b2cb71a53cbe21e4873be65822bdac8d599441beeaf9e934e1e6fe2d53c06600

Analysis

max time kernel
152s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_0c2497f094d4bbbf6755e4fe081706d1_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Size 110.0MB
Sample260804-kcemwsz1f1
SHA256 b2cb71a53cbe21e4873be65822bdac8d599441beeaf9e934e1e6fe2d53c06600
MD5 0c2497f094d4bbbf6755e4fe081706d1
SHA1 7b1ce37e128e6fdcb593718d887a9fbfeb2fc2de
SHA512 b30a70e8fbffad0cbeca560f9a64573caed28023479f1a15c3e409ab8d1a46d62429ebe02d7564fe7d9d2d8462b3c1020211698f4e76ef0c8261b1fa2cb95939
SSDEEP 393216:Gy57a3Z40F23nAlWMn9PfDhOru/hm+vxwUdN3QSI8wxSvDazn1N5VRc+9YcEaDzS:GtDn3QtRCc3Ltw18bvxOtxk2v5j
TLSH
T17D48BE4267EA04C5F9F7AA3499E25213D673BC067F3081CB325C172A1F736E09976B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c586-135.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Executes dropped EXE 8 IoCs

pid	Process
4364	javaw.exe
2016	chromelevator_x64.exe
5764	chromelevator_x64.exe
2580	chromelevator_x64.exe
5132	chromelevator_x64.exe
2392	chromelevator_x64.exe
4960	chromelevator_x64.exe
1420	chromelevator_x64.exe

Loads dropped DLL 17 IoCs

pid	Process
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
3236	chrome.exe
4364	javaw.exe
2264	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
1	discord.com
7	raw.githubusercontent.com
8	discord.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	javaw.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3420	cmd.exe
2692	cmd.exe
2772	cmd.exe
2628	cmd.exe
3160	cmd.exe
5440	cmd.exe
4608	cmd.exe
4980	cmd.exe
2268	cmd.exe
4920	cmd.exe
4496	cmd.exe
5152	cmd.exe
484	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5096	chrome.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javaw.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3912	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 13 IoCs

defense_evasion

pid	Process
3328	taskkill.exe
3120	taskkill.exe
124	taskkill.exe
1012	taskkill.exe
5080	taskkill.exe
5740	taskkill.exe
992	taskkill.exe
5860	taskkill.exe
3920	taskkill.exe
5652	taskkill.exe
3032	taskkill.exe
432	taskkill.exe
2784	taskkill.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303056960552064"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4640	reg.exe
4616	reg.exe
5964	reg.exe
5500	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
3236	chrome.exe
3236	chrome.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe
4364	javaw.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeDebugPrivilege	5740	taskkill.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	3328	taskkill.exe
Token: SeDebugPrivilege	992	taskkill.exe
Token: SeDebugPrivilege	3120	taskkill.exe
Token: SeDebugPrivilege	124	taskkill.exe
Token: SeDebugPrivilege	5860	taskkill.exe
Token: SeDebugPrivilege	1012	taskkill.exe
Token: SeDebugPrivilege	3920	taskkill.exe
Token: SeDebugPrivilege	5080	taskkill.exe
Token: SeDebugPrivilege	5652	taskkill.exe
Token: SeDebugPrivilege	3032	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3912	wmic.exe
Token: SeSecurityPrivilege	3912	wmic.exe
Token: SeTakeOwnershipPrivilege	3912	wmic.exe
Token: SeLoadDriverPrivilege	3912	wmic.exe
Token: SeSystemProfilePrivilege	3912	wmic.exe
Token: SeSystemtimePrivilege	3912	wmic.exe
Token: SeProfSingleProcessPrivilege	3912	wmic.exe
Token: SeIncBasePriorityPrivilege	3912	wmic.exe
Token: SeCreatePagefilePrivilege	3912	wmic.exe
Token: SeBackupPrivilege	3912	wmic.exe
Token: SeRestorePrivilege	3912	wmic.exe
Token: SeShutdownPrivilege	3912	wmic.exe
Token: SeDebugPrivilege	3912	wmic.exe
Token: SeSystemEnvironmentPrivilege	3912	wmic.exe
Token: SeRemoteShutdownPrivilege	3912	wmic.exe
Token: SeUndockPrivilege	3912	wmic.exe
Token: SeManageVolumePrivilege	3912	wmic.exe
Token: 33	3912	wmic.exe
Token: 34	3912	wmic.exe
Token: 35	3912	wmic.exe
Token: 36	3912	wmic.exe
Token: SeIncreaseQuotaPrivilege	3912	wmic.exe
Token: SeSecurityPrivilege	3912	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3236	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 4364	3352	2026-08-04_0c2497f094d4bbbf6755e4fe081706d1_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	89
PID 4364 wrote to memory of 3236	4364	javaw.exe	90
PID 3236 wrote to memory of 2264	3236	chrome.exe	91
PID 3236 wrote to memory of 5240	3236	chrome.exe	92
PID 3236 wrote to memory of 5096	3236	chrome.exe	93
PID 3236 wrote to memory of 5240	3236	chrome.exe	92
PID 3236 wrote to memory of 940	3236	chrome.exe	94
PID 3236 wrote to memory of 940	3236	chrome.exe	94
PID 3236 wrote to memory of 2380	3236	chrome.exe	96
PID 3236 wrote to memory of 2380	3236	chrome.exe	96
PID 3236 wrote to memory of 4152	3236	chrome.exe	97
PID 3236 wrote to memory of 4152	3236	chrome.exe	97
PID 3236 wrote to memory of 6064	3236	chrome.exe	98
PID 3236 wrote to memory of 3772	3236	chrome.exe	99
PID 3236 wrote to memory of 3772	3236	chrome.exe	99
PID 3236 wrote to memory of 4860	3236	chrome.exe	100
PID 3236 wrote to memory of 4860	3236	chrome.exe	100
PID 3236 wrote to memory of 4532	3236	chrome.exe	102
PID 3236 wrote to memory of 4532	3236	chrome.exe	102
PID 3236 wrote to memory of 3692	3236	chrome.exe	103
PID 3236 wrote to memory of 3692	3236	chrome.exe	103
PID 3236 wrote to memory of 4172	3236	chrome.exe	106
PID 3236 wrote to memory of 5540	3236	chrome.exe	107
PID 3236 wrote to memory of 4172	3236	chrome.exe	106
PID 3236 wrote to memory of 5540	3236	chrome.exe	107
PID 3236 wrote to memory of 6076	3236	chrome.exe	108
PID 3236 wrote to memory of 6076	3236	chrome.exe	108
PID 3236 wrote to memory of 1608	3236	chrome.exe	109
PID 3236 wrote to memory of 1608	3236	chrome.exe	109
PID 4364 wrote to memory of 2016	4364	javaw.exe	122
PID 2016 wrote to memory of 2836	2016	chromelevator_x64.exe	124
PID 2016 wrote to memory of 2836	2016	chromelevator_x64.exe	124
PID 2016 wrote to memory of 5448	2016	chromelevator_x64.exe	127
PID 2016 wrote to memory of 5448	2016	chromelevator_x64.exe	127
PID 4364 wrote to memory of 5764	4364	javaw.exe	128
PID 5764 wrote to memory of 5452	5764	chromelevator_x64.exe	130
PID 5764 wrote to memory of 5452	5764	chromelevator_x64.exe	130
PID 4364 wrote to memory of 2580	4364	javaw.exe	133
PID 2580 wrote to memory of 4260	2580	chromelevator_x64.exe	135
PID 2580 wrote to memory of 4260	2580	chromelevator_x64.exe	135
PID 4364 wrote to memory of 5132	4364	javaw.exe	136
PID 4364 wrote to memory of 2392	4364	javaw.exe	138
PID 4364 wrote to memory of 4960	4364	javaw.exe	140
PID 4364 wrote to memory of 1420	4364	javaw.exe	142
PID 4364 wrote to memory of 4980	4364	javaw.exe	144
PID 4980 wrote to memory of 5740	4980	cmd.exe	146
PID 4364 wrote to memory of 2268	4364	javaw.exe	147
PID 2268 wrote to memory of 432	2268	cmd.exe	149
PID 4364 wrote to memory of 4920	4364	javaw.exe	150
PID 4920 wrote to memory of 2784	4920	cmd.exe	152
PID 4364 wrote to memory of 4496	4364	javaw.exe	153
PID 4496 wrote to memory of 3328	4496	cmd.exe	155
PID 4364 wrote to memory of 5152	4364	javaw.exe	156
PID 5152 wrote to memory of 992	5152	cmd.exe	158
PID 4364 wrote to memory of 2772	4364	javaw.exe	159
PID 2772 wrote to memory of 3120	2772	cmd.exe	161
PID 4364 wrote to memory of 484	4364	javaw.exe	162
PID 484 wrote to memory of 124	484	cmd.exe	164
PID 4364 wrote to memory of 3420	4364	javaw.exe	165
PID 3420 wrote to memory of 5860	3420	cmd.exe	167
PID 4364 wrote to memory of 2628	4364	javaw.exe	168
PID 2628 wrote to memory of 1012	2628	cmd.exe	170
PID 4364 wrote to memory of 3160	4364	javaw.exe	171
PID 3160 wrote to memory of 3920	3160	cmd.exe	173

C:\Users\Admin\AppData\Local\Temp\2026-08-04_0c2497f094d4bbbf6755e4fe081706d1_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_0c2497f094d4bbbf6755e4fe081706d1_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\bin\javaw.exe
  C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\modules.jar;C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\* e C:\Users\Admin\AppData\Local\Temp\2026-08-04_0c2497f094d4bbbf6755e4fe081706d1_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe --force
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --disable-gpu --no-first-run --no-default-browser-check --disable-background-networking --disable-extensions "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" about:blank
    3⤵
    - Loads dropped DLL
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffd1b64c728,0x7ffd1b64c734,0x7ffd1b64c740
      4⤵
      Loads dropped DLL
      PID:2264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1900,i,17161332662775514799,1204667496265998898,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
      4⤵
      PID:5240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,17161332662775514799,1204667496265998898,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:11
      4⤵
      System Time Discovery
      PID:5096
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,17161332662775514799,1204667496265998898,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:13
      4⤵
      PID:940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1900,i,17161332662775514799,1204667496265998898,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:1
      4⤵
      PID:2380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1900,i,17161332662775514799,1204667496265998898,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:1
      4⤵
      PID:4152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,17161332662775514799,1204667496265998898,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
      4⤵
      PID:6064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1900,i,17161332662775514799,1204667496265998898,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
      4⤵
      PID:3772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1900,i,17161332662775514799,1204667496265998898,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
      4⤵
      PID:4860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1900,i,17161332662775514799,1204667496265998898,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      PID:4532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1900,i,17161332662775514799,1204667496265998898,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
      4⤵
      PID:3692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1900,i,17161332662775514799,1204667496265998898,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      PID:4172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1900,i,17161332662775514799,1204667496265998898,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
      4⤵
      PID:5540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1900,i,17161332662775514799,1204667496265998898,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      PID:6076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1900,i,17161332662775514799,1204667496265998898,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
      4⤵
      PID:1608
- - C:\Users\Admin\AppData\Local\Temp\chromelevator_x64.exe
    C:\Users\Admin\AppData\Local\Temp\chromelevator_x64.exe all -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_914c0278 -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5448
- - C:\Users\Admin\AppData\Local\Temp\chromelevator_x64.exe
    C:\Users\Admin\AppData\Local\Temp\chromelevator_x64.exe chrome -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_9e2394ae -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5452
- - C:\Users\Admin\AppData\Local\Temp\chromelevator_x64.exe
    C:\Users\Admin\AppData\Local\Temp\chromelevator_x64.exe edge -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_00ff9c52 -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4260
- - C:\Users\Admin\AppData\Local\Temp\chromelevator_x64.exe
    C:\Users\Admin\AppData\Local\Temp\chromelevator_x64.exe brave -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_949d68ec -k
    3⤵
    - Executes dropped EXE
    PID:5132
- - C:\Users\Admin\AppData\Local\Temp\chromelevator_x64.exe
    C:\Users\Admin\AppData\Local\Temp\chromelevator_x64.exe avast -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_9aac79c7 -k
    3⤵
    - Executes dropped EXE
    PID:2392
- - C:\Users\Admin\AppData\Local\Temp\chromelevator_x64.exe
    C:\Users\Admin\AppData\Local\Temp\chromelevator_x64.exe opera -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_f9e5ef97 -k
    3⤵
    - Executes dropped EXE
    PID:4960
- - C:\Users\Admin\AppData\Local\Temp\chromelevator_x64.exe
    C:\Users\Admin\AppData\Local\Temp\chromelevator_x64.exe vivaldi -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_fc699e63 -k
    3⤵
    - Executes dropped EXE
    PID:1420
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im brave.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im brave.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5740
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im waterfox.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im waterfox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:432
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im msedge.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2784
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im yandexbrowser.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im yandexbrowser.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3328
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im firefox.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5152
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:992
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im librewolf.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im librewolf.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3120
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im chrome.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:484
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:124
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im opera.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im opera.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5860
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im vivaldi.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vivaldi.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1012
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im opera_gx.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im opera_gx.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3920
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im waterfox.exe
    3⤵
    - Executes a command shell one-liner
    PID:2692
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im waterfox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5080
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im firefox.exe
    3⤵
    - Executes a command shell one-liner
    PID:5440
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5652
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im librewolf.exe
    3⤵
    - Executes a command shell one-liner
    PID:4608
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im librewolf.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3032
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:5844
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Roblox /s
    3⤵
    - Modifies registry key
    PID:4640
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Roblox\RobloxStudio /s
    3⤵
    - Modifies registry key
    PID:4616
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Roblox\RobloxPlayer /s
    3⤵
    - Modifies registry key
    PID:5964
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Valve\Steam /v SteamPath
    3⤵
    - Modifies registry key
    PID:5500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2096

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4136

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4620

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4c359c3d00307b4b69b92f19c72bd39f450207ecd4e28ab9fd3f5da1bdf5c138
MD5 de2774e4b5754317f45628fc7a8b2a38
SHA1 376645573a1bc1732e8a662017ffd70225c35925
SHA512 20df9d18a83c727bb73a25bd984c987af413c09689a7f747b189368a82bcfa39c1950bcbc65b75ec149dd451d82710798515074907ba7c56f56908092223acca
SSDEEP 192:5BRvDqgjaMlv7QvAPRp2o9XxHsb+WNn/jPfCeu1VyIsnAUge:5BRv2UFV86XjfwbPye
TLSH
T1D432972EBD10793B6DCBC229FA667693D7F6102121D52E44E7FC9A2C11DB6CC622701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 bf32584c20415cd649da445f13d8507bf4975a9d1578cbd67736d8c79166269e
MD5 244538deac0f9934e4abafedb3e30b9d
SHA1 1a056234283eed72d6d4c4f80826671c9a04fd33
SHA512 37bfea78d45e824e1e441bcb16e4c6119cc876297d1a3a85fe13b97e32394bf0a79500a578a0c15ca3e1d3fdcc48ff1819ad30e46488b06b0d43bb55a0b08ea7
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5mmDqB6nGyvn0b4T86ybJv4a:xC0ITo+TQ0InDUDt6PPb4T86ybl
TLSH
T111A10975A0284DB74476D446F1622A43CEB9B067E972AFA4EAD91E0D14F70EC1341623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 18ba537655b977be3552ecb7e2090c071d96701786d197c6733a0a120be5d39f
MD5 2bb2716db8d130ba914534a547c68de9
SHA1 c171476ca333f72cf75cb8493c9e6c4af7acbc9c
SHA512 45a2d9d8a13c3e13facae63aee8525150f0fd2a5152ad4efe249e8127e35680a1af71e47361772524f4d0791b933f64b4cb7dce4ee0423afb4851358433ab6c8
SSDEEP 96:RC0d+r2io+TJ/E0f6m934h9MjSl8h4otop5micDqB63Gyvn0SvQxwzQKShjm+967:RC0ITo+TQ0IhAiU2w6nPSIxBhjm+96rP
TLSH
T169C12A71A46D5C7705A7D442F1233A97CEF8706BDA51AF74EAD91E1D01EB0EC2382523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\bin\VCRUNTIME140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\bin\java.dll
Size 119KB
SHA256 bd32ce0677b5dc044305db88153414ed2e2529e7d07b29c70599d569f6eab503
MD5 fc68db8ab902b37fe547926f27c9ca90
SHA1 8a8098727d05f023fd1fbca4c95395e976831e93
SHA512 1b0d2ad2e4eb6068c0cd3a88b8c31494a82304764df2f66f6edeb93fc5c97ee5a9799ffea990acf4e85e6f77c74533e6e09ba7612c6b70546e17c0419f04e0f3
SSDEEP 3072:J3wQqkpOFiVohaEOvYej06M4yNGBv3UfrRaXj+v:RIkpOFiVoKgeyaO
TLSH
T146C35B1BB3558096F47EB1BC806A864BD37274B11141E30E43A9CA6EDF8FB713D1AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\bin\javaw.exe
Size 49KB
SHA256 0773cc34c8468eae9caf31fc2c36548a2b5d92762cd912a43354f2bee9dcab87
MD5 3b172ab79593cc71041eb59b4145d8b8
SHA1 a3f38ff05e00d7c389cf876470d351ccffc82a2f
SHA512 e553a4d00af4aae846658b7c09ce52b81f80202c0298a6549bd7d0edc4de9203ada2105aa6805cf312b887193dda6c135a116f4aa12009b6f25b9c9ecc5d3609
SSDEEP 768:kgKzK2RM5R2TyJ5R3s8D/bkt5Ruz3Vb3PM5NYiDLk5kIvK:RKzxM5RdJ5R3sozkt5RA3PM5N7VIvK
TLSH
T1BD336C47AE082C81F42F84F158A7352655B4BD032BD1B3EBBDC6B21E0971391A9176DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\bin\jimage.dll
Size 33KB
SHA256 3720bd728631cca1fbfdb328adc6d9aca225c766118952c59e0721b429597741
MD5 261b0d6868f1bcdfa3167b4d255c4269
SHA1 43b850bab525eb9f81dac3ea4a16fe7becd3a604
SHA512 2672a1274280bf266321146d99e4d5019550af75b3b0b6d89336616f5f7f1a535363d59406a1c766362b84b94fba8cfa6270bdac3c04531ec98bb1fd94e1f724
SSDEEP 384:w55kBR2x3tCn9LD+YuNIpfByvh7GB4AzNyEIYi2mL4/y8RFvIIvZuI4f:wFHCnFDCIpfIvh76QYiDLk5kIv
TLSH
T19CF27C5AE6841C98DD6BE538C4AB9A1BE6F5F9524F50C3CB2720825E0F333813F69356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\bin\jli.dll
Size 87KB
SHA256 4ac0488a5604ad6d509cbfa88eeabbd6ed59d8c3f246b7eecafb0280c6d84171
MD5 eca58518fdab13af01d807d36ca694cc
SHA1 ffdaaec8756ec6f0a2a26cbeb56243c1b70ff15b
SHA512 323f87aee6450440fb0e220d290111651a349150a34ec89cf1c558d822667562a09d43408d069b1613c176acd190ff69cd3045a581cb5ee955ab016e9f5fff1f
SSDEEP 1536:oGt/i+vN6d/wYAkzx0kbtVH7CIOPQm+tGItYgh7VIvy9q:7tdvNHYAaTb7cPQm+gIFh+vy
TLSH
T1F9938D5653E021A1DEB7C579D9B4960BC3F2F0522B21938F136885EA0F637623E1CBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\bin\msvcp140.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\bin\net.dll
Size 58KB
SHA256 7be667a7a539a410a0fe28808068f57a01a011f6a6899c930823a8d7229a7815
MD5 e7af88f39ac1df202e0821d224411513
SHA1 6c1189128b5f95f86dd709a421a21c0b2720bb7b
SHA512 11ef20943e981cc333cda992a8c63b96844ee8d6a74b2b52f11e068b5b250b73bbde8d9d044bf30211685db010bc6f9f40a8214ef4233f677cf04c2d736dc256
SSDEEP 1536:0rBn2zLBxyvTtPnhv5awOYwT2eBIUmXgXW7VIv1:wnUevxl5arpfBIUmwXW+v
TLSH
T1F5436D0597D454C4F86BCA7886A75E16DBB2B470225083DF1379C56EAFE73B23B29380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\bin\nio.dll
Size 78KB
SHA256 258ff5c878daf328ad6dca0df2101ac432b4461cb7669077659a1431bd8e6224
MD5 2c6b9ea27a250378dbd8519e57e46bf1
SHA1 5ed71b807359a9278bdaf815c709ad5170156e0f
SHA512 58366a99cfcffb9e0a6c863d01d036d50c454315048208e7f5f849f4afd641745b7ffb6eb8e36e700caecfe8630e303265d7bc3533d600bab3874c8eb002ac01
SSDEEP 1536:luKDrKVqEiWtCnNXHlJ4Ozuwc7tGaRHpiys6gu7VIv:luKDuVqaMN3lJhXw/RHpi1Ju+v
TLSH
T1337339A243A4849BE86A7538825A4747E733FC114510A35F5368CB699F5F2B33E3E783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\bin\server\jvm.dll
Size 13.3MB
SHA256 9dac8ae1dfe88cb107e27ee952071682f48ab67266920cbecf03b15bb02ce181
MD5 e0d77cbc30bf03af6e78b43b0cb0c92e
SHA1 f7b06565bb09ad7152f89c63923131616e97e798
SHA512 c0de5c4831e0a66dc013b3963f1c850ddb028a06046aa7fad40bb02abc6dc641cfca1a809840b9194e6895df88ab6b01c22506c06dce4338dc1e9bf38087f3d4
SSDEEP 393216:YhQGDgO065OTXJ5ILPPrDOJ7TOD9Ey/cocqpfm7ApiCjoBYGsiFVUo83X+mq0sEB:nG
TLSH
T1D5E67C17A77840D1D06BD078CAAB9E0BD7F2B894433197CB61A056AD6F63FE2153E360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\bin\vcruntime140_1.dll
Size 48KB
SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
MD5 2bd576cbc5cb712935eb1b10e4d312f5
SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
TLSH
T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\bin\zip.dll
Size 85KB
SHA256 a7730f7aedad64aa48dc9d1b886ff96f22ed7f43497a8b8f4683cd55f9c36fb3
MD5 e93279f45b6f0ea348ce4cde6dd5342a
SHA1 cbb170ad50fd0bb06f8fa409a419955287e46330
SHA512 14f9cbca3fd65038fef4350d0089f777cf3537c3817c56ac20472b7f480a0f8bb0476a76abc50c7c992082e2adad639b8973639efb6e42b1062973c3cecab81b
SSDEEP 1536:5gXMxC9p/oorxZtRi58KSUXbIOxgWjBy7VIv:5gXMxC9p/Nr48IxgCBy+v
TLSH
T11483AD959AA05051DAFB95B0C9F34B6ED3B9B04653A147CF6358836A2F532213F0C3FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\conf\security\java.security
Size 70KB
SHA256 de75a6bb6a9cd330717507cd16b3179d0caac696e98063c0bc98c99070099b96
MD5 da5713e00093248c4165339461098c7c
SHA1 33a647adfe0d921408c34c7d72827cd6b6bd2739
SHA512 b9c1b642449fde63da3685a51412ae09b818e4e0ee64718781e124469f7a62d8e52b397a00e57908d9d14c5fbc50823228e15e92ab3dd7e4ddf7bcac1d55579f
SSDEEP 1536:r+My8Si8MRjJPFp5/jTNHu1UoQ2k/gl0ugzYilNndOc90:v8MfPFD/jTNO1UoQDciDndOcC
TLSH
T1E363D422BB896B7206F211A363AEF1D9F76DA12A36325154748D420C7326F71C3736E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

modules

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\lib\modules
Size 15.4MB
SHA256 78a8e4bc17707192c93dac06d3d331f24d16fdc925d8cc8af347ed5edf307e53
MD5 1951438b7e1c7d51b66745c1d610e7ac
SHA1 1d01076e712251a9431540d36525669f7c92ccc0
SHA512 e89afee7f74f5b65eaaf59b4c3df594800ed95815bb9fc7821e88ca8442e7770a2d16e0dfee8d1fd8f0dc05e795d708162fbde9f98541d397269474cd49e01f0
SSDEEP 393216:K1w5fgHsGScY3TbaGSnFqPCcd/w/r62h3RuAVXWW:KUYjhY35SFpUaGwuAV
TLSH
T10BF6220DB8C58B11E89A55FB85A2B6D42A7194C0FE8A830F2085726D3C77963CB7F57C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\lib\tzdb.dat
Size 100KB
SHA256 36cf71e63ce2816fe4456e9195e6c27fa7c9cd431c89ba762eba394ec2c7a1e3
MD5 df8a313edca47a1b2537b7ec047ce4de
SHA1 449cd5af08a45e2b017e670b3df9c8bf06de0c7e
SHA512 7c4c67d5793bdbf3f9b7dec1360b9278ad7206e66f6917568e2fc04e0fbc019b504edc35870eae143f9f313d5b7eca81404d5c4783c7fc61e0f8a1ec1d18e36e
SSDEEP 1536:N0ExeF88hPdr92L674jAGubVj0Lg/////UzJbPdJPNL0mIT/M4Z3jyxU:NPeq8hPdrcWzbVj0hJzdxuT/5ToU
TLSH
T149A3C4B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\jre\release
Size 110B
SHA256 0727484b6c682a5cad1baf656e36582c89565ec15b82aa115cdf1b4ca01eb141
MD5 52d83408bb11d932a2a65ec073028490
SHA1 b38a6520806fb92318767d3335d9a7da1ab12188
SHA512 c2310826e6345bca3e78a5ce17614061123b3f392cea49bdb333b8433e6d064105abb5c34ba7e08381337163e3d8435c91a69b7353f7c733c906568ed145e7e2
TLSH
T166B0126F145AE0C4896151C53479948BF4D94C70C724B054BB47780296A25A8057653C
MD5 SHA1 SHA512 TLSH

Submit Download

imgui-java-binding-1.86.12.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\imgui-java-binding-1.86.12.jar
Size 145KB
SHA256 be59b856753f40159cf2847e40eeb833e7b512ef2520218af47244029f930fed
MD5 a07b7ee3a39e016a89636657a3cbde95
SHA1 a13fa049c952f68753b7f7a3a38facea59f390be
SHA512 78f84a1d7bd84d3fefff484cefa5eca8f1ccdc7afae6f32af38b2fbaddc729681428207314a4b97770c60483e244632b6a40ea370c848293b3e62c4ee3e7ada7
SSDEEP 3072:yLbwoP1tYn/kv2SGsKV13RRRXi154jkCqVeQ9jCX7:ynJtan/kxG/VNJX6rCq7RCL
TLSH
T180E3BE61A1F932A6D9F74376C45183D3BA3E01CCA64BB1F634E4DF9B6432509CB1632A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imgui-java-lwjgl3-1.86.12.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\imgui-java-lwjgl3-1.86.12.jar
Size 33KB
SHA256 ada91c37cd42b261e1f92b305f57f5b5da1d9ba1f569422644cd44b035171721
MD5 278d84d76d0091bee5c867f55d8f92d7
SHA1 fc17cc082d58b7c0c858afe509f6b955df8b01f9
SHA512 6ed09fe820301816b7283f6f46c5d7e4f5ac80dc33ab9058918efeeea4ddccbf8d5dfe7fa15398f503bd45136bb29a672cfeba5389e98754ab86ea714b907133
SSDEEP 768:R9HEx6Wp9MoP8J/Clhnifn8lgAD68OxIw81+TiYaf8r:R6x66h8MPOng68OxIw4+TirEr
TLSH
T199E2AEA439A97161F0721334855B33562275886CE205B7F134D1ABEBEF2F829FB45437
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imgui-java-natives-windows-1.86.12.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\imgui-java-natives-windows-1.86.12.jar
Size 2.1MB
SHA256 7a162b825f9bb62cbcb37a269e72bb78f73c5bb0f85fe005371e8c5d190521d1
MD5 27325ea10ffb33d497f49c27ed5e45b6
SHA1 c7844dc67868f5b44c4e60d9438620a80eeac737
SHA512 4501a2fb6721a8d8796f35a52e4a2d3b3293bd19901cee8bf4a3c03cd7066b4c1a28cb5989894f0575793d38a0508f5cb035547dc4acb1f92739a06fac7279e8
SSDEEP 49152:t3vAxcDTVXvxZLe88d8r970+1rt5Ia+7UufzeefUklQYbyO2ELyBPJ:t4xwfxZLeFdoAq+7reQhh2ELMh
TLSH
T1F7A53328679339F4D60A0433A71FA206AC3F5578969501BB2877F1C53D47AFEFA8A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna-5.14.0.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\jna-5.14.0.jar
Size 504KB
SHA256 b1b01112686bcf165265cf432394c5c99446b29576f757ca5326792b1a4f849c
MD5 35d22882a5c2043c205193ea7a179b7e
SHA1 c25b699d7e10be02a8cdd753307bfcaef2182e28
SHA512 9a1139fc9dee2d3c26fdd105473779ac814f2261f7b5f3016f1d29249997e6c7e5cb4636dc1bc946c1967ab701a3c6709840c3c41a6faf1399f708a96e3a7275
SSDEEP 12288:KlFIOnBVJ6whcYQw/UI0nFfrWD3wt3lJ9DsNk+vg9:KPIOBWucl06ECfDse9
TLSH
T14BB41203784BD61FDD2386F610C7A386789B15E4D502A0EF67E0190B5924E5F8792EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna-platform-5.14.0.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\jna-platform-5.14.0.jar
Size 1.0MB
SHA256 428ef9440b2db8c0752dc7bd5f21caefe1aba4b42e605bf250a9a79823af9925
MD5 0826a7418dfa0533beb04c31e8ec111d
SHA1 0af4ab15b9d6c683e2e5066a9c5e135a5ca5adac
SHA512 93b266f92102b5fae22025d728f981866e7e6d41c60a88bb40ef654328c5b93cb1e0372990f475bd8fb1a559acc8e9a6dfaac0189e70c59e561da5f346320832
SSDEEP 24576:L1F2q6mrLgecRHGYpFHR+o1qZoo2x5E1QQhj:L1F2q62pcDFHR+CrzE1Qw
TLSH
T13B357D13AEDFCD68DE7759B351C28252507B25A4AC0F807E03986DC6CB6094B1762FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

json-20231013.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\json-20231013.jar
Size 72KB
SHA256 0f18192df289114e17aa1a0d0a7f8372cc9f5c7e4f7e39adcf8906fe714fa7d3
MD5 1a0702c57783ce9e948252c34644f328
SHA1 e22e0c040fe16f04ffdb85d851d77b07fc05ea52
SHA512 a5cdd1ed984448d6538746429f2d1a0ec8f64f93af0e84870ce898a9f07a81d11bf27d2ee081471975772efc8a0d3d5e05541197a532066e9edb09ad032d31a3
SSDEEP 1536:I8H/7uh2MbfZ7bPKkktY1yLvZoW/4LbxzSPWFopXIJeD59Hlz+v:IAusOlutIkZoW/4LFSPWCIJeD59Fz+v
TLSH
T15573F119B691A866F10FB2395CC2C40DF69948E8009519CB94986EC9FC66EC70F07BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl-3.3.3-natives-windows.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\lwjgl-3.3.3-natives-windows.jar
Size 161KB
SHA256 5ee63a19187efe5bb8747fd24f7b13257db348df5ad641113a3695e43f213959
MD5 57b9ecc451e79997e3d5432f5dffe571
SHA1 a5ed18a2b82fc91b81f40d717cb1f64c9dcb0540
SHA512 490ee96c4cd40a6ba7354d15f6c4bb966523dd8804a029376c7f6b462e34d9dd7e96e6d9f3b19a2abf80d7326955120818e664b07989c844bb7eaba286bdf6f3
SSDEEP 3072:mai1TYe2rHl6w265HUPyPMMXa4K/Q6jSG2xZGmcofCJphGxhdI5y/xOgNWos6TY:RiGJHl6w26VsSjBKY/GhpS55/vs6k
TLSH
T1AEF3130046B186C3E1680177D75A21967AFA69C00F5BE3606773331DED39AF7F9B805A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl-3.3.3.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\lwjgl-3.3.3.jar
Size 766KB
SHA256 dc9c7b2d48e8396d68895f8902ffa01e46253de44dfe927533ff09457ebfeec4
MD5 d89fce0be944d8cffd1f82c6546509bf
SHA1 29589b5f87ed335a6c7e7ee6a5775f81f97ecb84
SHA512 9e1d584441c669eb154792547646bc2910a6a12ca11fa0c110d67453960e9f18fdea7877dc8a6e2e5aad44950ce2a963b5ce65dce4588477804a990a48e17539
SSDEEP 12288:HGlfHh5LGOcVeuzvR5Db40/MRnf1Smtqjevm4E804EtBUUCNrfZUbTEsgvI/rxGC:mlrajZzvRNEKM5Fqcm4E804OuTZ4gjQj
TLSH
T107F40120DE71C06DE039213557EB2643783D27D8BE8B99994CD866C9E4328FB4B93B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl-glfw-3.3.3-natives-windows.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\lwjgl-glfw-3.3.3-natives-windows.jar
Size 162KB
SHA256 98155b451dfc6f585089dec77a12f9c05789c4dceb8da472f9d308160101a70d
MD5 135887d54b4ce08d087f3644ca75469e
SHA1 e449e28b4891fc423c54c85fbc5bb0b9efece67a
SHA512 acf919d9d01d90f4d49dce09c9990e1676c981b7bcd60a49a712bad2acc7cf8b99fb2a25d252d2ca60f73190e23bbc01d4e35ccab3a434d30731285e05feb00a
SSDEEP 3072:YuRNTpkIDe7VJWPpXiNiYrV6IWcED0Sa3oB28V8rPqmCcBDNx4V4VUOvCQainG:YuD9HP1fYrV1oD013oB2Ccnc4eOvCTiG
TLSH
T1D0F312743D6C197CDABB8E353656FA07E43A9BD83D6ABB821D41500470198D9F4CE2CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl-glfw-3.3.3.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\lwjgl-glfw-3.3.3.jar
Size 132KB
SHA256 bedc757fd2b1b255146db26b74b9cbd1fcf5644b89b47b104fa721c741604259
MD5 41c1287c1219fd0b67e8d51879f4c812
SHA1 efa1eb78c5ccd840e9f329717109b5e892d72f8e
SHA512 a64a9fee5b3c58e0a90826eaf0edea55694674e5589813f1d50f55a80356f658a786194aba52609aee7bd83b00356de336fba2f99ff2d4644c0df39179b53cb0
SSDEEP 3072:IGm4DZbkWyXYmHL3sJDqHOXt8sZE30AJZbu87:N7dXyBH7iZqsy0o7
TLSH
T173D39E717D72E9AAF436033A427B5BD3747D5788AA9AAF801C5D53C2F82283167433E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl-opengl-3.3.3-natives-windows.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\lwjgl-opengl-3.3.3-natives-windows.jar
Size 99KB
SHA256 f45e5f60596b03b2e3d8b98a123c855ebd0b5154c8155dc2a56b890ccc907477
MD5 6577f923b0cf80ee8edbd644fd242cfd
SHA1 e6c1eec8be8a71951b830a4d69efc01c6531900c
SHA512 5056f75d3933729f9c18661c373d705ea6d6751dd729e374cf4e3f47f94c6fc19a876108f6e1132a29cf509cb2f18526cc030e3c49a57d72795850a484df3234
SSDEEP 1536:0SE2N7JIHaEU4xAuo35FN2sVT5qxezK+BWcu0dEPaB3KlciLDyMrPXbZVSU8NuH3:e2XIPxADcoE0dElnLDyMPfSU8Nut9DHL
TLSH
T1CFA3023796DA9DC8EA3C06F15795F01A006731B9288AF747524C3956383BCB635397E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl-opengl-3.3.3.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\lwjgl-opengl-3.3.3.jar
Size 907KB
SHA256 5062da750e5f7ec89e27e8b67b7d40fa8c4b16890159e35f828116ce6c8eca1e
MD5 d5a85fe9c675ff040197e2e2dd694fc1
SHA1 02f6b0147078396a58979125a4c947664e98293a
SHA512 b96fcb6eb86a07c019c92f450b2c84e04d80e2f4a23ef0d911c7b44798d0727caf16a7d4b5600b43e4bb62ab2895cee2737ad72023894898b0d20de71d2bcac7
SSDEEP 24576:GszX2yjbFPjJATJwgeXtSBwuV817/cT2BLOWa:1zXzBji1wJuVK7/cT2ra
TLSH
T1D115E123EDB7A52BFE2B023941771AB3642D73C8D887AA81156D27D1B462419FF27730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

okhttp-3.12.0.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\okhttp-3.12.0.jar
Size 412KB
SHA256 71787f2c599e0441c7a4413983bfdd93d40b56e1badc5e0413d6a4c485ba3f35
MD5 2a0ca42298238d76d9b7f4dcf750c01a
SHA1 b36f4a04584c0fb0d9af2d3401cdff8dacb1ea54
SHA512 11da48455283684b8ffe8353403c9e57e81a35868a3a15a5eee98ea7b10a8438f2992583bdcff519116cc27d07ce6b61cc28212841541d708c646f912f8871ce
SSDEEP 12288:ZQ0ljorlPXN0wv/KFW4XTzRFh0UvTguPNTd0w7:6yccsGW4XTz9088UNOw7
TLSH
T11394F1FBBA409627ED53E032E1B2F956F42C12D98023E49225F0C69B58F38549759BCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

okio-1.17.6.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\okio-1.17.6.jar
Size 90KB
SHA256 8e88b055523cc80613dfb844d598740e10ada62f4bd98304cdd140c5854cc3b6
MD5 26495cb0317ba27245f92ce57cfa600c
SHA1 fca77ce5f3ce6fa8a65738a31e34b87ccd289f71
SHA512 47eae3855284d37cea11befd8c5a298764cd32eb297a4a1fffc73700431f40890dde1a1d5f286ce5304f41c10c7293d350fdab1ac55b855222a8a22a963fda0d
SSDEEP 1536:yT3P01oeV4oUKJDXD0mlnX6QpfzCoKMnrZHrYh9pzAPuc4uy+I5s+A5E4c1CRdd:AP01Z7DXImhHfO4nrprYhL0G/uYafWyH
TLSH
T10893F1223CCD983DD4FBE4798DFE69A7321E26DD90B932D768A13887093DC806AF1115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

slf4j-api-2.0.9.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\slf4j-api-2.0.9.jar
Size 63KB
SHA256 0818930dc8d7debb403204611691da58e49d42c50b6ffcfdce02dadb7c3c2b6c
MD5 45630e54b0f0ac2b3c80462515ad8fda
SHA1 7cf2726fdcfbc8610f9a71fb3ed639871f315340
SHA512 069e6ddce79617e37d61758120c7e68348ee62f255781948937f7bec3058e46244026d7f6a11e90fbc15cd4288c4bb1acee4f242af521c721a9e68a05e64d526
SSDEEP 1536:wE1sO9m2obNMBEplcMmVFKseV/wk3t6FTKMBCm:RV9m2Uo+zmVFKseay6A6
TLSH
T1C953BF98FEAD802DF90FB4F5406355EA7BAC51E8029A910305E95E5D9637D8A0B33FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite-jdbc-3.44.1.0.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\libs\sqlite-jdbc-3.44.1.0.jar
Size 751KB
SHA256 69e5d2c36364b13dfc54a9829b8bac5057218e8c5160c60bfa5f227799b8ef0b
MD5 ff6cf4986fdb9d179355787ba39161f0
SHA1 11d1bcaa6eb65fe1ef79afd3219fa88faf4ae19b
SHA512 f8fa52604cf8d4b93aaf92ab31b76299fae4b4f2f163c072639960e2cac3e9524e0252857ac08bef94508d08984c33ce44c923512609767a6ed3fca0f95a77d4
SSDEEP 12288:izip9mt0HAqzgz+kWembIrQx3lrB7BG0QHTjJTGtYxxHWAkcn8vWMXcol6:Zmt0HAegzGbIExhWHWAfQsol6
TLSH
T176F4228FDA1C4778E6C700B5981641D6E87D4C1CECA2D2260CA055ABED71C9B1B1BFDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modules.jar

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\modules.jar
Size 527KB
SHA256 abd6c3a4ae8963e44f581c707e9d03791044f6004b7e8b840cf0c6d1589f6378
MD5 39ab698b16d2db12fcf0aa03929258de
SHA1 e80bc180e35b262eb6e3e88bd4d952d740dbab62
SHA512 bc25001076855e3dae3d5c02b72f5e09a644d793726044da2855d8af22aecb19386b5417e931de8ec0596f344c278704ab02c8d60511b1c2cb662c5eabed5ada
SSDEEP 12288:g0ihopHlHX2cwPjDrkUwhhatenWp0EhH421Ea9nI:NtirkUehatgWr4KEaK
TLSH
T1C7B43A2FF906670BF560ED3E249607942311BCB49452F4A7BFCE6D6389E528B1E406DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_key_dll.dll

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\native\chrome_key_dll.dll
Size 153KB
SHA256 7118d6b50281d585ecc7aa752e5757645a9d47a70493a9e044324662eba55903
MD5 23cc37f7d74a70ded86c6a975d710e23
SHA1 c784e94f3aa1bb5358371d503b6340551616ed02
SHA512 288d1692c40fcad070ea65f07d73ef7aa920e5cfdaf7489053be7998758878d499cd53fbccc3fa6d5ce056b0640da67440c768c8d895e58b694d18c2c2c4fd8a
SSDEEP 3072:dMzFlC5vaYZSp+Frv0k1nZxRJV9EUf4NcV5TlWVP:dMzF+vxa++k1Zbn0l
TLSH
T170E33B17AAA6507BE26B8934C9534901EB737C565BA0EADF03500EF60E27BD09F3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chromelevator_x64.exe

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\cache\40a049d77156071c9a42\native\chromelevator_x64.exe
Size 1.4MB
SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
MD5 1d04536714bb22a3e909525a7dd627f0
SHA1 affc166fa1874ff3ec0e42646e008cec972b76ab
SHA512 ec2028983c8c5939545c572f13e1d24e730ca1601c6a8840769d1a6b28b8e12d7c9bd1850007ec0be8abc7c44e12bafcd64dc5b4c842155b75a70d8c71769166
SSDEEP 24576:+7JVbIr44BR1IVOe4waHbTkEFhA+b3XYXKXjAOY5MBmYBREkM2eU25gooYHJLUY:moj15e4w8xhACEKzs57Xci5NLd
TLSH
T14565020BA6A401F9D5F3C174CC42590ADB76F84A47A5EB4F03E449961F276B09E3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna15668914990499906727.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna15668914990499906727.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sacma_debug.log

Path C:\Users\Admin\AppData\Local\Temp\sacma_debug.log
Size 1KB
SHA256 2a33797710b4e658626746411108c94705dae61c563af645f5c7a141e3da3945
MD5 b18948b1805be10c8b868d7c8b3570f5
SHA1 ed79d20ff82ff7e938b11698eaea2acfb449b1e6
SHA512 c085f664bedd8c339719724fe349b8dd4d91859bbb6c82603b19fab69c8330fbf910754014e0716f308b0019d51ae3c21e463b0c0a9fc0a9142ad06402fad2aa
TLSH
T1BE417B1495CACF2B0851F5E30EA8C38ED4E5DE5D7ACE2761CB2484DD21D3C4AA695703
MD5 SHA1 SHA512 TLSH

Submit Download

sacma_debug.log

Path C:\Users\Admin\AppData\Local\Temp\sacma_debug.log
Size 3KB
SHA256 f130dd49462cd070cfb266fe58eee1c88bbc2bd6a0f706338da9ccf53ee3a26c
MD5 7e3128357035189f5a59ab635299879b
SHA1 615b0c87613a9e935be393b91687588c29eefc7b
SHA512 45e2b8565c2c66ed73fdcfd3f7cd471e9373bce95abfa4f9f704df3c78089194104616c81f879a8897fe30f8c945d932978edc1b9061ff3d9fe323f83779c679
TLSH
T197718A50A5CACB3B0851E4D70EA4C38ED4E0DA4C7ACE2B75CB2585DD21D3C0AE6AA713
MD5 SHA1 SHA512 TLSH

Submit Download

sacma_debug.log

Path C:\Users\Admin\AppData\Local\Temp\sacma_debug.log
Size 3KB
SHA256 0b938e89235878f36d5839ea59b8a6b8f13c8cbd3fae2b4ef427c7b25b348755
MD5 61ba43eefa1449d4d35eae0d5529a00e
SHA1 07f141c2463835aaf8449d23b91879f669b38507
SHA512 a09018949587b787470b144c387cece236c47e8bcafcaa612517b2ed0e9ccf4e12d1a1a8e7ad77b8d841772713291682589e1fcf65ff6de2c6dd7e8d41f897e3
TLSH
T1DC718B50A5CACB3B0851E5D70EA4C3CED4E1DA4C7ACE2B75CB2584DD21D3C0AE6AA713
MD5 SHA1 SHA512 TLSH

Submit Download

sacma_debug.log

Path C:\Users\Admin\AppData\Local\Temp\sacma_debug.log
Size 4KB
SHA256 4e95d9f476dd2d9c7402d022b27a93678f9af383875300985a0409e7169822a6
MD5 c341cabc0e09395cfff1164775ea3dc6
SHA1 3c2ca667f9ac78395441e933775abd8b74aea0ff
SHA512 cd2691373fb1e1237b5dc19d0514cdf247a8c7c431400c351b7098a03810a4b0d692d3ee3fb83a81b7a1aec89a0b6851b2734f34809f294e204b47c29b464798
SSDEEP 96:p67+s7r9FZ/ML4OkZmBL44aL/Z/02I5L/ZmBI5LhLgL2L5y5w6zsVwSXUZm3L4OY:p9qJFQ49a4B/AV/xVdOsA5w+l24oc4yp
TLSH
T1E5A17A50E5CACB2B0851E4E70DA4838ED4F1DA4C7ACE2B71CB2594DD25D3C0EE6AA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

soul_debug.log

Path C:\Users\Admin\AppData\Local\Temp\soul_debug.log
Size 1KB
SHA256 dccc503f1631168e1e20db71522339a92763e50da2520b74453838cf642cf93b
MD5 b1fc9e07936005c02e720230ccb2289f
SHA1 8199c89d306fb91cf37c4569454e861cf2daf5a7
SHA512 395933e678bf5b2cb829ff066815544de5503a4f8cd35c62d7dc3c8d1b8c78568b53d9de0b86afa2fa35523e8a90be1c63823c7450c84088b1f64614636673ea
TLSH
T175218B544BDF765E6509B546307802CC40900C99AEDAFA6B8FAC852C27130DF96CA353
MD5 SHA1 SHA512 TLSH

Submit Download

soul_debug.log

Path C:\Users\Admin\AppData\Local\Temp\soul_debug.log
Size 5KB
SHA256 396d1be4cedda5fa0b00b1792c2220d2b0bdb2efd0ddafadbc4b3ca310d10ee4
MD5 0f3a52ed0abe343d4a84aae21d290cce
SHA1 a94bd566c6b980578fb8f9479dd0abc2fde7eb98
SHA512 bd0eebfe206dab958e11cc5e030485306ef8d9ed92484edc66cc98fc84b5d6d597979de532629a4b19a349b0604c94d35ea5823d8187567dd1a2a58b5305299c
SSDEEP 96:8CnmRV8whhThHh6IEAQfmZHPsMUmqmpmjwmgmEJOggzS0O0O0O0O0O0O0O0O0O0a:twhpZhgwmxEJOLzu
TLSH
T16DB1005F874D74C7216BC1C9F6944AD4EEC196A40866FAFF89BECBCC0B06056E18B217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite-3.44.1.0-b422686c-a954-4eb4-beb1-cf0d86ccebef-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.44.1.0-b422686c-a954-4eb4-beb1-cf0d86ccebef-sqlitejdbc.dll
Size 933KB
SHA256 393e8faa8231ac4090f4feabecaf2db00c7bff4b2671c685850b36910d694967
MD5 e1d69e2d6b6b96891a16068b9e4cf439
SHA1 e32f4dc6dbe9e5cd3a33508757feec9f5d4e198a
SHA512 1bd0f6d958086b20f37431f043d35637f7a99d4bef442c0092a15799bba66fc622c9f356791fb0a8b8b15fd6d6863bbb0acf1bc70fea8e1be35e0f325e9363e1
SSDEEP 24576:oii5GOMxczl93QtR/bKNr5mQj5qjiN5HZv:H/Gzlut1aqjiN5H
TLSH
T1AD156C13E39244BDC47BC2B0872FA323B631F4497134EB5F6AA48B642E61E60971F759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4364-398-0x00007FFD219B0000-0x00007FFD21AA0000-memory.dmp

Download

memory/4364-168-0x0000027C51410000-0x0000027C51680000-memory.dmp

Download

memory/4364-178-0x0000027C49EE0000-0x0000027C4A150000-memory.dmp

Download

memory/4364-399-0x0000027C49EE0000-0x0000027C4A150000-memory.dmp

Download

memory/4364-374-0x0000027C51410000-0x0000027C51680000-memory.dmp

Download