87c49f77dcba41728a5842923b7f9b7dfb5ad6806d34688a751e9607744b8b0c

Analysis

max time kernel
109s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OakHaven-Setup.exe
Size 49.1MB
Sample260805-qjrtpayclb
SHA256 87c49f77dcba41728a5842923b7f9b7dfb5ad6806d34688a751e9607744b8b0c
MD5 8a838122053e0750f9e80e0b6435f7a7
SHA1 a3f7373d313c7085209242f278095912d3ecc6e4
SHA512 72b67a2f7cdf8432fb4f4ddec0e6cbd1445db0ffce572eacfdb1d3e4170224d4cef44ad0957a1d395ad0fa2f9f3795b0938769813a42af9691f18ca11740b29d
SSDEEP 1572864:jdED6d4MYqEK9mhMpxiqsQyoMENooCzf:jdhd4MYqBmqOoMoZCzf
TLSH
T116B7331DAEB488A7C2B6863449B1F32EE53C79911F25438B5B6162C51F36FD83D3AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	OakHaven.exe

Executes dropped EXE 2 IoCs

pid	Process
524	OakHaven.exe
3448	OakHaven.exe

Loads dropped DLL 17 IoCs

pid	Process
892	MsiExec.exe
3448	OakHaven.exe
3448	OakHaven.exe
3448	OakHaven.exe
3448	OakHaven.exe
3448	OakHaven.exe
3448	OakHaven.exe
3448	OakHaven.exe
3448	OakHaven.exe
3448	OakHaven.exe
3448	OakHaven.exe
3448	OakHaven.exe
3448	OakHaven.exe
3448	OakHaven.exe
3448	OakHaven.exe
3448	OakHaven.exe
3448	OakHaven.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
50	raw.githubusercontent.com
51	raw.githubusercontent.com
52	raw.githubusercontent.com
53	raw.githubusercontent.com
56	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8837.tmp	msiexec.exe
File created	C:\Windows\Installer\e588085.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{081C7FB8-D69E-310A-A99A-EF43E494AF80}	msiexec.exe
File created	C:\Windows\Installer\e588087.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e588085.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8122.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1808	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OakHaven.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	OakHaven.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "L1033"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Speech SW Voice Activation - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\r1040sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\c1041.fe"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\de-DE-N\\tn1031.bin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "L1036"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Speech SW Voice Activation - French (France)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Pablo"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SR fr-FR Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "L1040"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\es-ES\\VoiceActivation_HW_es-ES.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\M1036Paul"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Speech Recognition Engine - it-IT Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\AudioInput\\TokenEnums\\MMAudioIn\\"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 ~ 0009 aa 000a a 000b oh 000c ax 000d b 000e d 000f eh 0010 ey 0011 f 0012 g 0013 hy 0014 uy 0015 iy 0016 k 0017 l 0018 m 0019 n 001a ng 001b nj 001c oe 001d eu 001e ow 001f p 0020 r 0021 s 0022 sh 0023 t 0024 uw 0025 v 0026 w 0027 y 0028 z 0029 zh 002a"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "CC"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Speech Recognition Engine - en-US Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_HW_ja-JP.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Hedda"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033David"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft David"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\lsr3082.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Speech Recognition Engine - fr-FR Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SR fr-FR Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\MSTTSLocfrFR.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Hortense - French (France)"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SR es-ES Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SR ja-JP Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Ayumi"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_ja-JP.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Speech HW Voice Activation - Japanese (Japan)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 + 0008 * 0009 1 000A 2 000B 3 000C 4 000D 5 000E a 000F ai 0010 an 0011 ang 0012 ao 0013 ba 0014 bai 0015 ban 0016 bang 0017 bao 0018 bei 0019 ben 001A beng 001B bi 001C bian 001D biao 001E bie 001F bin 0020 bing 0021 bo 0022 bu 0023 ca 0024 cai 0025 can 0026 cang 0027 cao 0028 ce 0029 cen 002A ceng 002B cha 002C chai 002D chan 002E chang 002F chao 0030 che 0031 chen 0032 cheng 0033 chi 0034 chong 0035 chou 0036 chu 0037 chuai 0038 chuan 0039 chuang 003A chui 003B chun 003C chuo 003D ci 003E cong 003F cou 0040 cu 0041 cuan 0042 cui 0043 cun 0044 cuo 0045 da 0046 dai 0047 dan 0048 dang 0049 dao 004A de 004B dei 004C den 004D deng 004E di 004F dia 0050 dian 0051 diao 0052 die 0053 ding 0054 diu 0055 dong 0056 dou 0057 du 0058 duan 0059 dui 005A dun 005B duo 005C e 005D ei 005E en 005F er 0060 fa 0061 fan 0062 fang 0063 fei 0064 fen 0065 feng 0066 fo 0067 fou 0068 fu 0069 ga 006A gai 006B gan 006C gang 006D gao 006E ge 006F gei 0070 gen 0071 geng 0072 gong 0073 gou 0074 gu 0075 gua 0076 guai 0077 guan 0078 guang 0079 gui 007A gun 007B guo 007C ha 007D hai 007E han 007F hang 0080 hao 0081 he 0082 hei 0083 hen 0084 heng 0085 hong 0086 hou 0087 hu 0088 hua 0089 huai 008A huan 008B huang 008C hui 008D hun 008E huo 008F ji 0090 jia 0091 jian 0092 jiang 0093 jiao 0094 jie 0095 jin 0096 jing 0097 jiong 0098 jiu 0099 ju 009A juan 009B jue 009C jun 009D ka 009E kai 009F kan 00A0 kang 00A1 kao 00A2 ke 00A3 kei 00A4 ken 00A5 keng 00A6 kong 00A7 kou 00A8 ku 00A9 kua 00AA kuai 00AB kuan 00AC kuang 00AD kui 00AE kun 00AF kuo 00B0 la 00B1 lai 00B2 lan 00B3 lang 00B4 lao 00B5 le 00B6 lei 00B7 leng 00B8 li 00B9 lia 00BA lian 00BB liang 00BC liao 00BD lie 00BE lin 00BF ling 00C0 liu 00C1 lo 00C2 long 00C3 lou 00C4 lu 00C5 luan 00C6 lue 00C7 lun 00C8 luo 00C9 lv 00CA ma 00CB mai 00CC man 00CD mang 00CE mao 00CF me 00D0 mei 00D1 men 00D2 meng 00D3 mi 00D4 mian 00D5 miao 00D6 mie 00D7 min 00D8 ming 00D9 miu 00DA mo 00DB mou 00DC mu 00DD na 00DE nai 00DF nan 00E0 nang 00E1 nao 00E2 ne 00E3 nei 00E4 nen 00E5 neng 00E6 ni 00E7 nian 00E8 niang 00E9 niao 00EA nie 00EB nin 00EC ning 00ED niu 00EE nong 00EF nou 00F0 nu 00F1 nuan 00F2 nue 00F3 nuo 00F4 nv 00F5 o 00F6 ou 00F7 pa 00F8 pai 00F9 pan 00FA pang 00FB pao 00FC pei 00FD pen 00FE peng 00FF pi 0100 pian 0101 piao 0102 pie 0103 pin 0104 ping 0105 po 0106 pou 0107 pu 0108 qi 0109 qia 010A qian 010B qiang 010C qiao 010D qie 010E qin 010F qing 0110 qiong 0111 qiu 0112 qu 0113 quan 0114 que 0115 qun 0116 ran 0117 rang 0118 rao 0119 re 011A ren 011B reng 011C ri 011D rong 011E rou 011F ru 0120 ruan 0121 rui 0122 run 0123 ruo 0124 sa 0125 sai 0126 san 0127 sang 0128 sao 0129 se 012A sen 012B seng 012C sha 012D shai 012E shan 012F shang 0130 shao 0131 she 0132 shei 0133 shen 0134 sheng 0135 shi 0136 shou 0137 shu 0138 shua 0139 shuai 013A shuan 013B shuang 013C shui 013D shun 013E shuo 013F si 0140 song 0141 sou 0142 su 0143 suan 0144 sui 0145 sun 0146 suo 0147 ta 0148 tai 0149 tan 014A tang 014B tao 014C te 014D tei 014E teng 014F ti 0150 tian 0151 tiao 0152 tie 0153 ting 0154 tong 0155 tou 0156 tu 0157 tuan 0158 tui 0159 tun 015A tuo 015B wa 015C wai 015D wan 015E wang 015F wei 0160 wen 0161 weng 0162 wo 0163 wu 0164 xi 0165 xia 0166 xian 0167 xiang 0168 xiao 0169 xie 016A xin 016B xing 016C xiong 016D xiu 016E xu 016F xuan 0170 xue 0171 xun 0172 ya 0173 yan 0174 yang 0175 yao 0176 ye 0177 yi 0178 yin 0179 ying 017A yo 017B yong 017C you 017D yu 017E yuan 017F yue 0180 yun 0181 za 0182 zai 0183 zan 0184 zang 0185 zao 0186 ze 0187 zei 0188 zen 0189 zeng 018A zha 018B zhai 018C zhan 018D zhang 018E zhao 018F zhe 0190 zhei 0191 zhen 0192 zheng 0193 zhi 0194 zhong 0195 zhou 0196 zhu 0197 zhua 0198 zhuai 0199 zhuan 019A zhuang 019B zhui 019C zhun 019D zhuo 019E zi 019F zong 01A0 zou 01A1 zu 01A2 zuan 01A3 zui 01A4 zun 01A5 zuo 01A6"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Stefan - German (Germany)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HW"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\tn1041.bin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "{31350404-77AC-4471-B33A-9020A2EDA1D1}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\AI043082"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; currency=NativeSupported; url=NativeSupported; address=NativeSupported; alphanumeric=NativeSupported; message=NativeSupported; computer=NativeSupported"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "È stata selezionata la voce predefinita %1."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "{14E74C62-DC97-43B0-8F2F-581496A65D60}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "{81218F10-A8AA-44C4-9436-33A42C3852E9}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\de-DE-N\\lsr1031.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SW"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\lsr1033.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\VoiceActivation_en-US.dat.prev"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Pablo - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "410"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Traditional Chinese Phone Converter"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Sie haben %1 als Standardstimme ausgewählt."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Zira - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "{57523D96-B7F6-4D2C-8AFC-BCC5F5392E94}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\AI041036"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\TTS\\ja-JP\\M1041Ichiro"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SR es-ES Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\lsr1036.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "6;18;22"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "{179F3D56-1B0B-42B2-A962-59B7EF59FE1B}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "5218064"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Ichiro"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Mark - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "{A79020BC-1F7E-4D20-AC2A-51D73012DDD5}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\de-DE-N\\c1031.fe"	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4496	msiexec.exe
4496	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1808	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1808	msiexec.exe
Token: SeSecurityPrivilege	4496	msiexec.exe
Token: SeCreateTokenPrivilege	1808	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1808	msiexec.exe
Token: SeLockMemoryPrivilege	1808	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1808	msiexec.exe
Token: SeMachineAccountPrivilege	1808	msiexec.exe
Token: SeTcbPrivilege	1808	msiexec.exe
Token: SeSecurityPrivilege	1808	msiexec.exe
Token: SeTakeOwnershipPrivilege	1808	msiexec.exe
Token: SeLoadDriverPrivilege	1808	msiexec.exe
Token: SeSystemProfilePrivilege	1808	msiexec.exe
Token: SeSystemtimePrivilege	1808	msiexec.exe
Token: SeProfSingleProcessPrivilege	1808	msiexec.exe
Token: SeIncBasePriorityPrivilege	1808	msiexec.exe
Token: SeCreatePagefilePrivilege	1808	msiexec.exe
Token: SeCreatePermanentPrivilege	1808	msiexec.exe
Token: SeBackupPrivilege	1808	msiexec.exe
Token: SeRestorePrivilege	1808	msiexec.exe
Token: SeShutdownPrivilege	1808	msiexec.exe
Token: SeDebugPrivilege	1808	msiexec.exe
Token: SeAuditPrivilege	1808	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1808	msiexec.exe
Token: SeChangeNotifyPrivilege	1808	msiexec.exe
Token: SeRemoteShutdownPrivilege	1808	msiexec.exe
Token: SeUndockPrivilege	1808	msiexec.exe
Token: SeSyncAgentPrivilege	1808	msiexec.exe
Token: SeEnableDelegationPrivilege	1808	msiexec.exe
Token: SeManageVolumePrivilege	1808	msiexec.exe
Token: SeImpersonatePrivilege	1808	msiexec.exe
Token: SeCreateGlobalPrivilege	1808	msiexec.exe
Token: SeBackupPrivilege	1900	vssvc.exe
Token: SeRestorePrivilege	1900	vssvc.exe
Token: SeAuditPrivilege	1900	vssvc.exe
Token: SeBackupPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1808	msiexec.exe
1808	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3448	OakHaven.exe
3448	OakHaven.exe
4788	SearchApp.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 1808	4544	OakHaven-Setup.exe	84
PID 4496 wrote to memory of 3832	4496	msiexec.exe	100
PID 4496 wrote to memory of 892	4496	msiexec.exe	102
PID 4496 wrote to memory of 524	4496	msiexec.exe	103
PID 524 wrote to memory of 3448	524	OakHaven.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\OakHaven-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\OakHaven-Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\system32\msiexec.exe
  C:\Windows\system32\msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\240662000.tmp\main.msi
  2⤵
  - Enumerates connected drives
  - Event Triggered Execution: Installer Packages
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1808

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3832
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5943FDEF51F608A48C9FF94B2F00DAFC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:892
- C:\Users\Admin\AppData\Local\OakHaven\OakHaven.exe
  "C:\Users\Admin\AppData\Local\OakHaven\OakHaven.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Users\Admin\AppData\Local\OakHaven\OakHaven.exe
    C:\Users\Admin\AppData\Local\OakHaven\OakHaven.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:3448
  - - C:\Users\Admin\.OakHavenCache_v1\java\jdk-11\bin\java.exe
      C:\Users\Admin\.OakHavenCache_v1\java\jdk-11\bin\java.exe -Xms512M -Xmx1024M -jar OakHaven.jar
      4⤵
      PID:892

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\ab86f363f970412483afad37caebd1ed /t 4048 /p 3920
1⤵
PID:1680

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e588086.rbs

Path C:\Config.Msi\e588086.rbs
Size 108KB
SHA256 be27d96a09a1a34f0d8ad97d9317705805ba2acd2eff71faa582bb71c29b553d
MD5 d606f33f0c178bbc2e1fafe7bc2b2b80
SHA1 b750b652a7a10c643e639b3d4a9825b1ffe55843
SHA512 72bc5d741f0e93910349304145a47b6162d322981f515c05895132cc67151b0cc458823218d480eda8850de364464de20f1cef17cb9d6805a5b8b7ea844513e7
SSDEEP 1536:cHygTnc/TTvxDayVrDA1n1l1l1kFObRxcAQDBuomQlnaLUtkMWKiC+jMw6+3wsIE:V3Rajm8su5r
TLSH
T130B39D44B8715FF5A804522FC3FAA38C552B4B0976E72E5C8722DD4C4BE7C0ADDA16B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OakHaven.jar

Path C:\Users\Admin\.OakHavenCache_v1\OakHaven.jar
Size 47.0MB
SHA256 9f9e8d6e987b290911867e32d379214ea72d0049d2f46c259e30c2c482471782
MD5 f7afb524adb3e396f7747468c1df5df1
SHA1 09cea1089c0dd1fc09074faf1e727e4bb8719e52
SHA512 91e321b1361c515f094f144534f6efbbc577524b619d98b57e2ad23c7f423da569d843efaa4a1227956f9b0ff161dadc0f5b5f317ea144ee1ca81c6b56419cf0
SSDEEP 786432:vy9BGEPKC+b6dnbbyRBbdzfK+bjJB3P2EzP61FPiwlyNjjZdRsCZH:AGEPKdOdbbyRXz/TeE6LtejZdRsOH
TLSH
T130B71233F5DC253AEA338236D0625963746D46DCE40B30BB34F8468B9973D8D8B927A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1321.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\1321.wav
Size 14KB
SHA256 6ed218781f96d407475c684df2c9f3d0000a1bf80dbbcc2e2bf2b715ad1780db
MD5 84b951ca1c97c5ad9df02251a1d8f916
SHA1 554a7f8a44104faedc72b0ca62c528e5a6521338
SHA512 c34bcdb28640b55a79eeed24b49b349bfbd8cf637fcf9c955e82674ae964e235ddb58165811a25d60897b62e36c418916c2cb896d0abbf51ecfac5689d18238a
SSDEEP 96:U7BXp+hkNo+k9yYA/Ne+TEt/cTnJ0gnjVVYlerygIohy0XrRsCvdIIBXXKn3:UNXp+hzs9dEtOOgU0mgIeH7f/an3
TLSH
T1B752E8DE95B17A0A4D1E8320EE3ECB6DF48A55D0177CA1281225EF4B50F32D8C197B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1452.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\1452.wav
Size 20KB
SHA256 e1211f429ccf3b574b3996786f4cce4fc5858e01b155b1fef87f1a77a543e6ff
MD5 7c712132c181075805d112c15183a16a
SHA1 6a9adcd880413e7d16b3c8176644eb5f0480768d
SHA512 0290afdf40cb86ed7accaca0008c6e74db72e56e7fcb00647c39c466b1a17a08a4d28615873a194e50b8e9d68619366a263522696c12279a1440d83456c3d656
SSDEEP 192:PaN45Fx7wMBE2/a5rE+UJtSKj8yZyyyyfyyy3yV:PAkF42/a5rPUJrN
TLSH
T103925AEEA06238211D4A8371EE7DDB2CB68664D11B3C97640624EF9B40737D4C8B3B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1572.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\1572.wav
Size 16KB
SHA256 1abb08e330615da7ade9b24ceb1e7f74435c586c655cffe15b4f922cc54f2404
MD5 b87e3971c869514d7f51d38375f3996a
SHA1 d792d59a31cb7125962da68007240bfb22494684
SHA512 19b5a1bad7bd5ef8debcb2dfb28566a9bbe3b84255a34596a49589682619542355fbe2c955356ad0cc87996255d90808583914c09613527424e83448d0747f2c
SSDEEP 192:sySJNqDRdQUjwx2ChF+ZQgCJsmHPiQ46tF65IyjY:sySvqDRdQp2CP+OgC/vrFAY
TLSH
T1F972759B50363C63994DC77AEF1CCB6EBA856880A900A675A030FE4640B57DAFD3374D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1701.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\1701.wav
Size 39KB
SHA256 e68e5d3d81040482cfba1e92d60eb627bc9113752f894f655380fe626c148bd0
MD5 d0fcc0b38d3b5c48e2aaa458f0a7c22d
SHA1 d0949cd401961c26ab56612066e2d0042a5916f6
SHA512 8bed3768e51cf525fc5667048eedc1a67313d9a6b9201cf85bbca23084ea821ccc85070da787e1038fa8dde1592878b65f184d451d08755068dd2b6881768446
SSDEEP 384:sunj/r+akjqAGyWWzwTPFRkG/dckSbCpiDJ3CY40I:sunj/FVAG7/TPFR3FcPtDU0I
TLSH
T13E0389E295D27E4929569F779F0CC0EC770D36A89E8B2376901ECE1320B4876C7A7B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1800.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\1800.wav
Size 50KB
SHA256 0762a3a0c973658ab9945bf32ee6f95ee98796ce78a40a5a9b53e8f015081030
MD5 4968e64956f3569b5126c10ed035e55c
SHA1 6f484432e576858cec25d1c7a44622d9d56ce13d
SHA512 3b00b15786ea440e8232977b49850feeca52d1b6a0e910b7a6ac632b79f741511f521814dd7d1e6ffdf3ef6a870647a4a3888d2725f317813c2fe625ed136149
SSDEEP 384:qWEEvN/GWjonWlS/n6z17lgRpuMg0XdQk:qkNKWO6z17OEW
TLSH
T13B3398DFA4A238151D4A8771EF6DD72CF2CEB8859E6C9B941524FF1600326E9C4B2B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2321.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2321.wav
Size 15KB
SHA256 cd3039d6d4a4da1f87c7e63a48fd54b6776f47c35dd08c4cdc3cf3a3ac0c1ddc
MD5 e4b5212a4af5386db42f62b194847c68
SHA1 cc15c9214b9e1f21d63d685c611931d9e995f934
SHA512 1ea77b77414f6772f9b7bf256aa8ea3937189c29b075ce721d8175235f508d5df18ba2c17063da809e93867540d0afac06289f06fab5ae3f80b5fa12296e3913
SSDEEP 192:5h5g2yYQui1YM8uWBQfSECuTrrMdaxqB/iC:5H9yYs1YnuWBcTrrMdaxqBR
TLSH
T14A62071B90A335899F0B9B2AFF2ED8AC751DB4901E5EA7502215ED53047D870C9F3E93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2470.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2470.wav
Size 18KB
SHA256 48ad3ab4fa3568c4cddfc81bd2c600ae3949cf3dbf08c5848396e8b56aa88369
MD5 6e7aac66b33d12db73826bc18b97e0d4
SHA1 a47568d58f262fa981295681be37741a16dca48b
SHA512 e96138195f440d2a4f1e8496451d2eb167b2a07d29febb0c88182f50c135134753bfad26c153753b7457e7d932db97d6f12be1a27d0b79ee94ccd72a0ebaab41
SSDEEP 48:lKEVLoOnRHre+dRJUpQ7o006vQ1X4htQ/Oh4q4hOd0kozCGKJ:bVVre+lGqQ1X4ht4Oh4q4hOddozCGI
TLSH
T1198209DE50B5B9374E0982119E3CD76EFAC4A481973CD2290072EF4B51737ADEA22397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2500.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2500.wav
Size 10KB
SHA256 e19cddc130ddfc056ae7ff6aef3b985b32280eeb3f4d15abf95f0cfabe0c931c
MD5 89d26a0203240075e8ba1a560df99957
SHA1 07dd64aba34b177212b52c673a15f7053dbacf42
SHA512 cbbbf3de774b00ffd50a4e8c4f12c630f9a5ea4298fc91affb8ef354b68a1b5eb4a86a669055c6d11fc1e9b71a3030a309140666685951bb896075058cb44387
SSDEEP 48:YYBVwh2/0go7Y91blYE6DyDqZCa1k7jggL6I6eApVnJLA4hL/L4+FM/hYA:9KTgo0i1DEq4arvI6eQ1A4hT4cM/2A
TLSH
T1DB3279FB74E36E238A0CC29AEE3FCAF8DFA54451E60C601404769E07A9724E561D3F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2512.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2512.wav
Size 12KB
SHA256 90fa2de50fe2db6637594d17b818484a541764567241ef1e04d4a962588a70a9
MD5 d82262f69ec0332e47b1dfb66255807b
SHA1 9b5f4db1325ca0a821a71b07030fc239d7591efe
SHA512 cf55203ab4d491c3467ae31396611f65e5951972d166ff9b6ad1dded7580a33733a823d5c0482b60cf53679d382dab352927b9b5515d4cd2de7b3ef7864b6b01
SSDEEP 48:BtAdJ3MOuvHPkUwmvRKZ+okHARpeP0MYqt6/oBi/lpZX75O6Y0vhZfw6gjoooopP:B2TuXkhmv8+ofqgqi/tIQh1o6dYwd8Th
TLSH
T1495274C2B3EDAC516C71A0104C7D4AFD3A95F256285F666DBE7FCE68A41B0FC4292321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2522.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2522.wav
Size 19KB
SHA256 55f0793b7cb676592e6a34402eead6aab0376574160524bcdddfd87cc91313f1
MD5 d01be7a5afa7bb5ab705508d2458551b
SHA1 46955734390c470f7055dcf444a728dd2971557e
SHA512 8c5c264fc070b42d1edbf7be043df3ce46cc838a7dc342b65beb7663709ee7b8feedacce85f5a3284d179cc76ea4e342259cf31f5abbb3c128d063e97b916ddf
SSDEEP 48:YKamjxfoJZXuWAF+okiuUKKEjkayhHuOEa12JIP4mzxQ+:1j1oJPTomdwayhHWssIP4mzxQ+
TLSH
T1CC924BCD5066B8022E0CD5299D3CF79CF799A0904B2CC664A034CF2D10B36EAD972BCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2526.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2526.wav
Size 17KB
SHA256 e912062488fcf3621ee4eaa06d8ff8f9ee6215b07f5f841ee2d1f738a56c4baf
MD5 9c4e9ec87edeb1981aca8ba707aa5c94
SHA1 093eb1364c2b31a9834f51dbc6794ca8e214bffd
SHA512 940a1fe1495d74f3829511a703dbae1ae54248e14364aa543b969acd5a083f04cdab89fbdf8d2d0cb3d84a5f1240de3b2ecb7b17e320cf5909bff0dc4d9054c2
SSDEEP 384:T0EV1JR5ZKWIQ/tnD2h0e7QqppRpppgApgvvGfg:T0E3xj1D2h0e7QqppRpppgApgvvGfg
TLSH
T19782CD0613C41F59B4F1C60A2EAC8BFD939E3D2454ADA38FB83B9C1ED5014BF92527A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2563.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2563.wav
Size 32KB
SHA256 b24409e0256e375154452f6adc2960cfbc65a45755f361f73f022097a19d7923
MD5 dfba1fbebda92e6d1e258a90dcd31d02
SHA1 07de2c11fce0b5a1023e8dc0686525054699e71e
SHA512 1762b52231478f667516997c5b9609ef2fd5183429a347aee1d9523ea7c043b6bf4637276c8646f62e9d5bd0bf5b5a6229eb4dd8194de3c16f3d50fe8e941278
SSDEEP 384:yDFlqYFuCtzWbWOJk4LKHvZHa+bj1PnIS03+Z:AOsXmkHvdnIS03+Z
TLSH
T158E240975344BD8A2A874B95AF1DC5ECB2CCB3E6CD8F634D92259C2210F85F6C213B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2587.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2587.wav
Size 29KB
SHA256 42407cd89462324ffe4e073099a24d937e77447b7cbae012a592fd667ebe7ba5
MD5 67a4bce82bd698e1b7d3cb206e9a8806
SHA1 d6772a9b7557a0fda9d9245789c53f02ee529a45
SHA512 b09b00e5e89093b4e4daaf2ff71fc3536dd7dcca69b5bd38c42466471f7e7a742851a4244ab378e6bb44ccbb2e7de656fdebcde69f54a119d262ee45e4b72975
SSDEEP 192:IKohoqF+Nss7DNDoDoJDOrB/8sxCZu4hd4uuF4h94DO5d4hkF7R4hqOAud4duF47:Qq7qM
TLSH
T128D223EF5096B80B0E4CD352DE3EE69CA749F585461CE31C0061EF1BA0B157AF453B9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2604.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2604.wav
Size 21KB
SHA256 254b4a5397dab8fd0fbacee97196ea9bc4a9da08bd8ca49e28ecab7e745aedc3
MD5 edabd89028cc7ab852ca506189e9a679
SHA1 7681c8faa1ef8a255f7bbe645a1ad1cd7d8628cf
SHA512 c117b191b622b9dcaaa2ade753cb11acdd44e11867239a369459ab2c3b483a95f0fa1d36e13e8b16987c1fb8e882c9c282d8f7d8840f7b6522fda3f0ce822ee6
SSDEEP 192:Ao+DI4u+4Po4oo+DI4u+4PFHGno+DI4u+4PAG:Do0FHGgAG
TLSH
T17EA2F2EF519ABC474E48D367AF3EE42CBA4DB4048A2D931C0062DF3B6072536D592B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2619.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2619.wav
Size 37KB
SHA256 5defa627f218b3809406f6cae615ca7abe2e1ab911a9a732694f52ff38196ba8
MD5 3e46eeefb686448f2aba094615c25384
SHA1 7031523550845ff2e4388cc8ff861bc9fa11f649
SHA512 2f64f8f3b75f0f09d7710e4dd413a5ce093527adfd403577c0125fe3cfdfb863ddfb47ce53b4ed238bbdc008214e5cadfeea1d7d654823ad9f71f32322722962
SSDEEP 384:sYeMcFgCalVCfh5/gknsUUsMTsU8IeIuhw7fdroU:XeMcFgCals3/gknsUUsMTsUV1oU
TLSH
T1FA03E3DF9464B8016E4C8B66FF7EEB1CB68D74914E7DD6202024EF0A10726B4D1B6B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2707.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2707.wav
Size 23KB
SHA256 b437df678cd803331a6e2ad48bce6dd90532ecc233185112220a4a834501b8af
MD5 c00d5fe7600df161eba126628988024d
SHA1 6a9d2b4df79ddb92c90b31ef328de64c6398c793
SHA512 665da74b38d8d2e6ae973239425b7b839c55925eac63fbd5526863414fc1778d1aea181464030ff69de8ad5596850ca45cc74bf6328ce5955c604a38f9e96a7f
SSDEEP 24:suQTSmFB+GYVzYBZkIGgifmdWMkKqU2ujCvJqd+yo+55+BIdOMuKn9brbbmO12QN:sum17ZkIGdfMZqU355+BIdOMui
TLSH
T1A4B253DF60E6BC0B8D089353DE3DDA9CB648B1858628932C0471DF2760B25E2D962B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2708.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2708.wav
Size 26KB
SHA256 de2b7d95cbb7ff89a594380029c343efeaa97d891373738397aa5d21b2ec829f
MD5 13b541ed70a6938737555c7616891137
SHA1 51e833430f8860deadb314e9cb4c926504a495f0
SHA512 e9fda5c9cf4b2fc95db0cd4eb4974a01be45f7207e456c1f09171f1b0df7ea7678c5c5683f8b5bb6a930c9ed6203fcc8a38a7438672fb9dce555d8d43dee654c
SSDEEP 24:EuQCH5vEvIVP0RTDMNJteQhbNmeUhOQ8/EMxzd4DYd+d+deBtXnjHXFbXXXBZXrE:Eu5VPzbPhygEMxzd4DYd+d+deG
TLSH
T1CDC2E7DF5051BD070A4CD3639F2EAA6CB65CB5544E1CC32C0472DF2B60B29B6D86279A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2896.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2896.wav
Size 109KB
SHA256 33a21b944c0f8c849504faebb651492fa7b4b84c4f44831e1b4213eb9dde21c8
MD5 1936389fb75e6b80a65bf2d6486b5fbe
SHA1 b376f0947fb0c52f50d46c98180355a42b474d29
SHA512 9bf5922240504d72a3287bd8c2972974c605853ab10fa837e82698934f51ff17fc209edf6d8cbe5b0e1134db7865ce10aafe48c444a839b48aa6352dfb2454fc
SSDEEP 3072:jNHtloAh1zI/byzfNTNXH9qSwSGyQIuU0F/sHCAi7CqOl:jjloAh1zpNBHWgfl
TLSH
T1AAB3E85BF592B8843D6F0573AD0DC5ACBB8EA0585D0B0AB1441ECFA26075036FAF3A75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2933.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2933.wav
Size 24KB
SHA256 f388498d7133b45adade2ff4f024ee41f999814626161f64309ec73450d2319e
MD5 b5e07900e7b053e399e6680f6dfe2e45
SHA1 803a564ecc5ff7ab2151935637ade6e399ab0a96
SHA512 4f851e297bd5263885197da070f37ddbbc5b1c62567f2f13f2ea27b07f0f0ed06e1edcfed1eceeb4f8f0c15c8cbed9a6752ce4714c094ee6001924b96be50149
SSDEEP 192:p6WTtadM/jZd2Ir0wTBE4/YJw1X+pxDsscPeEIs78FwSSagq0V:kWTtLd2IrndE4wW1U+HeEb8PSb
TLSH
T1A2B26107A3A13D89359A8B91AF1E8AEC778DF1D18ECD3B1AA119ED9740F4073C653742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2970.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2970.wav
Size 43KB
SHA256 e413ea0b2d78bd28503e694b78a4f078a2a7316f5d95baa7b569a4de6100bb0a
MD5 f8673185fd5bdf4109cd0530dde22ca4
SHA1 10b2e71ab1b686910ccf48cca2b0bed68f21999b
SHA512 52dba0d49500caff07bf0db9b463c9a15524c7b47f2cd79cb1b6be7d3626553e5038796daccdb6e2228630b8a36f8579b625f5111bff6c236b9f42405132420a
SSDEEP 768:G8uZuGX/TLIPPPPPPP6e93UOR////wH/t0L///3/////////fTJOt/lggRU:G8uZuGX/TLIPPPPPPP6e93UOR////wH2
TLSH
T125132C9786963E84686AC3A1FF4ED6EC730CB6925E8D73AE12164E6350B1270C077F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2978.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2978.wav
Size 40KB
SHA256 243fad5c9a65fbfe3d679de47a98f8f87d2c5dbf984eb47baabfda668bd49835
MD5 e80aa8c3460cd06c6fced8bf267c36ab
SHA1 fa68fa1e72751b4d47665756577dd4390f0f5c5a
SHA512 52e1e87792e1b188e801447349fc74da6d7c74e713ba7177d659d52e8bb52f1a2a653f2307b3bdb315f2bba7831afe5e34bbffc32c26761c0f467795d232710b
SSDEEP 384:TAlYZW/gwNccHdregrDRvV1Qw5KvtuZpEP1VhrV5Q8:TeYQnNccHdzxTIEOPDho8
TLSH
T1571388DF20653D221D0E8762DF3DD9EDB25DB480AE2CA6655125EF0700725B8CA73BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2998.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2998.wav
Size 31KB
SHA256 999bf2a9cb442c17778be0acd5577a41431aab5a0cab42e7439b1dfdaf9acb41
MD5 521545b90faa2512c541b3269a7abbe3
SHA1 5d78db267d4d84d44f35473da93d54dddd84e3bb
SHA512 fbdbb19978b6bb30902f14d82a92fb86eef3f680066b1615791e5f9857b0884de1fdf6cf30ee995467aed3997a8cd17e675bef2bb84625b4f55971cbae0d1f58
SSDEEP 48:Kb/ASCzzzzzzuzzzzzzzYiYeloU2B0rrrrrrrHHrrLrrrrrreKJJJJJ1jJ8LEPU5:KTA62B+PPkh3/0gyx+
TLSH
T1BFE21E4F5B752B5065AD5321EFCD8EDE7F8E35410E4232FE15092EA3A1F1326D02BA89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3083.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3083.wav
Size 86KB
SHA256 cd3aee6e2343b54a6a61de99d2cd9049446f97ec657adf5bf4d1eec055799f82
MD5 6660b75903c652ab453043b25275ced0
SHA1 3e6275d16210b60f02287ad9d6c819f6ab873261
SHA512 109071db16cf222dd4c4d1ee9c533642d4bcdda3d974dba49f1e9173084544c0b5ff46276a1c2a81391d04a286d195f8b70d5f619cccb8d078fa391bfbe4a722
SSDEEP 1536:aNhdXWdol+bgD82qkyyLInJrYjDjgwi9K7oBuac0hwbL3PBEVmATsArTqMx/fZW8:Q+bgD82qkyZnJEDg9phKEVmAF
TLSH
T14783DDA7A8D278482B074779FF1E929CB54EB886CE9E67D55128DF5200B1470C9FBE03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3210.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3210.wav
Size 34KB
SHA256 0621d65f79395d8bb4176f9955961b311cb249dc39bc2593d119856147633667
MD5 a905912e495efc258f57947af9b5b383
SHA1 22a5d2bcb25f207e4818f4c9353c39f2008ccf40
SHA512 a04a584712997b55b40b52879b3bca1a71770ab8fa4bcc0e267a549f7607fbf2d4acc73a5b7ba7b919114f5f5050f232d434eeaedb1b599028350474bf54430a
SSDEEP 768:aaPYg2hQVmLid3olumbSrqQtcZqJJd/IC4YIoEtiNZKPQZ9I92MfaR0rEqxn7XWE:aaPY96QE3AumbrZqJJd/qiuz
TLSH
T10EF29D4F6601B90D5A998F32AF8D8B9CF64C718ACD5E63E521B2DF261279033CB4F251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3314.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3314.wav
Size 30KB
SHA256 2ab8931ec66c47a1a8019fc295138c5608b9f8cb5baf1fdb0fa35769a7597fbe
MD5 9cee90f5a3b5b7c1d3adacc564a366db
SHA1 ca3db2a18c5a9d585582d88069ba253e33f72c15
SHA512 7aad8dc06656363583689dfe5a159928a82b4f398e0802154b439e305172801770cc6dd810e8ccd84452727b8155ca54219b0c24dd01c148e36c28032cae51f2
SSDEEP 384:VFAn03S8y16Xznt+rEgR67Cox6T9EgpISdkfzGx0BNBmmaq97Y:Qn00gXzcr/6v6REwdIvNB597Y
TLSH
T102D2A24BA262FE05B9958B32EFAFC2ECBB1DBC005D898396A419FF0B1035071C697745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3367.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3367.wav
Size 7KB
SHA256 8c88a8b3d0a3f9346efbb42ffd28fd25590873bac53399cb9e4d22b2adbe9efb
MD5 3c5c8d67895677658149f13c588365bd
SHA1 7c65bdb92289f43a49ea6cac520a016a549bcb70
SHA512 0a21ded297152efc75b1082c1d0559dbdec59875eb4fbda8a54371c1eb315e2ce12f85236fd81068bf009bcb3d0410dddf9014b584415b9efe2a303291a9bec3
SSDEEP 48:7hMqnh+zqgZ1lx9QLxBXCVbDcOlRTxJ3oKtLxrJZbhz5e1:tM6hx+vA15C9DcOlRvXJ1R6
TLSH
T1F3F1C8773BB299814F478FAA4F0EA279772E404CB0C3916A50AD4F0BE4621725E37094
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3408.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3408.wav
Size 22KB
SHA256 418ee299751a4260a449765b94bdd5e8749b35c0fc9f61b7e309ecf27b1604f3
MD5 f34ef9cb91af88b872f7ce1535cc8b8d
SHA1 b26114603c0acd3075f46bdc40d172f1f5d512b1
SHA512 c6f930346af2f02085d3c61f1f6e6b467972ba001e937465e58f6ba2d905bfa18e79e257ce4e3be62fbb179e25c9a4043e6f9a02f94d4488439e1da07b5455a5
SSDEEP 48:a2Dpv2lUycVn/rJohfVSu8uTTjc2OzxMjV1104ZIyBRBy:ae2ETBu8uTT4fxGE45BRc
TLSH
T12FA2B39B95523CC9360A8B62FF5D46CC738EF5A44D692BA82421DEA314B11B2C5F3F03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3481.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3481.wav
Size 53KB
SHA256 aef5f9e9b5fa6ef5decd4c95ed68d9356f047444b142d96bb7fc4045b320fe72
MD5 1267f602ed29972477afc16a50f3427e
SHA1 ac9c6b90c0cd7eb4861f381f272c283f10c1785e
SHA512 048a2fd96889d1f5ff4adbcabeb9d6042385b4a73be04eed2db1bad12c794f8965b69d6ebbeb0a2ae1305330baf417b69c905c7bb92e6fbe840069018213269f
SSDEEP 768:UDDwiqomAWBDjKa7xiG9sf4Ix8BghQOCIF:UDD3qoCZjKatiGOW2R
TLSH
T1C04380EF61917C10CC4E87B2EF2ED5DCB65DBC809E1867A81024FF6244351B5DAA3B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3487.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3487.wav
Size 51KB
SHA256 802c30930129f45a3c3809cc3a0f93ccefb9a44be0b0ffa0a7e618e4dee23bf5
MD5 f314e2a944080a091b1b29dce7ca1bec
SHA1 8c47bd80cebfa25755d02aeeab8c1903c401329b
SHA512 95a872a0636b1b6821ca925c94dacd61f0cc6036ed55fbeb2aa79475665a795451dd8570f9c4b6ecc0eb492bdd41fdb6628a5223b3ee8ff2c320473af7129a93
SSDEEP 384:VWw/OLY83Ap1SUvwFoBgIvlOkOvCNXJPx7TQ8lq7XbiyvgeoX7u9iUpodd/c50Wl:g083gt9OkOvCNXzQ7WX8541Y
TLSH
T1F5335EDD60B27926DD4D8836EC3CDBACF6D61C809A28AA606135FF4901373C8D972797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3617.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3617.wav
Size 96KB
SHA256 343ab2eea60b9f2ec66a2e44f5dadbd62bb6dc06d0288dccc82704f41dcec7fe
MD5 462039a01e297488beddddaf68c2e9b2
SHA1 ffa91a5cba131f01d586666318e1b463157b81d1
SHA512 292bf47c4840e5392991741244eb9bdd2aa67c9be69afdd95ade1ddc7fc07ac188d32a0014e1df1010d431de2aba682e8f252235870c5c1da961d6d9047f08cc
SSDEEP 3072:d4TU+I9yCclknt0o2i/Blw2E3xePfb9u5CJDyX8Af:d+U+Ytpt/2i/Blk3xgQuA
TLSH
T154A3F123ADD87D0229518746AF0FC8BC7B4EB454EE86173720469E7724B213BE61BB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3664.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3664.wav
Size 49KB
SHA256 56fc02cd73dcbe26f17c18d9839eeab97e9cc99d4e0bf44909c87126fa69a7f9
MD5 21f7632c9588717faa35f69e6ad162c6
SHA1 dd5e30ccb8a97fcb63bc82327f84e37b751c92d6
SHA512 7b47d628f0cdb79acc906fc542df61ec58fb8421afceddd576f4ab518f6f9d1b961726b5f248a1035ce36f72260735c2705d143b41c56611c1228d71a11c6fee
SSDEEP 48:effAfQBFHL1oc4PNTXDKPD2uHtr47/DPIDSXa+BW5NrCftA:uHZSO72UtKuoav5NratA
TLSH
T1CF33ADFBA741FC57494ADBDADF0CC5DCA24CB8A68E0927AD61005F2315305B1D50BFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3793.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3793.wav
Size 39KB
SHA256 e8dc2cb72677734973e95b20eb5b5a5d178fb6d26f1acd15b88684f06a61ce5f
MD5 a344f5d58155591ad0b895973915cb5d
SHA1 179003db66e0531fb792c9b3367a806d092e54c4
SHA512 2a6179f0a442244a27becb17a9230a18064007cc551d1fdbfb7d222af50780773198710ff671c3cf69b245d552a55a6820c008383dbee9b888c29878809b6917
SSDEEP 192:DlxP3drC9kak444E4kWpchbiQm2lvL/lWOEm00+5UKLJOhPezTNABDfbKB+Og+OA:DPcvz44E4kWpcgd2NLbEm00pkNiWIG3
TLSH
T1B20346E967D23DCA3E891E35CF7EC5AC734A7BA49D5BD3A2986D8D0850704A3C563B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4007.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\4007.wav
Size 36KB
SHA256 ebb20fe09f37cb28f27b72eaa7d6b7b435978765edf073249889379b4973850b
MD5 5f5e7d6d682a06e7c01de6ebafb4b640
SHA1 ed589857379f822696a266900cb79f66dc10d7ae
SHA512 14714246d2afd51ef83ad05bdabda63206f6535d8c5bbbdcb72ed3de02768e541f8f22dd45c067ee495fb77e8ab5bf7ba9ed2572ae7eae76b229a863884189c0
SSDEEP 384:4xLjCEje68Z5DbN7P2ApsOSNgDyMigtPuoyL4+hRYKMVU+iLxZ4M3pfNQ2kwKr:CLh6TrxIN6yd0KR1MVUjLE4LPC
TLSH
T1B4F28ED1ACB7AB334BC851251EADDF794B88405402AC921C04B3DE7A570BB539572FEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4375.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\4375.wav
Size 64KB
SHA256 2362f76cf3da727a639c3e434dac0d5720f6fb0c6505bdfa6e9d3897b8724325
MD5 43ef8b4e44effabcdcfd609236ce01b7
SHA1 708d4bbaffc1dab254e48a06a3e5d7cb1fdc6bc1
SHA512 60c3592a1d805e449c9f847942688e3aa6ec349d806c732d732879d4c49f874e9c4a144e1b2edb051faa16f24bc6b25d1a4602f4d5964dd18fa0fa81558107f3
SSDEEP 768:sGQJBvBO2EvbP6Xld8lTAQt042AE+/6UdO/Yf:osbUXyT32AE8d3
TLSH
T1D653BF0CE44678B78E0F413EEE7D1F6DA7185D70E445D9329180FF2B0456908EEAA9F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4481.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\4481.wav
Size 25KB
SHA256 6e4b8af16d3f613d448edc87fc3707280e1c1265aa3f116c82e65df9928dd9df
MD5 d1eb60e355390596efc6a97d34f609e3
SHA1 762c3a44a735968394860633779d4444a587c8b8
SHA512 554b4e6dcd480ad7a9c59f048072bc9c7ce4f18a93626a9adb0bd338140290e62fa59a1c39f088f13e14d53db9aca19f5c52f03c1a33eef84906ebe002d7b685
SSDEEP 192:ACw8L2unIn5WDvMkg9tHFvi1rslDqDuQGm3VXbEs+tFB:AJh9n0D0kg9tHFHuDuQnqsST
TLSH
T1A8C22F8FA2203C0D195997A9AF0DC2DC754DF198DDAEB7A83115CF1340B11B1D5BBB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4614.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\4614.wav
Size 9KB
SHA256 ffe9255338a1e7f305255e0331b4719538a347d5c338b6dda3e9b222d02ff68e
MD5 4968f6e0f9727f776616cee2f8bc70b1
SHA1 690baa9c8ff89fce5ec6eb04429d823daaadedad
SHA512 1c65f1ffd7470da81b51d1cf2d9924151ac1bd17d88da997985b3265a9200ab3e60ce3f42e1c4d2de5b1d524b1c40f154b25ab298f8c05f2b13cec5ee1a2848a
SSDEEP 96:QfEqt84DWrO3Y52/DlHT1d7sHb4fYqJ7K:QfEw84DWrfSlX74b7qJ7K
TLSH
T14322029FA45630851E05C7B1FF7CE72CF68AB89049299FE45420AF0910719A4C0FBBA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4685.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\4685.wav
Size 28KB
SHA256 882ed1cbb89e5398ee7dfb902a9935d7039005be28b6712ade6bb1792e691bae
MD5 2e25ae61d16a698488ae93464b60c92f
SHA1 2e926e7a93dbc32c333ef1f3e05bec320b838cfa
SHA512 638566634c767dea389a17f6475755f3de55a08f6b9a30587b97f580f776158c4f239ff03b6987f53f73f3e8ea610149d2a5d339b9fb79caaf2696d962af65e3
SSDEEP 384:1rc+QNBFleD8ZWRiYEN/cpDaCQ1qXXFkQTCFhMyg0eJPNo3A:1rcjlacF8jQbFhZg0jA
TLSH
T120D2C0895940AD2134BFC306BF5CCCEDAF1EF6C7999E5796A1321DBF00B8196CA61212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4758.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\4758.wav
Size 22KB
SHA256 82761f18c179535367e02ccc1240b9b5ebd823f328e09c24cb241e839d676b02
MD5 e5ed0b52f0e5b7945cdbe3a32ab05baf
SHA1 69d8b826ec16e6604cf5109f53ed5be3f8593a0d
SHA512 317339fc7128cb24f58dd7d1de2992a3c4cb7f4108092e4d3d1ea97d64ab480d550ef100d9865c3c83ad0f9208cc6881f6652898dc4182770aeea4c74b83a7e6
SSDEEP 12:xlV/7X9pRpRfH31Rvg3AqrDs78H8O73BiAvpUAYYu9A9XNRhjRu:xjzfzh1xg3NrzHnNi4YYRNN7Y
TLSH
T1E1A290539B827D870D0CAB56EF3E66ACEB5DF615090C632900729D05A5B0432F893B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

706.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\706.wav
Size 11KB
SHA256 34e7858244098ece009eae815ca1214adc553e78026beb3af702b1790d44fc1e
MD5 08e2582a89a3e463c75a1a0c81e41d9b
SHA1 f3acd5639083be05f322f02b5581a73e0c12abb5
SHA512 7bc3d04e1d06a0e7a69a134130a9f44e41fa1f74652855642ad93062a9d886185d071518af2868b7e28f0d421cca71634ae5cf8cbf6fc09f38129432016243ae
SSDEEP 96:PB64nrh9LDAvuC3E8G1qR2VuqUNh7Zo8/jCxn0pr+L:k4n2u98G1qEVVg7Zom2n0J+L
TLSH
T166426C53EC6331893D47C7FEDF9CB31C36955EC09A8899834A8DDE51A9224F5CE71A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

895.wav

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\895.wav
Size 45KB
SHA256 a1cdc2182feab5edf8f6bd53e57afeb7588d997d8a4c149e8a74b83d8cc49c02
MD5 c82fb62d400c4f2d0b90743c70750620
SHA1 6d231de2bc392afdcaad315a6addc24bad880805
SHA512 c647446c28e6319e393262d7fd4924c922e56f5799a39502023c1e2264c86faab469869e0df00abf088dee31d8586255a7328ab32089d5e23b45605d0f0143af
SSDEEP 768:yu50x5/ZUpRxI0rEqq2u75uGgKFVYbq9JIie4aXaK2S+auM0fyq/q:ypDZUpRxZrEpX75uGgUR9JIiYXaK2S/v
TLSH
T1D6239FDD91F23852ED0B4AB0FF1E6A68769A2D918C3C9B514460FF97083BD44D8E2753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\dump\103.png
Size 483B
SHA256 66ee4ae0c887d13ae947650627b1288d5e5e9ec7e977dbb992fb82b382773e33
MD5 df389f7aa9a85a9e9243b517dc6c3fa2
SHA1 6fa33d36f7cc863103609e560b9363e699c777a0
SHA512 6a4f2af8ed5fb72b04dc6815de827b8a23ed764f1a24263905e069ec8b07e68d85f7791b113bc81fce9eb91793bfa5a6af4b836c2675fefe5790566abeaad073
TLSH
T110F054D0264AC888C692467301333040F53A6F0E429A1D0DEE1EF9F4402E76CC05F723
MD5 SHA1 SHA512 TLSH

Submit Download

91.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\dump\91.png
Size 8KB
SHA256 1fcf12ede17a9fee2536e954ab48ffde8f63a35d31a870f05de161ee8c646b8e
MD5 ad4bf1c24dc81d3860a6d8aa43554759
SHA1 652850cc681fdc9679a5e6116035b469b3958e62
SHA512 862a74176161bc298756c595c26fe2936a37444869e9e05cb7bc772495d8e16ccaddf4670c7353fc5ce8f02163fc561f8dfeb545d2f49862fee231275218fb2f
SSDEEP 192:eS8nP/WFQ3HEamIfkpbVPGrOpKcNrVCgP0eXLWppxZ0d7a72W6xzD:B8XWFQ3HEPakpDpffP0e7Wp3ZLbKD
TLSH
T1F702BFECFF1B5E06341A0E19B2BD86A2CE93777D58B20506FA8C7B679B56C08111D4E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sprite 3.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\equipment\sprite 3.png
Size 483B
SHA256 e5c4741ab107e559f272a4a2075d5badf745d8ee5e526cc1ab361f1a5bf530c2
MD5 728de1cca438a4ec272e2ab3febe2ce1
SHA1 c9dac5faef7b7d09f4dd484a43e76de0accc8a24
SHA512 910479a3cb65c1c0c95be0dc35259442cb2b989910bce6cf0a23e4b5aa420cfa5a7decc66eff266a6aca7d1cd81e0956692614a047388452cc4775903d4b05b6
TLSH
T13BF054F28306B978C26705738F13200874FB103A15810A3FBDAFCF1D4640A54CD51827
MD5 SHA1 SHA512 TLSH

Submit Download

283.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\icon_pack\283.png
Size 80B
SHA256 9873662e54f9d71b9529d60be599e55e1ffad6ad033ef5cd8a7c81500286e3ea
MD5 a64f399732ee85c8eb88a359d066baac
SHA1 8aecfcf689fdc58fe128d91e58a98c27322a4ee8
SHA512 02a529bf78cf0d41b94a8a172d3007766e383857eb193743fb0f962ae262f36d11158f096c54b4df4956a03a3d3669a33799e1cfd79c1ca92777a83b35bd111a
TLSH
T171A012E701000D34CE11207608216032EC7101380A01249A41014C74058121089D0391
MD5 SHA1 SHA512 TLSH

Submit Download

sprite 37.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\clan chat\sprite 37.png
Size 8KB
SHA256 8ca89e30b9cadc986dd760d5caeb6d2fe0c08aaab964f009d7a40e20d8be79c4
MD5 dedb855d52daed53ba7d829698810f52
SHA1 288a4764f50eadcf3f3a6e157ac1e61b93716af9
SHA512 372ef84bdfc21566afcb567acbe377456e46528fae8d53fd724006e82eec6141618fdf30f082d5d0e5c490b2d6fa650d0b04a009732657fefe32a3e1696cba68
SSDEEP 192:q2CUUVc6L7Nsve4zuSmeyIAyVNYjpFLEbM5Fhlzs4CWuHM2:zCpc6LpE4IAwaHpjhVChHn
TLSH
T11B12BF1DDCC40DA7C05A21B217B128EA9F7AE0221F74D38A07AF7436B038175BE7665D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sprite 8.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\clan chat\sprite 8.png
Size 256B
SHA256 f4e403a94410e612068f7c3915efa3021121c2d27cd3e207067c654bc7154c85
MD5 e1bb55934b3aa94be36b2688ad12abe2
SHA1 6b05d6786e27cdd663ef27ba64b41fae8f97d58e
SHA512 6c6942f3e95070f4910a1fa739b514bd488b050c2a2f776d95de2ee792aa364fcb2bb6f8d7978941c4028ff077d37a514217db0b9729880150f5803e80280a22
TLSH
T1B3D095F37D145DBCD56B4B3B5357D411FF3042BD1201860DBA04C593810715205857BF
MD5 SHA1 SHA512 TLSH

Submit Download

close 0.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\death\close 0.png
Size 405B
SHA256 41de7769fb4e5b137cfa5f905f514a4594a881329b00e7afd7ab6df3b76c5182
MD5 a1d67367ef228504e1eb49cc19cd7221
SHA1 1dd3490f2684dab34784fd87c1206e99a095cdfe
SHA512 176135a0a8533643cea5dedff618df1382b976235fca41a84a7631b089d72aa019695a68b029f22865dfd8ef7152d06c658f6b8d37eeb2e20ff70ec9d80bb688
TLSH
T1BFE0F1AB19A658FDF713517786E9367DCD65225D0900035E7B33F4860641BACC1E9548
MD5 SHA1 SHA512 TLSH

Submit Download

close 1.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\death\close 1.png
Size 399B
SHA256 4f8d51b527b0d07e3ed07c1f119c165aaca9377fbf4e2ee02d6bd0d7e3611917
MD5 d7e4df2e630c639c847574684eada558
SHA1 52d1e929691026e01189ba073ddea336e3cd6179
SHA512 baea1440126c9f658bed9862c1ea503c96cf22bfe8472bc84569438311ced46a2fc45bfba46ef49dd7a24727a9e40819e28e1b959ae5b2a1c3d0227fcfc9d24a
TLSH
T1AAE0F14767C8D77092D63C77A5AF18B6B45BFE103471556EC1624235CD03D42406D787
MD5 SHA1 SHA512 TLSH

Submit Download

day 4.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\giveaway\day 4.png
Size 9KB
SHA256 4df045aa2aca79039c6d3e807c5da45883c2eb0b711288576acc6ec435454bd2
MD5 5498143c7ac47c83c6ba6ba0fc319a94
SHA1 3813921bb947cf0f9d336d7cb7d09c3cc7be5847
SHA512 604c539c6b807b019dcb9fd6917401f1202261500b3728fdf081eb7f26ae8fba9b621c33f3bf92b53937c4ebda01ebebe33414863eb1f1eab838bfd6e4791ba7
SSDEEP 192:6S81A1qSN4R488AnyPMaHKyxPSbfoltR53GIy5T:1KA1DN4Rx8AnykcRSElBRQT
TLSH
T15412BF305A565F2ABDE0D840B147010707A9185882D6FB8E60FEBAF695B4332BBD147B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sprite 1015.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\mysterybox\sprite 1015.png
Size 475B
SHA256 09ebe00096d69b447486ecda428712b90f95e7c082c34b4e99ff0414485f67a1
MD5 1179aba40ff2510630a93aea0de90236
SHA1 3a005b101b0979c056cfc41eab2707775a37920b
SHA512 2ee6a4eee7a048e7df89a877c22668f170c04c8a9adadb84612662b12a41f8a841c0f5890edc6facd84cb32f38e598bcd6b985975bda1f04f38d9913f3c4c3ee
TLSH
T1F9F0DCEFC1BAB4E4C99B01E6F1B24950B4361EE502671C4C4D2DBA5649B43C04A44AA9
MD5 SHA1 SHA512 TLSH

Submit Download

sprite 527.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\mysterybox\sprite 527.png
Size 418B
SHA256 4ce10abe19e3df0302685bf9bde06f313cd1f2a38f36eb3172cd3f6bde98ca34
MD5 b293dc4951816153a0c49f2cad4a7173
SHA1 1e273739dfee6c20d70ad91a874b5c77e30416e0
SHA512 f61a266685d3e51e56e1d20af91c7bd51e8f58b18963f348e3dc193a45a6d08744aad610354404cd843923084145890cbafe40de093f7f24ac3ca8a68961a833
TLSH
T10BE0ABD23619DD25C84D012B9C879172BE7926079EB919CBCB4946249C7CA389065743
MD5 SHA1 SHA512 TLSH

Submit Download

image 6.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\passwordexpired\image 6.png
Size 1KB
SHA256 48c03e33ba344d681b1d5fc2237fa54286ac0d2242a67f4c764b5e7d5b693501
MD5 cdb34743c3e1eb189f9106d13f5c58e4
SHA1 feb8da24653b231a2ad27a00ec121e58dbc30915
SHA512 ea966403bef28ac56e4f1be3fa478b3f15930bc6780ec9cda4f747e3a64ba6554acedc17e3cb734d9eaa3482ea4a43c89ab95db370517ebb2b2b8c0d6570b5b0
TLSH
T1BC313AC2424A99FAEDCF0450B4F2155FE31C13038087A31B29C6C43A140D4A5A38A86A
MD5 SHA1 SHA512 TLSH

Submit Download

image 7.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\passwordexpired\image 7.png
Size 1KB
SHA256 0abfd1f7bfb48f11de151fc24b328b3eed23ffd21a1cbaeaaf713a6c442b089e
MD5 8e6638bf27a05760d33b6864d0ea8604
SHA1 05f6d2f9b6e49b746b2b267b33e028e7f8735ff1
SHA512 327630f81dd0d58b34326b71ec0d288585b2e13f3da2cd479a5024bf9ef6b04064df2a4d6627457bc298a7f59789c82f2570f788b0b6d12574d35cf35d35132e
TLSH
T1B63109526B9A701D90A6C545D6A0BEBB3C771C66ABDB128A7E718C09DD04E113D8B20F
MD5 SHA1 SHA512 TLSH

Submit Download

image 4.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\pest control\reward\image 4.png
Size 390B
SHA256 ffeccfbade90b0895fd3ede449f09f04667f03eab1d572c57b45c50b8b895465
MD5 82c0e5dc1e7c542a9d9481edbb5618bf
SHA1 72c96e07c1aeee4065b57bd276e0883e1592f423
SHA512 3e86ef1045760cd1334bb2c53ec45b19f1cd628abef68cab82f0b9ed42e5f58b579b2388d6fceecc67669aeaa97a011b0b9f17e016c181652cf24c1e82dca571
TLSH
T13CE068DB63100BF8D58B98E9C7522255A872AF85412E2C4EC2446C770AFC68A02B2F35
MD5 SHA1 SHA512 TLSH

Submit Download

button 0.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\polltab\button 0.png
Size 1KB
SHA256 262bc43bfbec64db3e585921d31ae01e3ce3eaf8ed0895053730c6c7cce1f2f5
MD5 2ca88c37d6fa5e43ffe6b2afb8320d25
SHA1 f3eba0b3f71c61a6c8252bef5c65c7759bdeb1ee
SHA512 affe4e0977c569e7e90b721cb6328c66dd4cc0d128d9c955ebe5f0f3376da78883221c2d557cc5b9750459981d41351e3136ebf17e9fde0d7a970c9fdf0c8574
TLSH
T1FC21D7E3F63CB5CCD455A0932716A1EC6F2E3282D3B8206A4377D5358C3E421686351E
MD5 SHA1 SHA512 TLSH

Submit Download

sprite 1.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\q2\sprite 1.png
Size 1KB
SHA256 d5c0176937ffeaf9c45d7e16d7395b4b21a71f5753c7315bd9a78b0de1920866
MD5 f39d878c9af540346678e24abfbdd4e7
SHA1 4ec2fe7d699b2e69149b204ec7596e9fb4c28d21
SHA512 9d0fcc4d93bd3f699da8792b7bf9e93a5a026721c237a2e31563aaefcd83952e23932b2c6fd076b63a9bff0c10f0e432b67839f54c3667097b8eab54e6199bb5
TLSH
T1E2210ABA0C55168071F2D0C799727D08EF273E42EC3281BCF9BF89C36412946A5246C3
MD5 SHA1 SHA512 TLSH

Submit Download

sprite 2.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\q2\sprite 2.png
Size 1KB
SHA256 a57ef8c60a5c70240003aa14a9170d150ad50528a8c6ccb7774daecfcad10b7d
MD5 258546f707b17377fccfb74b88703657
SHA1 9b99fe39a25c009eb33bbd941612eaae8f86719f
SHA512 bcc326e185575e8a2455012f997086de9bc72af7d58f8dc0540a81dd64dfc3953873a8c529035f47b59326f32a36840c7e57375ed37abf608fb7f1fc9e79c709
TLSH
T1552196CCBF6CD9B590EB193987562E62D0CA2A283C66EBDD54CC364D0C35549EA42622
MD5 SHA1 SHA512 TLSH

Submit Download

1280.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\1280.png
Size 159B
SHA256 0ec3958f4bfa8f16f2c816bafb6143f7dec4b17162990ae2ad41dc3f139cf330
MD5 2719cb40801e1db6cd51b332c1c37652
SHA1 1b807c6f031411ce5b55c5944f65eacf0d2b7eb0
SHA512 40497e26ddc755b57163f40b91eaf80f43d6b8f80d4a5cb76b4a827007fa9735a4df69a962f0ddf16ca98d2f31600a675a3eb5353c2dedf287b14cc542de1e90
TLSH
T128C08CA3108CACB1C2DC3D73649614E49C710D25693A86758128D22D27891A59481082
MD5 SHA1 SHA512 TLSH

Submit Download

1722.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\1722.png
Size 81B
SHA256 65ac3d9585bb89475c38ba323d08c961057f68666bf8c389196a939b13a3a00b
MD5 b180f84ad640c5485dbc3241ea8d8a6e
SHA1 812cb2dbb390c99dd1f4da24be5ef7578a0fafc6
SHA512 c2300a0097d2570e8d21a4509e2e5bd63d4ebfa6b332bced920e13ecbf1a52ef93bf698551f66d0506c1a73e2547dd9773d55c55306d49e1b6e28659bc37feb3
TLSH
T11EA012F356405C35C68C0923151D0432D671037C40020448100DC0207BC03140481B82
MD5 SHA1 SHA512 TLSH

Submit Download

1807.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\1807.png
Size 85B
SHA256 1f98395f629bfe623dc2fba7a6fc8896c40f7234a22ab20f3c0841ad91b0c1ee
MD5 f5fc8cdfba8b25902f947a8eac57e75a
SHA1 48338d4f5da3b00a4678d8456b3e952d0cb0a2cf
SHA512 3c4ad5ff9a51d91e7918750d594ed1fea8e31296d5a646cadb7c0284c2fb3875d146d263937efe513ac76c867269230fc8a54fbe430d60d33c7bd6fdcfd84958
TLSH
T118A012D3F3841C2CC8580C3B00580168C53602440522124C900564301B007AC0548BC2
MD5 SHA1 SHA512 TLSH

Submit Download

188.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\188.png
Size 85B
SHA256 abddd7b31fb4058ac18d191499a906f395733d67a96e3ae98e4a79c8e8423506
MD5 b94c1a8edc870f139eac5dc6aa48027a
SHA1 3e9338f154d8a1767466ef6293fa873e4c7d2bd7
SHA512 fa68543cdbc59b6730a4ca32ef92b5cc703e295746c152aa4c5f8b5cc8e5b6f24a2016ee2b74a3fcad1d327882bf64cbf8d11bfb68231445eacf37283cd6b60e
TLSH
T113A011C28B8A3C38E3A80C3B8A2E00B0C8B288022A0A80288800EC30A880B080088302
MD5 SHA1 SHA512 TLSH

Submit Download

2100.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\2100.png
Size 237B
SHA256 2159c4608eba8b294a291b8afd550bf8799dedc18f4d984e1c43f12d4ef07abf
MD5 a120e8cc6f36109601d89e1162593286
SHA1 6305d57680c0f5f116355374df5f38a6f91a399a
SHA512 39894af7febce7c1c251b3ab1a698433b1a452c3c82d853f122c7c64b5719f2ec948c5e8f002e14a1ca0a56ebeadce9533e01f91663970a7b90e8bfe5acea7f2
TLSH
T117D097E682087B68FA1D0119E6EA0BF0BD112158462B19532483B030366B94C8DFCD93
MD5 SHA1 SHA512 TLSH

Submit Download

2131.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\2131.png
Size 274B
SHA256 bd0c5fc044579797c1eb923153856d5aeb25f0a379dd98a823f181876639af21
MD5 79a52a54a5c54e2d24ece0771220fdeb
SHA1 8040e20f7dc5f83c17d0b8570f7cb9d2bc16aaf8
SHA512 1fd82c7fd45a7ce6bfaae97f04fb387bb847d6693958ca241e789601d8468cea6d9e79029938351dc5281b8353d0924c27b43e7d1abb848f87f6902690a22301
TLSH
T134D0EBA7F5AC8664B8030A03030E17908A216080D2030128680AC8300A9E83D8E9CBAB
MD5 SHA1 SHA512 TLSH

Submit Download

230.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\230.png
Size 82B
SHA256 7d51d035949791c0cad9b8438d88f42aa928b9a525ead1771757a5d2503718dc
MD5 a72ed462b0382c2ada0e29dc57f9bed3
SHA1 c3989c3b714aa8949bda60faa3907b7f3097463a
SHA512 2262472a10975a076f2fbd568cd5c1d331584c45cb944cd3414d4a47e4ccb6ba82c0f8fde05c635f853086f3b595af1a5d9baa07acbe728d9693b9aa0d264846
TLSH
T146A011C3BAA08C38CB280833022E8020EAB082CC820200280008A0B8F28230882883CB
MD5 SHA1 SHA512 TLSH

Submit Download

2648.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\2648.png
Size 136B
SHA256 fea6e185ef4bb2bf68b9b700bd1e5c368e18f5a778f02d3edbe9fd40da53bdf0
MD5 f7e4b3362d34247a68573b0bae5edb59
SHA1 549b91a908f20b5645cad600a865abe06fc74f2d
SHA512 b7742b0bde3b79304b1784aa58fccf82937881493747ea75e01f6bb5c7e65b9d4b9eb9ec4ad5dbeb158851394c9db42cd97d0982b5953b6c69e6a0caec5c62d7
TLSH
T1D6C012D38F430C34C1890833814E4559CD7022040402D0840111943570133044045A2B
MD5 SHA1 SHA512 TLSH

Submit Download

2692.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\2692.png
Size 83B
SHA256 34a4a4d3c487cfc7a8b9c8bde5820e42879f7a8129acd750057247eb31c4ffb1
MD5 96f9200b775de9abfa5fac3c6e0b76fe
SHA1 62a0321036e6e4d6cd97ee7e694fd4e13eb9d44d
SHA512 90445e4faa0ae75ecba52559be02d175ea0c551e309c3bbf79437bccc4b30b1754e089f225f5596d139a442f5dec43a0c6fa453c2bb2de297c86f5b0092faccb
TLSH
T114A012D1CF540824C6D40C3646110031E4704A6401021188082441209A00704418D342
MD5 SHA1 SHA512 TLSH

Submit Download

2824.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\2824.png
Size 81B
SHA256 4eb4ae34880bada2a7f27beae3f85915b2bad86c79cffe2c61128a384117cfa3
MD5 9bdaabd080341493bac8ef38bcdb2bef
SHA1 ed9b6018cd58de85a38f4e7cd0ece9e3719ff930
SHA512 1d6169fd9dbc093cf887434265f6bc03cbc4c1d7a0930905f4662e79777b26d4c54372ec03790d2975cfef81ea1724d54f7fe2574b07761476739cfcd9601737
TLSH
T189A012C367A0683DC04C0D3601180111C47601208420014D040D903819043BA2445641
MD5 SHA1 SHA512 TLSH

Submit Download

2938.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\2938.png
Size 80B
SHA256 96c7a27f005bd472c75b13f10c6e457fb6ddb298135530733079439e85bfdf2f
MD5 8ff44f4e0ae0c9d28bcdb04ea9316e2e
SHA1 8c9e181f92571089bddc32db982288bdeeb14ad1
SHA512 9341ecd85cd891b374a3b619c16676cbb5c70a0e7aa2bfc0b8b1afaaebed64331e647a87712f190f1783be4b149458455d604f5944dc82693bd30cea1bcc6616
TLSH
T1FAA024D757503C7CC75C4F3301030030D43C0044057511140F4D5030717510C517DF41
MD5 SHA1 SHA512 TLSH

Submit Download

3336.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\3336.png
Size 72B
SHA256 03e7e0b10a784e0ac20a351255f02761b086f65a7bce7889b4f5ba0fe4df9ef6
MD5 0f8ae011ab885377cce406605212ac96
SHA1 55e90969857126028600939d86bc33f3beeb1398
SHA512 a2e44e70c3cdad0e1ee1a5cfa2ad92536a6811cf4a4c851eba8f5b0163e8c192364ab329f8ec85ac437cebfed53d10bb9fcff30573499939cdc5f2aa68c76917
TLSH
T1EAA022C302A00F3CCBBAAAF302220030F83220283B3803BC03A88C3C2000808E0B8383
MD5 SHA1 SHA512 TLSH

Submit Download

3350.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\3350.png
Size 75B
SHA256 9136d9c96fdabe993edcc2f33bf871697461b9c39c2fbcf8b421de00a2c74b2a
MD5 3f5105cdba9d99f222984d5d49e16b09
SHA1 e743048354aa78cf364e1ec1aa5230f766c79237
SHA512 c9722ca30144c4f0fc8d96dc06a25fabd33bcedc06e668a7c3a8c36f69ca7a3a839e37b601a8e6e83c85dde480271893e98eecd35ce3e60733a5f47b9105dcb4
TLSH
T163A022C382E3BC3CCFCB00B30A0C0230C838A3A80AB2032A030AE830303223880B03C2
MD5 SHA1 SHA512 TLSH

Submit Download

3742.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\3742.png
Size 77B
SHA256 320dad20de1a0af6e50ad93be1efb19b4de53bad8046a4f83306efa4d158d86c
MD5 d37d5540a18aa33bf28e5bfbaa672edb
SHA1 caac648ffa1534ad1e525a5e0bf7fd7a5d85d197
SHA512 ec19c5eab314652908d11f7c5212ebe405f37fd0c757db97171c2d3f725ef72b0b5a16c7ae7368c37652ccb02698d827c8e46d4c552cfc9c755c37744ae20164
TLSH
T18DA024C3F1505D3DC341443347035070C43541144353030D031F403C1F3054D54F0341
MD5 SHA1 SHA512 TLSH

Submit Download

3950.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\3950.png
Size 83B
SHA256 a6ad1bec9b073969cce0b126f9bcf9c9f1e18973f4ea84c5620f0a5da4d1fc74
MD5 95306e64861b799d37863566f6da54bf
SHA1 1032be90da0a3bd137d0fe6d27932c156839ac15
SHA512 31961c0625f5ab489f3992c9aa59d5e6ab3d0f7d6e67b51509f5049cfa5842199aa147cfed48e492e5d5fca9984f5698b05099026957769b23868bba6c4547a9
TLSH
T172A012C3A3801C64C06809330019109098F30950443A014C100596350B252452484B01
MD5 SHA1 SHA512 TLSH

Submit Download

4336.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\4336.png
Size 89B
SHA256 196e77c1d5e1b0e28677ab57dca87dd8a758ad2a20b29d0b8ae26ba76095e924
MD5 49cb887adf9310586421a9678ee188be
SHA1 a6a0ffaa2cf2db86f4339568aae2785f21e77072
SHA512 88e3ba513156653899272a995037a572b5181940ba066094938dd7b3472d81cd1d8139c9cd927ed63c28fe283e7dee62e5b6dc96f292e9d91bd2bd35c1001f5c
TLSH
T163B012C773C20C74D0740832022901F0CEB6024808350298804854314D056486440541
MD5 SHA1 SHA512 TLSH

Submit Download

4549.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\4549.png
Size 83B
SHA256 502cce141390b59c37cb2f52d0a960968b8bfb9c8562498fdb1de88c04051fa5
MD5 4cdd08c4e4cb58e63d9ccc18c0f07cde
SHA1 d81d42582961fa8bc2ef80c3ad571ce76244b016
SHA512 68325880064f6e642996b8d544bdf894c34e843c361a40744f966168a8564db0188fa2c7f778932ad20cc4756741420dae64a6835047552aa38937cc2adc5a83
TLSH
T128A012D34A600C3CC6E40DBB852480B9C4B001260D234005041340281411B10448B305
MD5 SHA1 SHA512 TLSH

Submit Download

4898.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\4898.png
Size 75B
SHA256 7074f74f39a8ad752db14a876089e9867d92b2425c37a6d44a74660f900a877d
MD5 6841bbe3c295575f3fb692ed4e856a92
SHA1 2e85fb59c3355a8babca063ac80f8b531f8058ac
SHA512 9cdd3805ef765dc0fd725c8c3e7868d0390bb04d85830ac9983d6acac0c383e9c8302b8e8fd399c6677664eccdc1523efc5189f896bb75302d61682dbbd95fad
TLSH
T114A011C2A2822C3EC22888220A808230E822220802A22A28020A88282022080E0F0AA2
MD5 SHA1 SHA512 TLSH

Submit Download

4946.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\4946.png
Size 74B
SHA256 716326173f96724c19eb990d196239545df6e63106d14a331b7dad43a93fc88e
MD5 9729b8b0d79be2e8c6f5764fe123e0cb
SHA1 65fe4463c479390612c0bfd37a500e7763d739ff
SHA512 c9af5e5c71acbbcd0f9c4a9cb457172e79f5984be0cd7321ec93b515282fe6acce1e2a3cdfb6f53a16206058bc36a9cff461ee38429b2b7673ad1a02aa9f3592
TLSH
T1B1A022C203C08E3CC3800A338230002CCC3C32380A3E230C0E8C88303803808C0E0283
MD5 SHA1 SHA512 TLSH

Submit Download

5065.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\5065.png
Size 88B
SHA256 4aa1f89a66ccbe29345581d370bcd2a1753868bfbb5915a7f61de3b5c2d1e14e
MD5 20a35f3c9f0943494bbc7fdb168ed5ee
SHA1 5088abce9e3c0d5850c44a24962f1180ef85c367
SHA512 d69f73fa0abb0ab778e03594369e4cda9cf42865badfc91ed5f10eeab7907d151fbe6b18ab5660a6bfa1cef879dbdf243f97bf06714d7edbf2287d9e57713147
TLSH
T1C6B012C362801CB4D0085932441889528936014445264248200D92381A203441484702
MD5 SHA1 SHA512 TLSH

Submit Download

5413.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\5413.png
Size 93B
SHA256 c3a1fc4f8084550a3b7629605af11481fa4d4273e7b544a2249d70a9a21d49be
MD5 c2eb8578f29943f8c201f6a430fa89ab
SHA1 1ad3c62628a74ae33266116ed3b344efd88ce1d3
SHA512 1dc60ab988bbbaead6ce5772664a6989a90083e916a23d1d1e6d7a82a62113d58500e8adc62a865635b2acd61ae80b5d75f208222fad7eb3b190f348773fab8c
TLSH
T196B012C21B600C28D6D04C3F81260010C871805008401148900A94355D2270C5044245
MD5 SHA1 SHA512 TLSH

Submit Download

modicons 63.png

Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\player\modicons 63.png
Size 174B
SHA256 9896386097d71eba6a17937c41dd1fc489d02ac58c3d13dc6a1547dc63108741
MD5 cb950343f52fae9429db0589790ef0b1
SHA1 4200505bb080f3195f390d0cfee407e211241790
SHA512 4545c89dd148a52cba1939e3e30a85d1a356ac51ba1f4d5729152476bc0ba871404e9e02d3227700f9a1ab25cea1c40171a3e1e380d941fff1132c9d68b6c497
TLSH
T1F3C080F395995D34F7175656C0FF9133E5723D1C157F11780041D4397405681597167B
MD5 SHA1 SHA512 TLSH

Submit Download

java.dll

Path C:\Users\Admin\.OakHavenCache_v1\java\jdk-11\bin\java.dll
Size 153KB
SHA256 6c3629ceeda33c2d22150be8749d3615f1145b84a038c15ded2fa41ec7568b58
MD5 67eab35f9ae1e6cc5572be3f7afb5fda
SHA1 f09967195b0f2ebae9c283821aa32a3dc06ce666
SHA512 7236c19bd20c57494fed5e75edb983c733e9cbeaf08dcb8d89a864e3dc3303637f8e877f1c9f1f0cde03ae07b4eb672dd089929dde9dcbd4e7f422b8c72c7df0
SSDEEP 3072:Zae384Q3NG4zaKXWV31LFBNQhp86Faro3DmYbrDZVC:HOFY1LS5ZbBVC
TLSH
T116E34A0BA34240A3F55AA6B8B029450BF3767065031D93FB43F58A6E5FAF7217D87B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Users\Admin\.OakHavenCache_v1\java\jdk-11\bin\java.exe
Size 53KB
SHA256 95f9dfc53e94e630a33868d8d6e4fea04f0863d4be6084a9b1f5db6a2f86041a
MD5 0c251953ed7a5fa16bf858026c9f5a80
SHA1 4098ec5c2605f0447035de6c99d6c278173ad0e9
SHA512 76e516ffa80627ecdbcfe2f013ba4c509f6f48099eb6057a5c25f9817d03ba6aae37ae8b6e035fa0bfc304862bb56f7c458f50be6647fa4cbebb9be358849754
SSDEEP 768:xJ9NMFjLAuDeGJiqrmehiVSrmaBP39V8A5b5Yi1Vee2EW:xDNV7qjh3rmKPNSA5b571Vlg
TLSH
T16C3309F2F204A885DA0BC9B3D86EDD3164B23DDD99E0454D22AE71294DB33D2109ED9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\.OakHavenCache_v1\java\jdk-11\bin\jli.dll
Size 89KB
SHA256 f43be28ec29ac4ff997ba1a4bb9712c4c04b036f014f903842946a86991db5fb
MD5 dd65bd644741903165bf5a486d893030
SHA1 67c6422ca11e8291601aa6751023f4a5b37bdc7b
SHA512 c0e3ab5e6bf7f67a333699d58ae414ded807c0666ab3e2aa0ed431041d101c75d060e31c2aad352d370c6413b79b8e6e343ae93cdeeb63551da20449218213be
SSDEEP 1536:KXY5t0Z/TxzFpq4HQratXvUM3sIOcATwT5fK59tut63VxkXTkTP71VDIi:KXCy/TDU4wWhvUffTwT5fK59tuwxkXTE
TLSH
T1D2938D4B53A011E1DEB685B9DAB1951BD3F2F0162760838F137CC5960F63A523E1CBEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\.OakHavenCache_v1\java\jdk-11\bin\server\jvm.dll
Size 11.1MB
SHA256 8fa80abc294e324a657014fedbad0db0aa575174d7a154dba585ad08dc07c3a4
MD5 deffffbf8fe15b7a64169da5b75c26d4
SHA1 0b17c9b114dd413dfab2e0d1123f1d096cfba6d0
SHA512 e01824da65c2f2c0d77d7d1148938a4d43cc2f07c8a94448eec7d68e41a9c733d9851421f3db184615df006595185a63a59c5891b61e9a88bd6cd7e8a4b2a59e
SSDEEP 196608:0j2+sYyd5qGcCcFeR2556pDpFtNIx88P2GrBUhE7cnonBuHLASyzLQ9PMGHSTtLv:0yUGcCeeRI56pDpFtNIx88P2GrBUhE7t
TLSH
T12DC67C5AA27400E5C46BC1B886974E47E7F1F8605330B7EB22F5069D9F93FE6067A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dat

Path C:\Users\Admin\.OakHavenCache_v1\version.dat
Size 1B
SHA256 4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce
MD5 eccbc87e4b5ce2fe28308fd9f2a7baf3
SHA1 77de68daecd823babbb58edb1c8e14d7106e83bb
SHA512 3bafbf08882a2d10133093a1b8433f50563b93c14acd05b79028eb1d12799027241450980651994501423a66c276ae26c43b739bc65c4e16b10c3af6c202aebb
MD5 SHA1 SHA512

Submit Download

OakHaven.exe

Path C:\Users\Admin\AppData\Local\OakHaven\OakHaven.exe
Size 795KB
SHA256 77b6930eebd0a1fc93963702e08d15e7dbaaf8712e2f6e561f48db893bc2b742
MD5 d35be06ac94c68a398e41ec1a5126034
SHA1 5daa81856f1d7726a3c152429d056d4e6914f051
SHA512 7ffac7b510417ccbdb5cab01c4ec0ae075030f035d014764317b2955261d75f01fd84dc11b59360859b6318884f382e76d5c0843c870e6bf8bcd48b8fae64d84
SSDEEP 12288:5rnsoTOwJ5P4OeWRD3oWVtK+TlpjfycLZk265ooD0:pn5P4OeCjjnfDyV265v0
TLSH
T198058D1D6F7888EBC3A396784DE2E319D67C75911D29830B4BA446E52F37F983D1AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OakHaven.cfg

Path C:\Users\Admin\AppData\Local\OakHaven\app\OakHaven.cfg
Size 128B
SHA256 041529032bb1376d1398ae9f9fc6cbe0e4a41ecec517636e809809d0589b7ee3
MD5 17532b63e51cba49207099d3531f2dfa
SHA1 d516734b675c73b24ab1d7e7451cf1466e4fc6b3
SHA512 cfde19bff869d42e819f8957b9ee82cbc16ec845aabd4929e13bdfdf821afdcbefaafbd315608e48e4b1bba6cf183f39b0567ade5a485c498b454b1684431b50
TLSH
T15FB02BE105C5232052E70BBC0118051030263298C931952310B002083F0081CAE2F000
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.jar

Path C:\Users\Admin\AppData\Local\OakHaven\app\launcher.jar
Size 420KB
SHA256 07f15df25b2719f381dbb4d9362fe04b627e7c8d3b240817e33871c8a3020def
MD5 1dc65d840838c9ef590b9227b0221260
SHA1 7f44bcb6c8ca1d8c311d6f331ce60c34d33c3ab9
SHA512 575b0533d54a07ade9fe62ea479323b5eeadbf7cb6e169c733627354e2653128032cc60e73da5819279e67f0927a68bd6759af61a01d4aa4a24fcf21f8d98c6d
SSDEEP 12288:NKtBER5cAsdsBNpudwe+BUIvjtm7qfXx095+:uBER6As+BNpudw1U2cqfXSk
TLSH
T1EF942368E3C85244F322D678007B9AE33EFC42908AB650EF2F55AE4650F5D951E427BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\awt.dll
Size 1.4MB
SHA256 a49c7fe3063e9a09eff562e3b7cd811f6bd31e6a9773ec7767ac42dbdbd3f27f
MD5 2fddad1622c84f09eded0913b8c81fe3
SHA1 4f32067f61b9b1c500b019ac0ca27a442414d17f
SHA512 e68bfdb60a84419eb421935cd8f90b3fb88aa7d3ccda33d1cfabc17ae89a79faf4d7914a170d5a4e9b51e20ab4fae333b0a82803fc1c4e0e3c71b0f69db4dac0
SSDEEP 24576:Fz5ticoqZl71gAEaMFrqO6fsonqPLsXNhNbER2gDqfqKVVkaT+fqOku6516Co:Fz5McoqZ/EaMtbPUNbExDqfqKVVkaKfV
TLSH
T1B8656B06E2950095E4FB80B4C14B9A1FE7B27419134097EB77A59B6AFF77FE06239302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontmanager.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\fontmanager.dll
Size 885KB
SHA256 3c0548f1fc523f4e76c816534355bb482c5b33f5c38652c833792847c1e3ebca
MD5 29651b23555b94cf7a1249e49843d032
SHA1 28aaa95b18288bab99a3e8f8bb98bf23d7752c47
SHA512 1a9255363637faa39f4f2cc69795ab99dd79ea983cba6c394506fcb29650d8095b040ebd2799f6643d818a54ba0bec2378fc1122d2a5d7d872d3beeac4b831e1
SSDEEP 24576:JSqtmStHwzC/VoyG88FYPJH5FUpDSSRuJmjSVUJSrJZoso9TV8rLeUPGcJiOzmBd:JtD/VoyG88WPeUPG89zmBd
TLSH
T1EF159D09F28769E5CE3F90359AA28407E7F1B44513059FEB65B09A45FB27BF02A7E304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freetype.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\freetype.dll
Size 534KB
SHA256 399cfd49fe57f6c78093e026d9ab0091988cf35c31c31b1118ab234e38356f23
MD5 df656dcb1d9e9eaba26e30712c89c372
SHA1 8e686cceca0c456fa1df3feddecd3a8f70d3a713
SHA512 cd61953b67b0c7fdfb4787b640c0afb9fdc7962035e3f5b7cbd7e1b2c3b05a5f7f8e919c09f4b9fa520d3cb2628224755cf52e055238f952eb252c57b09f6e22
SSDEEP 12288:prG2KaPhNdss2oBKeK/tgF9K2AJixdkUDlzJ0NfEWm7SfQwor:BGoWs2oBq/qU2AJcd/pFZzr
TLSH
T17DC48E82F3A51BE8C667C2388717870BE7B5744913119BCB17A04B6A6F13FE26B39315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\java.dll
Size 143KB
SHA256 5b26c6c962b42a8405665f957cd16b0acff94b84ec71c612018e75b798987d5e
MD5 9fb2b9dfc090bdf192c75deb8852258d
SHA1 14d481296293c1f8556d09b144410aee96891ca6
SHA512 bd60dbe5a51fee4c183e7f1dc49f95aac3d9e13a4e599d57a76c379e44f734e678dedbc64bdfb46a4d28358d5efab022f0df514c8b6f42841d337b34f1097bf8
SSDEEP 3072:0M4MwKuuBQY8qbqgqBebK8suiCv0gvsyEr0sUkOX:x4MwKSqR0azd
TLSH
T187E33A4FB30640A6F429B6B8701A410BD37A7461412DD3BA43E98A8F9F6F7317E87791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\jimage.dll
Size 32KB
SHA256 3ef5e6937ff8127dc933a7694e5e57e0adfc3884cddcea1baa74a4d5d7f64a06
MD5 b72f67c27c8e4c4ad3d273b91dfc4df3
SHA1 8a386d327817dc4f3fb151a70577c24241f0b01e
SHA512 fe000533669d07e708d28909b3c6242e59ce9cc5b8038862aad608b99be344a0d2eec83d267367d9db5a4756f7aa542f8898907ed500cbf578e5cb5f922a3ee4
SSDEEP 768:0kQzWXz+VM5J1Q4O21rEbvZPR7Yi4JAMxkEF:0HmT1a21wbRPR77wxB
TLSH
T100E26C97EB505C29E92BD538C8DB9D2ED6B1F9825B50C3CB1721821A0F333813BAD761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\jli.dll
Size 90KB
SHA256 aaae87028a4938ab7a0c2407b30ecc2585f714b465bca83af7aba173b05350ff
MD5 b50df4b74808158ecd1032ebf9cfd69d
SHA1 094f031cb5b229313dafc82e975534a38685b704
SHA512 a042c41f58a1385b7ae90d182d6407c0c3f9f23519deb0c8c698eae69653f8802eab16795a873bc5b5f26b4a665c5bb56fdefa198ca1a8db1538c9cb27ea9bdf
SSDEEP 1536:aaA9Em1poMyUAc2U5cS9RYIO/NQwT5/K56Cltrx23IG79xF:h27goF2EfelQwT5/K56ClZx24Gd
TLSH
T167939E97539010A1DEB68579DAB1950FD3F1F0162760838F536CC6A60F53BA13E1CBEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsvml.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\jsvml.dll
Size 849KB
SHA256 11d87852577308261aaa7d23766cd419cc9ce97d37f53c2889c0f907e1207d6c
MD5 598e0bb3ad45b0516ad4783be21f5420
SHA1 5299246f15205b3ff5fe4d0db704b337c0436f11
SHA512 b02393f4c88f079423834e151f8b87e32311720a9c50b8421a674c6a1037a50b4612fd7c6bb21d3cb923302e08b9039bd71d39b7125a4472666fe59fb59f5260
SSDEEP 12288:uRybOUKnvJNeCs5wHuIbh/V71AVNV+Ssc3Q:uobO7JN3qwHJbhN7wj+9OQ
TLSH
T1D305AF82F81284CDC03534B024FFBD95A91A1CE941BC0EB32732AE9D2AFD7467957A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\msvcp140.dll
Size 564KB
SHA256 74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823
MD5 1ba6d1cf0508775096f9e121a24e5863
SHA1 df552810d779476610da3c8b956cc921ed6c91ae
SHA512 9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af
SSDEEP 12288:RBSNvy11qsslnxU/1ceqHiNHlOp/2M+UHHZpDLO+r2VhQEKZm+jWodEEVAdm:RBSDOFQEKZm+jWodEE2dm
TLSH
T145C41923B75905A0E196A3B8A1C74306D7F0BC4A8312A3C792FBD65E2F5B7D1673B190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\net.dll
Size 94KB
SHA256 b33884eefc7bc71b63ab5945f85a9f0f1622c7252bc8ab28551182e267377cd4
MD5 b9cff8fd0f1ce60dce2d56cf7c34f86a
SHA1 bfd43a004f6eb37d556534654e052699fa6973d3
SHA512 9f4af3a034bdb7100b335a0eb28d186ab912c81b34e163548bef20107a85616ffc5e1cc34d2dc411562c3f384ae318cea380397c3f61dc9ae3ad8e16eb36cd10
SSDEEP 1536:E9ed8doqUsfEIOAsVaSY710DfH/XQ+lM+F0hkNZ0nn+h2Hxu7wxR:iU8doqRxcVaSYZ0DQk5F0ONZwn+hqxu4
TLSH
T18A936B11A35820C9FC77D2BCC686861BC7B3B4A1261093CF13B6C55E6FAB6723E19781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\nio.dll
Size 78KB
SHA256 9fde3d0eeeb8ecd4790a9938cc554f342da747e5a5e82a01730612e934d2a63e
MD5 746493004e65ecf84aa40008d7fcf90f
SHA1 7d77d811abbca2d8b39518275cf40d1aace1d8eb
SHA512 4491dc27d1726ee55075f05f867731244ad0f90fb4d38f705e1c41e7f1689d7d87b20d846bc900df83fee647b62543fcff2016e0c3811f805632510c8f921a27
SSDEEP 1536:C2Jjdth+Kii8fBj/qbinPbifBs37nvhCW4e67k6xN:H/Yi8fJyb4PUBs3lCW4e6b
TLSH
T1BE733BA29374849BE8297138829A5787F732FC514500A75F5368C7659F2F3B23D3E392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\server\jvm.dll
Size 11.6MB
SHA256 0d0dffd2f99760ff850b03afa179e60b4730f982377fdf475d6428084889ae25
MD5 bbd67da03b04c8538b7d791b8a639990
SHA1 2be2b5656965e1d1914ef90b156ece50d343f260
SHA512 ca36411f349bab71914185473b5e81b5213d0d95d2a9e4e32c4374861bc7d9e8aaf9a19ffe9ac4143ffdb2da4af10a5e4e85606fb622da7e27a84ade3084ff76
SSDEEP 196608:O3Z+T4dWyDcvbCRhR/Ek01H9FtDllFhpS/0HVtAkkjeQJZCm8dv3PSPlCkliKfNj:aWyDBX/Ek01H9FtDllFhpS/0HVtAkkjF
TLSH
T140C66C6BB27401D5C42BC5B886279A0BF7F2B9546331D7DB11A1468E1F23FE59A3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\sunmscapi.dll
Size 46KB
SHA256 b948a6efd85b7ea46e73cad1083d4969639846d7f14cac56850c11fa54f07545
MD5 0d3e8126ad569a738ed77bd5b86d9b5d
SHA1 03ee4962eef25d9c0c3c954dbac0b2b802ceeb9b
SHA512 62eafb62554006376a45e9433604d109a9af31c892a22e96b1935b76f0e99927eec68562fdd9fe4607ab6e67436b1801f1e1f6b083a08b2bc02b185f21693177
SSDEEP 768:7cnnT8dTKpHEyvBdkGPQksz0QukwksUmiBW1lyig3YivRAMxkES:7cnaKdEyvBrsz0QutksUmiBolyig37Ro
TLSH
T1D6235907C7A204E6ECB3D8BCD466862BE672B8865121CBCF0750CA099F57B61B73C795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\vcruntime140.dll
Size 106KB
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
SSDEEP 1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
TLSH
T1E5B37C4672A442F7D0AAD174C2E38A47FB70B4418B60A3CF03B58A650F63BE19E3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\vcruntime140_1.dll
Size 48KB
SHA256 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
MD5 cf0a1c4776ffe23ada5e570fc36e39fe
SHA1 2050fadecc11550ad9bde0b542bcf87e19d37f1a
SHA512 d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168
SSDEEP 768:a0Q4HUcGJZekJSam1BbuBSYcCZbiLzlSHji9z4GwZHji9znwT:afnDex5izbiLzlE+z4Gwl+zwT
TLSH
T133235CE157788046E4ABA5B0C1E7AE13BE38F6A24B50528F0B65D15C1F537D0B73D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\zip.dll
Size 87KB
SHA256 8854e90c32c657c131d9dabebf78f80f295cd14e6b9b92767a09085c9d644dca
MD5 15dce66967282bedcd89206d423bb07c
SHA1 4ef52784faa535e89b834b6109db588f96c4df9b
SHA512 20b019fdfbd8dd628744ac08e4f0f11a07452a3d3451c34e4c70c201efa1b097c0c3b18ce02573ecd052db27f438eb23ee74948fd01a01c817915a609bd961e5
SSDEEP 1536:VHwVisweGMiCzUTEACjbKFOKBn6IOQIOhGUzw7QdW87Wxz:VHwVisw7MzUcbAOKnIGhGmAyW8C
TLSH
T109938D919AB055A1DEBA95B0C9F24A2FD3B6B01612D0578B534C83962F037A13F5C3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.properties

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\conf\net.properties
Size 6KB
SHA256 5bc726671936e0af4fdf6bed67d9e3a20a92c30b0ba23673d0314baa5e3ffb08
MD5 385443b7e4a37bc277c018cd1d336d49
SHA1 b2c0dfb00bf699e817bdd49b14bc24b8d3282c65
SHA512 260afc7671a1dc0c443564f1d10386f0b241bb53c76df68d8d03f1d0b1ceaf3f68847ab3477732c876c2b01c812ef7521744befe88e312f3aa63164b608b67a1
SSDEEP 96:6ATE+VEtGObfObz3Ob6Onte3CO0V+r/aJ7SFXtqBZUT+gTzDuBnZkRnF:/LVGG4f4z346et5m27SnCgTe9GnF
TLSH
T127D142C2FF46B72543A9C291E21EA7EAE32C903D5C33757831AC890D2619D76427F4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\conf\security\java.security
Size 58KB
SHA256 def331e59bca4eda427febd98f44a2785a21654dc0a1251649c8d11175bc0513
MD5 8a6e10ae557027c42c1781d6be228f86
SHA1 70097d748e8a7a2711779016c3296e74c967b200
SHA512 03a40ed11d138acc05e2398071920be84f11bf50bd24aa7840762b4a7e82dbbce9eff866fec5c410b68c6df741c4b358e82e8d6440aae345c47030c03b26172c
SSDEEP 1536:r2My8SiqOpjtHp5/jTNHu1UoQhzYKpNnCF:3qOPHD/jTNO1UoQhcK3nCF
TLSH
T13F43D422BB897B7106F211A363AEF1D9E76DA12A36721150748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\legal\jdk.internal.le\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\legal\jdk.jsobject\COPYRIGHT
Size 35B
SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
MD5 4586c3797f538d41b7b2e30e8afebbc9
SHA1 3419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA512 f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3
MD5 SHA1 SHA512

Submit Download

fontconfig.bfc

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\lib\fontconfig.bfc
Size 4KB
SHA256 968ac99bbaaf8a49a474c934e73ad58f88c6c7f2a363cb44771e0378444e36ba
MD5 0e25b41e6acf99681eaf2e8b572f18d1
SHA1 d6b4290da768e050fe6c310366272f87e6c2b6d2
SHA512 7c1e98bc6582af9e9c58c13cdc4d257e441a6d48fd395a3601ad558ebd481257f138d6f0dcbfe12735eb6bebeb7c8985b3d8af633b545fa01d56738f56360c08
SSDEEP 96:Pdbj5aublPBl7BWBBTiraXnaZziAaZH29sKG:P5j3pfuBTi2cz0Cs7
TLSH
T147A1CC01E5FA6208F2FBFB72A7B88455CD66F851B773DA5C1020405E4BA16408F62F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

blocked.certs

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\lib\security\blocked.certs
Size 2KB
SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
MD5 8273f70416f494f7fa5b6c70a101e00e
SHA1 aeaebb14fbf146fbb0aaf347446c08766c86ca7f
SHA512 e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
TLSH
T1CC512CCAD15E02DA9D407BE208EC82A7779381B2AB2C442A2BF60F420577C5DD73B8C5
MD5 SHA1 SHA512 TLSH

Submit Download

cacerts

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\lib\security\cacerts
Size 121KB
SHA256 c168b4ac51bfb5c6fd206917e1afe45b019baa3fc39a80a85153742ca204b0ff
MD5 b1d5ae0830b9a865af8f1defb6853694
SHA1 f9657787bd6ce0b51f691383fd21c4ad487b3ecb
SHA512 d08293b5de2bb4e48931757164aae4ea7bace82b44ee85de6909311cf8842fa3110b717f2c7d65e030b3d7031bd72302d20bfd2971a4df9c25d75802041db0de
SSDEEP 1536:S/YNTer0bHoIXErDpKQxPHyJ/ul+VxZ1IYbJGvM0vp4eOZVlylbIAYn:SYUr0zl0npKQxPQ/dZ/bJNiAlylbIAm
TLSH
T14EC38D9F4F383811BFC6DE646688E1373E7AB3D5A6DA24172521C0E56E923F4798C01E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

public_suffix_list.dat

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\lib\security\public_suffix_list.dat
Size 225KB
SHA256 d5a0e25d7d46039beab0cdb7e6d114a94972b09a75f0e1fbd795d94ad7244a1f
MD5 b96bb0ad6afc8d4cd6e41ea0d61bf941
SHA1 668c6a9669c3311f31020adea9da6e952937cda3
SHA512 15351a4fcbc7bbea991063f450014817b5ddb1159c333dff2400ee0c22b09fc3b0acf75f2da93bbecb5221263ea6eb501050099c5f5b33b50af28f136de1117b
SSDEEP 3072:9Fsth4k2eOj0MPGIq3UFuIgj4ARhCDBzmgO2Abhsf6YeUORcZ6OI0mGxzhpDstu/:9eth4kZ32gMAgpAW1r2b0t
TLSH
T1E934DC5A6EE9AD0DC01381374472929AD729A21C5E49EF1F1B4470A81CF5E9B2F43FCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\lib\tzdb.dat
Size 101KB
SHA256 108a63fb316b1eaa8949f3ff7265c2af0402c9ff13f360578e658caaafc40faf
MD5 c054908b3f007234696a2c13f2cb58be
SHA1 330a69ed889539d7b8f9ec8bcb00f49b5ee2895d
SHA512 64f3c996f668e200acec60138d027fd60523c35e5de60dcca915101c2c069f1bef6783f34584b2212a5c140061d65cb23d889bb2cdd67b57014c66020e777a7c
SSDEEP 1536:c0EEMEBHNPdrY2L/rmjAGubVj0Lg/////PhbPdJPNL0mOTLMXjbF35a2yiz:cCMYHNPdrtDxbVj0MhzdxgTLw42Z
TLSH
T1D0A3A2757F7050B7B2CF4222262B5B93097DAC816FC3080679B5BD4E8A76AD6603335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Local\OakHaven\runtime\lib\tzmappings
Size 21KB
SHA256 b41575b332809b37ad423bdca30c7c48cdef3d82f82fa9d534781a6f15d6a2ab
MD5 4c30d7867505379a18a27d0e8f03198c
SHA1 0cc871d5bd91e061d676a861749af68bbc0ca9c6
SHA512 873d329682ce67267f438b88eee0fc25cecbbcc1f7d694118417ad12756ec2b6ae7502ec4eea0cc9b4ae8b9e68f5f8877762fa13dea89c4a6dcd54fd8bf82c56
SSDEEP 192:3nqW46ARn1+RQ7wbNQQSaapvQZglEcCDqvOCJqGic3yzA6bbAdOFmYXKhJmBW:3nqW46ARnGQqN2KhcQ+qAa9W
TLSH
T1CDA25386B06662D4C073EC0D7B527AD3F886F3C899C69A4D2943C366BD019B767E1837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134304095742292046.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134304095742292046.txt
Size 79KB
SHA256 ef6db19c045715b4a24fde36875983d203608979ffcc2b6be445223555baad5c
MD5 9ff47e87aa32b614be704bc880275a6c
SHA1 981e11a21499108b89c231d07be7b8494e557ee5
SHA512 06c2bc7f2d3e0355886a3200aea863b2b0eef314b923089e3af50edbe056bbee11a193d74e7ff1e31eb9173c125d0095a9ab10723319f34b0ab67a74616d1bdf
SSDEEP 384:i/v8/n5a/rM/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/e1:vhs7omR3V1D
TLSH
T1B583B3A53281CBF3313966A0BCD9E525E13926B1E0E88F4561FA9613FC5ADDC62313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.msi

Path C:\Users\Admin\AppData\Local\Temp\240662000.tmp\main.msi
Size 48.2MB
SHA256 7d59e2d8f607793bb2dae611b8c1e2dab2190bc09728dd2a0dc5a4e96c0d2533
MD5 3bd6aea78470d3cf4d28488c9df74920
SHA1 70940390f0a75a9acad6a924631c93b1b217a9f3
SHA512 2962c04be2e4ae3e29bc38cc3a63c3221fe540a49e16ddabdbb78eeb230c855046c9936391f7563471e35ed20469d9dc395545c19e86b8cad4db18025a35ec9d
SSDEEP 786432:wEGY6d48nJYhBdcEKhXmW4u9E6xiwbdsQYGUoX8gMu1JZNoG2K4g4X20STSq3aa/:wED6d4MYqEK9mhMpxiqsQyoMENooCzfE
TLSH
T119B7332CAEB4C86BC3765A345AB1F35AC23C7E511E16460B1B7572C82F76E883D36B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna267554249301547551.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna267554249301547551.dll
Size 390KB
SHA256 5cc2e504800cf4ed2f4781364f661ea22349658ddc391b5d54195e573109d87b
MD5 5882c37b79bae47a0d090006564edb22
SHA1 ac7bbbdb1d34eb763d8db4ef7875a50f700e9d48
SHA512 d4a6a1a36842dd1c8b2162168807b990e0d491a908e11b52ebf11174a67f818b131607c2122dbb484f5d946418a05a1a84d42e1468bef5c98ec3fcff7d225ccd
SSDEEP 6144:TnQCrLe2xJLChxTC+LxTYXrHJZ5upQtXsK+62C3wh+0U1c5xrunBLko:TnQCrLXxgvU7v8ph7+0kHB7
TLSH
T12C847D5AFB6448B5D0679135C973864BE3B27C891B70D78F23A8439A2F37BA1453E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8122.tmp

Path C:\Windows\Installer\MSI8122.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 adb426226def2fbe33fd7b0fa418c0d18ec704fcf7faf856a1a430ce3dfc2eeb
MD5 42aec3d1eea6ea26821db25fadb5d4fd
SHA1 4839598d748b5ec979ae3f16dae39110e979dac3
SHA512 d328384d6f493009bbdca1336265772d41dc6e996186302eaf7856c3d42a99a820d63b5e7534a31a6c93daa81daa12f30f74a7c567173a13511eae68f02273cd
SSDEEP 24576:su8m+1z7doO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:s
TLSH
T17747C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{af8b23fb-674a-48e2-8845-8abdb3e0646d}_OnDiskSnapshotProp

Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{af8b23fb-674a-48e2-8845-8abdb3e0646d}_OnDiskSnapshotProp
Size 6KB
SHA256 fe92d64ca1e230e1af953807d92afaead79b1f8c72457c42f57385ee4a300f49
MD5 d7afcd3d1c4c666d46200e5a890c64db
SHA1 ed650e741f75558a605ed51c998fd1fce67961f0
SHA512 1b528bc2e17ec38f9df926e12c68e8640175ba4d3279ee679a9b10436b0e46619e0b032c01260792c4b53784681222c27c83b766947dd27f4cd73bb7d26af305
SSDEEP 96:FNfBAkcvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:v5Gb++ZVmN
TLSH
T17DD199085AF54711E2B3AB3229F18557A877B911EF33CB8E0298238E2670910F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3448-439-0x000001C121D80000-0x000001C121E61000-memory.dmp

Download

memory/3448-15084-0x000001C121D80000-0x000001C121E61000-memory.dmp

Download

memory/4788-3125-0x000002C6B5270000-0x000002C6B5290000-memory.dmp

Download

memory/4788-2904-0x000002C6B2D00000-0x000002C6B2E00000-memory.dmp

Download

memory/4788-2972-0x000002C6B4EA0000-0x000002C6B4EC0000-memory.dmp

Download

memory/4788-3044-0x000002C6B4E60000-0x000002C6B4E80000-memory.dmp

Download