07ee3127344b4c6cc78cb649a48d1bf6c66d87965fe74b9c70362aaa483dbf15

Analysis

max time kernel
150s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe
Size 1.8MB
Sample260528-bak78act7p
SHA256 07ee3127344b4c6cc78cb649a48d1bf6c66d87965fe74b9c70362aaa483dbf15
MD5 d03e0d26379efe9f2f435c08e62637fa
SHA1 ad7a0fe0c0cf718018bbb8df31653bb339e23b2e
SHA512 ff30e27114ad436722d0f64a5cae8a09f29c457121fa9eff9af169dd44e1f7dbed0ed30e9fbb0f928779c92791fb15c1b74374b3c52c656540b0dcaf71d23862
SSDEEP 49152:OfTGsESpclZT2Yg8UbzIqMWtzRnNmMgIU6iY:Ofpoybz/fJ5+Y
TLSH
T1E3957E03F6A580E8C19DC078C7579A33BA36B88D063576EF2BD45A512E2AFD06F2C715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1004	2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe

Executes dropped EXE 10 IoCs

pid	Process
1004	2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe
4744	javaw.exe
2964	javaw.exe
3808	jcef_helper.exe
2104	jcef_helper.exe
4060	jcef_helper.exe
1972	jcef_helper.exe
2932	jcef_helper.exe
4824	jcef_helper.exe
3600	jcef_helper.exe

Loads dropped DLL 63 IoCs

pid	Process
4744	javaw.exe
4744	javaw.exe
4744	javaw.exe
4744	javaw.exe
4744	javaw.exe
4744	javaw.exe
4744	javaw.exe
4744	javaw.exe
4744	javaw.exe
4744	javaw.exe
4744	javaw.exe
4744	javaw.exe
4744	javaw.exe
2964	javaw.exe
2964	javaw.exe
4744	javaw.exe
2964	javaw.exe
2964	javaw.exe
2964	javaw.exe
4744	javaw.exe
2964	javaw.exe
2964	javaw.exe
4744	javaw.exe
4744	javaw.exe
4744	javaw.exe
2964	javaw.exe
4744	javaw.exe
2964	javaw.exe
2964	javaw.exe
3808	jcef_helper.exe
3808	jcef_helper.exe
3808	jcef_helper.exe
3808	jcef_helper.exe
3808	jcef_helper.exe
3808	jcef_helper.exe
2104	jcef_helper.exe
2104	jcef_helper.exe
2964	javaw.exe
2964	javaw.exe
4744	javaw.exe
4744	javaw.exe
4744	javaw.exe
2964	javaw.exe
2964	javaw.exe
4060	jcef_helper.exe
4060	jcef_helper.exe
4060	jcef_helper.exe
4060	jcef_helper.exe
4060	jcef_helper.exe
4060	jcef_helper.exe
1972	jcef_helper.exe
1972	jcef_helper.exe
1972	jcef_helper.exe
1972	jcef_helper.exe
1972	jcef_helper.exe
2932	jcef_helper.exe
2932	jcef_helper.exe
4824	jcef_helper.exe
4824	jcef_helper.exe
3600	jcef_helper.exe
3600	jcef_helper.exe
2964	javaw.exe
2964	javaw.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	javaw.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	javaw.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	javaw.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3808	jcef_helper.exe
3808	jcef_helper.exe
2104	jcef_helper.exe
2104	jcef_helper.exe
4060	jcef_helper.exe
4060	jcef_helper.exe
1972	jcef_helper.exe
1972	jcef_helper.exe
2932	jcef_helper.exe
2932	jcef_helper.exe
4824	jcef_helper.exe
4824	jcef_helper.exe
3600	jcef_helper.exe
3600	jcef_helper.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1500	2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe
Token: SeShutdownPrivilege	4744	javaw.exe
Token: SeCreatePagefilePrivilege	4744	javaw.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4744	javaw.exe
4744	javaw.exe
4744	javaw.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1004	1500	2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe	79
PID 1004 wrote to memory of 4744	1004	2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe	80
PID 4744 wrote to memory of 2964	4744	javaw.exe	81
PID 4744 wrote to memory of 3808	4744	javaw.exe	82
PID 4744 wrote to memory of 2104	4744	javaw.exe	83
PID 4744 wrote to memory of 4060	4744	javaw.exe	85
PID 4744 wrote to memory of 1972	4744	javaw.exe	86
PID 4744 wrote to memory of 2932	4744	javaw.exe	87
PID 4744 wrote to memory of 3600	4744	javaw.exe	88
PID 4744 wrote to memory of 4824	4744	javaw.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Temp\2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\javaw.exe
    "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\javaw.exe" -cp C:\Users\Admin\AppData\Roaming\.SummerCraft\components/launcher-ui-jcef.jar -Dlauncher.home=C:\Users\Admin\AppData\Roaming\.SummerCraft -Dlauncher.bootstrapVersion=1.1.0 -Dlauncher.buildId=1277 -Dlauncher.channel=stable -Dlauncher.bootstrapExe=C:\Users\Admin\AppData\Local\Temp\2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe -Dlauncher.configBin=C:\Users\Admin\AppData\Roaming\.SummerCraft\config.bin -Dlauncher.coreJar=C:\Users\Admin\AppData\Roaming\.SummerCraft\components/launcher-core.jar --add-modules=jcef --enable-native-access=ALL-UNNAMED -XX:+UseG1GC -XX:MaxGCPauseMillis=20 -XX:+ParallelRefProcEnabled -XX:+UseStringDeduplication -XX:G1HeapRegionSize=4m -XX:+AlwaysPreTouch -Xms256m -Xmx768m launcherui.JcefLauncherMain
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\javaw.exe
      C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\javaw.exe -Dlauncher.home=C:\Users\Admin\AppData\Roaming\.SummerCraft -Dlauncher.buildId=1277 -Dlauncher.channel=stable -Dlauncher.bootstrapVersion=1.1.0 -Dlauncher.configBin=C:\Users\Admin\AppData\Roaming\.SummerCraft\config.bin -jar C:\Users\Admin\AppData\Roaming\.SummerCraft\components\launcher-core.jar --service
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Enumerates system info in registry
      PID:2964
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef_helper.exe
      "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/bin/jcef_helper.exe" --type=gpu-process --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib/locales" --log-severity=warning --resources-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\.SummerCraft\logs\cef.log" --mojo-platform-channel-handle=2336 --field-trial-handle=2340,i,15885104619467724664,4447622939964310603,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3808
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef_helper.exe
      "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/bin/jcef_helper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib/locales" --log-severity=warning --resources-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal" --log-file="C:\Users\Admin\AppData\Roaming\.SummerCraft\logs\cef.log" --mojo-platform-channel-handle=2168 --field-trial-handle=2340,i,15885104619467724664,4447622939964310603,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2104
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef_helper.exe
      "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/bin/jcef_helper.exe" --type=gpu-process --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib/locales" --log-severity=warning --resources-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Roaming\.SummerCraft\logs\cef.log" --mojo-platform-channel-handle=2412 --field-trial-handle=2340,i,15885104619467724664,4447622939964310603,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:4060
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef_helper.exe
      "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/bin/jcef_helper.exe" --type=gpu-process --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib/locales" --log-severity=warning --resources-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --log-file="C:\Users\Admin\AppData\Roaming\.SummerCraft\logs\cef.log" --mojo-platform-channel-handle=2336 --field-trial-handle=2340,i,15885104619467724664,4447622939964310603,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1972
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef_helper.exe
      "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/bin/jcef_helper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib/locales" --log-severity=warning --resources-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal" --log-file="C:\Users\Admin\AppData\Roaming\.SummerCraft\logs\cef.log" --mojo-platform-channel-handle=3408 --field-trial-handle=2340,i,15885104619467724664,4447622939964310603,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2932
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef_helper.exe
      "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/bin/jcef_helper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib/locales" --log-severity=warning --resources-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib" --user-data-dir="C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\.SummerCraft\logs\cef.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3664 --field-trial-handle=2340,i,15885104619467724664,4447622939964310603,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3600
  - - C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef_helper.exe
      "C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/bin/jcef_helper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib/locales" --log-severity=warning --resources-dir-path="C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win/lib" --user-data-dir="C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\.SummerCraft\logs\cef.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3684 --field-trial-handle=2340,i,15885104619467724664,4447622939964310603,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-28_d03e0d26379efe9f2f435c08e62637fa_akira_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk.exe
Size 1.8MB
SHA256 4a55cc91caf0184787722918453068b1794c92d0f04e20b31051f94b75969d47
MD5 e297936171c295e8ec0b5e0423151f9c
SHA1 9b0333762bf96e7f80119bf9e1d240c6b77ed672
SHA512 08d49e24c636106af128f25df2aacc5e7da2db9da71ac8026ef2630e976fa48c6e234ddbbae0b8dc5d4d9d5563530917fdb625cf1cc1823969a53582e723df31
SSDEEP 49152:1B0pozXueoU9Kh7WxpOHhEyQhT/mFYIU6iY:1B78MOHSFdg+Y
TLSH
T163957D03F6A580E8C19DC078C3579A33BA72B88D0A3576EF1BD45A513E2AF906F2D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NvAPI_SettingsEditor.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\NvAPI_SettingsEditor.dll
Size 38KB
SHA256 22fefbe0a8a4e02ba95320375f811d40cab7756d841f822972d62870f5da0c94
MD5 74ab4fdacc4126247a791fdec1547d93
SHA1 dadef49dfb17374a23a4cb80e860bcc84f37abed
SHA512 56d37464ee9c4385b642a14ed2ea086f3df736923950b5628fae7c8d0b67423889b928d151a368682fabea858c87caaa7d30b70f1e32fe7e9afdf604657ef65d
SSDEEP 768:KL4n+cXlTqrNjVD/8oIRFJj1WGj4UlMeu4SxH1mg:Kq1WrNJr7cSr
TLSH
T133032B4A67D001E5F1AAD17CC8754A1AD6F2B5111321A3CF1330869A2FD3EEBB53E792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

self-update-attempted.txt

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cache\self-update-attempted.txt
Size 64B
SHA256 1750ad34c024d16509c74dc357938f2869fbb1f3ec875e9253613164f5898c20
MD5 aa950df32149a61a193801128520d6be
SHA1 8f85bf0c4de11167d82f4c94f03069934773f236
SHA512 308e47203be16619b0d5f66ba46f70a12b6bd6ce7b2b2a001e37ac032d1d3b59a0789158de8d841ebd72e3c8e5fbae79938545967c8f6549fc5ddf1273e23f44
TLSH
T193A002F53E431415B02D02E18F5D9356039941A891496DC9501F739A8D7E709FC8F449
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 33b8793056f6c27b2e4ed20d97ee37bcb52ce3c3b29d02c7bd6d3e518a2286d6
MD5 23c2441520e9a1b24ac9b14f338678d6
SHA1 91deb667960bae507767c2e82c60b0f6fc05e26a
SHA512 1fdd591a2a54f391d7d1f5f6813cb65ca2788bf34288bc83c565be018910006164e632aacf880a97f3ead01fa9b460752375fdad73e9a25c058da584be16dbd1
TLSH
T1ABA0027455C04B82D15683B022C3225032739D3403635F12429215F598D17408671640
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592447.TMP

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\Code Cache\js\index-dir\the-real-index~RFe592447.TMP
Size 48B
SHA256 08ffc6df377a551f83dd9423a6c82adb3f396d9d423f0cb05c919d6cc3bfdba3
MD5 56a7516ce1b336fe0822a408275bf837
SHA1 50e1fe9e11b7ef85153bdba1221d50fe4ed4f94b
SHA512 573d7d85274e3f78e907a970708f1c21a06330e680db5e541063f60e8e46e97d01e336d6d7904fcd3a92eddbed5993747f98bf730e634a9b658fb95653f4b991
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

LocalPrefs.json

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\LocalPrefs.json
Size 702B
SHA256 b261861997f1fd02078f633b3217e0eb583159ad3b38af84c99180fd34925a4f
MD5 958c2bd1edcd307b775d63e6a6a0e59a
SHA1 c90092c91afef90a5f5d95879eccea0ed8cbf12f
SHA512 208a6533f474a2357ff821631a7ba22742514de00de71feafd80c5533b4f07eaf9567e0f7cb0cb057b23323f896c35ec28d552ac41d3ac8820fb7e4a445d4844
TLSH
T15D014E71A0EA86D36DAA8C81023AE2080F1C695B864272F029CE192A82FF4D99705C34
MD5 SHA1 SHA512 TLSH

Submit Download

LocalPrefs.json~RFe59dcca.TMP

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\LocalPrefs.json~RFe59dcca.TMP
Size 529B
SHA256 83fffe5eabff3a69489bb6f4d66bffc6113ede2ae1e9bd4a82bd2aca55cf8b6b
MD5 e2e2a2930c3a9b3e3fc78140b460000e
SHA1 b3d2c3e7bb25afdb17da4eb710b3ec5f647c2f86
SHA512 4d5108ff5d12603d5ed81f0379768993a7818d0bccbc3c52165b34a08002289d52c822e90e2cddc8554a56a1227a423e3bc8de28fa9796097ca049dffc89a739
TLSH
T1D8F0C9B161EA99936636CCC25676E3000F28696B9A5172B03ADD066692FB8C29302871
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\Network\Network Persistent State
Size 300B
SHA256 97daa780dd35f31e0817a5e328d1d53677cc1cbea4ddc8be11d967ace02684da
MD5 6e1f7d9130e9dafa7d050f1d2ead2445
SHA1 6f9ca6aa2e07e185ff437f1edc1d4f0dd0c53418
SHA512 8c0bb26344db9288e72ccd49a920b75ec55cd045f2d484231864a1ae29b76a7fb2fd240f0ee330e35ebd2d5498d5c11ddbecee61e7f786a6fcf7e207f696c91a
TLSH
T13AE07D97C1D44DBE078143F026142513C1BE0C4552182D06D5D4B71E43A18B8451084F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59f11d.TMP

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\Network\Network Persistent State~RFe59f11d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\cef-cache\jbr122-normal\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

launcher-core.jar

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\components\launcher-core.jar
Size 3.1MB
SHA256 bb78b76ee71cb148ddd422cc6b134dd7374645f5e5f489e000a030bed0f38942
MD5 5c2ff2068f00fa2983ef721452866cc5
SHA1 2b728b365f7e928f1c76e921a5fe933bccd695bf
SHA512 f825496bd9b770885c4144d9ed33ac9b766ff00c1dc25db7165f779253197baa471ed28cb2fa568a7cc45d21675cfae3925b9d6195e919f0c2fbc22fd2761b06
SSDEEP 49152:6fwej4Z163cnKZbCDg3gr4VgJQYud3P08mSfeWtoKTznn3tOzJn8R:6fw1cy2VgJQvP0coeEFn8R
TLSH
T133E5D0639AABC868DF7B44F395C26290743B55A0BC0B71BD16F05DE28B7098B4361BF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher-ui-jcef.jar

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\components\launcher-ui-jcef.jar
Size 3.1MB
SHA256 a58febf4bc81c3c3e1c0c9af2cc6fdc9f5a467012f604de413bbe8e3cca27c99
MD5 915fc3fdcb6f64295b2fcb1f83131957
SHA1 b10e0fb02052fdefd79018b50d517b8d900ec469
SHA512 3b9e8b0126b0fc0e9fed2981b4233fc5344a00909410e451bea2ada796fbd9244de7b52636b65ef343ca846c7883f3e0cf850eb0048883a40f52e242c8d202a0
SSDEEP 49152:MeAhij4Z1Z3cnKZbCDg3P4Y00kcKE63Yu1nCUXAd6BoKTznn3tOzJaNL:KhpvyL0JF0X1nCUwGoeEFaNL
TLSH
T16FE5E063DA5BC868DFBB48F395C26294743A15A1BC0B71BD16B05DE28B7098B4360FF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\awt.dll
Size 1.5MB
SHA256 d8aec9fa3d8cca7ad1c91bb1615c7a1d78f934c681472a1720fed5806f35c483
MD5 be305a3acbc4ac9a2a197dd7f0d96057
SHA1 fb2987bc80018215677e70df4dd47c4e926b4714
SHA512 56938bd5fe9648d05553e23fe94d64554838661367a2c2eaf6b3a343b0d99a9d7fb465a87998b008f95e9f07abd5d6938e02cfa04895128cc5ee74ed5fb1fdf3
SSDEEP 24576:dd6hwaxhyw9FvztxsLpCBTuSBA1phy/yiogE0aE4F0hAiNcs7Y:X6GaxhfFbsMg/1ps/yiogE0aEQu7
TLSH
T184658E06E3A40195D4BBC2B8C55B920BE7B174191341C7EB66BACB6E7F67FD0623A301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\chrome_elf.dll
Size 1.3MB
SHA256 9a0950dfbe19fa0435770602c08a6844191f43371374c45fe83c0eb0cbaa151f
MD5 35ce9fb4e86365e7ed36df4071d14881
SHA1 3fd326411b453d38dfd101a7e55c8e1ef78f30ab
SHA512 f16c566539aff23f950379241e4958f7d6a4c74f5373b5ed9d866cb10910206886ca1dfe289e4a575d6fd8c7a9a488f4d270045f790bec2e3fb134962aab1c2d
SSDEEP 24576:t5my4VDw7nAH0bkyiuG7ndxJWl2ERc73k:t5my4V87A04ys7jJYxx
TLSH
T1D2558C17B6D981E8D06EC17487578236EA727C420B34AADF0290B7592F77FE46B3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extnet.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\extnet.dll
Size 24KB
SHA256 af778cb436829b60c4df394052fd5b9228735779c4f026c374f7fe887ef80103
MD5 89b3f660d4648d2318a2478cafc88960
SHA1 78163fbaf98d711a2c9d4a2b9f292b99b1c3756b
SHA512 1f6235e7bc277183f584279e3031d3091724054aebfcf8ea464458c0627479bf524e3f1d8eb58b02d8b225e67b90758e292e3f3d4038d706dff6a93045429d61
SSDEEP 384:oV18LnLTFTr7Uqk9WFP27xWkVbgWUlIx4c5WARmvV0FP27NBY3Yuv+a:RjLTuXEKxnVbgvqxN5XPK/Y/+a
TLSH
T126B27E8B976813F2FDE78A3160D29B17CDB1B690B76392AB1270C1655DF23223B09719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\icudtl.dat
Size 10.2MB
SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
MD5 e0f1ad85c0933ecce2e003a2c59ae726
SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
TLSH
T1B8B63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\java.dll
Size 145KB
SHA256 750bfba12a865b4575fe37536c6297e1d53080d5ffa22dd1c8a30674d4630414
MD5 25bd878db4ef4021cdc14adc44f5cdc7
SHA1 d22f12f8fb3e8e93f2c6264a844128fbfc0e245b
SHA512 6efff6d3b3b63fbe5f1bb6a0ba0275120ce6c07d3649e35900d6bbe20d788a255fe0df7d4ed4887b89dc0cd6a6d7597145379b77b06c0b847dddf793f205fbef
SSDEEP 3072:eWrFkKqhqQ68H6cB5mu/WNFsmcvMyYFosxCr1Pc/bKuKuK/P:N6xRGORU+7P/P
TLSH
T188E34B0BB30640A2F45AB6B87019810BD37A34A1512DD3BE43E58A9F9F6F7317E87791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\javaw.exe
Size 34KB
SHA256 5b5702a2a82a2e9d363d97b8afc794ab1cbb6533aea20c547281bb19cd99ff3b
MD5 d51c81d9b08e0ac2f43c993b7af7fbc0
SHA1 21bc2494a72d5f021f5512c1bc5ffdeeead955e9
SHA512 fea29704057e9d4e8de97acb9af4cb5a2cca3c2019b192f88c93a9039a6949f85575cc42b386db32f294b7865093c10c56298d3ff38aa29eaa2cb3e3a8d0bae1
SSDEEP 768:iXNZ2osmh5KKxnVbgvqxNdeJLdvtK/Y/+5:iXymh5KKxnKvKNdejFK/v
TLSH
T1A6F26D0697161132F6854C3460AFE3DEADB46D76FE72CCE61294B87ADCB03612E0625B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jawt.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jawt.dll
Size 22KB
SHA256 bb749b1d78ac677563b632352acd29dab17e30f48b124221ba97d386c3b4c562
MD5 7363dd5de7d5bc07db4733eb3bae3bbe
SHA1 7ca2793b0570a37ca7142e30d808342db886f5e5
SHA512 095e9a7f7f324d4ab224b9c7a548a4701d2facc0bbc90f9cc7fadf959b06a582e929f14db7bc099d8961ec5a340f43a2a75bcbb9bd9626c9019eb6a9d7e8a4fa
SSDEEP 384:OdyySe1G07nAeG4IwFP27xWkVbgWUlIx4cBWzPHcg0FP27NBY3Yuv+fRm:OAy1h7Al4bKxnVbgvqxNBWHYK/Y/+f8
TLSH
T176A26C8EABA81772FDDB8E3060D5CE1B8C70B7A4F79392D7526086716D913263E0870D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcef.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jcef.dll
Size 994KB
SHA256 bdc0bd23f783bff191de8cb386d611494b0aeba457c5882babd8fb1a766723e3
MD5 65ab5844edb988b66155c992c5d49632
SHA1 cae8122bc60473988fdc647dd2d889f6465668b8
SHA512 f60f8cf4356b1836b5d2ac45b88fbddaacdbc92449e9223c04a365b94a14d142d4824aa5460aefafe6f5c8905c5b6834757f03db32ab10351479f488501b5d0e
SSDEEP 24576:p9H++wLhmCAz2P9hV6SDum+NGLdaDhb6nyw06Xthh84Ybo9Jm6LP5P74W:p4GpEthhDWEw6j
TLSH
T173254C1A72B800A8E1B9D97C572BD90AF2B138471360E7DF51A6074B6F5BBF4517E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jimage.dll
Size 34KB
SHA256 75784d2aac1cfe2227cf47148d3d78e84ce0e24a3487c900e51cdaee0e3a5928
MD5 e5b62a6c37241b1df0da6deeea877a3d
SHA1 e2903c0ccd7c2246346fb377e62a6563ef3e8a46
SHA512 d66823278c265fce34c2b74d138a6c892e21b4e75e792ede3f800b6093f4970fedc57e50e7694d51aba4ac5e561c2e08c2d6a1435e6ebe6f0a092d72c8c208b3
SSDEEP 768:NM1nW0iqnlFMGvLs+6KxnVbgvqxNpK6Uq9K/Y/+a6:WiqnYGzf6KxnKvKNpKQ9K/Y6
TLSH
T107F27E5AA7686666F9DBC93880C6DF1BC9F1F591BB52C387531143AA1F723603F1830A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\jli.dll
Size 88KB
SHA256 fd9bf35c456499186a8ba5b551ff335a55e9a83fe03300c0b3329558779bcb95
MD5 735746e1dffc9ef14e9ad3f04907d6cf
SHA1 575f1a338a6ae2b47d50414df9391b16cc617e34
SHA512 def43934818263f6608b9c92daafb8acf2129413ef2b4954d5278f9cb330f4b80f812f42bec3c525add4b6db5f38e9cb172fa62af5001aa569a2a64a09971f90
SSDEEP 1536:evawtZ+pqZtq7hXPLqoN+AzBcIOddzXtf61s+KxnKvKN1hxK/e:St+pqeFXPLeAtSddzX1+s+KuKXK/e
TLSH
T179938D8A53A022B1EDF6C579D5B5960BC7F0B0963712934F037889A60F633763E18BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\msvcp140.dll
Size 565KB
SHA256 d09d9df70b56d47ca89ec2766ee6ce1b1699dc8305edf8e1da5f18ee4b9963f6
MD5 f1525f46244224826cea928f11de4969
SHA1 96c25a83470091ea210cb9b4ed85396cc250bfdd
SHA512 39234638527a4c14c68a95b32674a8032b5ceca27a1ce3df637462e6e95d49118b6fc277d77c93131dacc0dbd19d50422cc7bc8a0d46245fc1c0567a4ac3b3ba
SSDEEP 12288:Q7dqZ1EqSGQEwkcz6sm7UtgZ/29z7mnuMG7NaekWdgJMKZ+h7rUh0wvaQEKZm+jW:QZNg+h7r6iQEKZm+jWodEERAc7I1
TLSH
T11DC41923B74D01A0E196A3B8A1C38315D7F17C9A4312A3C792FB96AD2F573D5AB3B150
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\net.dll
Size 96KB
SHA256 4fcd85589274d40029f7849f5fa8e927cd96343b36cc92a8eec10108a101f853
MD5 a9560d6be2de28abcd7c5e52bcd6ba3f
SHA1 671303db6405b181cd4d5e0a782ad39b58a0fd6c
SHA512 f1d42a9bcf311b2b32ebf34975d6ad1441fdb29ffb479e77a6102b148dafb7b2b4fbc69d92a20c3c52a5e26c2dbcf9f424cbbc46e90fe28c0225eeff16a8ea7d
SSDEEP 3072:YsIXGaipcLAEnu2d3sE/HWl6WWYpc5qFcXXckuKuKmkK/f:YRGzKG+j/WlZFcc27u/f
TLSH
T1DFA36B05A36820D5FCA7C6BC85828617C7B3B4B07641839F13A6C96EAFEB7713E19741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\nio.dll
Size 79KB
SHA256 7877cf696331ad4a65cddad250982c7da7ffb20573036c525c95569e228585b5
MD5 4d8c82a049256f8aa654023a1eee692a
SHA1 4bf66e82b2f6de6eaea8a53178d0cbf8e30246d3
SHA512 5949133d7ab4b6e01bb5477dcf0dabdfa3e9eb55e6d2d058aee6f870374a51d8dae8350157a14818f4916342f98b92c8847ce8cac44cc6fdb1acd5b857afe3e0
SSDEEP 1536:bdtr8zQDUJA/cKIrNN3RrhJD1qNp8KxnKvKN1oK/dK:bdtqMUJCcKIZN39hJDop8KuKQK/o
TLSH
T1D5835BA64374459BE86AB53C429A4747E732FC205500A75F4268CB669F2F3B33E3D782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvdaControllerClient64.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\nvdaControllerClient64.dll
Size 271KB
SHA256 af12a899c87bfed3c86b06aef8a4ffb839c7ccca76ff7d45f8790b7a3ff14491
MD5 1b47f997f81f19a4d584b921dea0e24e
SHA1 040637cc26c4bacc22c611c8f6e0ba1a23059ac9
SHA512 1b89d674ab3589378d4a1d312f5c59f257b2f319f9de9fe5c77f735dc3219be5219a81e61b200baf3367a834900dc94aa0734e70562c93f24d8e30fa86a263b2
SSDEEP 6144:T5uGIDi7wt2mFd40+oEK2BLJriohEaX3t3/37A/X:TsGWht2Y4zvLJrioZP7A/X
TLSH
T13A448C1976A90CB9ED77813C88475A05E7F2781103B1DAFF03A0476A9F277D0A63EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\server\jvm.dll
Size 12.1MB
SHA256 279bdc9c37b66ebe4402ccc7974ec33d8eff75e3f14e87e54571dba1b09afd4c
MD5 68ef297bbef990f45758439917ea7878
SHA1 76b0bd9c98cc990eeb2473cf827a0d24fabdb7a6
SHA512 b51b00dc2e481fa2bd45332991324a33d771c4151d2e94e4c86cdbfe03db7816a05c91018c4c2c304892824a6c548bb1b5d4c323f856ad2ed8ef68adc00b8bb4
SSDEEP 393216:jjzcmncKCRXwJZdW2FD3qjuGYU950YROKDnZ3stwwUkIwyX9jigCwyo5utiDMfJx:jW+
TLSH
T17BD67C5BAA7480D4D42BF178C62B5A0BD7F2B45493B4E7CF21B406496F23BE5663E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\sunmscapi.dll
Size 48KB
SHA256 7f7bc73e00c640d741e567d403425594cf087a47c0f48b94fa1871421f09b143
MD5 5afb8a2819cf9c4b1a6a4fa90b74eebe
SHA1 aada5b931660cde7d8191f531257d982f64663a3
SHA512 0b17722fafcc743b4185b677d35c28c1b333ae1c01d07e2a6be849737dd5cac6bc46d13e27bfb05db7f8567cc78082393e753a0c20c3f12f2fbfa849adf829ea
SSDEEP 1536:ZecIM3fGT4IQRs0mrD86dwQ/2KxnKvKN1fRK/V:ZI2GT4Iv7dwQOKuKfRK/V
TLSH
T184236C0BD7A500E2FCE3C9BC8056961BDA71F895A162C78F0350CA199FA7B71B72C715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\vcruntime140.dll
Size 107KB
SHA256 289746ec5a3c7947c4db77a3ff01915d31d153d88aadc5c48388406862962fc0
MD5 88be0cced6adb4bd149442fc7429d925
SHA1 d8b06d67c7a612563979237fdd80046493a10415
SHA512 86f74a9287e6fe52dad991a650db1d7780692b535c8215a62be038bc0293c0f465acc5d71c614df164ce2d8792eb77405eab3c111ca5eb13e07d393251a779d5
SSDEEP 3072:yS7mylIhkoQpdK9H9YOecbKV02pKuKiK/E:LiylZoQwH93ecbKCR77/E
TLSH
T1BDB37C5A766442B7D0ABC274C1E24A1BEB70B880977093CF03B286665F63BF15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\vcruntime140_1.dll
Size 49KB
SHA256 fdc5e49d37b831c213f5ba43b0a1fe8f1a0902df6336610692535017676ad064
MD5 f5747ebbd71fa84455e924af56903a76
SHA1 3612e426cc53c1d55579c46f7ea879b9b2316290
SHA512 4e8d5f254a40e9ef75e106f8d316a8539eb25ea5ad695b888819ebf91aefe6b361f4b95f5d7aff932cb58e277b61d1f6bf126b248810d5626fbcd5a019bff1ba
SSDEEP 768:ECm5yhUcwrHY/ntTxT6ovF7Iyw4Bl9ziKxnVbgvqxN5UlK/Y/+3:TOHc16opIyw4B3ziKxnKvKN5UlK/t
TLSH
T111337C95537C9152E4DFC97090D29F27EE38F5A1B741868F06A0C1692EA23E0FB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\bin\zip.dll
Size 88KB
SHA256 4280315aeb211ecb1ce780ff4ffdd138d9f5d317694e8fa54fc627fffb283a21
MD5 8553f0256b67ba47b467c0f20bebce54
SHA1 f7d744de6026d2b6fe435ccb1561c5aa33dd6e3b
SHA512 a52d1fb172961afa0290498a28d24fce95b6f0ee86e918ccdf1347a43942d710bb346cc6375879b6372f7e63fc51b666598ac8ef2cf4af515bf72bdff66325cc
SSDEEP 1536:MLOqJYRrxeHblz63B0xCvqQBKf9sWjIOQIO6WaoHeFQoKxnKvKNNYK/:MLOqJYRrx29yqQBisWFG6WaoHiQoKuKB
TLSH
T158939D965A706362DAFA81B085F28A2FC375B05062C5578B534CCB9A2F433623F493FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.properties

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\conf\net.properties
Size 6KB
SHA256 5bc726671936e0af4fdf6bed67d9e3a20a92c30b0ba23673d0314baa5e3ffb08
MD5 385443b7e4a37bc277c018cd1d336d49
SHA1 b2c0dfb00bf699e817bdd49b14bc24b8d3282c65
SHA512 260afc7671a1dc0c443564f1d10386f0b241bb53c76df68d8d03f1d0b1ceaf3f68847ab3477732c876c2b01c812ef7521744befe88e312f3aa63164b608b67a1
SSDEEP 96:6ATE+VEtGObfObz3Ob6Onte3CO0V+r/aJ7SFXtqBZUT+gTzDuBnZkRnF:/LVGG4f4z346et5m27SnCgTe9GnF
TLSH
T127D142C2FF46B72543A9C291E21EA7EAE32C903D5C33757831AC890D2619D76427F4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\conf\security\java.security
Size 57KB
SHA256 d0e59d5c3bbb69ba4db235bbc9f7d0bbf966752f3ccf1e774fe3a8c0bc9b54d9
MD5 fb2f8510dbdc58955528789078a8350d
SHA1 664f61e0bf8a7a4382b703620e7c1b545d8ecd33
SHA512 112a5d610b186364d7e3fb9e364f9dd89e271e29ceb5eba16ad72e9a4c23a4dcd8ac916324361c23b9a00db777039600fcd78178e3acaae893f3bc842dfd6e71
SSDEEP 1536:r2My8SiqOpjt1p5/jTGHu1UoQhzYKpNnCF:3qOP1D/jTGO1UoQhcK3nCF
TLSH
T17043C422BB897B710AF211A363AEF1D9E76DA12A36721150748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\legal\java.logging\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\legal\java.logging\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\legal\java.logging\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\lib\chrome_100_percent.pak
Size 674KB
SHA256 47e14eb863a9ebec98dfcb99bdbc88f075c71ddc27a17b108e38fd3d70cd5b8c
MD5 fd80a5e69cc456bdcbf71ce4820e950b
SHA1 47d18753f93c0196f1c0595968e31ad5c7359288
SHA512 cd3ed3390c3dd2a3f5763e562151ad008f6f0f366f843fba143213c81f1b9b3aebda5d7f24c5b20e3e95993eae6f5995f1a14f3eb635219bda727590a267db50
SSDEEP 12288:XI3H1fJqjzgsz5B0GDJQrnKs8SNP+QSsSilRBiNz401+gIXm4pboO0TehErw5:43VBq7zEEmPLSOiNz40AgUjpboO0TOv5
TLSH
T12BE412D773B4EC3DEE9B1677926504B1FC7345281AA2010B178EE87A6A6374898DD3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\lib\chrome_200_percent.pak
Size 1.0MB
SHA256 b2c8e8d23ffee4f111ca39cb71757d37eb17d69e04536bc47daa252d97610248
MD5 fc1793c3f0b0dbf4557b3a15b2af91f8
SHA1 1e4c3617cfb860c5de8ca15b2bd02c42bc9b3ae0
SHA512 b720dc7c30947217b6d97f8861efb5db78d936aac3dc8354f325cd8aa0ee9b983e3774d486384ef1c2fdc227631dc593fc26576ab6a9ca9c019e672efdd0dfda
SSDEEP 24576:+l3zBr5zLmmibkFR8+mZR9hQumegvQtSP0AUwvdbbag6edhOLoeu5:Q3t53mNbkFRJmH9hQRhQsP0AJvdbjrOi
TLSH
T1B23512D793B4CC7DCD630BB3925A01F1FD75103A0AB6510B07A7BD3A3A5668899CA6C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\lib\locales\en-US.pak
Size 453KB
SHA256 aebe5b97f97e07ccaa6e3f4498b739466ed46d63b9e749f7933251d36dbb75aa
MD5 7120e754ad53d69d38b207eb9cadb876
SHA1 2f3f1cf3d88cc2d79ae0be1fff442f9acc679ec6
SHA512 758e86c15fcb3132be13a018de429210b9b4d9f9ca625245fd24f5ad850bc44f413b40910be774c7c19c11b22d781adef183d3e6f43c5909fc0e6cfc77c989cc
SSDEEP 6144:K0xkNNav7rgS0w3jjMP9eD3D9faYLbcNx5FSZngP/eXPwp:K1NkvvljMY3DzA5FSHPwp
TLSH
T172A45C1FF744122A069352627F0996A2FF36D06CA35112563CBD812C33B7B66C37B6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\lib\resources.pak
Size 7.8MB
SHA256 4fcd2333f97ffebc538b476183ca6afefc8ca39b2cd6650a7221a55aecc190a9
MD5 ef1290bec69ed21acbd39af39bb819c1
SHA1 0af1bfa5809c46ad10bd918eedbf1226049e0a74
SHA512 eb79244f4637d32fa037334e96130552676cac2aaacc335fe5c1828d9fdc4ebce4ffff3e2e07b2b1fd38aa2df91c6ff1fd3670a760746515e4f02dd8c5fbc043
SSDEEP 196608:TsmwTAnSwHi153eBbKRcQpkrNa/SQaVN2wuJ10Le+oT:gBTmR05u8RvpkrQ/GN2wuJ10hE
TLSH
T1258633D3BBE8603FDC445777425C46350B2CE58A2A221066309CB69DFE3A249AFD51BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\lib\tzdb.dat
Size 101KB
SHA256 108a63fb316b1eaa8949f3ff7265c2af0402c9ff13f360578e658caaafc40faf
MD5 c054908b3f007234696a2c13f2cb58be
SHA1 330a69ed889539d7b8f9ec8bcb00f49b5ee2895d
SHA512 64f3c996f668e200acec60138d027fd60523c35e5de60dcca915101c2c069f1bef6783f34584b2212a5c140061d65cb23d889bb2cdd67b57014c66020e777a7c
SSDEEP 1536:c0EEMEBHNPdrY2L/rmjAGubVj0Lg/////PhbPdJPNL0mOTLMXjbF35a2yiz:cCMYHNPdrtDxbVj0MhzdxgTLw42Z
TLSH
T1D0A3A2757F7050B7B2CF4222262B5B93097DAC816FC3080679B5BD4E8A76AD6603335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Roaming\.SummerCraft\jre\win\lib\tzmappings
Size 21KB
SHA256 36dc51c4bf787f640a4b45cbb84ab6954f6e595cbd3617c2f5a4e1e607b38bff
MD5 b02ee240a8db902961fe886a19beba16
SHA1 c52c42d591f4c650b629e6b374e967e211fb5aeb
SHA512 024811961511b7182860ed03a5670f82412a45d005a1db0876f6b0c9af7e96c104566abff0ebbded11a780349444214291f439039d20fb92071c7dd24bda0e23
SSDEEP 192:3nqW46ARn1+RQ7wbNQQSaapvQZglEcCDqvOCJqGiF3yzA6bb/KOFmYXKhJmBW:3nqW46ARnGQqN2KhcQ+q5a3W
TLSH
T1F9A24386B06662D4C073EC0D7B527AD3F886F3C499C69A4D2943C366BD019B767E1837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1500-5-0x00007FF6BE2D0000-0x00007FF6BE4A6000-memory.dmp

Download

memory/4744-882-0x000001FA109C0000-0x000001FA10C30000-memory.dmp

Download

memory/4744-578-0x000001FA10F50000-0x000001FA111C0000-memory.dmp

Download

memory/4744-577-0x000001FA09490000-0x000001FA09700000-memory.dmp

Download

memory/4744-885-0x000001FA10F50000-0x000001FA111C0000-memory.dmp

Download

memory/4744-883-0x000001FA09490000-0x000001FA09700000-memory.dmp

Download

memory/4744-881-0x000001FA24060000-0x000001FA24145000-memory.dmp

Download

memory/4744-565-0x000001FA109C0000-0x000001FA10C30000-memory.dmp

Download