326d0b698547c24bf837739f9f574a740248dca3702fc87a3cabc047a77952f0

Resubmissions

14/10/2026, 03:07

261014-dmlevsfv4m10

14/10/2026, 03:02

261014-djne2svv3j8

Analysis

user interaction
yes
max time kernel
151s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
reverse-slop_0.1.1_x64-setup.exe
Size 51.0MB
Sample261014-dmlevsfv4m
SHA256 326d0b698547c24bf837739f9f574a740248dca3702fc87a3cabc047a77952f0
MD5 4ad624e851ba557683a41e08d9fdc291
SHA1 4df81b9d788c2aed3457ab6cbbe91b2d8d8ebd78
SHA512 d5e744f1d1b5f092abd5026cb6e537c437fa0a9d5a31d0b14bf4ee63650d33052252a2a8053ce26af93841d9cd522ef833f7fe48eed918159079d22d2a1305ff
SSDEEP 1572864:M7X1Nn56YVP08yekDIl+qZqPZZ85juuyl/8DGnXIwYGfJPAEX:M/NVP086I81gjuuyeqnXIwRfJJ
TLSH
T1FCC73393B01B36CEE14BD0797486B391B831AEF3F5687C43517389A293BC6D356A7908
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation spyware trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 5456 created 5764	5456	reverse-slop_0.1.1_x64-setup.exe	81

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\H7wwvtvtHN41\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\reverse-slop\\DriverRuntime\\H7wwvtvtHN41.sys"	slop_mapper.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KdjQKsgyaCbo\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\reverse-slop\\DriverRuntime\\KdjQKsgyaCbo.sys"	slop_mapper.exe

Executes dropped EXE 3 IoCs

pid	Process
4892	reverse-slop-ui.exe
1404	reverse-slop-engine.exe
200	slop_mapper.exe

Loads dropped DLL 5 IoCs

pid	Process
5456	reverse-slop_0.1.1_x64-setup.exe
5456	reverse-slop_0.1.1_x64-setup.exe
5456	reverse-slop_0.1.1_x64-setup.exe
5456	reverse-slop_0.1.1_x64-setup.exe
1404	reverse-slop-engine.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	reverse-slop-ui.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\reverse-slop\engine\tools\magicmida\x64\Magicmida.exe	reverse-slop_0.1.1_x64-setup.exe
File created	C:\Program Files\reverse-slop\engine\tools\magicmida\x64\scylla_hide.ini	reverse-slop_0.1.1_x64-setup.exe
File opened for modification	C:\Program Files\reverse-slop\engine\tools\magicmida\x64\scylla_hide.ini	reverse-slop_0.1.1_x64-setup.exe
File opened for modification	C:\Program Files\reverse-slop\engine\tools\magicmida\x86\scylla_hide.ini	reverse-slop_0.1.1_x64-setup.exe
File created	C:\Program Files\reverse-slop\engine\slopdrvr.sys	reverse-slop_0.1.1_x64-setup.exe
File created	C:\Program Files\reverse-slop\engine\slop_mapper.exe	reverse-slop_0.1.1_x64-setup.exe
File opened for modification	C:\Program Files\reverse-slop\engine\slop_mapper.exe	reverse-slop_0.1.1_x64-setup.exe
File created	C:\Program Files\reverse-slop\engine\reverse-slop-engine.exe	reverse-slop_0.1.1_x64-setup.exe
File created	C:\Program Files\reverse-slop\engine\slop_frida.dll	reverse-slop_0.1.1_x64-setup.exe
File opened for modification	C:\Program Files\reverse-slop\engine\tools\magicmida\SOURCE.txt	reverse-slop_0.1.1_x64-setup.exe
File opened for modification	C:\Program Files\reverse-slop\engine\tools\magicmida\x64\HookLibraryx64.dll	reverse-slop_0.1.1_x64-setup.exe
File created	C:\Program Files\reverse-slop\engine\tools\magicmida\x64\Magicmida.exe	reverse-slop_0.1.1_x64-setup.exe
File opened for modification	C:\Program Files\reverse-slop\engine\slopdrvr.sys	reverse-slop_0.1.1_x64-setup.exe
File opened for modification	C:\Program Files\reverse-slop\engine\reverse-slop-engine.exe	reverse-slop_0.1.1_x64-setup.exe
File created	C:\Program Files\reverse-slop\engine\tools\magicmida\x64\InjectorCLIx64.exe	reverse-slop_0.1.1_x64-setup.exe
File created	C:\Program Files\reverse-slop\engine\tools\magicmida\x86\scylla_hide.ini	reverse-slop_0.1.1_x64-setup.exe
File created	C:\Program Files\reverse-slop\uninstall.exe	reverse-slop_0.1.1_x64-setup.exe
File created	C:\Program Files\reverse-slop\engine\slop_mapper_last.log	reverse-slop-engine.exe
File opened for modification	C:\Program Files\reverse-slop\engine\tools\magicmida\x64\InjectorCLIx64.exe	reverse-slop_0.1.1_x64-setup.exe
File created	C:\Program Files\reverse-slop\engine\tools\magicmida\x86\Magicmida.exe	reverse-slop_0.1.1_x64-setup.exe
File opened for modification	C:\Program Files\reverse-slop\engine\tools\magicmida\x86\Magicmida.exe	reverse-slop_0.1.1_x64-setup.exe
File created	C:\Program Files\reverse-slop\engine\slop_mapper_last.log	slop_mapper.exe
File created	C:\Program Files\reverse-slop\reverse-slop-ui.exe	reverse-slop_0.1.1_x64-setup.exe
File opened for modification	C:\Program Files\reverse-slop\engine\slop_frida.dll	reverse-slop_0.1.1_x64-setup.exe
File created	C:\Program Files\reverse-slop\engine\tools\magicmida\SOURCE.txt	reverse-slop_0.1.1_x64-setup.exe
File created	C:\Program Files\reverse-slop\engine\tools\magicmida\x64\HookLibraryx64.dll	reverse-slop_0.1.1_x64-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reverse-slop_0.1.1_x64-setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868	slop_mapper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	slop_mapper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	slop_mapper.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5456	reverse-slop_0.1.1_x64-setup.exe
5456	reverse-slop_0.1.1_x64-setup.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
200	slop_mapper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1620	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	200	slop_mapper.exe
Token: SeLoadDriverPrivilege	200	slop_mapper.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4892	reverse-slop-ui.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5456 wrote to memory of 4892	5456	reverse-slop_0.1.1_x64-setup.exe	90
PID 4892 wrote to memory of 1620	4892	reverse-slop-ui.exe	92
PID 1620 wrote to memory of 2064	1620	msedgewebview2.exe	93
PID 1620 wrote to memory of 2120	1620	msedgewebview2.exe	94
PID 1620 wrote to memory of 2120	1620	msedgewebview2.exe	94
PID 1620 wrote to memory of 2120	1620	msedgewebview2.exe	94
PID 1620 wrote to memory of 2120	1620	msedgewebview2.exe	94
PID 1620 wrote to memory of 3716	1620	msedgewebview2.exe	95
PID 1620 wrote to memory of 3416	1620	msedgewebview2.exe	96
PID 1620 wrote to memory of 3416	1620	msedgewebview2.exe	96
PID 1620 wrote to memory of 3416	1620	msedgewebview2.exe	96
PID 1620 wrote to memory of 1180	1620	msedgewebview2.exe	97
PID 1620 wrote to memory of 1180	1620	msedgewebview2.exe	97
PID 1620 wrote to memory of 1180	1620	msedgewebview2.exe	97
PID 1620 wrote to memory of 1180	1620	msedgewebview2.exe	97
PID 1620 wrote to memory of 1180	1620	msedgewebview2.exe	97
PID 4892 wrote to memory of 1404	4892	reverse-slop-ui.exe	98
PID 1404 wrote to memory of 200	1404	reverse-slop-engine.exe	100

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5764
- C:\Users\Admin\AppData\Local\Temp\reverse-slop_0.1.1_x64-setup.exe
  "C:\Users\Admin\AppData\Local\Temp\reverse-slop_0.1.1_x64-setup.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5456
- C:\Program Files\reverse-slop\reverse-slop-ui.exe
  "C:\Program Files\reverse-slop\reverse-slop-ui.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=reverse-slop-ui.exe --webview-exe-version=0.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4892.1704.232616956538101717 /pfhostedapp:95e7510087fd56be4fde3cf5d4df9070feb93552
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView /prefetch:4 /pfhostedapp:95e7510087fd56be4fde3cf5d4df9070feb93552 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x50,0x7ffe8af35fd8,0x7ffe8af35fe4,0x7ffe8af35ff0
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView" --webview-exe-name=reverse-slop-ui.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,18226454601573170374,217870298787775244,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:95e7510087fd56be4fde3cf5d4df9070feb93552
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView" --webview-exe-name=reverse-slop-ui.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2044 --field-trial-handle=1768,i,18226454601573170374,217870298787775244,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:95e7510087fd56be4fde3cf5d4df9070feb93552
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView" --webview-exe-name=reverse-slop-ui.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1768,i,18226454601573170374,217870298787775244,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:95e7510087fd56be4fde3cf5d4df9070feb93552
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView" --webview-exe-name=reverse-slop-ui.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3476 --field-trial-handle=1768,i,18226454601573170374,217870298787775244,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:95e7510087fd56be4fde3cf5d4df9070feb93552 /prefetch:1
      4⤵
      PID:1180
- - C:\Program Files\reverse-slop\engine\reverse-slop-engine.exe
    "\\?\C:\Program Files\reverse-slop\engine\reverse-slop-engine.exe" --headless --parent-pid 4892
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Program Files\reverse-slop\engine\slop_mapper.exe
      "C:\Program Files\reverse-slop\engine\slop_mapper.exe" load "C:\Program Files\reverse-slop\engine\slopdrvr.sys"
      4⤵
      Sets service image path in registry
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies system certificate store
      Suspicious behavior: LoadsDriver
      Suspicious use of AdjustPrivilegeToken
      PID:200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reverse-slop-engine.exe

Path C:\Program Files\reverse-slop\engine\reverse-slop-engine.exe
Size 10.0MB
SHA256 460488f6fdbb4837834e4f91a9319e338e59aa376e72a605c897f6e90434a143
MD5 768fde7603cec1f143b2fc148f1d2373
SHA1 a126d2e7fbf0642b7dd180197f79ee348f368756
SHA512 936c03ca3deb1491cbc5de834dce8b8bcbdf29a3eb7d4474b77c695fd4270900a3c683d30361a34ac3f24e68cd81b99b20199b59e7aa6cafbe98a73ee55cd230
SSDEEP 98304:71barU9/P5qLTtfGeZhcWjMFXkRINafs7z+/CkCqgU00LuW4zg2thesRm9yLVkIC:RbarUxP5QTEUhcWQ3+ak100b4
TLSH
T1B5B68D26BB9441FAC47EC278CE9B4A0BF371B04503319BEB159466229F577E06F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

slop_mapper.exe

Path C:\Program Files\reverse-slop\engine\slop_mapper.exe
Size 301KB
SHA256 7bd1802b9cf5a711bf8df5a91af95e557b9b6eeba527278f8c05bf1a4a7fd674
MD5 228d1ce924e3a7e430f5329f76d747e7
SHA1 efb7acc7c4e96ab1c561d4f6ca53a0443f5a106c
SHA512 c5d04b0f04bfa7b8150dd0a30dff60ad3582d32810299849ed7ef2aeabbdffddad40a629dd279c4b51d80e5dd3b257134af4f058900ee67664645c98cb220ade
SSDEEP 6144:LdhXmBm3g9HiXu876BZFxhBvjQGp3jGv5tiO+38FPpIHS8ukY6njVZeUvCT:mouygZFxhBUYT2
TLSH
T1EF647B69B39811F9E8B7D2BCCC42D516E7B2B8560360DADF03A0465A3F236D09D3EB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

slopdrvr.sys

Path C:\Program Files\reverse-slop\engine\slopdrvr.sys
Size 751KB
SHA256 c742ce76597e02d988179e4d1fbb0843a10df5887df31ceb388e3f6dc6e4db1b
MD5 3de7b9da88969e1e11d91e2014059025
SHA1 5240deaebae3e536d31ab25beb60eee29ad2e0c9
SHA512 d74a2862b2eebadbd6eca69cd2f24a6ee236319ce554e18ae711a1a565a4071d01091ae8792a304db79e09598c9b8591edeef1ffbc6ec1d6cd913e12f63d3a3b
SSDEEP 12288:9ohcfnG/Zt/DoFeEYA3zFcmTFP1+3rDbDvZ7yGJIp0f7J5QDAAcgdqYAKexuyEGx:9oIWrqrFPYrvZ7340f7
TLSH
T18FF44A23F15181E7C56BC5B4C526A277EBF6740CE20865EBEF80C7293BA1710B23E695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reverse-slop-ui.exe

Path C:\Program Files\reverse-slop\reverse-slop-ui.exe
Size 7.8MB
SHA256 bdc1a5ee9c2c016756eb3fd3f823c92a2907624e1c0521f92b781c53360449c6
MD5 416173d3d2300a1cb1ede744a8be514a
SHA1 4fe7a7c6ee74fcbdd210113a589dfc10d7e30145
SHA512 e840dc5fcd17e56db9996ebc35b664c898bc63515571cfaa724e21a8035f6a3d8dc5998f800482756eed4c736a1a189725feaa4686e25af5d2ec7528c2baadde
SSDEEP 98304:+fVkALQ1q3Lgd0OpqI8QY737SqjszZrDbS5h0x3F33YK/S6eyt7BSJV:2VkAUq3jb3+qj6ZrDbrx3F3/HBt7BSJ
TLSH
T19586BE12F71151E8C46AC134835AA232F6B1788A4B343AEF5BE44B253F65FE06B3D719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mcp_config.json.tmp

Path C:\Users\Admin\.codeium\windsurf\mcp_config.json.tmp
Size 100B
SHA256 7089729b64d472441ab2190929ce5b124fb51d9b3b96b3a6d60581a3ea411dd0
MD5 559ac721387d3cc6a28c021a0b9c226b
SHA1 f1b21be38b000819962525eb558572f4f14ead60
SHA512 38e4cb5894b633d6a476badccce301886ab1211a38cdf58b843a0a3e365211347c8ede45ae1bb89a9210cc4b7a02174028c3819899c5c3400aa118d363e3d3e2
TLSH
T1D4B01268841D3EB300FB37F0D0B20101F752841300102405BA44400C0F36C992148F48
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw7920.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsw7920.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw7920.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw7920.tmp\nsis_tauri_utils.dll
Size 29KB
SHA256 5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266
MD5 c5bd51b72a0de24a183585da36a160c7
SHA1 f99a50209a345185a84d34d0e5f66d04c75ff52f
SHA512 1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc
SSDEEP 768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/
TLSH
T139D23818FDC83EBAD6DF1172281C4A6E559FC8080754CEABD3B15E62D4A63722EE510F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

075984b5-d969-42d5-aa7c-7b9c783dbae4.tmp

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\075984b5-d969-42d5-aa7c-7b9c783dbae4.tmp
Size 15KB
SHA256 9674bc98c3b51a8e92d352d7e6b8cf9ab6c14dabf080defdd3d58f94bfcf7b66
MD5 3302823582d0a3c29183f89b410b8e43
SHA1 69a1ac723ffcaec4c977cc5ae62ac72ae152ceeb
SHA512 96f83fb552950fb44032804b776f03bdba34b30eb3bd81b54756bfc43142c9cb12e68b12630f6667ae52c1e7876cdb5f9f4d97d58e82313d3dd2aad2f8b7e261
SSDEEP 384:++aQikB+z/xvxjg/qhEwNBS2pYUtXBTKPk9zXS:J/UxvxjgC+6XTKsFXS
TLSH
T19C729F2B58747F2385B7F604B9991B5BCFB89472A0C26EB44AAD4F0D07C73D80342D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f7bc6b2-b71a-4b7f-a9ee-07f417d85d92.tmp

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\0f7bc6b2-b71a-4b7f-a9ee-07f417d85d92.tmp
Size 3KB
SHA256 a39c405c9ebd4fe0d80644599b4a562f926c2031101f1e97ae0eeb322a2fbd14
MD5 15bf159c77e54002419f21b3cf878539
SHA1 67d65717d0212c4c5120a9730398337963ff3cd2
SHA512 71029c54659aa1ce2f2c76a91ebee42cdfe12b2a53fbd79758ba9b25b34a998d7206965dee16a3961244b1b94cce80be464538be8960fba8da647a86ab15467f
TLSH
T1C16166769970AA378DA29A04B9C63B12E7A55133E5C17F95D5EC0F1C02DB3DD1382C2B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 590a10200410dbce73d60e78066ecefec7ddcccefc7aedc0a278cde7307dd86d
MD5 f6689faaa46e7ba1a292e642ad5b83ab
SHA1 16168e9ed2e9ebb7764fa5f738184c947a14a57a
SHA512 1bbb68600b6bccd83dc2bc12f630717ff6c6f3744adaa08a7d9d6b9be1c338c4199abbbf633902c4b6f3108f32d219d482acfc31ab46fb4a0f9d3fc8b92c2735
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dcc6659b0bdf9a95c332a98695896a3616f68b297f2979175d5b2e8230320776
MD5 aac2de43e87c249f56d05f40479fe72e
SHA1 645cf6e27b5c5866e6c04bfb50a5cf1511d44dad
SHA512 42a2d6989d8a94190c3ec6190a88017acc7ab8fee0b1c847017b2c172eee312c5073edbc98ee23fbbbb64cfab10a8a78a8e9cab8e7430106585a36c673b4dd07
TLSH
T1D9D0122372024138C0103037011362480601C11F400E80409429DA1DDF140502D0B485
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

51b0c07d-c441-4359-93ac-1e138a1ea5e2.tmp

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\Default\51b0c07d-c441-4359-93ac-1e138a1ea5e2.tmp
Size 6KB
SHA256 758e1db658852a0e064d841cf10b1bec0cfca17d06ab0baea2558ee827d6dd9b
MD5 2cd5562d41efbf42d56cac8658579cf4
SHA1 d29502911038075c52e1a0ddb37eef8d47e01f1f
SHA512 aad70cfea2727c903dbbb1b29b87714aa7128d06cbacab80042f3b69bb7c60a92ad9f662bcbdf86ac2a0e2c7f80d4f98e7ca3feb1d0aa03661d79ed1a7549a15
SSDEEP 96:st07/d8lO4b9jkso5h16Z0ps7/x+6MhmuecJQnj0je/K+g9W28XM1C7K:st0D6JJonpsV+FdQn4jJ3WG6K
TLSH
T136D1A6015E24797B8CC6F109BAB9BB07E2F9617270D51E58EBF8462C08DB6CD631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 113711610468a0eb385766b8eb9e85255d4f3dcbef182e90bd8f87de21a3a355
MD5 0a32f367621d97228a0e2aa75cf44dd1
SHA1 740bdf394186d6c924d4a04a407ca8e3dfb21fb4
SHA512 35de7628644dd303f7c3a3b559d267911f039f089a17b6fc107efef7986c4628ef75bfe51d495921962f7a5ca3fd0953796fb54152a1dce5754bd17dbc705b66
TLSH
T1E5A0021492505652C624537374C52975B2747F350B975686909510B4CAF4394DE52000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 93b7e128a3cd71b9fcd3418d6565ebb8a15da8af49f5c29769bdc3c939e5a779
MD5 123e4e7e80c2c5713a82e36676194ed7
SHA1 3f10222eb7e91b719f76053a9a10f4bd3cf0ef4b
SHA512 172af2f35cb76b311dd5ff813819bbc4c38c3e23c3361e043ede1d4384b17b1a7a96f222ece2d1458ed04c3a41fc421ba311c6bcf8ba4408c3e8fc7622c419aa
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\Local State
Size 1KB
SHA256 c126908d601ae6864eea85b2b082fd40a2468ce14cd4f23709e22ab913b448c9
MD5 6d5c8375435c4ff984be7476ea389ba6
SHA1 b572763aaba3b25c2217458d1a6fdc062f20d302
SHA512 0092d55e75bce4859e2752fe146274b4eef57bf72e4c1ccc32a7cf9ed975036c0937e7138d65adbe3fe005b3ac87bddb719eeefd96953aa6502670e03c3c88ab
TLSH
T19F2120B2D8A05B32DC52764522E63A679F311063D2818E4461EE871C03DB2CFD29693B
MD5 SHA1 SHA512 TLSH

Submit Download

a46f94f4-66d3-4c31-8e34-773d0c1beb6a.tmp

Path C:\Users\Admin\AppData\Local\dev.reverse-slop.ui\EBWebView\a46f94f4-66d3-4c31-8e34-773d0c1beb6a.tmp
Size 2KB
SHA256 3160034d97cd32cd0d29b8f90df57101c03007b224e212956d1dc747ae315eee
MD5 cee05982bb8274722f77c6dac3c4fa6a
SHA1 cf7fb1568fd21493c36b1a773ae2f9884accafef
SHA512 f803c90360b27f7386ead86e5ce05911d75f2520df3f0ff3a9af89c91b6660e2f48d762aed84644b72251ff368504ca41120996af5595496818c95830544f51d
TLSH
T12C515673AC10AB37C9A2560479DA3F23DB755162E6826F5096ED071C02DB29E5342C7B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1180-276-0x000001F8203C0000-0x000001F820496000-memory.dmp

Download

memory/1180-181-0x00007FFEAC2D0000-0x00007FFEAC2D1000-memory.dmp

Download

memory/2120-269-0x0000023D4BC60000-0x0000023D4BD36000-memory.dmp

Download

memory/2120-89-0x00007FFEAC2D0000-0x00007FFEAC2D1000-memory.dmp

Download