36ebd241c8aca12a0c09f906082fb271e045d04e7b8455ec71523eef49bd6475

Analysis

user interaction
yes
max time kernel
98s
max time network
105s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 04:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FreenetInstaller-1506.exe
Size 78.3MB
Sample260628-fmrb8aft3p
SHA256 36ebd241c8aca12a0c09f906082fb271e045d04e7b8455ec71523eef49bd6475
MD5 4bb2fc0a4a124a77c0a740b849ec4a0c
SHA1 c388d8df9943dbc692ef8425f9cfc24fc9056211
SHA512 0cea9bc94a5051409a3cfe391c76207fe0cb0316cb5f79f966ad263ae1a0e909d788078efcc8e952cd491fa753c8a2843b608274ef42bd7982817d771e57627e
SSDEEP 1572864:uPIoPAWBoep1G+pbFutWxeXlt5Ioy9mV52FTdmrqH6xul:u1nBFp13VYKLaI5Zaxul
TLSH
T12608331DB2954539EDB216371CF6B610593A7C70D632869EE390B83C8FF22A01EB571B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery installer persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\Freenet = "\"C:\\Users\\Admin\\AppData\\Local\\Freenet\\FreenetTray.exe\""	FreenetInstaller-1506.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 4 IoCs

pid	Process
3948	FreenetInstaller-1506.tmp
2508	FreenetTray.exe
2296	FreenetTray.exe
3264	freenetwrapper-64.exe

Loads dropped DLL 3 IoCs

pid	Process
3948	FreenetInstaller-1506.tmp
3432	java.exe
3432	java.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreenetInstaller-1506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreenetInstaller-1506.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3432	java.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5992-0-0x00000000007B0000-0x0000000000892000-memory.dmp	innosetup
behavioral2/memory/5992-11-0x00000000007B0000-0x0000000000892000-memory.dmp	innosetup
behavioral2/memory/5992-173-0x00000000007B0000-0x0000000000892000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3948	FreenetInstaller-1506.tmp
3948	FreenetInstaller-1506.tmp

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
3948	FreenetInstaller-1506.tmp
2508	FreenetTray.exe
2508	FreenetTray.exe
2508	FreenetTray.exe
2296	FreenetTray.exe
2296	FreenetTray.exe
2296	FreenetTray.exe
2296	FreenetTray.exe
2296	FreenetTray.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2508	FreenetTray.exe
2508	FreenetTray.exe
2508	FreenetTray.exe
2296	FreenetTray.exe
2296	FreenetTray.exe
2296	FreenetTray.exe
2296	FreenetTray.exe
2296	FreenetTray.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5992 wrote to memory of 3948	5992	FreenetInstaller-1506.exe	89
PID 3948 wrote to memory of 988	3948	FreenetInstaller-1506.tmp	90
PID 3948 wrote to memory of 4472	3948	FreenetInstaller-1506.tmp	92
PID 3948 wrote to memory of 5884	3948	FreenetInstaller-1506.tmp	94
PID 2508 wrote to memory of 1716	2508	FreenetTray.exe	99
PID 3948 wrote to memory of 2296	3948	FreenetInstaller-1506.tmp	101
PID 2296 wrote to memory of 4948	2296	FreenetTray.exe	102
PID 2296 wrote to memory of 3264	2296	FreenetTray.exe	104
PID 3264 wrote to memory of 3432	3264	freenetwrapper-64.exe	106

C:\Users\Admin\AppData\Local\Temp\FreenetInstaller-1506.exe
"C:\Users\Admin\AppData\Local\Temp\FreenetInstaller-1506.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Users\Admin\AppData\Local\Temp\is-M3DWO0XFSD.tmp\FreenetInstaller-1506.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-M3DWO0XFSD.tmp\FreenetInstaller-1506.tmp" /SL5="$C006C,80769840,865792,C:\Users\Admin\AppData\Local\Temp\FreenetInstaller-1506.exe"
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe"
    3⤵
    PID:988
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe"
    3⤵
    PID:4472
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe"
    3⤵
    PID:5884
- - C:\Users\Admin\AppData\Local\Freenet\FreenetTray.exe
    "C:\Users\Admin\AppData\Local\Freenet\FreenetTray.exe" -welcome
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
      "java" -XshowSettings:all
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Freenet\wrapper\freenetwrapper-64.exe
      "C:\Users\Admin\AppData\Local\Freenet\wrapper\freenetwrapper-64.exe" -c wrapper.conf wrapper.pidfile=freenet.pid
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3264
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -Dnetworkaddress.cache.ttl=0 -Dnetworkaddress.cache.negative.ttl=0 -Xss512k -Xms60m -Xmx512m -Djava.library.path="wrapper" -classpath "wrapper\wrapper.jar;bcprov-jdk15on-1.59.jar;freenet-ext.jar;jna-4.5.2.jar;jna-platform-4.5.2.jar;pebble-3.1.5.jar;unbescape-1.1.6.RELEASE.jar;slf4j-api-1.7.25.jar;freenet.jar" -Dwrapper.key="TzC4uDetnTi5sISt" -Dwrapper.backend=pipe -Dwrapper.pid=3264 -Dwrapper.version="3.5.30" -Dwrapper.native_library="wrapper" -Dwrapper.arch="x86" -Dwrapper.cpu.timeout="10" -Dwrapper.jvmid=1 freenet.node.NodeStarter freenet.ini
        5⤵
        Loads dropped DLL
        System Time Discovery
        
        PID:3432

C:\Users\Admin\AppData\Local\Freenet\FreenetTray.exe
"C:\Users\Admin\AppData\Local\Freenet\FreenetTray.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  "java" -XshowSettings:all
  2⤵
  PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 799aa05d23d7dfb1177f993cacaba5c79542de1941a67dfa5192994ca3569454
MD5 8f9fb6973018d90f2b2daca6462e6dfe
SHA1 0c31f6e04828067920d095812f709ac81d1dc008
SHA512 3c7b86f48108a338265860939a2447d67846c549dbd7bbfb5c46884a742c81a40f94de3c912d48482b5e984a1809d7d7889a1431624d1b9ad2b07be2e31162d2
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 1da71ea9919f650ee58951647873d56ca6e77e973313f5c629ed57c0c9c6aa36
MD5 cbc6c107a79d8683ee5424466986ea23
SHA1 a853abb0280f3247626796474d81cde6bf086968
SHA512 4b8d8b1a7c5dd44517ddaf516bb502b006c5ce9afc8c4de2d6af5334372a8d07081db63673216e73cc912b8c7b32f549d375c48b5186db99a6f2f1a75ad56b5e
MD5 SHA1 SHA512

Submit Download

FreenetTray.exe

Path C:\Users\Admin\AppData\Local\Freenet\FreenetTray.exe
Size 492KB
SHA256 787481787e292578a7852ac7842dc97f6eb1ec4387b5b65beff9279632069e96
MD5 ce347a357c0f18fbf820c58a71af261c
SHA1 7525b9bd9a7b6ec3266de0efeaacd7496b0f2479
SHA512 7082064ca9432a8d97c837b58e78b2436344017e9957f4e6df10cab0fa4c7823ca376f452a690bd1ec897994722b35644f66013b42b2ad6a8ee273992e13b6cb
SSDEEP 6144:Y0PwrfzIwiU07fC5tj8O/+3xV4PitfXXkWqTCJbH85ob+ip:Y0PwrfUwiUmC5toOG3Df9OM85bg
TLSH
T1ADB49D20F3A5D049DAA54A318C3AD1F40372BD2BED11DA5F35847B1E6E32B62872177B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FreenetTray.exe.config

Path C:\Users\Admin\AppData\Local\Freenet\FreenetTray.exe.config
Size 1KB
SHA256 0be498bdd67e489b9d58847a9bdfec2a958d057b8cabc1bbc4b986ebeb303f73
MD5 ba08fd670746b802297eee7a9754d805
SHA1 7789bd42788fa3a13374a923db20d23e782f486d
SHA512 58322cefabd3ef25b44a5ac7c61387ad8a552c86785c2f11a45ae035a6349f7cd7577e63aeda30b41d1bece17559394525f2c937556ce672c6873e8cbbcebdc1
TLSH
T12F31F91861C0BE9B45726F31D6314681EEF14667517A70E4B4AE326B5F308CB479336A
MD5 SHA1 SHA512 TLSH

Submit Download

bcprov-jdk15on-1.59.jar

Path C:\Users\Admin\AppData\Local\Freenet\bcprov-jdk15on-1.59.jar
Size 3.9MB
SHA256 1c31e44e331d25e46d293b3e8ee2d07028a67db011e74cb2443285aed1d59c85
MD5 7c7e9a51e0c86e26e3cc39b2ed678c4f
SHA1 2507204241ab450456bdb8e8c0a8f986e418bd99
SHA512 6f626269d8a4569141fee47dc4db3d347bde227aa4ec23a4afdad69c3f33896a963138c8f10783f9f5b03cc7f3cd072fc7a13e6698c3d33f8c9fd322cedadb9f
SSDEEP 49152:X7FChpelUX6JZV1mh0d8n+KtzXvK0/oJkBhpIV4+nNg9zLVmoeZmfIS6CmsEed8a:LFcpIU2ZVC0NKtzXxbraVj6soeIIpsN
TLSH
T17716BE1AED86C01EE083D0761D82EAE7BC3D42F4DA85EA2646D113ABF454E9D47637CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freenet-ext.jar

Path C:\Users\Admin\AppData\Local\Freenet\freenet-ext.jar
Size 4.5MB
SHA256 32f2b3d6beedf54137ea2f9a3ebef67666d769f0966b08cd17fd7db59ba4d79f
MD5 c25f5fa72e83a56f4502fca980959439
SHA1 507ab3f6ee91f47c187149136fb6d6e98f9a8c7f
SHA512 9735f1ce4ec11f074484f6ac9692e995ec245bc74211e74b228374b08b2bcd9ecc9f564a969a86d5fbb11de1291ffafad419d2decc22f1c18a2ee16fc59bbdb1
SSDEEP 98304:M98/CUQrZY45/XgnfE+iXFvXO6wUazB9r+6eNTnXmM5h6LBh6N1vD9:cssZYLfE+SFv+YKF+6eFnXRcSNh9
TLSH
T14B260223909C15ADDD3B1232A1F26126346E06FDD047746038F466DB6ABEC9DFB0E729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freenet.ini

Path C:\Users\Admin\AppData\Local\Freenet\freenet.ini
Size 158B
SHA256 1b219ad9d4dbe178c95ae2687e411706589ff3776c3bb88b7803577aec8c0a63
MD5 d9f5d9b7ea8232581c640ad20472f5e6
SHA1 05b74bff8e48b49062af30fe13d76d00aa3ca094
SHA512 1af2fb868ed5332d00a22d32b321bf128842b4e935c2c12dd99b976768849fc83accf7ccbbb9811512a8362d9e59f2fa0b5efd00ea22a8aaa8887812aa31d6b1
TLSH
T180C02B17940EEB1582FC1201344405F2104B2D9F50ABD84490F09E3EFC272627F0F00B
MD5 SHA1 SHA512 TLSH

Submit Download

freenet.jar

Path C:\Users\Admin\AppData\Local\Freenet\freenet.jar
Size 6.1MB
SHA256 81339fbc0273eb5d6614e152e6447eb37f83316e3fa3265172c01b01291772f2
MD5 4055505488f25f9734e94f55b08df372
SHA1 cfa23c3fb4477271d41f1ab0c6254b34b669a444
SHA512 0a02ed278279a552c46f91bbdc06a9bd5c859fd37940e293e2c6790a1a6f2015e1476a1097a766f0928ef5f087a564f1f4fed818ad5706a1fe865e87a7865956
SSDEEP 196608:FQCg2rK4LcyxQI4W96x5zF2l3RMNJab1XoIJW:up2rSyxHX9WF2JRUM45
TLSH
T12B56F172E288867ADB37DA3095425C6BFC3F329C945EB09F35B5481FC8B2549C389399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna-4.5.2.jar

Path C:\Users\Admin\AppData\Local\Freenet\jna-4.5.2.jar
Size 1.4MB
SHA256 0c8eb7acf67261656d79005191debaba3b6bf5dd60a43735a245429381dbecff
MD5 7af79401c6b29460994545939be50bb5
SHA1 35d000afbaa4ed425d91873b40f4df9b8236875b
SHA512 41d3b175af8aca64dced867f137149019d3a2c0e45eacb84c3a7d066b1fcb66de154c0d0739835df22bf6609f7e779e017878dd27452c59213368cf73fb83f2d
SSDEEP 24576:A5H4PGUS2CiG5UumNRE9l82M7t5oWQySKmpzitZGQicwDwaFAq0UGMAiYbc:2WGv2PGWumNRI9KQISK3ZJLUGniYbc
TLSH
T1F6652367D0DEE61CDE631BF340D5129B751F02EAC4812AB59AD41CEFA22980F47399F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna-platform-4.5.2.jar

Path C:\Users\Admin\AppData\Local\Freenet\jna-platform-4.5.2.jar
Size 2.2MB
SHA256 f1d00c167d8921c6e23c626ef9f1c3ae0be473c95c68ffa012bc7ae55a87e2d6
MD5 0f745823ee1bef2c2d55629b0844f05d
SHA1 741853c07152f6c0fef5194efa6b2dabac22e9c0
SHA512 440e81a7c7ded403c3190d81dc372a6559ffc4f9cb13d7d07328f25c34887f2df594652aeb04308ded8b473a5422ef45c58c7d6d2677ce541372fb52afc7a792
SSDEEP 12288:YjXhoqTB8HCXw0OqUtqxfP6M052G8Du3/+i164NzK2gclfUAkf5h+XZTETGbOBWt:YNoqmiXwl5o/I2U1tK2KBnQ
TLSH
T148B57427EA63CD62DFB48AF7A2C303491637A5206D0B86BD47C46C91DFA15475BA0BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pebble-3.1.5.jar

Path C:\Users\Admin\AppData\Local\Freenet\pebble-3.1.5.jar
Size 310KB
SHA256 d253a6dde59e138698aaaaee546461d2f1f6c8bd2aa38ecdd347df17cf90d6f0
MD5 d01954316286253ddc360585affef6f9
SHA1 0bc7d795cef5281a4f75d00df2607d78de0ae4bc
SHA512 9b7733df0439aadd0fcf383663864e966130d79cad7d5d9e72046bd9d691e6bd4ecef7e4bf9476ffc89f5d6faec799cd45da715ec7c39a599432f26f56616b66
SSDEEP 6144:i7m5D6mgIDuPaAAmwzKTao3nbQ1ADfXLkltpm78U1ouAh9PIGLHBmnIwxvx3BbZj:2mgIDEdvzTaoLQqDfXGv88U1SxDBhwLb
TLSH
T1AE647D73AD8C77E7ED3BA0B7C508B432F1290AB5F069505A679A095EEC348050F1AD7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JSTUN.jar

Path C:\Users\Admin\AppData\Local\Freenet\plugins\JSTUN.jar
Size 43KB
SHA256 1e3dab32c3997018f4a004a82a44fb7b910bbc08dcde9551a1ba8e504a0c1302
MD5 c9aec3aa63b4a31d7e4e74bd4f8a79ca
SHA1 4e5bbb73a809cf5feace14d2deafe9425dbcaec1
SHA512 8c85f17726255d6802a4d7333dbd634c3d11fcdad046afb424cb518e9f9b04091b4d726bc2aaf013d2b60a262d869cce1131eccb1eef44dd157a650ded362dec
SSDEEP 768:qT7KN4iRTpWB5pKHO3o2fXLtxe3SqeazGdlxjMeop0U9asLzyzFdm905:qSNFp+zKkff5xPvzAe+9aMyOq
TLSH
T1AC138D08538C1934EC760379D259B5D328FF02BCB4C6B27587785A4F2D0E8BB5A77A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KeyUtils.jar

Path C:\Users\Admin\AppData\Local\Freenet\plugins\KeyUtils.jar
Size 107KB
SHA256 f3c60e85d1fec26038de459e71d49e955e38506d4bbee1931e4d00746e1312f4
MD5 23db41e67e1c94d10f121e2d0a3cf20f
SHA1 7be3b366ee3fb3168fd65a69f32aa4d235a5bba5
SHA512 8f336d6ad1425bd111f8e55becd6a4f94628014eac392899857f7562c3603eb5ffca2a4b4885b2c573bd20b30b51f1b6ebe401ffb4b441dbe33095b5766b12e1
SSDEEP 3072:z0ggiyLuE4hYTZ6MJbAkZv/Wdl+MB9Mp3t:zTgi+4eThJskt/elpBOlt
TLSH
T111B3D01392C21E91D835553A94A5208376FEB3DCEB59FE3078B4724F6DF1A764E2B208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sharesite.jar

Path C:\Users\Admin\AppData\Local\Freenet\plugins\Sharesite.jar
Size 295KB
SHA256 7ca7d399111218519433b8614b585df87c97159028f9f66e20a7d7677af8d04d
MD5 d43fae3cb3a9e4d7f8e327c953c896dc
SHA1 dd8778377a8fc5dcc367be85ed78595344299c9b
SHA512 9081449e6b6acf66108e2654087d795ec898f8fad540b94766716d121950de1999fb5fdb050559535df6dfa23cfe657bfd27d04174af5c6df46d2bc7ac2dc5a5
SSDEEP 6144:Nn9gX0AqDkUkBP97QKJW+CalaeJrIbc0v1mbh8ipCYwM+:dKXR3P97O+rlaembc6mq/Ywn
TLSH
T1CA54BF2A119FB1E2D61BC3798BC4A643FC2EA5B4AC1BF1963874C2CB7C74C854653B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UPnP.jar

Path C:\Users\Admin\AppData\Local\Freenet\plugins\UPnP.jar
Size 180KB
SHA256 ecead06aadcf27b4aa05401feffa4d59949879a8713f5889b64f8186fa9a0a7a
MD5 21148499b26d8124af3ec155e4dff7d5
SHA1 ca7b1b87815dd146e9390fbc5defccd882dce2c4
SHA512 afe837a7db013f3931e7a2526273fb15b9f262803d68eb7fae8837945776ea10d52e3b2a9b86d3e0d134110964e1b7e0c91956876b4b450a8efbf9f5c280f6f3
SSDEEP 3072:ZdspGfaraQFAuNpAxRajK7qKMNkvvIviFGyzIUBTYYM1eaNGU4rKVNU8I+:zTar7WupjsPoyzIUJYYMTsUmKV68h
TLSH
T1D104C0135E841F72D2FB0635974022D3BCEF5ECCE2CFA22E7474954F68225B749626A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

slf4j-api-1.7.25.jar

Path C:\Users\Admin\AppData\Local\Freenet\slf4j-api-1.7.25.jar
Size 40KB
SHA256 18c4a0095d5c1da6b817592e767bb23d29dd2f560ad74df75ff3961dbde25b79
MD5 caafe376afb7086dcbee79f780394ca3
SHA1 da76ca59f6a57ee3102f8f9bd9cee742973efa8a
SHA512 5dd6271fd5b34579d8e66271bab75c89baca8b2ebeaa9966de391284bd08f2d720083c6e0e1edda106ecf8a04e9a32116de6873f0f88c19c049c0fe27e5d820b
SSDEEP 768:CkwPhOR4PpSvw6vob5IJ9eoYUx7eBr9HDhzCZ+8ylnm1fjiUNcS5cXeK/7DaeR7g:CRPhOR4B0reWJYURuHN4ylnaeSI4
TLSH
T16403B0B5DD3950ADFF0A30F6C16323FA372F5040497A162274A19AF6A43BA4B6F57B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unbescape-1.1.6.RELEASE.jar

Path C:\Users\Admin\AppData\Local\Freenet\unbescape-1.1.6.RELEASE.jar
Size 169KB
SHA256 597cf87d5b1a4f385b9d1cec974b7b483abb3ee85fc5b3f8b62af8e4bec95c2c
MD5 d95ed94e1624e307a1958ee105ccbf39
SHA1 7b90360afb2b860e09e8347112800d12c12b2a13
SHA512 6918e9579b06721942fdcd91e401f5b996fb4eac13056dbafdf594661f355a34874eb5266784bc2c4f82df9fdd9e219d71a96f52945a354f01665f85f8166bb3
SSDEEP 3072:OR+1H/44GIwq9rEou8NgA39Ijg7DdwTzy2R04gd6pGq8M3TAoAqdrf81UbPhq4wu:EO4NIRjAaSjg1WHWBdEV8MEoAqdrTbhJ
TLSH
T1B104F17BFCD7C72AE123553997E34D173E2D028AE08A1E16E09A9B51F074C19418FB9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freenetwrapper-64.exe

Path C:\Users\Admin\AppData\Local\Freenet\wrapper\freenetwrapper-64.exe
Size 521KB
SHA256 7cf3a04f2eb5b1a6c9a219f6857c2aed20960eff9fa7ea803aa35ceb4c165bea
MD5 e5c416c0f7dc1e9777d427ae0601f18c
SHA1 c23893c96822a62e8e722aa76d1e04d13d27d5e1
SHA512 b6b79dc9358d64851a662a44206b5719d0675e3550e9e1a362906a091ab04f1b8f5a3f3e64981f695b45422c787e7333744e574aaec32f4935f16f1e8d5a93ba
SSDEEP 12288:niI1UWm3c2XHq1pTLwT6g/HmxK5+YvIDQYzrGoXVh3b:niI1J/2XHq1pXKj/HAK5hvIDQcKsVZb
TLSH
T1FBB4070177F80398F5B36B75AD769101AA7A7C65AA31D6AF0310AD0D2F73A908D35F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrapper-windows-x86-64.dll

Path C:\Users\Admin\AppData\Local\Freenet\wrapper\wrapper-windows-x86-64.dll
Size 312KB
SHA256 7e0837cfbc356cf532715372d70507c6eabdecaaa347aaf510d914c6250bce64
MD5 d283e385c85cb1fc709e57fcf0372504
SHA1 dd898cabefa86c68c19ba6708719da18920112a0
SHA512 beb9e76bd16f96f016d60412d9a5628821e75c9feb84234f3ab9097882b805567e4c6edd2bc8ebc473f1c98e88b771eef91e27b2dd6bbd36749c32a229bedbf3
SSDEEP 3072:rgzN8IIFzAkfyJlD5qqw8NsZMTvU/af9lFAEu7gaU69ZI5buXrjRCMv:rguF65pwgsqTs/af99ucQ66IK
TLSH
T17564160673A049A9E4B3963FB9634611DAB27C165770D7CF13946E4A2F337E08639B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrapper.conf

Path C:\Users\Admin\AppData\Local\Freenet\wrapper\wrapper.conf
Size 2KB
SHA256 ab33f37e1c893f28407f00e26b027743dda11243efa62d9dd1b2ba528933d261
MD5 663128b342a5d146b2b86ae5c0fbfb33
SHA1 e890e8f0650eba0c2b04a8f511e0559443484673
SHA512 981ac6bfa07cd9885f5db827c102f4654048048e3da81081bc7956d29d02513e70d45ac50ff51afd3ffba94626446bbc69699d883229a8bb9771d58a852fefd5
TLSH
T18051332F49BD71B411E202FC74F9909AB53820FC43A268DD62F3049E4375A51B7ADAE1
MD5 SHA1 SHA512 TLSH

Submit Download

wrapper.conf

Path C:\Users\Admin\AppData\Local\Freenet\wrapper\wrapper.conf
Size 2KB
SHA256 e7adc9bdf43fd28f6f8e0ba0370a7a7d770e5809a2e4e7a3076762f1b50169e2
MD5 9a1b0823c0c5bc2e5c74919d47aca539
SHA1 87434e531fd69823abfe554a8d36972c638e636a
SHA512 964d8d7b713c2e01bec3bba8d9336412588e7c5cda4c976a8693b4917a90dd48da43b559af77f73cc220f59b559d5b5e9844dadc7a993fb2796e325ef221ef59
TLSH
T11651342F49BD71B411F202FC74FA9099B53820FC43A264DD22F3049E4365A51A7AD6E1
MD5 SHA1 SHA512 TLSH

Submit Download

wrapper.jar

Path C:\Users\Admin\AppData\Local\Freenet\wrapper\wrapper.jar
Size 123KB
SHA256 8bb43b8570e9cdd2d443167a7732d568a62ffa59166c2ba8b186a6834cedffe2
MD5 c8b88b0e3610858f18b5f4e361612d59
SHA1 343b8519526b96b3a97a04e72d9476343cad3e37
SHA512 a303ac9d2193f6965b73a49f5f4ed9125f7502187260c911305333e8ddc981d2242c382acbbcc94725f42ec151fec95530e5c3333f386a1c076b6496df579106
SSDEEP 3072:aUUkiWDqauEpnN25i+/38r6VTmGOqGwsotlJEeXY5SZ9BHU6zv:nfWauEpnN2zc4TFsOlJEGYwZXU6T
TLSH
T193C3BF21B9BC32E8E8B2013E50421BA7FE7A1DF9C0C5364C25D8CA5FA737A164756F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrapper.log

Path C:\Users\Admin\AppData\Local\Freenet\wrapper\wrapper.log
Size 9KB
SHA256 165022448e0f0803fb0f696c8f70c31c4f93628a504b5fe93341d87d6d38d890
MD5 2cc253ac6ae6ab96eccdf24e4a068fc5
SHA1 bf905eda0e816b466c29f966b8f44e1090990e5c
SHA512 98d069f51a81dbb766216a30443bfabf357e4e3da0217af70abc570fec2d7c670de14efafda76a703f555ddc05479ade035df1a2312aef7efd43c3401a52f42c
SSDEEP 96:iRKX6+/71Zr/3A8JSIW6/wTdJq0exEyy7FRoAb528rB9FX4GDd2IXXaS4C6TA7Ls:imBHrqJGAC/kT+O1E5hL6rPzCX
TLSH
T1BD122D2E251F32E722F412CB8E131287B925F90D970E8658761D6C6ED7446508FBFCAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FreenetInstaller_InnoSetup_library.dll

Path C:\Users\Admin\AppData\Local\Temp\is-GXO7Y91P09.tmp\FreenetInstaller_InnoSetup_library.dll
Size 171KB
SHA256 eddc6f91566ff7bb8f9f961901146820c5c554b00782475141f982ef199c77da
MD5 7a374af3e943c9b623a4245549ca0da3
SHA1 f76e8b65a5420406286b0790abc21e2f7e89c556
SHA512 b30b3ccc1967436bdb6f3ec2899afbf8bd042a356eed439c1f80c42fd21f66d6b79e44630d1920d57d369bcd3133704b76b07ad970e41f909d10ee256a00deb2
SSDEEP 3072:vee0ZO4fn7r079wNurmZ2oT3CSDxUdnR/99xxgHvU:b0ff7r079wN8Vfg
TLSH
T1A1046D41B680C33BC75B0AB487998A579738B2243CF0D546BED41FEE6BB21917E39361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FreenetInstaller-1506.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-M3DWO0XFSD.tmp\FreenetInstaller-1506.tmp
Size 4.2MB
SHA256 a220c6d376c6eb092b3dd914b1afc7f7e856765723bc132b48084e799824a750
MD5 35495833d268335819fdc41049d91610
SHA1 d38dd16d653af41226d491c960132797f3a1b729
SHA512 b31c1a794e0eccc0ea2584e19b5c1f0c7a12f2da1c680bca4a0aabed550c8060e081301c56985c8e62cb37cb7a6a3ca6ec12f52055d8bdc401d74b68538b8565
SSDEEP 98304:WYU5hnuOajWwMPdCpepI3GrwrA+Jc333/q:2xuHjWfZIzT
TLSH
T1BB168F03B388753EE4671A3A583FA284983F7A213A26CD4F6BF40D5C8F395416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna6274904692623647479.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna6274904692623647479.dll
Size 240KB
SHA256 783921600b3ae8b7cfab93b342d56a6ff0072c8c3e54938b83d62426b4c5ecc8
MD5 df304e40060a89cf6afa88eb734244d3
SHA1 32b25a60350a1cd254fceb04901671c20930afc4
SHA512 6c39bce7558dc26b07b2933b22d933d49f916bf49541b53cb3a87e242b879d8cf155d7d00199ab6b9b1545249612518d79138d57fe885e0177d4fc8fdff85cda
SSDEEP 6144:MS6Pqw8PBAT2c7MkX7dHYLmfy1CI69RwjSrpiC13Z38nH6EzbyY:96PqwgBohy1gRgaVFQ
TLSH
T166341807E7B248E5E8B7C13A48136A12F57278254320EBEB47858B535F67BE09B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_c89963ef-cff2-4246-9703-c09e0e4c4057

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-28459746-3881314244-166055492-1000\83aa4cc77f591dfc2374580bbd95f6ba_c89963ef-cff2-4246-9703-c09e0e4c4057
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

memory/988-51-0x000002CAE3470000-0x000002CAE36E0000-memory.dmp

Download

memory/988-18-0x000002CAE3470000-0x000002CAE36E0000-memory.dmp

Download

memory/988-48-0x000002CAE1B70000-0x000002CAE1B71000-memory.dmp

Download

memory/1716-151-0x00000203B3B20000-0x00000203B3B21000-memory.dmp

Download

memory/2508-137-0x000000001BBF0000-0x000000001BC8A000-memory.dmp

Download

memory/2508-136-0x0000000000FC0000-0x0000000001040000-memory.dmp

Download

memory/3432-421-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-438-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-587-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-584-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-583-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-203-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-581-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-239-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-579-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-268-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-287-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-578-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-320-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-334-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-354-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-355-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-360-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-361-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-377-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-380-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-382-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-383-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-401-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-408-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-413-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-415-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-573-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-431-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-572-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-434-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-436-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-569-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-439-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-442-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-443-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-444-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-459-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-462-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-568-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-564-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-486-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-560-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-495-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-504-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-515-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-512-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-525-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-527-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-532-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-543-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3432-550-0x000001A170230000-0x000001A170231000-memory.dmp

Download

memory/3948-12-0x0000000000910000-0x0000000000D4C000-memory.dmp

Download

memory/3948-6-0x0000000002F00000-0x0000000002F01000-memory.dmp

Download

memory/3948-157-0x0000000000910000-0x0000000000D4C000-memory.dmp

Download

memory/3948-170-0x0000000000910000-0x0000000000D4C000-memory.dmp

Download

memory/3948-55-0x0000000000910000-0x0000000000D4C000-memory.dmp

Download

memory/3948-13-0x0000000002F00000-0x0000000002F01000-memory.dmp

Download

memory/3948-57-0x0000000000910000-0x0000000000D4C000-memory.dmp

Download

memory/4472-50-0x000002C50C940000-0x000002C50C941000-memory.dmp

Download

memory/4948-172-0x0000019831180000-0x0000019831181000-memory.dmp

Download

memory/5884-53-0x00000164319B0000-0x00000164319B1000-memory.dmp

Download

memory/5992-173-0x00000000007B0000-0x0000000000892000-memory.dmp

Download

memory/5992-11-0x00000000007B0000-0x0000000000892000-memory.dmp

Download

memory/5992-0-0x00000000007B0000-0x0000000000892000-memory.dmp

Download