Threat Database Hacktool Hacktool.RobloxHack.WDA

Hacktool.RobloxHack.WDA

By CagedTech in Hacktool

Analysis Report

General information

Family Name: Hacktool.RobloxHack.WDA
Signature status: No Signature

Known Samples

MD5: 4c3adbe7b800d422053e4e55f76b6072
SHA1: b2a5a64ba849e168c39b99d443ac93fda32dadb2
SHA256: B5BCBD7F2DF1C2B04D90BA25040539DBB2062C7C673FD38CF48BB1DD3CA26343
File Size: 1.49 MB, 1488896 bytes
MD5: 432244a756743c63621e307b1a7162e7
SHA1: 2087086389c122930d0251f714155e56dd1f1e16
SHA256: 2281F80B1E9CA0395185F95CA4A6534C5805AB06FD3DCCA37A991CC02134693A
File Size: 418.82 KB, 418816 bytes
MD5: a287b560a41eed9f5f690360018a4c23
SHA1: 5f85a89a9a6e4a9507092a9df1e162ddff9d1f55
SHA256: B06DF9E2BC40AE51D1A2BE9FC736B8F97D861970E373BD838D05B6A750C8A4C3
File Size: 389.83 KB, 389832 bytes
MD5: 9b21a7ae1216720590bfc8fcca8b1dce
SHA1: 8638774f03281df46f43998682c54c3dedda0382
SHA256: 7BDAE89DEE37117E732704680E9C4EEBD5D3C201011266E9A527DB22D2F97953
File Size: 373.25 KB, 373248 bytes
MD5: 9dc6a159f18923336f3e39e8c844e2f1
SHA1: 7493738c2519016e750878d6c91021f684cc5acf
SHA256: 203AE46DA44E96060B4497A6D552FD1F63E6CCA933988130A17CD9B0B81245E3
File Size: 5.06 MB, 5062656 bytes
Show More
MD5: e1ee14d62177f2a16171ad8818230132
SHA1: 558b09ceb3c4a0bacfb2f54fccef240b8daf17bd
SHA256: F105292FDDA926BB2E8C8F411865076C36A45E31C13029A9B50C3D7C7DCEF283
File Size: 1.76 MB, 1758720 bytes
MD5: 9b8c591e1211fc94c3726bae0e0ed874
SHA1: 1719abfe329bc64f98e3e4b02e1dd4d073627e81
SHA256: EF08BFDA0A6B34137A9B09DD71871CAF343E03C67B02B4ABF155744C026E9318
File Size: 4.02 MB, 4024320 bytes
MD5: bb08dfbb6db42272ca779577ced5931e
SHA1: 4584a30d021dc989aa11ae481fe6f3a1b5a27505
SHA256: 9AAE190A785D739604606999DBBBA2AA35C0690F7EA2F1ECB18A6F186B2AD899
File Size: 509.44 KB, 509440 bytes
MD5: 09b59d9caeaac8ee09e6523609de874a
SHA1: c6f9e554f7e56ea20c74e119d030fa00346ff46b
SHA256: A993D0174C54E075BF0CA684B62D9B457C838901F149646EAE0ADE9B6BFC495F
File Size: 3.67 MB, 3665408 bytes
MD5: 028a74ecc2eaafd0d6c538da62613d2f
SHA1: f85ad87d90981eb88ea1bb354fd541019231c73b
SHA256: D1CA3B4587F7AE31FADA6FFE4E60FECCF456E527FC6700A3B76DB146DA9FC1FB
File Size: 6.13 MB, 6129336 bytes
MD5: 6c591bdaffb1e9cdb5f298f1b3672a4c
SHA1: 19506b9058df2b107a0c54265a79e4da1024ba5e
SHA256: E03E13E6FCF2E5B30E77C627F90DBAAA7FB864CCA3729E36C92C9FB61E1ED444
File Size: 2.61 MB, 2606109 bytes
MD5: 1ecc64387b42ae881952e4f903f0ee28
SHA1: e587facf61a8849db1833d4b0a9819083ca04f79
SHA256: 5D9971C03D0F301D4DA0DF8130E67ED6CBD7C35A9E2DF424251E9178880A8D2D
File Size: 4.16 MB, 4159722 bytes
MD5: 019dd0bbacd463a5cab938b68dc9fee4
SHA1: 30231618968ff8cf3206c6b557c0acbb49f0b51d
SHA256: B2DB98D8825ABEC186A10A7326D11BA44409D90156AB2101588F2FB9616BEDAF
File Size: 1.51 MB, 1513984 bytes
MD5: d011d7bcda1146d44cffa705b32a84aa
SHA1: fa19e7831109988738e465123ae5f7cc3f6fb4ba
SHA256: E6DFB9CD3CEE2E5C570C21432C0FB5BED618A3E2B3D4EA1CB2DD44ADB84BF459
File Size: 187.90 KB, 187904 bytes
MD5: c2d3fb1104c57cc5d9dc5f3b80f5063c
SHA1: a456e9b67c6f6d4d9ab9ebe7a8b043604226dc83
SHA256: 5C41132E5F4A09DBEA04E354F05E1871BEBBFD7815B1F2C44E0BE5C2FC2879B0
File Size: 941.77 KB, 941768 bytes
MD5: 55b04998be8049d5dc6384bbd35cacae
SHA1: bf0a9619810bbf4a66b85038d39639705b2abf5d
SHA256: 4657B3CBC84718426A3DCB6115D1D351A95182115C0C104B2F9A35B945281217
File Size: 131.58 KB, 131584 bytes
MD5: 29b675a2d0764615532e98f3ab44c916
SHA1: 9978cf526d571e015e2ed154fab534f2d3c70490
SHA256: 50A8AB2B6F901F314C712589E709AA6F84E49CBADFE0402B3B4C56F06F07FD32
File Size: 1.90 MB, 1902080 bytes
MD5: 8b80c64e2853a8b5516531148dfeb4bc
SHA1: 069ed7c2b7e5852798c36c11bfd23ceb07672684
SHA256: 6A42262974F0E086C1F2DEFAFF4CCD9FB25046CF193422135E2DDA5B4B29B2A2
File Size: 9.94 MB, 9943040 bytes
MD5: bb8c6139dc30ce869b68f30b18a4e629
SHA1: adcb37cbf4ee8dc2b7600ec560e8dfc1c39110d6
SHA256: DE0F71D193A2FC452192BF57BB4FB1F14C6E3E98C97E4F343D3B1D89997B5B17
File Size: 2.65 MB, 2653696 bytes
MD5: a9c9367d56457f10b73ee1f4678f1a44
SHA1: 2edbba40cb63a5da42939f612f667bc107c1b4aa
SHA256: 28A186C9C7E2EB1E74B789037D269289F6F0D06EE1B801DA8905BD1D1523F07F
File Size: 244.74 KB, 244736 bytes
MD5: 6d0071858f5832162e6f30217c0af9e2
SHA1: 09353d05ba615caa18c56de0a051c483ca002378
SHA256: 589A01B51B3C35830C5D22181F6AB0285894CE7BE9848880F774EAB45209938D
File Size: 1.50 MB, 1495552 bytes
MD5: 248c470911c5016a967966bcbabacd89
SHA1: 9fdb7b142030e1ceaffa698a76cf0ea71235e55d
SHA256: 7DF10562C24DABB04A83790A44840E1949491E918DC506D4FF43086D9F753B12
File Size: 2.38 MB, 2378748 bytes
MD5: 2fc40fdc72a9b34bf76e27849c86e3e5
SHA1: a8902eaf2e6cadc512e85528495c615dd4cf7748
SHA256: 54DD417426A20FE81789BC33CEE38C03EF53BB0D6DE043DAD5282E3D0EA2BF53
File Size: 1.90 MB, 1902080 bytes
MD5: 5ce79f6d510e53a845f42302683fb87a
SHA1: 96f0c7aa3c9ed8b24c15315cc951a7f30a08fa3d
SHA256: CD4070DD7245EDCDFB466A066627CA5A29394062D5FA2B3E46F2B9A3F43B03D7
File Size: 2.11 MB, 2107904 bytes
MD5: 30a1f07187e4b31dfaabd2cdd56d8acf
SHA1: 33b29d6e317024ba2a02a062f39e8b2afdae3c8e
SHA256: EF8B1E30B32B0E579A262CAAB827493DA4C3D1364C3C28169D94D2C123D14124
File Size: 205.31 KB, 205312 bytes
MD5: 6cb7fb32ad159656b24458a30809c393
SHA1: 489e04e1d4efe89971bdeab1aeda87783a313732
SHA256: 4448157ABDD68A4C928F6E6A33E65689D55CAA6787699C4FF7EF09744D75026D
File Size: 373.25 KB, 373248 bytes
MD5: db9bfee8359e7d936689e0cf662dd0aa
SHA1: b0c945730ca3c05db81ca3864115146a6db54724
SHA256: 7C7E331A0ED315EDE767624B8FC0FCCCF143053583E6BF0E76078F2E545DB22D
File Size: 384.51 KB, 384512 bytes
MD5: efd01ee5dc4cc227cbc42800c651a843
SHA1: 8fdde38d1389d36271f2158c5c0e3ac322f64cd4
SHA256: 316EC3375FC7C9D0CEB5564FA2A6BE57CAFD77F3ED267153002C02774C66F734
File Size: 1.11 MB, 1113600 bytes
MD5: df307d0e141fbba3e069b79215cf1102
SHA1: 5b5a2a478dfa3fa129a207e09191f4e7f2104a77
SHA256: CB3295D3EF77A2EDE45B1C4793539355664C5693B0922486CD382186AE31C2BB
File Size: 3.67 MB, 3671552 bytes
MD5: 537726d843a8dc087b1f75d80ea01cca
SHA1: bc2482f9dd1b7daee7925cd2bf1c631f6fd44bd6
SHA256: DE140F574E495BA37ECC19A2C27ABB28939410B39D9794E8680A172A2F5937A6
File Size: 972.29 KB, 972288 bytes
MD5: 54f00266ce900596add7225c775ef1c3
SHA1: de8fe40d4ea3a2ef1848a164cd928591d4c1b0cf
SHA256: 3B983E43065539CAA7122B3FE3267EC722A0BD7230AB2791184017F99DB24B6B
File Size: 175.10 KB, 175104 bytes
MD5: afcc95e7da1813fa8e9592f046a9886c
SHA1: 1c80c6afcd19996e5cc2e508eb04952fbce97e52
SHA256: 705A225A62D407419CD5F20998867F5365297A322EE805251112F6D9935327DB
File Size: 292.35 KB, 292352 bytes
MD5: 23014851982ac848f01170b361b7bd99
SHA1: f5292299ea880fa852f501f39dcb113b718dcb8e
SHA256: E0530B0EACB5DD6E48677C822D9184A4CAFE1EF0C45B3A1874800C5E0F855D0D
File Size: 7.09 MB, 7090792 bytes
MD5: 7f11cd103f1546ac973117917eaf1545
SHA1: 88d56b356f54afbaf4ebe554128200cb92e262eb
SHA256: B21F3881DE1C7A56145C0D59CB38AB76DD35875242DF7E6E9CD8024DB4676AC9
File Size: 276.48 KB, 276480 bytes
MD5: 2bc854c5f5448482df75991e5d383136
SHA1: 34ec67875082893aaf9d964a8fa76c98f1e56f1e
SHA256: 2DF0E1AA18A20290AECDD09D1C25D44EE07518116BB8D169011BCAB8DAD9BF2A
File Size: 333.31 KB, 333312 bytes
MD5: 3cc99fd19e2fd64e27e697d7f6a0fa8d
SHA1: f44324ddf45b2428ac962c52bc7c6688bcb923f9
SHA256: 97D391A216C7A39A28F94827D1134B117788E4D27C7E71AE530BF6A25621B6ED
File Size: 391.68 KB, 391680 bytes
MD5: 785be65f4760f27a2b6f057aee50f8a4
SHA1: 053311cc462e07bee243b6ce1fb6d6819bd29d29
SHA256: 6E5A0658EF0392BD0C0132D8514F8801E0131F137C37AF56B986A6E587334386
File Size: 2.61 MB, 2607095 bytes
MD5: 73b5a40138741c129ff46364b2a5a792
SHA1: dda283ece0802819a24dae0033ff385c31c301c8
SHA256: BB31E33BB0CE7B769CFC292256E85E629BC87955BAA8ACC120F26C94DBA6BF79
File Size: 393.63 KB, 393632 bytes
MD5: 67fee333eca6bbd3c22a0785d05d4055
SHA1: cb199be7444ac52208430972b83bb216af7fbe97
SHA256: 7C9ECA13D5F189DEFC0BCC8C65FB2FB068D6953B26B5A24EE30052C864ED12E1
File Size: 128.51 KB, 128512 bytes
MD5: 8bae590ad31b5bc60a63eca68033c94d
SHA1: f32d328982c1d873afdaa6dcf3098924d571e4fa
SHA256: B81A0A14DCA39788665562DCA80FAFA45298439EDDEC17EC3042CD10E6F7C655
File Size: 600.06 KB, 600064 bytes
MD5: ea2291d33cfff27c00b77b5e6fec84ad
SHA1: 7bd3a4472dfe7e64d97726c7e134ed9671510a5e
SHA256: 08930FBBC2D880B1B96E6B99373E572AB65A4559CE9363721CE4F6828E61AED8
File Size: 695.30 KB, 695296 bytes
MD5: 8d4928ada3aefc22abff2bb9ed753901
SHA1: d6a40c750bd1216095355ac81b806e752e6434d0
SHA256: AB2D2564567FEE6FC4F18B4BC19679BC3B7078F37AFFAE4509C015D4C6A669B8
File Size: 509.44 KB, 509440 bytes
MD5: a2523bdd188bcfc68f5af61b2f2206ec
SHA1: 25e6c78aaa9872b0ea5258eb864c9a697cc1ee19
SHA256: B4F6DBA10B6EF6A91A6305B8337CEF8FBAC0CB3374E6B6346C8BBB748C37F5CE
File Size: 1.51 MB, 1513984 bytes
MD5: d8a002f4a7edccda02bd8fb88b271a6f
SHA1: 608785ee8f99adce541d320dbe851848881346cc
SHA256: 008FE745D63C8EEA95976BE6714C00FB42A3625ABCB23A87E7A7B33B142D6A4B
File Size: 4.05 MB, 4050944 bytes
MD5: ebbdccafc417a9186ec984d997aa038d
SHA1: 9dd34073cba0968a437837a4977f7a4724a75dd8
SHA256: 777954FB2AB024505C1672757CF07CA42D29C81BC85F6C16B2DC358B19BA8B08
File Size: 28.16 KB, 28160 bytes
MD5: 3f043294e3bdc8f8e8714983beb3696a
SHA1: 3ed4cc6a026aa2a2f5739ae85234a7dc14bc7ff2
SHA256: 229339ED78DCEF722199842BA1CA2DC75FE0E0F7678B1A328DDE4ABDD0475549
File Size: 456.70 KB, 456704 bytes
MD5: 762b8ebc72d3d1d46e25e933fbf9d30d
SHA1: bbd600d3b2d74b552698b3bbee9ad4d3ec49851d
SHA256: 7481CBCA6F20C9CFE1B577AF490E5FD9B033215EDC82E4474FFA6A69AFF5D150
File Size: 595.97 KB, 595968 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have resources
  • File doesn't have security information
  • File has exports table
  • File has TLS information
  • File is 32-bit executable
  • File is 64-bit executable
Show More
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name Value
Assembly Version 1.0.4.0
Comments This installation was built with Inno Setup.
Company Name
  • AntoniX35
  • appcontainer
  • HHD Software Ltd.
  • MultiCommander
  • The curl library, https://curl.se/
  • Tien Do Nam
  • WinTools Software Engineering, Ltd.
File Description
  • appcontainer
  • arcdps
  • Data Annotations component
  • Hex Editor Neo Shell Extension Library
  • HHD Software Hex Editor Neo
  • HighFPSPhysicsFix
  • libcurl Shared Library
  • LocalSend
  • MultiCommander Administrator Mode Helper Process
  • SKSE plugin that fixes stuck inputs after window loss & focus plus some other fixes
Show More
  • utcsvc
  • WeatherDesk
  • WinTools.net Premium
  • WinTools.net Professional
  • WinTools.one Home
  • ZCOM Mod Manager
File Version
  • 26.8.1
  • 8.21.00.9493
  • 8.11.1-DEV
  • 3.0.9
  • 1.2026.816.1149
  • 1.18.2+64
  • 1.3.3.0
  • 1.2.0.0
  • 1.0.4.0
  • 1.0.0.1
Show More
  • 1.0.0.0
  • 0.8.20
  • 0.3.0
Internal Name
  • AltTabFix
  • annotations.dll
  • appcontainer.dll
  • HaBCR
  • hexframe.exe
  • hhdhexneo.dll
  • HighFPSPhysicsFix
  • libcurl
  • localsend_app
  • MCAdmin.exe
Show More
  • utcsvc.exe
Legal Copyright
  • Copyright (C) 2022-2026 Tien Do Nam
  • Copyright (C) 2023
  • Copyright (C) 2026
  • Copyright (C) Daniel Stenberg, <daniel@haxx.se>.
  • Copyright © 2026 Victor Hugo (arctco)
  • GPL-3.0
  • MIT License
  • © 2001 - 2026 by HHD Software Ltd. All rights reserved.
Legal Trademarks MIT License
License https://curl.se/docs/copyright.html
Original Filename
  • annotations.dll
  • appcontainer.dll
  • hexframe.exe
  • hhdhexneo.dll
  • libcurl.dll
  • localsend_app.exe
  • MCAdmin.exe
  • utcsvc.exe
Product Name
  • AltTabFix
  • appcontainer
  • HaBCR
  • Hex Editor Neo
  • HighFPSPhysicsFix
  • LocalSend
  • Multi Commander
  • The curl library
  • WeatherDesk
  • WinTools.net Premium
Show More
  • WinTools.net Professional
  • WinTools.one Home
  • ZCOM Mod Manager
Product Version
  • 26.8.1
  • 15.0.0.0
  • 8.21.00.9493
  • 8.11.1-DEV
  • 3.0.9
  • 1.2026.816.1149
  • 1.18.2+64
  • 1.3.3.0
  • 1.0.4+941f9944da5207958882b2c4379fe559c65d55f7
  • 1.0.0.1
Show More
  • 1.0.0.0
  • 0.8.20
  • 0.3.0

Digital Signatures

Signer Root Status
Ashampoo GmbH & Co. KG GlobalSign Code Signing Root R45 Root Not Trusted
MIKOM INC SSL.com EV Code Signing Intermediate CA ECC R2 Self Signed

File Traits

  • dll
  • fptable
  • GetConsoleWindow
  • HighEntropy
  • imgui
  • No Version Info
  • ntdll
  • VirtualAllocExNuma
  • VirtualQueryEx
  • WriteProcessMemory
Show More
  • x64

Block Information

Total Blocks: 2,485
Potentially Malicious Blocks: 18
Whitelisted Blocks: 1,957
Unknown Blocks: 510

Visual Map

0 0 1 0 0 ? 0 0 0 0 0 0 0 0 1 ? ? 0 0 0 0 0 0 ? ? 0 0 0 1 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 1 0 0 0 1 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 1 0 ? 0 0 0 0 0 ? 0 0 ? ? 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 1 ? 0 0 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? ? 0 0 0 0 0 ? 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 ? 0 0 0 0 0 0 0 ? 0 0 0 ? ? 0 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 ? ? ? 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 ? 0 0 0 0 1 0 ? 0 0 0 0 0 0 0 0 0 0 0 1 0 0 ? 0 ? 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? 0 ? 0 0 0 0 0 ? ? ? ? 0 0 0 0 ? 0 0 ? 0 0 0 ? ? ? ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 ? x ? 0 0 0 ? x ? ? 0 ? ? 0 ? ? ? 0 0 ? 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 ? ? 0 ? ? 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 ? ? 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 ? ? ? ? 0 0 ? 0 0 0 ? ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 ? 0 0 1 0 0 0 0 0 0 0 1 ? ? 0 0 0 0 ? ? ? 1 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 1 0 0 ? 0 0 0 ? 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? ? 0 0 ? 0 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? ? ? ? ? 0 0 ? 0 0 0 0 0 ? ? ? ? ? ? 0 0 0 ? ? ? 0 0 0 0 0 0 0 ? 0 0 ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 1 ? ? ? 0 ? ? 0 0 ? 0 0 0 1 ? ? ? ? ? ? ? 0 ? ? 0 0 0 0 0 0 0 ? ? 0 ? 0 0 0 ? ? 0 ? 0 0 0 ? 0 ? ? 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 ? ? 0 ? 0 ? 0 ? 0 0 ? 0 ? 0 0 ? ? 0 ? ? 0 0 0 ? ? 0 ? 0 0 ? 0 0 0 0 0 0 0 0 ? 0 0 x ? 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 ? 0 ? 0 0 0 0 ? 0 0 ? ? ? ? 0 0 0 0 0 ? 0 0 0 0 ? 0 0 0 ? ? 0 ? ? 0 1 0 0 ? ? ? 0 ? 0 0 0 ? ? ? 0 ? ? 0 0 0 1 0 ? ? 0 0 ? 0 0 0 0 0 ? ? ? 0 x x x x ? 0 ? 0 0 ? ? ? 0 0 x 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? 0 ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 ? ? 0 ? ? 0 ? ? ? ? 0 0 ? ? 0 0 0 0 ? 0 1 0 0 ? ? ? ? ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 ? ? 0 0 0 ? 0 0 ? 0 0 0 0 0 ? 0 ? 0 ? ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 ? ? ? ? 0 0 0 ? 0 0 0 0 0 0 ? 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 1 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 1 0 0 ? 0 0 0 0 x 0 0 0 0 ? 0 1 0 0 ? 0 1 0 0 0 ? ? ? 0 ? 0 ? 0 ? 0 0 0 0 ? ? 0 0 ? ? 0 0 0 0 ? 0 0 0 0 ? ? ? 0 0 ? ? 0 0 0 0 ? 0 0 0 ? 0 ? 0 0 0 0 0 ? ? ? 0 0 0 ? 0 ? 0 ? 0 0 0 ? ? 0 0 ? ? 0 0 1 0 0 ? 0 0 ? 0 0 0 ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 ? 1 0 0 ? 0 0 0 ? 0 ? ? 0 0 0 ? ? 0 ? 0 0 ? ? 0 ? 0 0 0 0 0 ? ? 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? ? 0 0 ? ? ? 0 0 0 0 0 0 ? 0 ? ? 0 ? 0 0 0 1 ? ? ? 0 0 0 ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 1 ? ? ? 0 0 0 0 0 0 1 0 0 ? 0 ? ? 0 0 ? 0 0 0 0 0 0 0 0 ? 0 0 1 0 0 0 0 ? 0 ? ? 0 ? 0 0 ? ? 0 ? 0 ? ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 x 0 0 ? ? 0 ? 0 0 0 ? 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 0 0 x 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? 0 ? 0 ? 0 0 0 ? 0 ? ? ? 0 ? 0 ? ? ? 0 0 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 ? ? 0 0 0 ? 0 ? 0 ? ? 0 ? 0 0 ? ? ? 0 0 ? 0 0 0 0 0 0 ? 0 ? 0 x 0 ? 0 0 0 0 0 0 0 0 ? 0
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Agent.GTS
  • Agent.MIFH
  • Agent.MUFB
  • Agent.PTA
  • Dropper.X
Show More
  • Filecoder.XSA
  • GameTool.GH
  • Kryptik.YKBB
  • SnakeLogger.C
  • Trojan.Agent.Gen.EYR
  • Trojan.Downloader.Gen.AGW
  • Trojan.Kryptik.Gen.IHA
  • Trojan.Kryptik.Gen.IIG
  • Trojan.Kryptik.Gen.IJB
  • Trojan.Kryptik.Gen.IJL
  • Trojan.Kryptik.Gen.ILS

Files Modified

File Attributes
\device\namedpipe\gmdasllogger Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-0254m.tmp\9fdb7b142030e1ceaffa698a76cf0ea71235e55d_0002378748.tmp Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-51tfv.tmp\053311cc462e07bee243b6ce1fb6d6819bd29d29_0002607095.tmp Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-f9g9v.tmp\_isetup\_setup64.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-kumhn.tmp\19506b9058df2b107a0c54265a79e4da1024ba5e_0002606109.tmp Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-o27ks.tmp\_isetup\_setup64.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-vkhj7.tmp\_isetup\_setup64.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsf633a.tmp\modern-wizard.bmp Generic Write,Read Attributes
Show More
c:\users\user\appdata\local\temp\nsf633a.tmp\modern-wizard.bmp Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsf633a.tmp\nsdialogs.dll Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsf633a.tmp\system.dll Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsn305f.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsp628d.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nst31b8.tmp\modern-wizard.bmp Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nst31b8.tmp\modern-wizard.bmp Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nst31b8.tmp\nsdialogs.dll Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nst31b8.tmp\system.dll Generic Write,Read Attributes

Registry Modifications

Key::Value Data API Name
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 �n% �v����Bx(�1`1�1HO@V�A��H[uN$b"hk`k�qw�n{b��P���!���� ���3�������������m�Ù��V����$�8წ���l��&M�~�=�SB1_T�Vw���%���������AE��D��&��$���LA*�"C�� RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 �n5 �vT�����Bx#��&� (�(X�1`1�1HO@V�A��H[uH�pN$b"hk`k�ql(�tǤw�n{b��P���!�����7� ���3��������������.���m�Ù�ƾB�IV�gi�V����$�Ac�8წ���Κ�l���j�&MA�~�=�SB1 RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 �n- �v����Bx&� (�1`1�1HO@V�A��H[uN$b"hk`k�ql(�tǤw�n{b��P���!�����7� ���3�������������m�Ù��'N�IV�V����$�8წ���Κ�l��&M���~�=�SB1_T�Vw�`�V��%���������AE�z RegNtPreCreateKey

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAddAtomEx
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcConnectPort
  • ntdll.dll!NtAlpcConnectPortEx
  • ntdll.dll!NtAlpcCreateResourceReserve
  • ntdll.dll!NtAlpcCreateSecurityContext
  • ntdll.dll!NtAlpcQueryInformation
  • ntdll.dll!NtAlpcQueryInformationMessage
  • ntdll.dll!NtAlpcSendWaitReceivePort
Show More
  • ntdll.dll!NtAlpcSetInformation
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateIoCompletion
  • ntdll.dll!NtCreateKey
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtCreateTimer2
  • ntdll.dll!NtCreateWaitCompletionPacket
  • ntdll.dll!NtCreateWorkerFactory
  • ntdll.dll!NtDeleteValueKey
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtGetCompleteWnfStateSubscription
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtNotifyChangeKey
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationJobObject
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryTimerResolution
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReadVirtualMemory
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationObject
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetTimer2
  • ntdll.dll!NtSetTimerResolution
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtTraceEvent
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • UNKNOWN
User Data Access
  • GetComputerNameEx
  • GetUserName
  • GetUserObjectInformation
Network Winhttp
  • WinHttpConnect
  • WinHttpOpen
  • WinHttpOpenRequest
  • WinHttpReadData
  • WinHttpReceiveResponse
  • WinHttpSendRequest
Network Info Queried
  • GetAdaptersInfo
Anti Debug
  • CheckRemoteDebuggerPresent
  • IsDebuggerPresent
  • OutputDebugString
Network Wininet
  • HttpOpenRequest
  • HttpSendRequest
  • InternetConnect
  • InternetOpen
  • InternetReadFile
  • InternetSetOption
Keyboard Access
  • GetAsyncKeyState
  • GetKeyState
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Service Control
  • ControlService
  • OpenSCManager
  • OpenService

Shell Command Execution

"C:\Users\Zyuutuvx\AppData\Local\Temp\is-KUMHN.tmp\19506b9058df2b107a0c54265a79e4da1024ba5e_0002606109.tmp" /SL5="$160196,2164709,131584,c:\users\user\downloads\19506b9058df2b107a0c54265a79e4da1024ba5e_0002606109"
"C:\Users\Nubhhqjr\AppData\Local\Temp\is-0254M.tmp\9fdb7b142030e1ceaffa698a76cf0ea71235e55d_0002378748.tmp" /SL5="$1F001E,1939940,131584,c:\users\user\downloads\9fdb7b142030e1ceaffa698a76cf0ea71235e55d_0002378748"
"C:\Users\Tdusnrbw\AppData\Local\Temp\is-51TFV.tmp\053311cc462e07bee243b6ce1fb6d6819bd29d29_0002607095.tmp" /SL5="$F028E,2165696,131584,c:\users\user\downloads\053311cc462e07bee243b6ce1fb6d6819bd29d29_0002607095"