07ee3127344b4c6cc78cb649a48d1bf6c66d87965fe74b9c70362aaa483dbf15

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe
Size 1.8MB
Sample260528-bak78act7p
SHA256 07ee3127344b4c6cc78cb649a48d1bf6c66d87965fe74b9c70362aaa483dbf15
MD5 d03e0d26379efe9f2f435c08e62637fa
SHA1 ad7a0fe0c0cf718018bbb8df31653bb339e23b2e
SHA512 ff30e27114ad436722d0f64a5cae8a09f29c457121fa9eff9af169dd44e1f7dbed0ed30e9fbb0f928779c92791fb15c1b74374b3c52c656540b0dcaf71d23862
SSDEEP 49152:OfTGsESpclZT2Yg8UbzIqMWtzRnNmMgIU6iY:Ofpoybz/fJ5+Y
TLSH
T1E3957E03F6A580E8C19DC078C7579A33BA36B88D063576EF2BD45A512E2AFD06F2C715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	javaw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	javaw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	jcef_helper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	jcef_helper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	jcef_helper.exe

Deletes itself 1 IoCs

pid	Process
3880	2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe

Executes dropped EXE 10 IoCs

pid	Process
3880	2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe
4556	javaw.exe
1744	javaw.exe
5072	jcef_helper.exe
2228	jcef_helper.exe
2096	jcef_helper.exe
3776	jcef_helper.exe
3572	jcef_helper.exe
3716	jcef_helper.exe
4724	jcef_helper.exe

Loads dropped DLL 63 IoCs

pid	Process
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe
1744	javaw.exe
1744	javaw.exe
1744	javaw.exe
1744	javaw.exe
1744	javaw.exe
4556	javaw.exe
4556	javaw.exe
1744	javaw.exe
1744	javaw.exe
1744	javaw.exe
4556	javaw.exe
1744	javaw.exe
1744	javaw.exe
4556	javaw.exe
1744	javaw.exe
1744	javaw.exe
5072	jcef_helper.exe
5072	jcef_helper.exe
5072	jcef_helper.exe
5072	jcef_helper.exe
5072	jcef_helper.exe
5072	jcef_helper.exe
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe
1744	javaw.exe
1744	javaw.exe
2228	jcef_helper.exe
2228	jcef_helper.exe
2096	jcef_helper.exe
2096	jcef_helper.exe
2096	jcef_helper.exe
2096	jcef_helper.exe
2096	jcef_helper.exe
2096	jcef_helper.exe
3776	jcef_helper.exe
3776	jcef_helper.exe
3776	jcef_helper.exe
3572	jcef_helper.exe
3776	jcef_helper.exe
3776	jcef_helper.exe
3572	jcef_helper.exe
3716	jcef_helper.exe
3716	jcef_helper.exe
4724	jcef_helper.exe
4724	jcef_helper.exe
1744	javaw.exe
1744	javaw.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	javaw.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5072	jcef_helper.exe
5072	jcef_helper.exe
2228	jcef_helper.exe
2228	jcef_helper.exe
2096	jcef_helper.exe
2096	jcef_helper.exe
3776	jcef_helper.exe
3776	jcef_helper.exe
3572	jcef_helper.exe
3572	jcef_helper.exe
3716	jcef_helper.exe
3716	jcef_helper.exe
4724	jcef_helper.exe
4724	jcef_helper.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2012	2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe
Token: SeShutdownPrivilege	4556	javaw.exe
Token: SeCreatePagefilePrivilege	4556	javaw.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4556	javaw.exe
4556	javaw.exe
4556	javaw.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3880	2012	2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe	91
PID 3880 wrote to memory of 4556	3880	2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe	107
PID 4556 wrote to memory of 1744	4556	javaw.exe	108
PID 4556 wrote to memory of 5072	4556	javaw.exe	109
PID 4556 wrote to memory of 2228	4556	javaw.exe	110
PID 4556 wrote to memory of 2096	4556	javaw.exe	111
PID 4556 wrote to memory of 3776	4556	javaw.exe	112
PID 4556 wrote to memory of 3572	4556	javaw.exe	113
PID 4556 wrote to memory of 3716	4556	javaw.exe	114
PID 4556 wrote to memory of 4724	4556	javaw.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\javaw.exe
    "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\javaw.exe" -cp C:\Users\Admin\AppData\Roaming\.SummerCraft\components/launcher-ui-jcef.jar -Dlauncher.home=C:\Users\Admin\AppData\Roaming\.SummerCraft -Dlauncher.bootstrapVersion=1.1.0 -Dlauncher.buildId=1277 -Dlauncher.channel=stable -Dlauncher.bootstrapExe=C:\Users\Admin\AppData\Local\Temp\2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe -Dlauncher.configBin=C:\Users\Admin\AppData\Roaming\.SummerCraft\config.bin -Dlauncher.coreJar=C:\Users\Admin\AppData\Roaming\.SummerCraft\components/launcher-core.jar --add-modules=jcef --enable-native-access=ALL-UNNAMED -XX:+UseG1GC -XX:MaxGCPauseMillis=20 -XX:+ParallelRefProcEnabled -XX:+UseStringDeduplication -XX:G1HeapRegionSize=4m -XX:+AlwaysPreTouch -Xms256m -Xmx768m launcherui.JcefLauncherMain
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\javaw.exe
      C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\javaw.exe -Dlauncher.home=C:\Users\Admin\AppData\Roaming\.SummerCraft -Dlauncher.buildId=1277 -Dlauncher.channel=stable -Dlauncher.bootstrapVersion=1.1.0 -Dlauncher.configBin=C:\Users\Admin\AppData\Roaming\.SummerCraft\config.bin -jar C:\Users\Admin\AppData\Roaming\.SummerCraft\components\launcher-core.jar --service
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Enumerates system info in registry
      PID:1744
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef_helper.exe
      "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/bin/jcef_helper.exe" --type=gpu-process --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib/locales" --log-severity=warning --resources-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\.SummerCraft\logs\cef.log" --mojo-platform-channel-handle=2464 --field-trial-handle=2468,i,5314724601210252863,10007088830464032652,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:5072
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef_helper.exe
      "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/bin/jcef_helper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib/locales" --log-severity=warning --resources-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal" --log-file="C:\Users\Admin\AppData\Roaming\.SummerCraft\logs\cef.log" --mojo-platform-channel-handle=1420 --field-trial-handle=2468,i,5314724601210252863,10007088830464032652,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2228
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef_helper.exe
      "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/bin/jcef_helper.exe" --type=gpu-process --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib/locales" --log-severity=warning --resources-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Roaming\.SummerCraft\logs\cef.log" --mojo-platform-channel-handle=2480 --field-trial-handle=2468,i,5314724601210252863,10007088830464032652,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2096
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef_helper.exe
      "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/bin/jcef_helper.exe" --type=gpu-process --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib/locales" --log-severity=warning --resources-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --log-file="C:\Users\Admin\AppData\Roaming\.SummerCraft\logs\cef.log" --mojo-platform-channel-handle=2344 --field-trial-handle=2468,i,5314724601210252863,10007088830464032652,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3776
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef_helper.exe
      "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/bin/jcef_helper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib/locales" --log-severity=warning --resources-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal" --log-file="C:\Users\Admin\AppData\Roaming\.SummerCraft\logs\cef.log" --mojo-platform-channel-handle=2512 --field-trial-handle=2468,i,5314724601210252863,10007088830464032652,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:8
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3572
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef_helper.exe
      "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/bin/jcef_helper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib/locales" --log-severity=warning --resources-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib" --user-data-dir="C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\.SummerCraft\logs\cef.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3632 --field-trial-handle=2468,i,5314724601210252863,10007088830464032652,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3716
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef_helper.exe
      "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/bin/jcef_helper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib/locales" --log-severity=warning --resources-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib" --user-data-dir="C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\.SummerCraft\logs\cef.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3668 --field-trial-handle=2468,i,5314724601210252863,10007088830464032652,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe
Size 1.8MB
SHA256 4a55cc91caf0184787722918453068b1794c92d0f04e20b31051f94b75969d47
MD5 e297936171c295e8ec0b5e0423151f9c
SHA1 9b0333762bf96e7f80119bf9e1d240c6b77ed672
SHA512 08d49e24c636106af128f25df2aacc5e7da2db9da71ac8026ef2630e976fa48c6e234ddbbae0b8dc5d4d9d5563530917fdb625cf1cc1823969a53582e723df31
SSDEEP 49152:1B0pozXueoU9Kh7WxpOHhEyQhT/mFYIU6iY:1B78MOHSFdg+Y
TLSH
T163957D03F6A580E8C19DC078C3579A33BA72B88D0A3576EF1BD45A513E2AF906F2D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NvAPI_SettingsEditor.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\NvAPI_SettingsEditor.dll
Size 38KB
SHA256 22fefbe0a8a4e02ba95320375f811d40cab7756d841f822972d62870f5da0c94
MD5 74ab4fdacc4126247a791fdec1547d93
SHA1 dadef49dfb17374a23a4cb80e860bcc84f37abed
SHA512 56d37464ee9c4385b642a14ed2ea086f3df736923950b5628fae7c8d0b67423889b928d151a368682fabea858c87caaa7d30b70f1e32fe7e9afdf604657ef65d
SSDEEP 768:KL4n+cXlTqrNjVD/8oIRFJj1WGj4UlMeu4SxH1mg:Kq1WrNJr7cSr
TLSH
T133032B4A67D001E5F1AAD17CC8754A1AD6F2B5111321A3CF1330869A2FD3EEBB53E792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

self-update-attempted.txt

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cache\self-update-attempted.txt
Size 64B
SHA256 1750ad34c024d16509c74dc357938f2869fbb1f3ec875e9253613164f5898c20
MD5 aa950df32149a61a193801128520d6be
SHA1 8f85bf0c4de11167d82f4c94f03069934773f236
SHA512 308e47203be16619b0d5f66ba46f70a12b6bd6ce7b2b2a001e37ac032d1d3b59a0789158de8d841ebd72e3c8e5fbae79938545967c8f6549fc5ddf1273e23f44
TLSH
T193A002F53E431415B02D02E18F5D9356039941A891496DC9501F739A8D7E709FC8F449
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 327bc479add95c9b76dd7c93aeec1c70c9e64d60768eae4abd9580474184751e
MD5 808f658ddddf9be495ff496bf84b49d7
SHA1 217e2167d827e2167af4415a24ab00babcd28b07
SHA512 daf0cb9c538d31854561891630d98be67875c8fdf9badf25e912b7bd1562532dbd5093bad99395fe79226633c0d2f41934edc2c5a770e7b59b62731f4b3e3820
TLSH
T1E3A0021291975E67C34007F054C117E437749D2012B3170283E724A4EBE77424141E24
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 72aa6465760d3de5f7b270165cc4b05264ee0b6c49bf2d448565e9c12e182fe2
MD5 bd96a0bb16c3b88e52dcba7575c37dc3
SHA1 470550e15b1843d70675fd17061d926b15e528ff
SHA512 9070e53b0ba8008c0b07e154a64e44be0e79447c565d01f4b4383cd499b085b2bb4f3a9ac088f9a7e17438f405531266096084ce96763c25449668f0d0b3b461
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

LocalPrefs.json

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\LocalPrefs.json
Size 702B
SHA256 950ec40fa12bf7d804b16873c3c61b051b4380beeaf76e147cc583f24c126ecd
MD5 f9eee4f93da3dca130362949c7000a63
SHA1 8088b51c34d0ef737c578c727c35c9e8909b18d3
SHA512 50b46d0fc1f0573dadd9cf1e1d7b7b312241a137716e71ff342d591d0e4ac9b63ec83606a3b26075d6f5af780a2ab609b5fa4b0a2ef363ffe121c4d7933ac6f6
TLSH
T1ED014470D022CB93AEAA5E94091EE25B4F0C1413088127D06D8C0E1C419EC686A04C1E
MD5 SHA1 SHA512 TLSH

Submit Download

LocalPrefs.json~RFe5a1677.TMP

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\LocalPrefs.json~RFe5a1677.TMP
Size 529B
SHA256 5981729154f07ec165246baee38c4a82ffc10c8e2b59928a2cce5892f7397d95
MD5 d2a76216e3f66a9ef8002f129f5c6f17
SHA1 7c135a4fa7c392817a59fd882d4b2953e8a30235
SHA512 4d55e8afe230a54bdd39a06248b368ba8a5b470a8473b0145e7e597093107f22f0112d9081d699a70c7381d7d4da83cfb5b25ee0f7c6d3b79089d2574e935fd9
TLSH
T1F4F005728022DE63F6715D94085BA35B4F1C5463488577707DDD071C52DBC617A04966
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\Network\Network Persistent State
Size 300B
SHA256 e37eade0b9b918deada69c550ee1cd67b43b51a6b992b97fcdbb8fa5ab505a9c
MD5 75be3af5898c0e3a2a38df9fc3503f0f
SHA1 99601af771a3aacaaa2f9ee3c1d93f3b8aa84111
SHA512 6de49afcbb9c04f6d08ef93ae848fd4c7ac3f350adfc5eb3a2d445fb57cd6effabc5c239afda8581540cb4cfd3d667b2380b86d5cebed4b4d95c71aa322507be
TLSH
T1C9E07D97C1D45CBE078143F466152513C1BD084553182E06C5D4A71E43A14BC450084F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a2a5d.TMP

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\Network\Network Persistent State~RFe5a2a5d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

launcher-core.jar

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\components\launcher-core.jar
Size 3.1MB
SHA256 bb78b76ee71cb148ddd422cc6b134dd7374645f5e5f489e000a030bed0f38942
MD5 5c2ff2068f00fa2983ef721452866cc5
SHA1 2b728b365f7e928f1c76e921a5fe933bccd695bf
SHA512 f825496bd9b770885c4144d9ed33ac9b766ff00c1dc25db7165f779253197baa471ed28cb2fa568a7cc45d21675cfae3925b9d6195e919f0c2fbc22fd2761b06
SSDEEP 49152:6fwej4Z163cnKZbCDg3gr4VgJQYud3P08mSfeWtoKTznn3tOzJn8R:6fw1cy2VgJQvP0coeEFn8R
TLSH
T133E5D0639AABC868DF7B44F395C26290743B55A0BC0B71BD16F05DE28B7098B4361BF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher-ui-jcef.jar

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\components\launcher-ui-jcef.jar
Size 3.1MB
SHA256 a58febf4bc81c3c3e1c0c9af2cc6fdc9f5a467012f604de413bbe8e3cca27c99
MD5 915fc3fdcb6f64295b2fcb1f83131957
SHA1 b10e0fb02052fdefd79018b50d517b8d900ec469
SHA512 3b9e8b0126b0fc0e9fed2981b4233fc5344a00909410e451bea2ada796fbd9244de7b52636b65ef343ca846c7883f3e0cf850eb0048883a40f52e242c8d202a0
SSDEEP 49152:MeAhij4Z1Z3cnKZbCDg3P4Y00kcKE63Yu1nCUXAd6BoKTznn3tOzJaNL:KhpvyL0JF0X1nCUwGoeEFaNL
TLSH
T16FE5E063DA5BC868DFBB48F395C26294743A15A1BC0B71BD16B05DE28B7098B4360FF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\VCRUNTIME140.dll
Size 107KB
SHA256 289746ec5a3c7947c4db77a3ff01915d31d153d88aadc5c48388406862962fc0
MD5 88be0cced6adb4bd149442fc7429d925
SHA1 d8b06d67c7a612563979237fdd80046493a10415
SHA512 86f74a9287e6fe52dad991a650db1d7780692b535c8215a62be038bc0293c0f465acc5d71c614df164ce2d8792eb77405eab3c111ca5eb13e07d393251a779d5
SSDEEP 3072:yS7mylIhkoQpdK9H9YOecbKV02pKuKiK/E:LiylZoQwH93ecbKCR77/E
TLSH
T1BDB37C5A766442B7D0ABC274C1E24A1BEB70B880977093CF03B286665F63BF15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\awt.dll
Size 1.5MB
SHA256 d8aec9fa3d8cca7ad1c91bb1615c7a1d78f934c681472a1720fed5806f35c483
MD5 be305a3acbc4ac9a2a197dd7f0d96057
SHA1 fb2987bc80018215677e70df4dd47c4e926b4714
SHA512 56938bd5fe9648d05553e23fe94d64554838661367a2c2eaf6b3a343b0d99a9d7fb465a87998b008f95e9f07abd5d6938e02cfa04895128cc5ee74ed5fb1fdf3
SSDEEP 24576:dd6hwaxhyw9FvztxsLpCBTuSBA1phy/yiogE0aE4F0hAiNcs7Y:X6GaxhfFbsMg/1ps/yiogE0aEQu7
TLSH
T184658E06E3A40195D4BBC2B8C55B920BE7B174191341C7EB66BACB6E7F67FD0623A301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\chrome_elf.dll
Size 1.3MB
SHA256 9a0950dfbe19fa0435770602c08a6844191f43371374c45fe83c0eb0cbaa151f
MD5 35ce9fb4e86365e7ed36df4071d14881
SHA1 3fd326411b453d38dfd101a7e55c8e1ef78f30ab
SHA512 f16c566539aff23f950379241e4958f7d6a4c74f5373b5ed9d866cb10910206886ca1dfe289e4a575d6fd8c7a9a488f4d270045f790bec2e3fb134962aab1c2d
SSDEEP 24576:t5my4VDw7nAH0bkyiuG7ndxJWl2ERc73k:t5my4V87A04ys7jJYxx
TLSH
T1D2558C17B6D981E8D06EC17487578236EA727C420B34AADF0290B7592F77FE46B3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extnet.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\extnet.dll
Size 24KB
SHA256 af778cb436829b60c4df394052fd5b9228735779c4f026c374f7fe887ef80103
MD5 89b3f660d4648d2318a2478cafc88960
SHA1 78163fbaf98d711a2c9d4a2b9f292b99b1c3756b
SHA512 1f6235e7bc277183f584279e3031d3091724054aebfcf8ea464458c0627479bf524e3f1d8eb58b02d8b225e67b90758e292e3f3d4038d706dff6a93045429d61
SSDEEP 384:oV18LnLTFTr7Uqk9WFP27xWkVbgWUlIx4c5WARmvV0FP27NBY3Yuv+a:RjLTuXEKxnVbgvqxN5XPK/Y/+a
TLSH
T126B27E8B976813F2FDE78A3160D29B17CDB1B690B76392AB1270C1655DF23223B09719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\icudtl.dat
Size 10.2MB
SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
MD5 e0f1ad85c0933ecce2e003a2c59ae726
SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
TLSH
T1B8B63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\java.dll
Size 145KB
SHA256 750bfba12a865b4575fe37536c6297e1d53080d5ffa22dd1c8a30674d4630414
MD5 25bd878db4ef4021cdc14adc44f5cdc7
SHA1 d22f12f8fb3e8e93f2c6264a844128fbfc0e245b
SHA512 6efff6d3b3b63fbe5f1bb6a0ba0275120ce6c07d3649e35900d6bbe20d788a255fe0df7d4ed4887b89dc0cd6a6d7597145379b77b06c0b847dddf793f205fbef
SSDEEP 3072:eWrFkKqhqQ68H6cB5mu/WNFsmcvMyYFosxCr1Pc/bKuKuK/P:N6xRGORU+7P/P
TLSH
T188E34B0BB30640A2F45AB6B87019810BD37A34A1512DD3BE43E58A9F9F6F7317E87791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\javaw.exe
Size 34KB
SHA256 5b5702a2a82a2e9d363d97b8afc794ab1cbb6533aea20c547281bb19cd99ff3b
MD5 d51c81d9b08e0ac2f43c993b7af7fbc0
SHA1 21bc2494a72d5f021f5512c1bc5ffdeeead955e9
SHA512 fea29704057e9d4e8de97acb9af4cb5a2cca3c2019b192f88c93a9039a6949f85575cc42b386db32f294b7865093c10c56298d3ff38aa29eaa2cb3e3a8d0bae1
SSDEEP 768:iXNZ2osmh5KKxnVbgvqxNdeJLdvtK/Y/+5:iXymh5KKxnKvKNdejFK/v
TLSH
T1A6F26D0697161132F6854C3460AFE3DEADB46D76FE72CCE61294B87ADCB03612E0625B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jawt.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jawt.dll
Size 22KB
SHA256 bb749b1d78ac677563b632352acd29dab17e30f48b124221ba97d386c3b4c562
MD5 7363dd5de7d5bc07db4733eb3bae3bbe
SHA1 7ca2793b0570a37ca7142e30d808342db886f5e5
SHA512 095e9a7f7f324d4ab224b9c7a548a4701d2facc0bbc90f9cc7fadf959b06a582e929f14db7bc099d8961ec5a340f43a2a75bcbb9bd9626c9019eb6a9d7e8a4fa
SSDEEP 384:OdyySe1G07nAeG4IwFP27xWkVbgWUlIx4cBWzPHcg0FP27NBY3Yuv+fRm:OAy1h7Al4bKxnVbgvqxNBWHYK/Y/+f8
TLSH
T176A26C8EABA81772FDDB8E3060D5CE1B8C70B7A4F79392D7526086716D913263E0870D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcef.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef.dll
Size 994KB
SHA256 bdc0bd23f783bff191de8cb386d611494b0aeba457c5882babd8fb1a766723e3
MD5 65ab5844edb988b66155c992c5d49632
SHA1 cae8122bc60473988fdc647dd2d889f6465668b8
SHA512 f60f8cf4356b1836b5d2ac45b88fbddaacdbc92449e9223c04a365b94a14d142d4824aa5460aefafe6f5c8905c5b6834757f03db32ab10351479f488501b5d0e
SSDEEP 24576:p9H++wLhmCAz2P9hV6SDum+NGLdaDhb6nyw06Xthh84Ybo9Jm6LP5P74W:p4GpEthhDWEw6j
TLSH
T173254C1A72B800A8E1B9D97C572BD90AF2B138471360E7DF51A6074B6F5BBF4517E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jimage.dll
Size 34KB
SHA256 75784d2aac1cfe2227cf47148d3d78e84ce0e24a3487c900e51cdaee0e3a5928
MD5 e5b62a6c37241b1df0da6deeea877a3d
SHA1 e2903c0ccd7c2246346fb377e62a6563ef3e8a46
SHA512 d66823278c265fce34c2b74d138a6c892e21b4e75e792ede3f800b6093f4970fedc57e50e7694d51aba4ac5e561c2e08c2d6a1435e6ebe6f0a092d72c8c208b3
SSDEEP 768:NM1nW0iqnlFMGvLs+6KxnVbgvqxNpK6Uq9K/Y/+a6:WiqnYGzf6KxnKvKNpKQ9K/Y6
TLSH
T107F27E5AA7686666F9DBC93880C6DF1BC9F1F591BB52C387531143AA1F723603F1830A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jli.dll
Size 88KB
SHA256 fd9bf35c456499186a8ba5b551ff335a55e9a83fe03300c0b3329558779bcb95
MD5 735746e1dffc9ef14e9ad3f04907d6cf
SHA1 575f1a338a6ae2b47d50414df9391b16cc617e34
SHA512 def43934818263f6608b9c92daafb8acf2129413ef2b4954d5278f9cb330f4b80f812f42bec3c525add4b6db5f38e9cb172fa62af5001aa569a2a64a09971f90
SSDEEP 1536:evawtZ+pqZtq7hXPLqoN+AzBcIOddzXtf61s+KxnKvKN1hxK/e:St+pqeFXPLeAtSddzX1+s+KuKXK/e
TLSH
T179938D8A53A022B1EDF6C579D5B5960BC7F0B0963712934F037889A60F633763E18BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\msvcp140.dll
Size 565KB
SHA256 d09d9df70b56d47ca89ec2766ee6ce1b1699dc8305edf8e1da5f18ee4b9963f6
MD5 f1525f46244224826cea928f11de4969
SHA1 96c25a83470091ea210cb9b4ed85396cc250bfdd
SHA512 39234638527a4c14c68a95b32674a8032b5ceca27a1ce3df637462e6e95d49118b6fc277d77c93131dacc0dbd19d50422cc7bc8a0d46245fc1c0567a4ac3b3ba
SSDEEP 12288:Q7dqZ1EqSGQEwkcz6sm7UtgZ/29z7mnuMG7NaekWdgJMKZ+h7rUh0wvaQEKZm+jW:QZNg+h7r6iQEKZm+jWodEERAc7I1
TLSH
T11DC41923B74D01A0E196A3B8A1C38315D7F17C9A4312A3C792FB96AD2F573D5AB3B150
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\net.dll
Size 96KB
SHA256 4fcd85589274d40029f7849f5fa8e927cd96343b36cc92a8eec10108a101f853
MD5 a9560d6be2de28abcd7c5e52bcd6ba3f
SHA1 671303db6405b181cd4d5e0a782ad39b58a0fd6c
SHA512 f1d42a9bcf311b2b32ebf34975d6ad1441fdb29ffb479e77a6102b148dafb7b2b4fbc69d92a20c3c52a5e26c2dbcf9f424cbbc46e90fe28c0225eeff16a8ea7d
SSDEEP 3072:YsIXGaipcLAEnu2d3sE/HWl6WWYpc5qFcXXckuKuKmkK/f:YRGzKG+j/WlZFcc27u/f
TLSH
T1DFA36B05A36820D5FCA7C6BC85828617C7B3B4B07641839F13A6C96EAFEB7713E19741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\nio.dll
Size 79KB
SHA256 7877cf696331ad4a65cddad250982c7da7ffb20573036c525c95569e228585b5
MD5 4d8c82a049256f8aa654023a1eee692a
SHA1 4bf66e82b2f6de6eaea8a53178d0cbf8e30246d3
SHA512 5949133d7ab4b6e01bb5477dcf0dabdfa3e9eb55e6d2d058aee6f870374a51d8dae8350157a14818f4916342f98b92c8847ce8cac44cc6fdb1acd5b857afe3e0
SSDEEP 1536:bdtr8zQDUJA/cKIrNN3RrhJD1qNp8KxnKvKN1oK/dK:bdtqMUJCcKIZN39hJDop8KuKQK/o
TLSH
T1D5835BA64374459BE86AB53C429A4747E732FC205500A75F4268CB669F2F3B33E3D782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvdaControllerClient64.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\nvdaControllerClient64.dll
Size 271KB
SHA256 af12a899c87bfed3c86b06aef8a4ffb839c7ccca76ff7d45f8790b7a3ff14491
MD5 1b47f997f81f19a4d584b921dea0e24e
SHA1 040637cc26c4bacc22c611c8f6e0ba1a23059ac9
SHA512 1b89d674ab3589378d4a1d312f5c59f257b2f319f9de9fe5c77f735dc3219be5219a81e61b200baf3367a834900dc94aa0734e70562c93f24d8e30fa86a263b2
SSDEEP 6144:T5uGIDi7wt2mFd40+oEK2BLJriohEaX3t3/37A/X:TsGWht2Y4zvLJrioZP7A/X
TLSH
T13A448C1976A90CB9ED77813C88475A05E7F2781103B1DAFF03A0476A9F277D0A63EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\server\jvm.dll
Size 12.1MB
SHA256 279bdc9c37b66ebe4402ccc7974ec33d8eff75e3f14e87e54571dba1b09afd4c
MD5 68ef297bbef990f45758439917ea7878
SHA1 76b0bd9c98cc990eeb2473cf827a0d24fabdb7a6
SHA512 b51b00dc2e481fa2bd45332991324a33d771c4151d2e94e4c86cdbfe03db7816a05c91018c4c2c304892824a6c548bb1b5d4c323f856ad2ed8ef68adc00b8bb4
SSDEEP 393216:jjzcmncKCRXwJZdW2FD3qjuGYU950YROKDnZ3stwwUkIwyX9jigCwyo5utiDMfJx:jW+
TLSH
T17BD67C5BAA7480D4D42BF178C62B5A0BD7F2B45493B4E7CF21B406496F23BE5663E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\vcruntime140_1.dll
Size 49KB
SHA256 fdc5e49d37b831c213f5ba43b0a1fe8f1a0902df6336610692535017676ad064
MD5 f5747ebbd71fa84455e924af56903a76
SHA1 3612e426cc53c1d55579c46f7ea879b9b2316290
SHA512 4e8d5f254a40e9ef75e106f8d316a8539eb25ea5ad695b888819ebf91aefe6b361f4b95f5d7aff932cb58e277b61d1f6bf126b248810d5626fbcd5a019bff1ba
SSDEEP 768:ECm5yhUcwrHY/ntTxT6ovF7Iyw4Bl9ziKxnVbgvqxN5UlK/Y/+3:TOHc16opIyw4B3ziKxnKvKN5UlK/t
TLSH
T111337C95537C9152E4DFC97090D29F27EE38F5A1B741868F06A0C1692EA23E0FB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\zip.dll
Size 88KB
SHA256 4280315aeb211ecb1ce780ff4ffdd138d9f5d317694e8fa54fc627fffb283a21
MD5 8553f0256b67ba47b467c0f20bebce54
SHA1 f7d744de6026d2b6fe435ccb1561c5aa33dd6e3b
SHA512 a52d1fb172961afa0290498a28d24fce95b6f0ee86e918ccdf1347a43942d710bb346cc6375879b6372f7e63fc51b666598ac8ef2cf4af515bf72bdff66325cc
SSDEEP 1536:MLOqJYRrxeHblz63B0xCvqQBKf9sWjIOQIO6WaoHeFQoKxnKvKNNYK/:MLOqJYRrx29yqQBisWFG6WaoHiQoKuKB
TLSH
T158939D965A706362DAFA81B085F28A2FC375B05062C5578B534CCB9A2F433623F493FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.properties

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\conf\net.properties
Size 6KB
SHA256 5bc726671936e0af4fdf6bed67d9e3a20a92c30b0ba23673d0314baa5e3ffb08
MD5 385443b7e4a37bc277c018cd1d336d49
SHA1 b2c0dfb00bf699e817bdd49b14bc24b8d3282c65
SHA512 260afc7671a1dc0c443564f1d10386f0b241bb53c76df68d8d03f1d0b1ceaf3f68847ab3477732c876c2b01c812ef7521744befe88e312f3aa63164b608b67a1
SSDEEP 96:6ATE+VEtGObfObz3Ob6Onte3CO0V+r/aJ7SFXtqBZUT+gTzDuBnZkRnF:/LVGG4f4z346et5m27SnCgTe9GnF
TLSH
T127D142C2FF46B72543A9C291E21EA7EAE32C903D5C33757831AC890D2619D76427F4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\conf\security\java.security
Size 57KB
SHA256 d0e59d5c3bbb69ba4db235bbc9f7d0bbf966752f3ccf1e774fe3a8c0bc9b54d9
MD5 fb2f8510dbdc58955528789078a8350d
SHA1 664f61e0bf8a7a4382b703620e7c1b545d8ecd33
SHA512 112a5d610b186364d7e3fb9e364f9dd89e271e29ceb5eba16ad72e9a4c23a4dcd8ac916324361c23b9a00db777039600fcd78178e3acaae893f3bc842dfd6e71
SSDEEP 1536:r2My8SiqOpjt1p5/jTGHu1UoQhzYKpNnCF:3qOP1D/jTGO1UoQhcK3nCF
TLSH
T17043C422BB897B710AF211A363AEF1D9E76DA12A36721150748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\legal\java.logging\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\legal\java.logging\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\legal\java.logging\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\lib\chrome_100_percent.pak
Size 674KB
SHA256 47e14eb863a9ebec98dfcb99bdbc88f075c71ddc27a17b108e38fd3d70cd5b8c
MD5 fd80a5e69cc456bdcbf71ce4820e950b
SHA1 47d18753f93c0196f1c0595968e31ad5c7359288
SHA512 cd3ed3390c3dd2a3f5763e562151ad008f6f0f366f843fba143213c81f1b9b3aebda5d7f24c5b20e3e95993eae6f5995f1a14f3eb635219bda727590a267db50
SSDEEP 12288:XI3H1fJqjzgsz5B0GDJQrnKs8SNP+QSsSilRBiNz401+gIXm4pboO0TehErw5:43VBq7zEEmPLSOiNz40AgUjpboO0TOv5
TLSH
T12BE412D773B4EC3DEE9B1677926504B1FC7345281AA2010B178EE87A6A6374898DD3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\lib\chrome_200_percent.pak
Size 1.0MB
SHA256 b2c8e8d23ffee4f111ca39cb71757d37eb17d69e04536bc47daa252d97610248
MD5 fc1793c3f0b0dbf4557b3a15b2af91f8
SHA1 1e4c3617cfb860c5de8ca15b2bd02c42bc9b3ae0
SHA512 b720dc7c30947217b6d97f8861efb5db78d936aac3dc8354f325cd8aa0ee9b983e3774d486384ef1c2fdc227631dc593fc26576ab6a9ca9c019e672efdd0dfda
SSDEEP 24576:+l3zBr5zLmmibkFR8+mZR9hQumegvQtSP0AUwvdbbag6edhOLoeu5:Q3t53mNbkFRJmH9hQRhQsP0AJvdbjrOi
TLSH
T1B23512D793B4CC7DCD630BB3925A01F1FD75103A0AB6510B07A7BD3A3A5668899CA6C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\lib\locales\en-US.pak
Size 453KB
SHA256 aebe5b97f97e07ccaa6e3f4498b739466ed46d63b9e749f7933251d36dbb75aa
MD5 7120e754ad53d69d38b207eb9cadb876
SHA1 2f3f1cf3d88cc2d79ae0be1fff442f9acc679ec6
SHA512 758e86c15fcb3132be13a018de429210b9b4d9f9ca625245fd24f5ad850bc44f413b40910be774c7c19c11b22d781adef183d3e6f43c5909fc0e6cfc77c989cc
SSDEEP 6144:K0xkNNav7rgS0w3jjMP9eD3D9faYLbcNx5FSZngP/eXPwp:K1NkvvljMY3DzA5FSHPwp
TLSH
T172A45C1FF744122A069352627F0996A2FF36D06CA35112563CBD812C33B7B66C37B6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\lib\resources.pak
Size 7.8MB
SHA256 4fcd2333f97ffebc538b476183ca6afefc8ca39b2cd6650a7221a55aecc190a9
MD5 ef1290bec69ed21acbd39af39bb819c1
SHA1 0af1bfa5809c46ad10bd918eedbf1226049e0a74
SHA512 eb79244f4637d32fa037334e96130552676cac2aaacc335fe5c1828d9fdc4ebce4ffff3e2e07b2b1fd38aa2df91c6ff1fd3670a760746515e4f02dd8c5fbc043
SSDEEP 196608:TsmwTAnSwHi153eBbKRcQpkrNa/SQaVN2wuJ10Le+oT:gBTmR05u8RvpkrQ/GN2wuJ10hE
TLSH
T1258633D3BBE8603FDC445777425C46350B2CE58A2A221066309CB69DFE3A249AFD51BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\lib\tzdb.dat
Size 101KB
SHA256 108a63fb316b1eaa8949f3ff7265c2af0402c9ff13f360578e658caaafc40faf
MD5 c054908b3f007234696a2c13f2cb58be
SHA1 330a69ed889539d7b8f9ec8bcb00f49b5ee2895d
SHA512 64f3c996f668e200acec60138d027fd60523c35e5de60dcca915101c2c069f1bef6783f34584b2212a5c140061d65cb23d889bb2cdd67b57014c66020e777a7c
SSDEEP 1536:c0EEMEBHNPdrY2L/rmjAGubVj0Lg/////PhbPdJPNL0mOTLMXjbF35a2yiz:cCMYHNPdrtDxbVj0MhzdxgTLw42Z
TLSH
T1D0A3A2757F7050B7B2CF4222262B5B93097DAC816FC3080679B5BD4E8A76AD6603335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\lib\tzmappings
Size 21KB
SHA256 36dc51c4bf787f640a4b45cbb84ab6954f6e595cbd3617c2f5a4e1e607b38bff
MD5 b02ee240a8db902961fe886a19beba16
SHA1 c52c42d591f4c650b629e6b374e967e211fb5aeb
SHA512 024811961511b7182860ed03a5670f82412a45d005a1db0876f6b0c9af7e96c104566abff0ebbded11a780349444214291f439039d20fb92071c7dd24bda0e23
SSDEEP 192:3nqW46ARn1+RQ7wbNQQSaapvQZglEcCDqvOCJqGiF3yzA6bb/KOFmYXKhJmBW:3nqW46ARnGQqN2KhcQ+q5a3W
TLSH
T1F9A24386B06662D4C073EC0D7B527AD3F886F3C499C69A4D2943C366BD019B767E1837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2012-6-0x00007FF7A5470000-0x00007FF7A5646000-memory.dmp

Download

memory/4556-565-0x000002552A0E0000-0x000002552A350000-memory.dmp

Download

memory/4556-927-0x000002552A670000-0x000002552A8E0000-memory.dmp

Download

memory/4556-926-0x0000025522BB0000-0x0000025522E20000-memory.dmp

Download

memory/4556-925-0x000002552A0E0000-0x000002552A350000-memory.dmp

Download

memory/4556-924-0x000002553D7D0000-0x000002553D8B5000-memory.dmp

Download

memory/4556-578-0x000002552A670000-0x000002552A8E0000-memory.dmp

Download

memory/4556-577-0x0000025522BB0000-0x0000025522E20000-memory.dmp

Download