ac96da4ad16fc0e4a23ca28bfd20e030d5903e1725255a8d88d0c4b1d6e0f1f4

Analysis

max time kernel
151s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MarisaV2.exe
Size 139.7MB
Sample260702-w7tabacw3y
SHA256 ac96da4ad16fc0e4a23ca28bfd20e030d5903e1725255a8d88d0c4b1d6e0f1f4
MD5 fa6fad8d82b96bede049445245251c5c
SHA1 70e9289ad83c8a53a8ac1d62a90e9480246d1ac5
SHA512 779fef5c0dde4ec8572fb80c8793b3351c9951c9e0affe2de036fbbdef745d088f0151ef6982b1f4c7d7921537b425356e25901143a43017d91c1651926ef8ef
SSDEEP 786432:PBdSr/5RVvsZXCZMeQ6mtYptgPV1DHNWtK+jjsxdUKit1+ue2vuxTSp5:PBdSL5jsZXoQTNWtK+jjQe+uelTSp5
TLSH
T1A368AD0177F6A563D1679179869FA002FB31B0032734DAC7366C8360AF53EE46EBAB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution spyware stealer

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1972	MarisaV2.exe
1972	MarisaV2.exe
1972	MarisaV2.exe
1972	MarisaV2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4076	powershell.exe

Kills process with taskkill 11 IoCs

defense_evasion

pid	Process
1140	taskkill.exe
2804	taskkill.exe
2692	taskkill.exe
1576	taskkill.exe
5460	taskkill.exe
2808	taskkill.exe
5656	taskkill.exe
1240	taskkill.exe
2024	taskkill.exe
5136	taskkill.exe
1328	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4076	powershell.exe
4076	powershell.exe
1972	MarisaV2.exe
1972	MarisaV2.exe
1972	MarisaV2.exe
1972	MarisaV2.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	1328	taskkill.exe
Token: SeDebugPrivilege	5460	taskkill.exe
Token: SeDebugPrivilege	5136	taskkill.exe
Token: SeDebugPrivilege	2024	taskkill.exe
Token: SeDebugPrivilege	1240	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	5656	taskkill.exe
Token: SeDebugPrivilege	1972	MarisaV2.exe
Token: SeDebugPrivilege	1972	MarisaV2.exe
Token: 33	1464	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1464	AUDIODG.EXE
Token: SeDebugPrivilege	2808	taskkill.exe
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2556	1972	MarisaV2.exe	89
PID 2556 wrote to memory of 4076	2556	cmd.exe	90
PID 4076 wrote to memory of 5432	4076	powershell.exe	91
PID 5432 wrote to memory of 4600	5432	csc.exe	92
PID 1972 wrote to memory of 248	1972	MarisaV2.exe	93
PID 248 wrote to memory of 4492	248	cmd.exe	94
PID 4492 wrote to memory of 6024	4492	net.exe	95
PID 1972 wrote to memory of 2052	1972	MarisaV2.exe	96
PID 1972 wrote to memory of 808	1972	MarisaV2.exe	97
PID 1972 wrote to memory of 5108	1972	MarisaV2.exe	98
PID 1972 wrote to memory of 844	1972	MarisaV2.exe	99
PID 1972 wrote to memory of 756	1972	MarisaV2.exe	100
PID 1972 wrote to memory of 5272	1972	MarisaV2.exe	101
PID 1972 wrote to memory of 5436	1972	MarisaV2.exe	102
PID 5436 wrote to memory of 1328	5436	cmd.exe	103
PID 2052 wrote to memory of 5460	2052	cmd.exe	104
PID 808 wrote to memory of 5136	808	cmd.exe	105
PID 5108 wrote to memory of 2024	5108	cmd.exe	106
PID 844 wrote to memory of 1240	844	cmd.exe	107
PID 756 wrote to memory of 1576	756	cmd.exe	108
PID 5272 wrote to memory of 5656	5272	cmd.exe	109
PID 1972 wrote to memory of 4376	1972	MarisaV2.exe	112
PID 1972 wrote to memory of 3956	1972	MarisaV2.exe	113
PID 1972 wrote to memory of 2880	1972	MarisaV2.exe	114
PID 1972 wrote to memory of 2184	1972	MarisaV2.exe	115
PID 2880 wrote to memory of 2808	2880	cmd.exe	116
PID 4376 wrote to memory of 2692	4376	cmd.exe	117
PID 3956 wrote to memory of 2804	3956	cmd.exe	118
PID 2184 wrote to memory of 1140	2184	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\MarisaV2.exe
"C:\Users\Admin\AppData\Local\Temp\MarisaV2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA=="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cgh5tvnj\cgh5tvnj.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5432
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES381.tmp" "c:\Users\Admin\AppData\Local\Temp\cgh5tvnj\CSC45BA4CC3DB2249029E90FF585E6B334.TMP"
        5⤵
        
        PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera_gx.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera_gx.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM zen.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5436
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM zen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discord.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discord.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordcanary.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordcanary.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discorddevelopment.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discorddevelopment.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordptb.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordptb.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1140

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@primno+dpapi.node

Path C:\Users\Admin\.cache\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
Size 134KB
SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
MD5 5dc8861862329b3b4122314922be3ed9
SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
TLSH
T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843\ref-napi\prebuilds\win32-x64\node.napi.node
Size 579KB
SHA256 837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843
MD5 153a5d422243f7f95721f6c2c5de8c9d
SHA1 b0f73501859500acd1eccbff3d790abb610511ef
SHA512 d078e20939b7bb1f77b003200359aaad2c1405a9193a1df56786cc2f9ae58cd7fec2b0825740c3b107003f797bcb86784e12704fd4625ca11637a41955ed40cf
SSDEEP 12288:+TpqaSnbD8MFDqKKPirxk8nkg6LZ/eZGi48rVk:USnbD8MBqKKPirxk8nkg6LZAGi48rW
TLSH
T1A0C47C6A37A811A6D17BD13DCA874B19D97234119731A6CF029453AF0F23BF86B3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffitarget.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\mac\ia32\ffitarget.h
Size 4KB
SHA256 ce9a87677a9b9af9dcc6f8f632b62948214824174b65fe4361d3b662cc72aec0
MD5 4ef9928ec21c398681ed3357aa400c48
SHA1 5bafcdf7c4ff860ce7f94c5260159e7bf063243b
SHA512 c0f5f26b249cf3ca72b2d334008a7ab8b7332f286e57edf7c700b5c4a80960dbce14e3db940829134a3bc593a087f56b41afb757daf3f03e32611ab1172c1f6d
SSDEEP 96:uxGPOUwuHtoSlcl5OVcaljadXHtYXvJsVBOxqSpBS:unuHt/lcl5ramTOxqSm
TLSH
T1CD91639B3E572EA12029D17358192816D307E96B776AF5E8340ED1D81F1A01793FF2B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffi.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\openbsd\x64\ffi.h
Size 13KB
SHA256 bdd54f5f8517f32767d864921edb878224068a75eff7e0386a55105d61e44466
MD5 4c8fce7c4f0bee30b8f03d94fba5b66c
SHA1 4eb6b34a1547e2da9b1a0daa9c9f7a32569a03e5
SHA512 0f077d7c2a9801eab3134d4c56793f64fc1c8434e8eabe9c749d0f7d0d875b1750ad0f32873b49778bbb7b5864c280c4546fd72775ad0ec49eb091ec26ee3848
SSDEEP 192:uuuHt/QidAyuyEWSIvZ+ReCm+arz6hqrREiAdOGL8K8GJhNn6BsxGRm:uuqH+yuChPzAqrREiAdr8K8ab5xb
TLSH
T1F05252132FE927632465D1068A7C966BC368E22B3256B2D0725F97783B0216363FD37D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.uv1.node

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\prebuilds\win32-x64\node.napi.uv1.node
Size 588KB
SHA256 b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3
MD5 d1f6e50334a50a3f1f8e35e02d788ad9
SHA1 1eab95b23d8ef82bb3171ed751eb14e178cb88d2
SHA512 9f40996f4a8a5c6fe17687162306a02a5292ffb82bf62a0a7afa4af8f4f52f6d44bff34b8e14cf936ea9c51780603cfaa0a9ce84935a7b509892e51be18b2c03
SSDEEP 12288:SIAsJ4jRp/N37hbzMqG7WtBNRjaDepQCKKO:UsJ4jRtN37hbzMqG7Wp4DepQA
TLSH
T1F4D46C6637A412A6D17BD23DCA934B29EA723811473196CF029453AF1F13BE85B3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3\ref-napi\prebuilds\win32-x64\node.napi.node
Size 550KB
SHA256 dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3
MD5 ee6e80bab410c751c935e6175acf8b5c
SHA1 c44cad6425db5c9c86351f9f9f7b019b876db528
SHA512 c654c44cfe115a9c4f9eaf6ed4207511c17dc4eeb00441c2be6413d0a16c348fce0dcf282f2b9132948150e3541d248edd62b2e055a1cd902f80b9a67d2e1d77
SSDEEP 12288:UccjJwUgiy5HMwBAHvrc7XOCzfYt5leQZ:9cjJwUgpHMwBAHvrc7XOcfYDleQZ
TLSH
T15EC46B6677A813A6C17BD13DCA974B29E97138115732A7CF01E452AF0F13BE4693BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES381.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES381.tmp
Size 1KB
SHA256 e7d44a983f1ce6ad43183768318139743dfcd0b1e0310d4ba2f84d32feb67452
MD5 e52779d2b0a0f3cb74f497ff3634658f
SHA1 bc92bd064829deee17745f5d761d37d9779ab431
SHA512 abb39114b9c93f07abdf85a2e56ea32d6302ee667d8e06552575acdad9e5bbd69e5640f04fe8db9304b6bc25c28eb6c397905fa21aa11fec8247bb4db9f00dc2
TLSH
T12421EB0583E8871EF07353317AFA472F9274FD68EFA2975A8450422C2C01504EEE0B73
MD5 SHA1 SHA512 TLSH

Submit Download

cgh5tvnj.dll

Path C:\Users\Admin\AppData\Local\Temp\cgh5tvnj\cgh5tvnj.dll
Size 3KB
SHA256 21c1b3fb7ea995af78840a1445c63a59b66c4cf90a9b7615eb8da779975094e1
MD5 725b712bbfe597eced9fd2fd9df7df21
SHA1 d52d4e664019125241019adc1366335a9032eec7
SHA512 b7c8820ce92d45fc7c66ff52cdb9da1c839156c503d870ec04fe400e924f6876a110de9fa82e1d0880999a9b33d1920cbf5b05c69ed6da047c8bc5abe6880ada
TLSH
T1BF51CB0697F8466BE46707306DF3471637B8F8609B73971D4990421CAC657645E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC45BA4CC3DB2249029E90FF585E6B334.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\cgh5tvnj\CSC45BA4CC3DB2249029E90FF585E6B334.TMP
Size 652B
SHA256 8f1cc14533113027428fbc94cb9ca47309beabdd5053d78cb68f06b7c05ce8f0
MD5 abe09604f252b3c65d47a22a552def0c
SHA1 a38c4df1800606921488d4cda571f8eb1b7e307f
SHA512 4562ea73bf741ebebe069e57bfd686e0e5a3ae137e0c1bdb277a1db37f205472302384323fa8fd2507f2fe1a629b74abe3d3eb4e2b436f8872ba78a6c509b292
TLSH
T195F05E0963F8020EF0F34B70BDF6836395A8BC64DE3297ED1450431D68649108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

cgh5tvnj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\cgh5tvnj\cgh5tvnj.0.cs
Size 342B
SHA256 6914d7afe54b19a22b8dad75c0781e9dc7321bbf43d3fd8fb00179d2d6a7f3f2
MD5 fb818b5af427cdf4bd5e9e48265dbd9b
SHA1 4494f9fe806d3d0ec6601ab8a6bdb5ff9b37a4ed
SHA512 843c02c18c777ae614a49d27722c495472c2b3ed4d45dc26bbb03d009a189e7241440a77107a7f17f26d03a8771c74efb49af9c98ce83020535c9027abb64cd4
TLSH
T1A1E0CD1866A29E70803304254D47D0FDF60B5427157B1E0475FD1311DF7B0099629A5D
MD5 SHA1 SHA512 TLSH

Submit Download

cgh5tvnj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\cgh5tvnj\cgh5tvnj.cmdline
Size 369B
SHA256 6823aa6e27d502325ae093e85f08d72a14eca76ef8e4333bf7dbe637f2f25885
MD5 17531dcf24d4694d2b8c64640f8295df
SHA1 48da82486baf72e4fa6d779699bcc2cc27aa8dd4
SHA512 82d61afa4a9ff16323c1e855f94c679118136d480874a0bf46cc896b48987df4658244aa0b3cbe10c2f405eabb945cfda3215b1ab79961111aaa92afaed423ed
TLSH
T1A8E0682B42AAC2BD55D91017227BC8AC82B2E6432A883F8455A0484FD0270102BF1752
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4076-778-0x00007FFC1C43F000-0x00007FFC1C440000-memory.dmp

Download

memory/4076-786-0x00007FFC1C2B0000-0x00007FFC1CC54000-memory.dmp

Download

memory/4076-787-0x00007FFC1C2B0000-0x00007FFC1CC54000-memory.dmp

Download

memory/4076-788-0x0000028EF8760000-0x0000028EF8922000-memory.dmp

Download

memory/4076-790-0x00007FFC1C2B0000-0x00007FFC1CC54000-memory.dmp

Download

memory/4076-794-0x00007FFC1C2B0000-0x00007FFC1CC54000-memory.dmp

Download

memory/4076-789-0x0000028EF8E60000-0x0000028EF9388000-memory.dmp

Download

memory/4076-782-0x00007FFC1C2B0000-0x00007FFC1CC54000-memory.dmp

Download

memory/4076-785-0x00007FFC1C2B0000-0x00007FFC1CC54000-memory.dmp

Download

memory/4076-804-0x0000028EDFCB0000-0x0000028EDFCB8000-memory.dmp

Download

memory/4076-806-0x00007FFC1C2B0000-0x00007FFC1CC54000-memory.dmp

Download

memory/4076-784-0x00007FFC1C2B0000-0x00007FFC1CC54000-memory.dmp

Download

memory/4076-783-0x0000028EF8290000-0x0000028EF82B2000-memory.dmp

Download

memory/4076-779-0x00007FFC1C2B0000-0x00007FFC1CC54000-memory.dmp

Download

memory/4076-807-0x00007FFC1C2B0000-0x00007FFC1CC54000-memory.dmp

Download

memory/4076-809-0x00007FFC1C2B0000-0x00007FFC1CC54000-memory.dmp

Download