: SeEnableDelegationPrivilege	3092	msiexec.exe
Token: SeManageVolumePrivilege	3092	msiexec.exe
Token: SeImpersonatePrivilege	3092	msiexec.exe
Token: SeCreateGlobalPrivilege	3092	msiexec.exe
Token: SeCreateTokenPrivilege	3092	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3092	msiexec.exe
Token: SeLockMemoryPrivilege	3092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3092	msiexec.exe
Token: SeMachineAccountPrivilege	3092	msiexec.exe
Token: SeTcbPrivilege	3092	msiexec.exe
Token: SeSecurityPrivilege	3092	msiexec.exe
Token: SeTakeOwnershipPrivilege	3092	msiexec.exe
Token: SeLoadDriverPrivilege	3092	msiexec.exe
Token: SeSystemProfilePrivilege	3092	msiexec.exe
Token: SeSystemtimePrivilege	3092	msiexec.exe
Token: SeProfSingleProcessPrivilege	3092	msiexec.exe
Token: SeIncBasePriorityPrivilege	3092	msiexec.exe
Token: SeCreatePagefilePrivilege	3092	msiexec.exe
Token: SeCreatePermanentPrivilege	3092	msiexec.exe
Token: SeBackupPrivilege	3092	msiexec.exe
Token: SeRestorePrivilege	3092	msiexec.exe
Token: SeShutdownPrivilege	3092	msiexec.exe
Token: SeDebugPrivilege	3092	msiexec.exe
Token: SeAuditPrivilege	3092	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3092	msiexec.exe
Token: SeChangeNotifyPrivilege	3092	msiexec.exe
Token: SeRemoteShutdownPrivilege	3092	msiexec.exe
Token: SeUndockPrivilege	3092	msiexec.exe
Token: SeSyncAgentPrivilege	3092	msiexec.exe
Token: SeEnableDelegationPrivilege	3092	msiexec.exe
Token: SeManageVolumePrivilege	3092	msiexec.exe
Token: SeImpersonatePrivilege	3092	msiexec.exe
Token: SeCreateGlobalPrivilege	3092	msiexec.exe
Token: SeCreateTokenPrivilege	3092	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3092	msiexec.exe
Token: SeLockMemoryPrivilege	3092	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3092	msiexec.exe
3092	msiexec.exe
3092	msiexec.exe
1072	7zG.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1072	7zG.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4504	4892	msiexec.exe	89
PID 4892 wrote to memory of 3344	4892	msiexec.exe	108
PID 4892 wrote to memory of 2516	4892	msiexec.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RexadorInstaller.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3092

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5834D1035D1FB82C7B27E3F89D051A96 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4504
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3344
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6520D19351C4FDAE99F91D3DEBA89C5E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2516

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2524

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap23185:134:7zEvent17489 -ad -saa -- "C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition"
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e592002.rbs

Path C:\Config.Msi\e592002.rbs
Size 73KB
SHA256 15528c50785909279268472eab8d734a853930a40779a0a40354a38676d8d95c
MD5 8d5415fb08db04db62b594781a2c1726
SHA1 fc1b56b7250732092b81ac1efb6fcb1630cf40c7
SHA512 718e2298137317dfe67cb788a88ef192e7e2a450823583d14babbb5fad761a3d48a5ad6f9f9c9187805a37dfdaa42a9e5b7e7a023b29b0feca203fae903ba561
SSDEEP 384:NNbTfyKUXBloKURP9QB0KHUiiZ2D1HIjD5tjD5MHfkFa+F4uWDoK+vQkiovxFvJ2:N5fyKEtSQsJEDePOjEJvo4s
TLSH
T1BE7330529406D6D3E84FFE72EBC15A0D1629CD5FB688110D015B4E7ECE82E7CEA6A1F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bunifu_UI_v1.5.3.dll

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\Bunifu_UI_v1.5.3.dll
Size 236KB
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
SSDEEP 6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
TLSH
T19D345B1137A88D6BC67E4BFEA4A40240D7B2F956B1DADBCF9D9510FD24C33664B02263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bunifu_UI_v1.5.3.xml

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\Bunifu_UI_v1.5.3.xml
Size 138KB
SHA256 b1fc8535168f18772724e9f30d059785296fc8535e74b4dd678e0f116d70d000
MD5 09e0b722c2ee47a6eddb3442425151c6
SHA1 fbad7786802c966f6cd4f8602bb4910a1b332872
SHA512 719ccda04b14af4ccee237b1849d82afad6e13bf738bf996597fd6dd22190b52076c4e8f99ff0ea07937b53edec09262d45d19437e06754764fb6c63be19af38
SSDEEP 768:e2rrTimsVvOq/Zxcbf8I8LIwfXYCJ0USXE2s268iGV/f:ymsVvOq/ZxcbfrMIwfXYCK42s26an
TLSH
T1E0D3BF1876C4AE600D73426A6F25F4C9FF951C2B64CD565A34AC2D6B0FB2C8293EF670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.BrowserSubprocess.Core.dll

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.BrowserSubprocess.Core.dll
Size 918KB
SHA256 f807839b248b8936914ec0ce063f8841bb2a96629f2329a0309bf6cf1b738b87
MD5 4f68eff866bfe403b2e85618652a85b8
SHA1 343b5b87bfbb9849ece81c9f8962d2afedac3137
SHA512 a236e521fff28d34f550d1d540032665e1f5791c9f639ad8017fd2afec6f99d2f3d42d6fe8b13d27ea25f4de681d72ce820191acd8e1aad46524646be6ec59c1
SSDEEP 24576:+uYDDnDnGnjqLPngyQgmklKKFs0ve5QCl2ZiVBhEDssQjPc8DnXoSiW+YfDx5LrV:5MZFs0ve5QCl2ZiVBhEDssQjPc8DnXoR
TLSH
T1D1156B393B76CA33EBC93171CC369A9E171E51404BA587C7D664B228AF392D09F72217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.BrowserSubprocess.Core.pdb

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.BrowserSubprocess.Core.pdb
Size 9.6MB
SHA256 450b8b59dd803449ef544d02175a2ab8b423b8af52d1eeecbcfebc6fdcee33e0
MD5 5675dd8546ca64db3507605b918cd509
SHA1 b2bdfc55823a00300fd900697782ce2d7f4ea0dc
SHA512 a33401420d2035e0f2a7b7b7a5142f8776af1478760310bb5e768da9a80c93c2018897aba14bf7a6667619787a7a52579aa27575d6ea2110073dfaf71f5ccefb
SSDEEP 49152:X8JovSnYsn5479U4cGPtXrDfaV5KePVsWu+JeBzNTIP2XjARX4M22touRGD8jGDx:XS4co3YruWrNU1A5I
TLSH
T1DEA62A22E54A9D73C69E463EA253075D2325990497EFE3DB4649A3351FCB308EE2F306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.BrowserSubprocess.exe

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.BrowserSubprocess.exe
Size 7KB
SHA256 25a98f44751aa85e1f0e9d521b498625e41ea11da4b3f44f330b6bfb3f17f450
MD5 60b2ea6d3cb5cd4b5abeb8148e03ddc3
SHA1 90c38697b394dd188f259b1acb4d50a717d5e93e
SHA512 ce6478052c6e896407c3896e3a45c18e04ec66cc7d0d34b65cf81a6344a5ff36e7b5bcfa0d9b5699f3ec46a135dccf7277a292042fa890784602c4f80426166e
SSDEEP 96:lklxdI7k5mQBDvScpqeFZketmAQNt61OYcXe5U:sdICmQB2OqeFZWsAYcXeS
TLSH
T1B5E1B52193E85372F6F646B638731641AE72BB63A85B87ECB44C460A3F36654C823256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.BrowserSubprocess.pdb

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.BrowserSubprocess.pdb
Size 19KB
SHA256 4d4aa0d4619733959b3c53b5d888d9fe26b3525cbbb83bbd983bbeb744c4c4ac
MD5 302fdc7f6b06d133ad28ce1cdd0ba3f3
SHA1 7aa79c7f52982d90db069cec7191dd14ed63b20a
SHA512 f5aa0a78ad97531c0e74a651c3dd4d1c483d6f8dec8bd939f977248d10ebfe1c52169180b591fae1cbf21b8a854655d000e3660baee54a2e9eb62cdf1768f40b
SSDEEP 96:zsPJkWAPK4UAPFAPK4UAPUW4Hn1EhjlfBW0z8kjlfBfyz1e:YPJkWAPAAPFAPAAPUWNM0QAyB
TLSH
T1A892DF08B208E723F6E415B11943A9897BD3EE00EA9757EF7224F71E7E371042D1559E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.Core.Runtime.dll

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.Core.Runtime.dll
Size 1.3MB
SHA256 8b520e1a364825973d8da79c16f703ae1e278c76a2723ad0f2b0f8172a168a1e
MD5 aeb5dbcf52eff77d1910c920acbee1a5
SHA1 bb5dcb9b8e76e41cc532a5584067acdf53c34e09
SHA512 7f38838e15b8950683a10383fc4369449d0627d9c01e472d3ecbbce5b7ce2aeacc567ff546ca74356a972cd3b895d90bca34f1ed8b21d83ed33ab1d2cc1cb489
SSDEEP 24576:XtBaa6LalQLdeSlI96FPOobEcIL4h5Bh4EfkU4Cqc4ChKZi5B9xh0uLgS3esm2qe:FByh4EfkU4Cqc4ChKZi5B9xh0uLgS3eG
TLSH
T16A556C26314ACE33E99A29B3C436526B136F9594937AA7C3E250533C1E763C06F3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.Core.Runtime.pdb

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.Core.Runtime.pdb
Size 10.6MB
SHA256 fccab75459ad7ab09d3614434ce0d8f2a43208175168842ade9e8a30fee425ec
MD5 d9ebc80179cc82eab11e70e20a293ec8
SHA1 6ed6f9a69cf78b611af097d609c0b3d40f8765ed
SHA512 c2c0db39e5ff0ed70ad476c381500832910ea9bdfcc0b761cc2c3cf1bf66d52560493231d65e1b15d3f6c3bfcb474c9f679ea7b8a79c378531b6050c06ebf28d
SSDEEP 49152:UOopntnHUPMsbklNzsDG0CCq4a7A6JVR+ORmRbcIeU7AszL4pDHyb/qccLNe7DQ8:m0q65rzrEUm
TLSH
T13AB60922E64B9D72D68F863D9297071D2326A80457AFE3C79949A3351FDB304DE2F309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.Core.Runtime.xml

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.Core.Runtime.xml
Size 553KB
SHA256 0fece138608c4ff180b0ff470a461c2859940e69b01c00d82b5dc34a6917dc1c
MD5 cb27b6f856baf807cad81567dd239675
SHA1 fc000dbc3d2c51be9c66d601b0f4c78eefb909fb
SHA512 6ace2657810eac229a2c6c6cbe04e27909c851df0f12ce6dbb9c4f9ce1702ae88f8ef78aeb9a2b4fddff585c24ec3675688362bdd17a61bdbedbc65bdcf07e6e
SSDEEP 3072:3pwH5ge5uqxJV3bRo6JLIMiV/AlYhPnhTx6qolg3ZBRMLpwunrCKDJYjHbqyKieI:qge5uqx/ltIhV/AldLLdCC6qyKiz
TLSH
T14AC4B42ABBCE3F710D220111AC0576C1BB1A9535237C61B8B4DD692F2B85855A3FF6BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.Core.dll

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.Core.dll
Size 844KB
SHA256 787bbb25b8e5dccb433aa7f657e23d3f0e98b1763740019e9cd37f0562e15b10
MD5 a1f60ae9d6f2da2dced98d5f3812974a
SHA1 28195a138619fc19696ba783f9b28e3bf16e064a
SHA512 162a07d5e77afef637560ce33df414048c24b7689f4cbfd3ad4461094bf53bb42098658f1ef787bab63ab5eeb7b10c8c62673a3120d3d565f698d74b0885b4ad
SSDEEP 6144:jV08zyY3IQ3OlxxlzByIOKZ1fugjoGn5NXEfrvdqfIo9tpZTw9LcB7mk/jRhQ1wZ:jQnQCfx3vdgz4dW9lsetcdKo7
TLSH
T14F05D81133A4976DF28A1BB0D2E34F353AB5E1BA3E26F7A987E0945D3C4270359015FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.Core.pdb

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.Core.pdb
Size 2.3MB
SHA256 c8b9529fdeb9c6e2019b280fbcdb9e3c4187005e951936d14be10e860e581e98
MD5 cb600787fc71cee360838495d5a703bb
SHA1 73f53aadf09446deb12dabff63383ca832d36b5d
SHA512 e7a72801878715dbe83495bf37e80f2b162921f7a0460803d0db3e825d8574c809c56122433b79522788364f12edd14d5279edc868c3c3d691f4f89edde0f85b
SSDEEP 12288:rXAdFq4xwzl43/CXebaKv3/Xnb4zj2glHraKeDlHra4:rwnqypPCXeba+nbipen
TLSH
T1EBB59427FB40CE73D069893C69AEDB0D0738F658AB42D76FA945B17C2E853851D0B2D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.Core.xml

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.Core.xml
Size 1.4MB
SHA256 c9a809fde4df4beef42c9f5c6566efd40b32e8e9056d936cc28ed57e34c16823
MD5 b009c54caff7e94a608ac1435dc260f2
SHA1 5390326b575d28eb059ac984f81a6f70e6642926
SHA512 a94877b9083b5ba138c98bc026398d5bb0a8fe628101577830bcbfdc5ea5c43cac291cb4856db719d5cd32b1cf0dac464be34d070bdba76dda63a23dc064c9d2
SSDEEP 12288:vGQt01+yDRnyfkUwUAIEwWky4G4QcI4K6kEgnpSwY8Qka8oQ8SgGoKYQcQ0QYoYT:vGQ95
TLSH
T1BE65BD19B6C06D521C720257AE71FCC4FE971E33224A256E708D2E731F7A8C35AAF4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.WinForms.dll

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.WinForms.dll
Size 52KB
SHA256 6eb40b2af9f51aabc9fd534ecd30700f305119fbe63ae8ea1e035f06d5753874
MD5 cde5764ebc38fcb08b7309c15a74e3b8
SHA1 3be7fdbe81f2014b92bc6f6f3a17fc79bdc77b1f
SHA512 496e1ca45098b5ae7c74eb04ee3b84836bd7579d0e3bab8d3efd4bf05de1c55dce470ed5d2c13ba273a623032c38291bed607a58f86a7182b10d9330713ffdd9
SSDEEP 768:Qp2JLzAyC7o1c1wWM9ZQ2uxAg/4dRhnli0qLNW4ZEzZiQQkmJOVZUymuF7T07SiK:rZC7YO43hnE0yizgkmJOvUymk7MSiK
TLSH
T16F33F61513AD8677E7ED1A7DE43015111B72AF03BAA6E3E99D01B1E62AB77C00F403A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.WinForms.pdb

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.WinForms.pdb
Size 151KB
SHA256 a0a4dfc551e427473ae71d5eafa0b32efecff56b3fcacaed7854b2d07adffc79
MD5 7b5cc325f56860627bd1c83f7541e57b
SHA1 6b5e7f4930aea9f5fdf2f75f94d3f237ca6cb9c4
SHA512 6c96f7513b0727880251911bbec1fdbb457b2853fed754b989a53791517f80dbb2919b34801936d780bd893b149039b140b3a71b59216fbffc7dd71fec9c7dc0
SSDEEP 1536:D8rO5y/FWaEnCH7B1QxiLJmXar69+QgEC3FqfiDtarpqbi:D8FNWaqCH7TL969OECVCikpSi
TLSH
T1C5E3942BBB48CB33E078453819DB5F0D1736EA4566839BDFA655B1182EF63093E0639C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.WinForms.xml

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.WinForms.xml
Size 102KB
SHA256 03457c9d8433d32adc683ce19544e8e728e93f2cc3941dc9e7b6c494ace6d55f
MD5 e4deff893168055d306bb3800ed83410
SHA1 e36d17467c94ea6b756dc2bd3a4834a4ea2ff0a5
SHA512 0339edcddfc403c2345786f60161703a88e2e52e714a3fbc124be379de1b6ba4af8ddb84059f855be25c8b8e819deb6916836da7aee4dac13114f7ad432a36e1
SSDEEP 1536:qqn0pGGh+PRWa9z91v8Gv/wqVVRQFPvKnvcKTvnvp4lNnjaHylY2W584Fy:q+0pL+fZnvp4lJHg5y
TLSH
T1B1A36229F7CCAA3619B5010A2E17B8D4FE030B73339D1DA5784D5E531FB98824BAF259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.dll

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.dll
Size 271KB
SHA256 94ff50445663ecce04fc5f123b61289d53d6b76528878788d3861ca5410f3eac
MD5 ba3f3f736f515300e6a6915ed922824e
SHA1 b709879506332ff46a4979df7e5fb4732f5aa80a
SHA512 513a8a637f1abea80f11adba6973f5f7841cc84586f1adb7ce86a2457511bb46ca476faee74ce20c7eba83733ba11798009ef2e5a3efb12cf71a1824f94a06b9
SSDEEP 6144:AP9MlyIALUShGqROh6T0HKUH3cug0xtdE+pmhT:coAL7ucjYcugEdo
TLSH
T16D44292167E88269E6FF5B38F8B11D191E7FF846B036D79C390C252E5673B059840BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.pdb

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.pdb
Size 1.0MB
SHA256 c8dad1168ef9898e0b07a23a45628f9f357201026eec752ba20e8383af5fab61
MD5 6d7053466079c35b55d161940342d615
SHA1 c057e476e8431f2df82314e9a7d2be6046ea6ea0
SHA512 1e0db886cc2516f8b87fce8e0dd8492dd5ad4a4db7045a2a8c167a17fde12abcbc1e43da017a0ab1b7975f6e87f8b417bcb8bd3c5a01ea88f438e5429507f0f8
SSDEEP 6144:QoPHgEdUivTWu4eJsh9TxW/j95VYzqwzyLdYWA5i0MIgEdD9TxW/j95bYWAZ4ie:QqrXWuP0l6zKzqwzyh3IrXl6zb
TLSH
T1A335621BFB04CA33F1F8567815DBAB0D6377E3546243A7EF9248A1183EB22493D4629D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.xml

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\CefSharp.xml
Size 906KB
SHA256 2c0350d5889e9de4c3b9d28a67ff36646585530b5fba8e1c6d336594beed4eb7
MD5 dea5aa9a4bfbd15c0ecc93604d2bf222
SHA1 0f821375073ff88bb03459c5fd35af41ca921cd3
SHA512 85d2fea5a5d93431235c7efeeaf3edb4495ad79cc36522edcee5c7ecd820d49751263a5cb937c3e6dec13b72a9964116455dbed9b4f61f5577609633272bfdc1
SSDEEP 6144:l/ds7uI+I8A94IWdYAVpQZjBERBSA//f28nW7W+xVbUHtoPPFa1Qu3O+X+9HGTlh:Fds0nV4AXf28nWRxVGuHalh
TLSH
T153159539B6C87E221D72020A5E1AF4C4FF170B33321D55AA70CD2E531F768D29AAF959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeviceId.dll

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\DeviceId.dll
Size 22KB
SHA256 c66a3c651803ab2fd2b1147c81b8a1be2af9da61efcc093bb2f08a7c419237f0
MD5 08adaa7956013fef7bf33d255f7b1877
SHA1 417a391e33fdc0f316a6dd64a9bf5e68c93b1508
SHA512 006d47b8855019fef2ef5239415317d0d86577790049a6c75ef306201adaf492e84e53eaf081c485a0063cb544a005484f0a2354c60772833a09fcc4e6c1c81d
SSDEEP 384:Zcw7DAebVS0gka6+Fejv515839+3Li+iacHInO4uM:ZcW9b40gH6Hv5c39+G+iaconpv
TLSH
T19AA23914A3F8672AC1FE02BDADB1510147F6FA9B6903EB4D0C64E5E61D237914E00BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeviceId.xml

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\DeviceId.xml
Size 39KB
SHA256 b22451bfbf62c4bc97289a9a0ddf575a525d2eb614fc81c4b4a926e51619ddb8
MD5 8aebe70e3f91d524e24b4849f0c3e433
SHA1 1636379773ee64cc6415a85fd6789ba73f704ed3
SHA512 8d2005386ebb031b241227a7401ec6399a365d4a9b51f6f799a2502deee43d066bfffd6f8947132526c48f11ec4e6ccd8973444e63216bf16553c0394276033b
SSDEEP 768:Lto2JFZ8m7GknBmLFwLmiYaLm/cJLmx9JLmBBJLmgw8LmQdAJLmP1JLmxXJLmRJO:c
TLSH
T12403697876C48D0108B3000E6F75B8CAFED94867785A1556348E1E8B6F72E9192FBBF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dropbox.Api.dll

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\Dropbox.Api.dll
Size 4.5MB
SHA256 a8f08d9265f2b577d371b25c8a7b36679f55759121746a02369994ee779d81a7
MD5 465edbe2cf76caac782d80e78fbaea7c
SHA1 9d8f2900c5c5f5b04a4dcbe01a1df548e8218cdd
SHA512 229fecf5c7ba0cadf00d7315266fdc3ef10978d40671215c3a539434159852d664377afd48206495d97c405a47dd728fb2db538d1f54749352277d51d8e0682d
SSDEEP 49152:8QaqvoMzSoBA8/T+Rrngkw/IL1PA/Lv2Z71ETUvrh:3z1GmABRGL/LvIh
TLSH
T1CF26E8E4B6D4DF3ED85D5A3BA1111A294CE48F9A2A0342563785FDFA3CB6B845C23370
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dropbox.Api.xml

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\Dropbox.Api.xml
Size 18.7MB
SHA256 3e3b4bc94cb06c195757cd4ff5db874970da8d18d9200e29cd6a16d4fc19b8c7
MD5 8f2e4b24abd220475658b805eb5c0fae
SHA1 cda26ce27bc327ab58a447a2207f28f20ad81db1
SHA512 69110dc2e20915442f625af317a8852f991c850bfe1e1ba866ba6f18cb888707ffd9449cd0bff03b4b4520533e8c810c62ce8bff11fcda01349a6bbc0a7b21ed
SSDEEP 49152:ZkOwj/ksC3l2v2edb0Dg8OcaoNwUgV8MRPavy2vUAv22vS4vPEcuoXIoEZAQVDub:l
TLSH
T10217FE25B7F94985CC85060B5D6EBC817E890C63365A181638CD7F5AFF86DC3A0AFB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.txt

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\LICENSE.txt
Size 1KB
SHA256 058c3827ffb827ff3edda471ae7e1bb1d1aa5931985f0126043ccd33409e792f
MD5 88f49d5225b9d3deadcaacb8a0b4d7d7
SHA1 b192e6a1f748912157ea4507528dd5c63029852f
SHA512 cc1172f10c329692744b4e03cbaed73b9438d5c8af4b819cfddfb3b2fc1bd0eb710ff1149c3d828e34c0704451edbfebf19a4bd022a542c6d50ba5c0611d2c42
TLSH
T13431545713A40B6706D6674161AAADC4B0DCD06C7F236D012C6EF394536B52E98B7443
MD5 SHA1 SHA512 TLSH

Submit Download

System.ValueTuple.dll

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\System.ValueTuple.dll
Size 24KB
SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
MD5 23ee4302e85013a1eb4324c414d561d5
SHA1 d1664731719e85aad7a2273685d77feb0204ec98
SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
TLSH
T1DBB23955DBFC5143EEA35E7066B4D6873C3EF7C35D21862E106AE14A1CA37C1AB20B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\chrome_100_percent.pak
Size 626KB
SHA256 40df7c1d2867c8b146d58b5ee80783ed36c5a38d410c1c3e55011cf042b58062
MD5 54563e9a40deb9c8d545847b4b4064d4
SHA1 2b00b7839477c1dc9699c960f8eaa2b471cbf96d
SHA512 19c86cd39e836f76a6e4e87abd53686837193362d84fefc8fff3498fe1c96bccd313c94ff56a663c10d5eab648a1f39f7fb308a9985ec3b3bd0ee4f2f0214db9
SSDEEP 12288:FI3Hcjzgsz5B0GDJQrnKs8SNP+QSsSilHXNzNVc+gIXRt4z8oO0TehEr7:C387zEEmPLScXNzN5gURmz8oO0TOW
TLSH
T13CD412D77374EC3DEA6766BBA26504B4FC7355280AA2020A178FE8796D53748D8D83C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\chrome_200_percent.pak
Size 964KB
SHA256 b8b297eeab2e9fe8ecde1e18f1ee6b8c7adb90084bdeb541ad3746defcfd6f07
MD5 33c6e196e50f93d6647baf3a08d21de1
SHA1 38da6b75585750ba892e11c8fe23fb41a00d7307
SHA512 9fcdd378f11b2cfbe0617737fc268da9c032126fb038366d2a22cc7c4f8bc26980e9115184ac996652a03efbd7da0912f4bd4bf1159849ebf43149fb0518152d
SSDEEP 24576:Y320zLmmibkFR8+mZXumegvQtn5UwvdNbatzk6edhOLoe9:Y3203mNbkFRJmxRhQ15JvdazkjrOH
TLSH
T14F2512D7A374CC7DCD630BB7925A00F1FCB510360AB6550B07ABAD7A39567889CCA683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\chrome_elf.dll
Size 1.1MB
SHA256 a4b6992403513416f2b9fd26347e7ed044deac733851d4d40f26a281bd7eeac5
MD5 4f52a7f81980fe846787a5c5fb177e39
SHA1 847ce426d4ea4be96b323303d6a4ca12466e2723
SHA512 bc2402af925e57bfddc5c55f5835766ea8d0213915bbe416b55f5f0a1ffac107d472da55b970244303377d00fc2c47a96296ebe7f12bf27ca4669c262b02242f
SSDEEP 12288:E0YZLBuJ+skfl7CR+unVdA//26Y681W1I8ildEOKPj33Um8C3xEJ58bbMA+nkDaH:E0YXmkfccLn2p681W1IddUUm8iumar
TLSH
T12D35AE06B090A076D8163136752CEB396B3DEE214B108EC7D7D0BDEA5FB46D1173A39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\d3dcompiler_47.dll
Size 3.9MB
SHA256 35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7
MD5 3b4647bcb9feb591c2c05d1a606ed988
SHA1 b42c59f96fb069fd49009dfd94550a7764e6c97c
SHA512 00cd443b36f53985212ac43b44f56c18bf70e25119bbf9c59d05e2358ff45254b957f1ec63fc70fb57b1726fd8f76ccfad8103c67454b817a4f183f9122e3f50
SSDEEP 49152:OS7PQ+besnXqRtHKzhwSsz6Ku1FVVOsLQuouM0MeAD36FqxLfeIgSNwLTzHiU2Ir:O4PhqqFVUsLQl6FqVCLTzHxJIMd
TLSH
T131169E31FA41807AD8EA05F0666E776E943C9B341B3444C75290ADA9ECB01D37F3EE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\icudtl.dat
Size 10.1MB
SHA256 7c40c811d30d459dbf04a04c141b60eb4247cd58a008fb836605317df665748f
MD5 62880b7d351a9f547b62b8da6c97ce25
SHA1 057f11003013cfb3f1c63e6bdd4f2f9949ff0104
SHA512 0d6f83175a91d90f4cc3ec4d9071b7acd0cd8ebbcc592322e46fde2adb7198e035af62c45a11a622f2a908e26d4dd8b8d1af023e634a74d0824d02c791ba3c1a
SSDEEP 196608:1IPBhORjFQwCliXUxbblHa93Whli6Z86WOH:1kwVAliXUxbblHa93Whli6Z8I
TLSH
T17AB62803A2FB4DC2F9F76F31D8F492679567BD496E32805A01042F3B5C336908A65BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\libEGL.dll
Size 365KB
SHA256 39ae6647ed49e928d9fe8d352ef36e17f307d3a448fcce7c517b31863034f946
MD5 1d44e0a8a4089274e4453838234388a9
SHA1 7553dfb0b2f005155c9ec41d558e65a110911b9f
SHA512 b2ae646fa7fa22cb0beff2be8827c97b172f291e3fbe29a2e3304f19c7dceda5840ffaea9e41de28d89e09c212cee7d84dda137b0b45b042ade01d208ff4311a
SSDEEP 6144:j/lDfH76v/PHu9ymym+WOrm/akpByOMfYo9UJKIqCd1ouRp/oc:blv6vgymym+WOrmJsfYo9UJAOnRp
TLSH
T1CF849D01B540D4B1D86E20353E29D36D5F7DBC605B7648CBA3980EBEAFF02C259357AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\libGLESv2.dll
Size 6.2MB
SHA256 a87d396d904990aff0b9466e968dadcb8e62abb18ee7aa20e0d2bd0f6932b947
MD5 c718183301fb2afb05e97766aaed6c22
SHA1 e9abac929f718983c8db5d97fd0e7742fc95ea93
SHA512 a94d29f3cf4c9908dced5e84cce6f189e8298f079c875002236de8077ee60aa203b9b11eb5901b64c1cd9cd360fc42943d3097995538737296d602b2883ec232
SSDEEP 196608:sUzGY4r7GB/zZJ7xjYjGS2mxCAlryB8g9:9L4uB/zZJ7xjYjGd7AlryOy
TLSH
T13D669D01B4D060A1DC0B31767D0DAB2EEA29B3658FE846C7E6553DA4BFB00D11A7636F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\af.pak
Size 438KB
SHA256 49ee9689ae39c197c697f3529fbc1448fb279f48d8ad27326b22c2d141791acf
MD5 b9a96905830c11164ecbe61a40927dc8
SHA1 361eb01c6d3cddd76598df683b34256428cd7a71
SHA512 6cee6c7ee5cf1e97a2cc08b399371cc8d6a58edfdb04f5d02ba8cae7d0781cfdabaa628e2323d2fc7d8341d77738f84740cdd419fd836bca76433ff26f2b2a23
SSDEEP 12288:O2uaL0N/vpRdda2KCh2bM70i2Jyngy8WIyCg7xHSt2lyV9i5t/te6AziJrNiw:9L0FxRdda2LIbM70i2Jyngy8WIyCg7x9
TLSH
T15D942C0AEB84273D09A07697B70946B7BF9CA26CD770B2B6DD9D82360562EFC007D5C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\am.pak
Size 711KB
SHA256 54e5e63f35a448a441eaf5cb2ecb9ab7c80d9c871aa22f93a1264c5400b85ede
MD5 26f2be8fddf06ca0fd59430b8515f269
SHA1 f14fb9005a79face197db880a086155b63901066
SHA512 80843aae757e289a2955795004c2274cf35e8ea66d2df2b45819f7d3fae6723c35cbd16eae52ef8a44b8fce45c299c3cf2f1cf4c7d13ed48f2123f1f86a30312
SSDEEP 12288:GbnuzgRUTZwuMhqNx9TvLB/m4N9zd85L96fVw0upOAPPx30jH8+1:GbuzgRUTZsqNxlLBu4N9zd85L96fVw/u
TLSH
T1FAF4BA547EF9F7570F8E8A19A4311E4E9594AD4652803C38C35AE3FC2B2EF1B4DDA218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\ar.pak
Size 782KB
SHA256 fae4ec9490979b8abc3987050bbf93884751a04b80661541dc89e415a7d3466d
MD5 da392bd735cbd9cdb9e443a6f39278fd
SHA1 b9f5be0bf0b6e088d5e8527478ddb82840c8f6e1
SHA512 94eaa520fe6ef81483553c0b91db92b250c4ebb255a7bc1e2e036cb382f0f4340b54c924f061199d206eb39013ba75cfd4f6c9f506f72edf98ce6a4304355771
SSDEEP 12288:vRwc55BIgW/B/RbVGxKvvYUNhjbkub5UNip+ilYMgSENX/G:O7pgm5T+s
TLSH
T164059BE21B2984720B56DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\bg.pak
Size 808KB
SHA256 96a06019adc22247a6fa9629636194c438f5f8770d333e3117c992c0161f942f
MD5 de1c445aa9108e1a1f2660ed4d715b58
SHA1 a82eb8c1979c5d0513b39986a634b61fc2c9aec0
SHA512 a9c941f1979ebcd27d69a6a430257b57f7a70ed17b41b1080a7237cf310987069f2fabebb9ac353c481aae8636c30d0c46a287ddbe5a20804ffbb1a317eff941
SSDEEP 24576:gCmCv/q5ftlYMdAs1axUB/x3aCKGtVDLSmvunp8dIO+5WJquLRlCQDwN/6ZIV6yr:aCv/q5ftlYtUBZ3a0tVDLSmndIO+5WJe
TLSH
T11E0523A15B9A64DF0101F45F98087E093CEB84FE3FE7879241652DBD39F20B486BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\bn.pak
Size 1.0MB
SHA256 6384e0fb49fabb1575d9411bd6d4551854a059e62604723fa465ef4a9d57fdb4
MD5 20e0bffd7dfd47a8ed800edcedfb4685
SHA1 4b72e33c2887e35195a20f67d1070e24f192a2c6
SHA512 17864c13bab9a32c090e1d0c736223990f2eee715bb8c57e06606a95abea65d45d72d5587a8f9977988096f08480df5946fd7120ad65d4c7660421279415049d
SSDEEP 3072:VwxqiD1yHfEqoAZoHFGe/a/0hfI0PLvCAOvktBbStDn51yiXlvz:Vw7pyHfEAZQc8v3OwBby5Fl7
TLSH
T19B35DF209C6E91B2A8C5CDC9434C6370C523AE979B61F74DDC17A24938ADC7C8DADDB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\ca.pak
Size 500KB
SHA256 ef2bfc50b5ab20c7b04f04cb41b519befa1887756e120c1a53d1026d9e15cca1
MD5 fb49eda55e2895bc0f7b97790caf0187
SHA1 83883be8fc72cecff61715db0498560123f742ba
SHA512 06b64ebb26317d7f9a00b77095c203442a85de6b593767f30c045e8a68e00411607a43d98b1df6228c8d9a262a1fc75176dce4db1a4b98c239a8d75ffe464fc0
SSDEEP 12288:A7WjkWb7X6ELn1R355PAF4N3Mw2juwHzejm0XNlGq8EmsTRvIs3cmlLEY0CJ7MyL:iVQpDR+Voc/MNK5/EB5TTBi2
TLSH
T107B4F8239FC93B7744D2220AFB46C217E48CA9847B06D254F5AE1B1623CCADCC677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\cs.pak
Size 508KB
SHA256 008a789ed3295b206d6481390f0430b172cc3986600b24361ab4545c64c90342
MD5 441f7180892855958f5a84cea4be9e25
SHA1 1afb3a67fc601e130ccec8b395887d1639b1da9d
SHA512 db73f188e9eefc8d812b9e2f1052e4d42205c33018561f411a2fdb269133f9a95771ab813e4b4b749f9ff1bc6b50f6cd2fe170e52dfe783e4e24564b00a45dfd
SSDEEP 6144:9e5BWwP2ThZZD7ZUc7GrAM/z15T8VKgkNOQw3SBbN8QjsA:KQbnZUcqNz15T8VKzNOl3SR
TLSH
T1EFB45B1EEEA26425488002497FBE4228BD5E83500B6FB5AB7C8F9D91217577ECFF4D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\da.pak
Size 462KB
SHA256 56695170e6533d9a33e9f91457716722c62e50a5cceaa9b59ffa7ce25ea3528d
MD5 6de3d0c003302ab63f1cd4e4a8def111
SHA1 172fe84f56448410ec2d4e0a45ec4be2c3bdeee8
SHA512 6edba5f4d04ead5b4e6446cc9e46506873ac3fd658b44b8666c60d1781b394d14b271f106c0052d7d96af82245b3969f150c4264de2de2599ab2487a91035ea4
SSDEEP 6144:t3R2wD3DQzVWFYO5c0orUrrwlH2oJwMEbtEbvvXe53Nrzppd4gTGqfwszZhSq:t3Ew/yLr2qQJ59r3Tpb
TLSH
T1BDA45A4BDC5C732F89AD4A25F3118EA7EB5DA03CC684264F65D894390ACFC6097BE1C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\de.pak
Size 498KB
SHA256 892357f96c90cf61ac039b1ac797f0a7b5111d99a89a291960a0cf508d5594cd
MD5 01fd82fbb7e9da70bd3a59d06c36b6e5
SHA1 7d4c95e279bb7b4e270a75522673a093429179b2
SHA512 9166a5a47d02159946aeb743d4ee91136ee21926641736f1770b9129721e0eadfd40f4dad9d205046dc3bb4c9df421a9a4589d0756689b9cd3f69caf4fb0e4d8
SSDEEP 6144:KoKm93L/cqFHsf63K7UpTzighla/nxDUBcP3w3A00o268dz5aRcT1MROItCxF:KA/ZY63K7UpCgvaPhq0p5u9tCxF
TLSH
T12EB40703ADDF621EC782B3613305CDB77B19E26BC342322794EDD13B654B5B282AC566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\el.pak
Size 885KB
SHA256 3b757753bc218b52cf4988111e96cad210b62005a2fde19e576dab6787730cea
MD5 63666b0ac1668920eac108970ffdfeda
SHA1 52bcc09944fe6ac9dd840f48d93fbe1137a0b74e
SHA512 e307e5356c59743960a058d0b43f61b9111dce8abb020745ff3e29da71cf20849cb4417aa01cac29f81e1bd3638d3e507c64c75e55fff33c5201a91b1a41e752
SSDEEP 24576:JFXUYcXPeFgx1vKxiQT/mqHMeD2fpYEKj0vSKjaEA3H8EuiEc7t2DQ739Qtf2kth:fkYcXPeFgx1vKxiQT/mqHnD2fpYEKj0r
TLSH
T12215BFEFB4542DED8086950785D8F07C2BC62D6CE749CBD86229CB60BDF90719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\en-GB.pak
Size 401KB
SHA256 967d3a816b7e4cdaf93014f2217e901b9f7ad31693b9be4331abacb13e7599b4
MD5 c2974f708589c0c703ad06a7f8b7ada5
SHA1 29498a7fd1defaa9a7adbfca5292d4a239d9b853
SHA512 57ddc2ea2f7962dfe9a5bc972c991be58dfa15e6b0b43ccd97f637978e0ffcc2bbd2d0d4eef9f121ce3d94a76b9c7d158d6eafff389e0a57e97db296a85ef17f
SSDEEP 6144:JOzu3jBNgAYBNSq8MP9elwSofaYeskuN5AVSzB7RujI:0zIjBZR3MqwSXu5cS6I
TLSH
T178943C1FF784226A069311727B0A6662FF26D06CB31112663CBD816C33B6756C37B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\en-US.pak
Size 404KB
SHA256 9d0df6a64559ff718c06963f740549ecead271b84cbdcc81c7782e0d0011041e
MD5 d35ff435ff91254246ae63984230e4bf
SHA1 4a780fc53e000d7eccabfeeff36bdbd01dfd8374
SHA512 1854e88765b9a9ee372164e24756000e70b5bf23bdb2bbb82c0db7b95458ace266fd37880f4502a6b8f2820986d5770ec1d7eb63e99a7dfe9ae48b62b8c79ddb
SSDEEP 6144:4UGmjMlNdRzP8Pr3BO4u8MP9ehWMIfaYUGrc5eFSQnC/MBTwp:49m+NzP8jvxMaWM/v5kSqTwp
TLSH
T1C0945B1FF744222A065352727F099672BF36D06CA36112563CBD812C33B7B66C27B6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\es-419.pak
Size 489KB
SHA256 7116b00185b0cf244e36502cf0e2d97d961670783c345e55e3dd23e8b42b3443
MD5 fd177446be4f90ef7f1135181ed4f2d8
SHA1 4e5d1b769453d9525915c5f2fdbea1de9a357354
SHA512 800fba17becf11125a4ebe9d384caf6929a3e03c3017b73caa42be9ccc8c8988fbecaab37d0fcc75f77f57c20cc5895523b7b4fc7d524b1dd5b99e527e643b85
SSDEEP 6144:S7zfBzs3E95pD+AYzTpmD5zLFzdPdXt5m+g:Qzf1CYfwpk5vF7Xfg
TLSH
T145B41B22BAC81F5310E2A389B743D757E4949545F408C29BE8EB876522DCF8CC877EE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\es.pak
Size 488KB
SHA256 bfa86937c5972c1691f96cc15c567a9cd5ae064ea156ace6399a6014f1197cce
MD5 51f43d5762c7c866d684439783eac5a7
SHA1 8bb594b0cf0d6049375dedab236560d7b6245d5a
SHA512 57294a3f9de5e573506abbd89bb97b41943ac2cf07358be0d218d546c81ee7c9c549916d2984349320a4e4014e87ae44a005069d413071dba901e53ab0989e5a
SSDEEP 6144:pyBgsWZ3aOGc123zun+p4HgspZpGnLKjs5d2rRXoRRie6PZOk8jMn:pH3aO0S6irpumjs5ArdoRw+Q
TLSH
T11CB40822BACC1B6350D39385B743D753E8D89585B408C29BE8EF876612DCB8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\et.pak
Size 443KB
SHA256 bbb447a0598e0db7c6941a67f921c30f3af36c6a9bd5010f4b5fd549a1a47211
MD5 eb85e0d2eef0b6a72a77e00efc9fab8e
SHA1 c1e1021627fc2f6643a3b5ce6d0989977f6a5573
SHA512 8d0b83a4498d7f93c6553b9fe76800f324b8b9fd96cb09d1816b7c50659f9e826755ca8edec1ab09d66908d8bc9e6c4c55ead9fa4148bc6f8e137b3c9ec4d2cb
SSDEEP 6144:RaUkQvNomrYEX1YnnJ1O7RCqDW+jDk+xdt0TOHMvT/l1AiGGZv5kjk43c3apLU0m:RaRQvSmZYK9DVDNOZdv5kjnm
TLSH
T105A43A42617D771B282451F9E337AD23CC9EE6D8B4000D9778974A1971EEF8C38B6B68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\fa.pak
Size 720KB
SHA256 144c2668afbf067ba4e38772abedb1d09c9590b71703fc8f707e7fe2761d64b7
MD5 8a40f31b0382e38519f3205dd7dddf90
SHA1 1ca4cd0b26585bc2c702f9f1239c4dab2e817763
SHA512 b4ac80c73cd4033ac39592f8024ae95f2e4e722fef56617c4f632c1996279088e754d4ac52d3f91b70865513166ea0713b85e01bca799d83e72f29f8a7ffabcb
SSDEEP 12288:vokeFQ8u313uyqoe+srXcfqvdUzOT4imdAQifaQ2XxFvGq+MXvOthgdpxHsAQi6c:wkYQ8u313uyqoe+sEq1UzOT4imdAQif6
TLSH
T1F0F4C3957AAC5AB16756CA0341E33834C773EF12D34DFE40ACA1076609A5B139F4EA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\fi.pak
Size 451KB
SHA256 d3cbba983f7a0f9d4dd3300ff3b64eb79f725840915d66b22412149b262298ea
MD5 dbc419045ea8da89e58be7ebab55a68f
SHA1 b514d58c2a26aa2edf870e96e1edf614bc4e295a
SHA512 5ca576e2f4f4d3065d6b207fb77d40e4cc9c2bab14e8236afcb8b696751b6d97035bf12f3ce582ce750f4c772fd86a9567a654cd9d1af34ec50c14be97731efb
SSDEEP 6144:cSxMj1dN19jrPzGI6B2Roh2jl7IsPzWAOEHGaSNLD5LYWyHRErWacA5CGWO4AMjy:kHN19v5JvKa65LYdHRErWaLleYf
TLSH
T185A46D915219C22137C4C29F7DB0903EF9E9E3DDCC284896E847C7D949EA9883D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\fil.pak
Size 509KB
SHA256 766bb6983a0dcd2cee47e1ca9212961c1fdb34143995735fc41701301292c280
MD5 ce10b19b85a5249c47768b1020f980ad
SHA1 a59cf52ad5aa6c8e6fb218c3c559f8e9ad60000f
SHA512 db752e5c1a5671c9cb3b1d59733a3033d77388c32442c1e2a6067daf4d9abc241436d61fbe7ef49d084217464152e2e3e94b26b32ab301c528912daafaba89e9
SSDEEP 6144:leC/Jd44B7DJ/Cup7xLyBDQZSH60wh0FeKznGOZ3jmF5ZVmlb8ATe3j:lewy4B7DJNsaVQaF5XmU
TLSH
T12FB4B615B7402748DBC356E51360682F6AE570BC3F826C6E4FBF269B2BA7CD5D270182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\fr.pak
Size 530KB
SHA256 115b6c73eab0f8f3d7895c610bd040bb30500731c872f139a1350c51b0a670b5
MD5 6937405e2d7c55849e8ff85221fe215e
SHA1 245d9b6ac3b559faa50b79cf362606ea039758b6
SHA512 476fb0befb4560103f6829177a23f737a880be9c2f102f2fc4db7f0dc525b66a9caa7f350508709d2c655cc70a5b3b540aa2247b6182d0a27e2338ae5b29e05c
SSDEEP 12288:QCN5pQ4ZLoeeEfW6QuaWV5sKzTeX/Z5MYnYZMBrNWi605exMJSWkt40wCe73OF8A:HXp40VRd5Tl
TLSH
T1C3C4E65FAED432CB15C21277FB12D663DD348248F216E340D89F4299129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\gu.pak
Size 1.0MB
SHA256 c0d7e010732c14e08ef3c57e68ced0cf33b8731b165c5cad4c2baf12b6524896
MD5 f9f1db3e1259ecfe25d761e9bdf9a210
SHA1 3f7759b851b2709b90102e771aacde5f627a1c06
SHA512 5bdafa767839622b454a07e41c947aaeae43f998195bddff1799d5521a36dbdc0e5584976a6e04076973f49be9310c0be756f9fb2fdbb6e4f4864fa67d6d69bd
SSDEEP 3072:J+m4H2trW0JF4bNHIwjAwREJKVMjNiT7llj63rhJWlPvpqi5eQWkYJ+WR6/GQoyr:UbHErW0IUKTkdZ15fVh3ERp
TLSH
T1EB2519D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\he.pak
Size 635KB
SHA256 a2d2d4fdd6e79f2b0ea2255dceb728d8826f3ba61cfc3563901eb5354e8ff2c6
MD5 cca0375b68cad99b4f07dc244f54cc70
SHA1 a643962d26a287d1f3f9c6dab9e34cd57288caf1
SHA512 7924901f76710ffb2012c877212cc40b84da83c69d3f777c2532f365f07c56450ee0e81e2af06d4d5c818d9c7a17f191b8d1285ee8a78374b92e7205286a4ebe
SSDEEP 12288:xPN1IgghH3SxsheRvre4maaW/gVZml60XA4OX78eQCap4X5kU9omhN5ylm7eDnw5:xPrIgSx5doQ
TLSH
T11DD4ABC4B2D452255231AAC39FA8FA286FF3CAB53CA27512CB14526CAC774F4BD530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Program Files (x86)\Rexador Team\Rexador Bot - Veteran Edition\locales\hi.pak
Size 1.1MB
SHA256 41b9427a2af857c37eba99e692e14f583d6fbc8c59c4f2c8421b4b2fb2d6a3b3
MD5 c09688a22c35bed688c3a02e4aa6aa18
SHA1 17e8e3258f260ca68e8be0a4bd812a718f99e9bc
SHA512 709ccb53f1fd42f5eff03276b44412f0207adf601c4ff85d46a42fbb505f2b25592db7832cd2cf6bc0b3f4af21676fbf9df3791e5a977d20307491c7aff472cd
SSDEEP 3072:uw8eGAk1kEFP8KFuV/BB0ZV1d1muOlzLZW3XHLeOTByntDPtDlqpZs4J/8W8w3kg:OTAkOu8KFX895w5oJMx
TLSH
T1CC35150CEBBEF3B55DEC3C9A32890D37C5AD3674A3E5521348D5B3DB9844CB4146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 daa082dbcd669fefaafe482e2528926738466aeb6a5af387cd2087f458bb9798
MD5 69f6ad9cb146f9b62f1fe5c74407eda6
SHA1 c111799070ef5b6d0019295708767bc0209150b4
SHA512 c0d4b9712957bbd78f925a64dad21ffae62ee41e2c51ae7c9ffa23f978a39a6dbd3c63b10b81412fdc76c08c78a02277c9a9ef08488f868e40c6d1a7d9fab370
SSDEEP 192:jCG+oSio+a9jvuQl4/n47SFhIo0PzwfaolpHwo9TUHNZrA6q2OaoKJs:CoS0a5vHl4/kOIBEfZCouE12OQs
TLSH
T16043B462B448D615ED0E5D76AFEAD6EC23317D16CE1B021338C2B77F8ABB0C00E19549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA812.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIA812.tmp
Size 298KB
SHA256 da1fe86141c446921021bb26b6fe2bd2d1bb51e3e614f46f8103ffad8042f2c0
MD5 684f2d21637cb5835172edad55b6a8d9
SHA1 5eac3b8d0733aa11543248b769d7c30d2c53fcdb
SHA512 7b626c2839ac7df4dd764d52290da80f40f7c02cb70c8668a33ad166b0bcb0c1d4114d08a8754e0ae9c0210129ae7e885a90df714ca79bd946fbd8009848538c
SSDEEP 6144:ruAOGlvgiHqfcTmGZ8009t0svTPxmx4yAyA5bDB+urH+nPAMyoZ3:iclvgiHAcTmS80g9vTMx4yAyA5b0urH0
TLSH
T12D548D517BD19032E2FE05307979A6A22ABEB8305CF0CA5FD794156D5E706C0AB28F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_103A51DF7E53A5A7FF33E0.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{24071C19-6750-4F60-A23C-92BF5B5ABB22}\_103A51DF7E53A5A7FF33E0.exe
Size 205KB
SHA256 d8fed187df86b04a49a38c69b069129fcd9a3f1250d7b23aeb288e9064930188
MD5 0739f9fe750b25c116e5b097a12d251e
SHA1 e15f39cd819bd62ab98f1758345d502f1284ea7f
SHA512 502fdbff681e708f5a0dc26985c9f001b4e94cc1564029e311c82d0d11f0e215d7bfb06565b00affda411ad8868f2ea015ab07889e57f8cac82c67007e157f9a
SSDEEP 768:n9NvDXjPkdwCGCykDif9cgl4EFcdddddzvCR+1D3Fp:9N/7CGCykYZCL
TLSH
T1BD2414A2691CDC05D4B32860D62767F5C267AE90CC9DEC83E52C7D19BEF34D8F026299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rexador Gladiatus Bot.lnk

Path C:\Users\Admin\Desktop\Rexador Gladiatus Bot.lnk
Size 3KB
SHA256 44606ea78639c0259ae54167b0faa0982c37220904366cfc808946df99ac724f
MD5 eb468a7e6ba6c8b74815fdfffe584f25
SHA1 aab60c6a5ac822057ea080168f3404d240dc784a
SHA512 40abaffb359a99f7b13765b285db6423f097e98246eaede1e8cb5f3d1a85ddfb21b7a2afffcd3b7110540c419811e525367777bff615c1598b37818dca9650fe
TLSH
T1E361FF801FF71161F3F3CB35A7E25D23D572A8025B194E2921864B050F22510B99BF3F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 aae427631083a9988743ec44f6302099adcd7e1e7aec94159155b6a17561d90e
MD5 4654547c57c7c2d7452a0744c4fbcde3
SHA1 1f7fee04e6d867c13b38989b50422ccae2c514bb
SHA512 4a51ffc616fc30b27e0b74bc6072470ffa86f4ae037f31bf60998ffe906bf1cd0148f1bf110685240d56c62a03f09c0b5301f02128792ac7d86d63af7ddeaee3
SSDEEP 24576:1u8m+1zMdoO/vvTLb2t+oGqZc0UjVVdSBLGtPic1l0asOqEgIP1UlbGRI:2
TLSH
T1F247A3243AF92110E7B79E3C6CF0AA234D3A7D5B9C199E8D45411F4E0921FB0E972F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{43325f55-f764-48cd-b368-36c87e78bf29}_OnDiskSnapshotProp

Path \??\Volume{c9561ee0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{43325f55-f764-48cd-b368-36c87e78bf29}_OnDiskSnapshotProp
Size 6KB
SHA256 a5b390c08eb3cd16fb7d44d3568c5f9ae2fe5987623d06f9229eff80ea3e628c
MD5 c60e2dc96eb907de12efd8b8a4811fb3
SHA1 d55650ea0c20ff62f75ff6b446a039b73ddbebfa
SHA512 024e15192af10780d360abe90fd5dd590c9e57c52fb2bd897c4951f514d43ba75968164e2047e17a3272b1c320718d7d6f4e8bd326e6ccc30a6505f529fb89d8
SSDEEP 96:FkbCInvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:mbNb++ZVmN
TLSH
T192D189085AE54711E2B3AB312DF18557A877B911EF33CB8E0298238E2670A10F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download