ac96da4ad16fc0e4a23ca28bfd20e030d5903e1725255a8d88d0c4b1d6e0f1f4

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MarisaV2.exe
Size 139.7MB
Sample260705-n76lmscs4v
SHA256 ac96da4ad16fc0e4a23ca28bfd20e030d5903e1725255a8d88d0c4b1d6e0f1f4
MD5 fa6fad8d82b96bede049445245251c5c
SHA1 70e9289ad83c8a53a8ac1d62a90e9480246d1ac5
SHA512 779fef5c0dde4ec8572fb80c8793b3351c9951c9e0affe2de036fbbdef745d088f0151ef6982b1f4c7d7921537b425356e25901143a43017d91c1651926ef8ef
SSDEEP 786432:PBdSr/5RVvsZXCZMeQ6mtYptgPV1DHNWtK+jjsxdUKit1+ue2vuxTSp5:PBdSL5jsZXoQTNWtK+jjQe+uelTSp5
TLSH
T1A368AD0177F6A563D1679179869FA002FB31B0032734DAC7366C8360AF53EE46EBAB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution spyware stealer

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
3068	MarisaV2.exe
3068	MarisaV2.exe
3068	MarisaV2.exe
3068	MarisaV2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2804	powershell.exe

Kills process with taskkill 11 IoCs

defense_evasion

pid	Process
2384	taskkill.exe
3240	taskkill.exe
3980	taskkill.exe
1320	taskkill.exe
5792	taskkill.exe
2056	taskkill.exe
3920	taskkill.exe
3296	taskkill.exe
5564	taskkill.exe
5100	taskkill.exe
4872	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2804	powershell.exe
2804	powershell.exe
3068	MarisaV2.exe
3068	MarisaV2.exe
3068	MarisaV2.exe
3068	MarisaV2.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	5564	taskkill.exe
Token: SeDebugPrivilege	3980	taskkill.exe
Token: SeDebugPrivilege	3296	taskkill.exe
Token: SeDebugPrivilege	3240	taskkill.exe
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	5792	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeDebugPrivilege	3068	MarisaV2.exe
Token: SeDebugPrivilege	3068	MarisaV2.exe
Token: 33	1588	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1588	AUDIODG.EXE
Token: SeDebugPrivilege	4872	taskkill.exe
Token: SeDebugPrivilege	5100	taskkill.exe
Token: SeDebugPrivilege	2056	taskkill.exe
Token: SeDebugPrivilege	3920	taskkill.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3280	3068	MarisaV2.exe	89
PID 3280 wrote to memory of 2804	3280	cmd.exe	90
PID 2804 wrote to memory of 1420	2804	powershell.exe	91
PID 1420 wrote to memory of 1992	1420	csc.exe	92
PID 3068 wrote to memory of 5988	3068	MarisaV2.exe	93
PID 5988 wrote to memory of 2808	5988	cmd.exe	94
PID 2808 wrote to memory of 800	2808	net.exe	95
PID 3068 wrote to memory of 1496	3068	MarisaV2.exe	96
PID 3068 wrote to memory of 2020	3068	MarisaV2.exe	97
PID 3068 wrote to memory of 1772	3068	MarisaV2.exe	98
PID 3068 wrote to memory of 2180	3068	MarisaV2.exe	99
PID 3068 wrote to memory of 3080	3068	MarisaV2.exe	100
PID 3068 wrote to memory of 4440	3068	MarisaV2.exe	101
PID 3068 wrote to memory of 2904	3068	MarisaV2.exe	102
PID 1496 wrote to memory of 5564	1496	cmd.exe	103
PID 2020 wrote to memory of 5792	2020	cmd.exe	104
PID 1772 wrote to memory of 1320	1772	cmd.exe	105
PID 2180 wrote to memory of 3980	2180	cmd.exe	106
PID 3080 wrote to memory of 3296	3080	cmd.exe	107
PID 4440 wrote to memory of 3240	4440	cmd.exe	108
PID 2904 wrote to memory of 2384	2904	cmd.exe	109
PID 3068 wrote to memory of 4416	3068	MarisaV2.exe	112
PID 3068 wrote to memory of 1156	3068	MarisaV2.exe	113
PID 3068 wrote to memory of 3048	3068	MarisaV2.exe	114
PID 3068 wrote to memory of 428	3068	MarisaV2.exe	115
PID 4416 wrote to memory of 4872	4416	cmd.exe	116
PID 3048 wrote to memory of 3920	3048	cmd.exe	117
PID 428 wrote to memory of 5100	428	cmd.exe	118
PID 1156 wrote to memory of 2056	1156	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\MarisaV2.exe
"C:\Users\Admin\AppData\Local\Temp\MarisaV2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA=="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rshwxpn3\rshwxpn3.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1420
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8CB6.tmp" "c:\Users\Admin\AppData\Local\Temp\rshwxpn3\CSCDF434A80396141A0A97AD24A2D8312AD.TMP"
        5⤵
        
        PID:1992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera_gx.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera_gx.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3080
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM zen.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM zen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discord.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discord.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordcanary.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordcanary.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discorddevelopment.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discorddevelopment.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordptb.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordptb.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5100

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004F4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@primno+dpapi.node

Path C:\Users\Admin\.cache\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
Size 134KB
SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
MD5 5dc8861862329b3b4122314922be3ed9
SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
TLSH
T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843\ref-napi\prebuilds\win32-x64\node.napi.node
Size 579KB
SHA256 837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843
MD5 153a5d422243f7f95721f6c2c5de8c9d
SHA1 b0f73501859500acd1eccbff3d790abb610511ef
SHA512 d078e20939b7bb1f77b003200359aaad2c1405a9193a1df56786cc2f9ae58cd7fec2b0825740c3b107003f797bcb86784e12704fd4625ca11637a41955ed40cf
SSDEEP 12288:+TpqaSnbD8MFDqKKPirxk8nkg6LZ/eZGi48rVk:USnbD8MBqKKPirxk8nkg6LZAGi48rW
TLSH
T1A0C47C6A37A811A6D17BD13DCA874B19D97234119731A6CF029453AF0F23BF86B3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffitarget.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\mac\ia32\ffitarget.h
Size 4KB
SHA256 ce9a87677a9b9af9dcc6f8f632b62948214824174b65fe4361d3b662cc72aec0
MD5 4ef9928ec21c398681ed3357aa400c48
SHA1 5bafcdf7c4ff860ce7f94c5260159e7bf063243b
SHA512 c0f5f26b249cf3ca72b2d334008a7ab8b7332f286e57edf7c700b5c4a80960dbce14e3db940829134a3bc593a087f56b41afb757daf3f03e32611ab1172c1f6d
SSDEEP 96:uxGPOUwuHtoSlcl5OVcaljadXHtYXvJsVBOxqSpBS:unuHt/lcl5ramTOxqSm
TLSH
T1CD91639B3E572EA12029D17358192816D307E96B776AF5E8340ED1D81F1A01793FF2B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffi.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\openbsd\x64\ffi.h
Size 13KB
SHA256 bdd54f5f8517f32767d864921edb878224068a75eff7e0386a55105d61e44466
MD5 4c8fce7c4f0bee30b8f03d94fba5b66c
SHA1 4eb6b34a1547e2da9b1a0daa9c9f7a32569a03e5
SHA512 0f077d7c2a9801eab3134d4c56793f64fc1c8434e8eabe9c749d0f7d0d875b1750ad0f32873b49778bbb7b5864c280c4546fd72775ad0ec49eb091ec26ee3848
SSDEEP 192:uuuHt/QidAyuyEWSIvZ+ReCm+arz6hqrREiAdOGL8K8GJhNn6BsxGRm:uuqH+yuChPzAqrREiAdr8K8ab5xb
TLSH
T1F05252132FE927632465D1068A7C966BC368E22B3256B2D0725F97783B0216363FD37D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.uv1.node

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\prebuilds\win32-x64\node.napi.uv1.node
Size 588KB
SHA256 b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3
MD5 d1f6e50334a50a3f1f8e35e02d788ad9
SHA1 1eab95b23d8ef82bb3171ed751eb14e178cb88d2
SHA512 9f40996f4a8a5c6fe17687162306a02a5292ffb82bf62a0a7afa4af8f4f52f6d44bff34b8e14cf936ea9c51780603cfaa0a9ce84935a7b509892e51be18b2c03
SSDEEP 12288:SIAsJ4jRp/N37hbzMqG7WtBNRjaDepQCKKO:UsJ4jRtN37hbzMqG7Wp4DepQA
TLSH
T1F4D46C6637A412A6D17BD23DCA934B29EA723811473196CF029453AF1F13BE85B3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3\ref-napi\prebuilds\win32-x64\node.napi.node
Size 550KB
SHA256 dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3
MD5 ee6e80bab410c751c935e6175acf8b5c
SHA1 c44cad6425db5c9c86351f9f9f7b019b876db528
SHA512 c654c44cfe115a9c4f9eaf6ed4207511c17dc4eeb00441c2be6413d0a16c348fce0dcf282f2b9132948150e3541d248edd62b2e055a1cd902f80b9a67d2e1d77
SSDEEP 12288:UccjJwUgiy5HMwBAHvrc7XOCzfYt5leQZ:9cjJwUgpHMwBAHvrc7XOcfYDleQZ
TLSH
T15EC46B6677A813A6C17BD13DCA974B29E97138115732A7CF01E452AF0F13BE4693BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES8CB6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8CB6.tmp
Size 1KB
SHA256 da605700763cbdb47181f0d436c30ed3fb69830af97a337826006ad36a016804
MD5 21eef908a9a6a498fa98676bd6db4582
SHA1 02c3c87d90bcdd4c85c909ac6153eecc84240925
SHA512 fa87e2f576e020503660149bed3def2261041a5f8719e1102227bccfad18b13235f6fccf0b43783097a162ec33e5098c7f946a2dded854fa860eaba39c516f22
TLSH
T18A21C90563E84B0FF0B74731A9F6575FA678FD64EFA3A79A844042282C51104EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

rshwxpn3.dll

Path C:\Users\Admin\AppData\Local\Temp\rshwxpn3\rshwxpn3.dll
Size 3KB
SHA256 d4f58ab81b670b3b4a8f9914234cf455ea7373ee64ea3616b3a8675b2e8b59d8
MD5 09566a87d6382cea03eaffb90b9e9046
SHA1 2a63aeb2579154e70c39cb73aac6338691465651
SHA512 d675e728d3e94239f97a92b4cfaade32f42808b4102e7dca0b67f595c99c847c7049d3245e3ac508b67af64f69d3c89a30ddc3716971d1950e6780f47f57508f
TLSH
T19B51A90797E84A6BE4774B306DF3471637B8FC509B73675E48804218ACA53549E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDF434A80396141A0A97AD24A2D8312AD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\rshwxpn3\CSCDF434A80396141A0A97AD24A2D8312AD.TMP
Size 652B
SHA256 bfaf59d63c29010eec7209ec4dbea24af949b3d2823fa810b9d421e5f741bde0
MD5 21160c4473064a48e1266b262cd6a97a
SHA1 636c0703aba92238c652f5f39b194a0e20e6b705
SHA512 b2dd67a4ba80088e610e6bdffe53dafc9d39c358552e88cbb2dda82529de629ce44d009c84593c85a3af60c355a724c0babc919036f1a0332eaca3a43aa44171
TLSH
T1D7F03A0967F8020AF0F35B30B9F683A3A1ACBC65DE32A7ED144003596C64510C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

rshwxpn3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\rshwxpn3\rshwxpn3.0.cs
Size 342B
SHA256 6914d7afe54b19a22b8dad75c0781e9dc7321bbf43d3fd8fb00179d2d6a7f3f2
MD5 fb818b5af427cdf4bd5e9e48265dbd9b
SHA1 4494f9fe806d3d0ec6601ab8a6bdb5ff9b37a4ed
SHA512 843c02c18c777ae614a49d27722c495472c2b3ed4d45dc26bbb03d009a189e7241440a77107a7f17f26d03a8771c74efb49af9c98ce83020535c9027abb64cd4
TLSH
T1A1E0CD1866A29E70803304254D47D0FDF60B5427157B1E0475FD1311DF7B0099629A5D
MD5 SHA1 SHA512 TLSH

Submit Download

rshwxpn3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\rshwxpn3\rshwxpn3.cmdline
Size 369B
SHA256 6feb9f2279660b8b568899747232ec3b760bada5e4a705f1f59c0173779b58f7
MD5 0890989c2483eb089db5a2dd3f892420
SHA1 2b8e63afe07fe52784a4f5c33e466b160c236441
SHA512 5ff797a29d1627024ef47803f42a165760c70f86b793762e3db0923866e229f9782f304f3c68e688a729c3405e615cd2b11a75152b527a85f6890b9aded835c0
TLSH
T1B4E0D82F5356CEBD15DE101721B9C5ACC2F30A8729467FC45158545ED06780867E2B57
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2804-788-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2804-783-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2804-787-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2804-785-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2804-790-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2804-792-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2804-796-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2804-789-0x00000227C1B60000-0x00000227C1D22000-memory.dmp

Download

memory/2804-784-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2804-786-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2804-797-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2804-791-0x00000227C2260000-0x00000227C2788000-memory.dmp

Download

memory/2804-807-0x00000227C1650000-0x00000227C1658000-memory.dmp

Download

memory/2804-782-0x00000227C1660000-0x00000227C1682000-memory.dmp

Download

memory/2804-809-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2804-781-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2804-778-0x00007FFD27C4F000-0x00007FFD27C50000-memory.dmp

Download