Analysis

  • max time kernel
    112s
  • max time network
    159s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 13:17

General

  • Target
    OakHaven-Setup.exe
  • Size 49.1MB
  • Sample260805-qjrtpayclb
  • SHA256 87c49f77dcba41728a5842923b7f9b7dfb5ad6806d34688a751e9607744b8b0c
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 16 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 13 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\OakHaven-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\OakHaven-Setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6004
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\240723921.tmp\main.msi
      2⤵
      • Enumerates connected drives
      • Event Triggered Execution: Installer Packages
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3724
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5348
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:628
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 2DA60CC9D8AC60B045F310F915B5BF30
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5104
    • C:\Users\Admin\AppData\Local\OakHaven\OakHaven.exe
      "C:\Users\Admin\AppData\Local\OakHaven\OakHaven.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5756
      • C:\Users\Admin\AppData\Local\OakHaven\OakHaven.exe
        C:\Users\Admin\AppData\Local\OakHaven\OakHaven.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious use of SetWindowsHookEx
        PID:2496
        • C:\Users\Admin\.OakHavenCache_v1\java\jdk-11\bin\java.exe
          C:\Users\Admin\.OakHavenCache_v1\java\jdk-11\bin\java.exe -Xms512M -Xmx1024M -jar OakHaven.jar
          4⤵
            PID:3520
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2836

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e597e9d.rbs

          • Path C:\Config.Msi\e597e9d.rbs
          • Size 108KB
          • SHA256 e0cce238633ebdd2126ebef2ccb7282e921443705865ffd79fa06d1fed6d5064
          • MD5 SHA1 SHA512 SSDEEP TLSH

          OakHaven.jar

          • Path C:\Users\Admin\.OakHavenCache_v1\OakHaven.jar
          • Size 47.0MB
          • SHA256 9f9e8d6e987b290911867e32d379214ea72d0049d2f46c259e30c2c482471782
          • MD5 SHA1 SHA512 SSDEEP TLSH

          1321.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\1321.wav
          • Size 14KB
          • SHA256 6ed218781f96d407475c684df2c9f3d0000a1bf80dbbcc2e2bf2b715ad1780db
          • MD5 SHA1 SHA512 SSDEEP TLSH

          1452.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\1452.wav
          • Size 20KB
          • SHA256 e1211f429ccf3b574b3996786f4cce4fc5858e01b155b1fef87f1a77a543e6ff
          • MD5 SHA1 SHA512 SSDEEP TLSH

          1572.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\1572.wav
          • Size 16KB
          • SHA256 1abb08e330615da7ade9b24ceb1e7f74435c586c655cffe15b4f922cc54f2404
          • MD5 SHA1 SHA512 SSDEEP TLSH

          1701.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\1701.wav
          • Size 39KB
          • SHA256 e68e5d3d81040482cfba1e92d60eb627bc9113752f894f655380fe626c148bd0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          1800.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\1800.wav
          • Size 50KB
          • SHA256 0762a3a0c973658ab9945bf32ee6f95ee98796ce78a40a5a9b53e8f015081030
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2321.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2321.wav
          • Size 15KB
          • SHA256 cd3039d6d4a4da1f87c7e63a48fd54b6776f47c35dd08c4cdc3cf3a3ac0c1ddc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2470.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2470.wav
          • Size 18KB
          • SHA256 48ad3ab4fa3568c4cddfc81bd2c600ae3949cf3dbf08c5848396e8b56aa88369
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2500.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2500.wav
          • Size 10KB
          • SHA256 e19cddc130ddfc056ae7ff6aef3b985b32280eeb3f4d15abf95f0cfabe0c931c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2512.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2512.wav
          • Size 12KB
          • SHA256 90fa2de50fe2db6637594d17b818484a541764567241ef1e04d4a962588a70a9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2522.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2522.wav
          • Size 19KB
          • SHA256 55f0793b7cb676592e6a34402eead6aab0376574160524bcdddfd87cc91313f1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2526.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2526.wav
          • Size 17KB
          • SHA256 e912062488fcf3621ee4eaa06d8ff8f9ee6215b07f5f841ee2d1f738a56c4baf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2563.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2563.wav
          • Size 32KB
          • SHA256 b24409e0256e375154452f6adc2960cfbc65a45755f361f73f022097a19d7923
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2587.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2587.wav
          • Size 29KB
          • SHA256 42407cd89462324ffe4e073099a24d937e77447b7cbae012a592fd667ebe7ba5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2604.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2604.wav
          • Size 21KB
          • SHA256 254b4a5397dab8fd0fbacee97196ea9bc4a9da08bd8ca49e28ecab7e745aedc3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2619.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2619.wav
          • Size 37KB
          • SHA256 5defa627f218b3809406f6cae615ca7abe2e1ab911a9a732694f52ff38196ba8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2707.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2707.wav
          • Size 23KB
          • SHA256 b437df678cd803331a6e2ad48bce6dd90532ecc233185112220a4a834501b8af
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2708.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2708.wav
          • Size 26KB
          • SHA256 de2b7d95cbb7ff89a594380029c343efeaa97d891373738397aa5d21b2ec829f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2896.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2896.wav
          • Size 109KB
          • SHA256 33a21b944c0f8c849504faebb651492fa7b4b84c4f44831e1b4213eb9dde21c8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2933.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2933.wav
          • Size 24KB
          • SHA256 f388498d7133b45adade2ff4f024ee41f999814626161f64309ec73450d2319e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2970.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2970.wav
          • Size 43KB
          • SHA256 e413ea0b2d78bd28503e694b78a4f078a2a7316f5d95baa7b569a4de6100bb0a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2978.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2978.wav
          • Size 40KB
          • SHA256 243fad5c9a65fbfe3d679de47a98f8f87d2c5dbf984eb47baabfda668bd49835
          • MD5 SHA1 SHA512 SSDEEP TLSH

          2998.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\2998.wav
          • Size 31KB
          • SHA256 999bf2a9cb442c17778be0acd5577a41431aab5a0cab42e7439b1dfdaf9acb41
          • MD5 SHA1 SHA512 SSDEEP TLSH

          3083.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3083.wav
          • Size 86KB
          • SHA256 cd3aee6e2343b54a6a61de99d2cd9049446f97ec657adf5bf4d1eec055799f82
          • MD5 SHA1 SHA512 SSDEEP TLSH

          3210.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3210.wav
          • Size 34KB
          • SHA256 0621d65f79395d8bb4176f9955961b311cb249dc39bc2593d119856147633667
          • MD5 SHA1 SHA512 SSDEEP TLSH

          3314.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3314.wav
          • Size 30KB
          • SHA256 2ab8931ec66c47a1a8019fc295138c5608b9f8cb5baf1fdb0fa35769a7597fbe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          3367.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3367.wav
          • Size 7KB
          • SHA256 8c88a8b3d0a3f9346efbb42ffd28fd25590873bac53399cb9e4d22b2adbe9efb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          3408.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3408.wav
          • Size 22KB
          • SHA256 418ee299751a4260a449765b94bdd5e8749b35c0fc9f61b7e309ecf27b1604f3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          3481.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3481.wav
          • Size 53KB
          • SHA256 aef5f9e9b5fa6ef5decd4c95ed68d9356f047444b142d96bb7fc4045b320fe72
          • MD5 SHA1 SHA512 SSDEEP TLSH

          3487.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3487.wav
          • Size 51KB
          • SHA256 802c30930129f45a3c3809cc3a0f93ccefb9a44be0b0ffa0a7e618e4dee23bf5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          3617.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3617.wav
          • Size 96KB
          • SHA256 343ab2eea60b9f2ec66a2e44f5dadbd62bb6dc06d0288dccc82704f41dcec7fe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          3664.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3664.wav
          • Size 49KB
          • SHA256 56fc02cd73dcbe26f17c18d9839eeab97e9cc99d4e0bf44909c87126fa69a7f9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          3793.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\3793.wav
          • Size 39KB
          • SHA256 e8dc2cb72677734973e95b20eb5b5a5d178fb6d26f1acd15b88684f06a61ce5f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          4007.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\4007.wav
          • Size 36KB
          • SHA256 ebb20fe09f37cb28f27b72eaa7d6b7b435978765edf073249889379b4973850b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          4375.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\4375.wav
          • Size 64KB
          • SHA256 2362f76cf3da727a639c3e434dac0d5720f6fb0c6505bdfa6e9d3897b8724325
          • MD5 SHA1 SHA512 SSDEEP TLSH

          4481.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\4481.wav
          • Size 25KB
          • SHA256 6e4b8af16d3f613d448edc87fc3707280e1c1265aa3f116c82e65df9928dd9df
          • MD5 SHA1 SHA512 SSDEEP TLSH

          4614.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\4614.wav
          • Size 9KB
          • SHA256 ffe9255338a1e7f305255e0331b4719538a347d5c338b6dda3e9b222d02ff68e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          4685.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\4685.wav
          • Size 28KB
          • SHA256 882ed1cbb89e5398ee7dfb902a9935d7039005be28b6712ade6bb1792e691bae
          • MD5 SHA1 SHA512 SSDEEP TLSH

          4758.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\4758.wav
          • Size 22KB
          • SHA256 82761f18c179535367e02ccc1240b9b5ebd823f328e09c24cb241e839d676b02
          • MD5 SHA1 SHA512 SSDEEP TLSH

          706.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\706.wav
          • Size 11KB
          • SHA256 34e7858244098ece009eae815ca1214adc553e78026beb3af702b1790d44fc1e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          895.wav

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sounds\895.wav
          • Size 45KB
          • SHA256 a1cdc2182feab5edf8f6bd53e57afeb7588d997d8a4c149e8a74b83d8cc49c02
          • MD5 SHA1 SHA512 SSDEEP TLSH

          103.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\dump\103.png
          • Size 483B
          • SHA256 66ee4ae0c887d13ae947650627b1288d5e5e9ec7e977dbb992fb82b382773e33
          • MD5 SHA1 SHA512 TLSH

          91.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\dump\91.png
          • Size 8KB
          • SHA256 1fcf12ede17a9fee2536e954ab48ffde8f63a35d31a870f05de161ee8c646b8e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sprite 3.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\equipment\sprite 3.png
          • Size 483B
          • SHA256 e5c4741ab107e559f272a4a2075d5badf745d8ee5e526cc1ab361f1a5bf530c2
          • MD5 SHA1 SHA512 TLSH

          283.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\icon_pack\283.png
          • Size 80B
          • SHA256 9873662e54f9d71b9529d60be599e55e1ffad6ad033ef5cd8a7c81500286e3ea
          • MD5 SHA1 SHA512 TLSH

          sprite 37 copy.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\clan chat\sprite 37 copy.png
          • Size 8KB
          • SHA256 8ca89e30b9cadc986dd760d5caeb6d2fe0c08aaab964f009d7a40e20d8be79c4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sprite 8.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\clan chat\sprite 8.png
          • Size 256B
          • SHA256 f4e403a94410e612068f7c3915efa3021121c2d27cd3e207067c654bc7154c85
          • MD5 SHA1 SHA512 TLSH

          close 0.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\death\close 0.png
          • Size 405B
          • SHA256 41de7769fb4e5b137cfa5f905f514a4594a881329b00e7afd7ab6df3b76c5182
          • MD5 SHA1 SHA512 TLSH

          close 1.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\death\close 1.png
          • Size 399B
          • SHA256 4f8d51b527b0d07e3ed07c1f119c165aaca9377fbf4e2ee02d6bd0d7e3611917
          • MD5 SHA1 SHA512 TLSH

          day 4.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\giveaway\day 4.png
          • Size 9KB
          • SHA256 4df045aa2aca79039c6d3e807c5da45883c2eb0b711288576acc6ec435454bd2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sprite 1015.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\mysterybox\sprite 1015.png
          • Size 475B
          • SHA256 09ebe00096d69b447486ecda428712b90f95e7c082c34b4e99ff0414485f67a1
          • MD5 SHA1 SHA512 TLSH

          sprite 527.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\mysterybox\sprite 527.png
          • Size 418B
          • SHA256 4ce10abe19e3df0302685bf9bde06f313cd1f2a38f36eb3172cd3f6bde98ca34
          • MD5 SHA1 SHA512 TLSH

          image 6.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\passwordexpired\image 6.png
          • Size 1KB
          • SHA256 48c03e33ba344d681b1d5fc2237fa54286ac0d2242a67f4c764b5e7d5b693501
          • MD5 SHA1 SHA512 TLSH

          image 7.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\passwordexpired\image 7.png
          • Size 1KB
          • SHA256 0abfd1f7bfb48f11de151fc24b328b3eed23ffd21a1cbaeaaf713a6c442b089e
          • MD5 SHA1 SHA512 TLSH

          image 4.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\pest control\reward\image 4.png
          • Size 390B
          • SHA256 ffeccfbade90b0895fd3ede449f09f04667f03eab1d572c57b45c50b8b895465
          • MD5 SHA1 SHA512 TLSH

          button 0.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\polltab\button 0.png
          • Size 1KB
          • SHA256 262bc43bfbec64db3e585921d31ae01e3ce3eaf8ed0895053730c6c7cce1f2f5
          • MD5 SHA1 SHA512 TLSH

          sprite 1.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\q2\sprite 1.png
          • Size 1KB
          • SHA256 d5c0176937ffeaf9c45d7e16d7395b4b21a71f5753c7315bd9a78b0de1920866
          • MD5 SHA1 SHA512 TLSH

          sprite 2.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\interfaces\q2\sprite 2.png
          • Size 1KB
          • SHA256 a57ef8c60a5c70240003aa14a9170d150ad50528a8c6ccb7774daecfcad10b7d
          • MD5 SHA1 SHA512 TLSH

          1280.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\1280.png
          • Size 159B
          • SHA256 0ec3958f4bfa8f16f2c816bafb6143f7dec4b17162990ae2ad41dc3f139cf330
          • MD5 SHA1 SHA512 TLSH

          1722.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\1722.png
          • Size 81B
          • SHA256 65ac3d9585bb89475c38ba323d08c961057f68666bf8c389196a939b13a3a00b
          • MD5 SHA1 SHA512 TLSH

          1807.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\1807.png
          • Size 85B
          • SHA256 1f98395f629bfe623dc2fba7a6fc8896c40f7234a22ab20f3c0841ad91b0c1ee
          • MD5 SHA1 SHA512 TLSH

          188.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\188.png
          • Size 85B
          • SHA256 abddd7b31fb4058ac18d191499a906f395733d67a96e3ae98e4a79c8e8423506
          • MD5 SHA1 SHA512 TLSH

          2100.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\2100.png
          • Size 237B
          • SHA256 2159c4608eba8b294a291b8afd550bf8799dedc18f4d984e1c43f12d4ef07abf
          • MD5 SHA1 SHA512 TLSH

          2131.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\2131.png
          • Size 274B
          • SHA256 bd0c5fc044579797c1eb923153856d5aeb25f0a379dd98a823f181876639af21
          • MD5 SHA1 SHA512 TLSH

          230.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\230.png
          • Size 82B
          • SHA256 7d51d035949791c0cad9b8438d88f42aa928b9a525ead1771757a5d2503718dc
          • MD5 SHA1 SHA512 TLSH

          2648.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\2648.png
          • Size 136B
          • SHA256 fea6e185ef4bb2bf68b9b700bd1e5c368e18f5a778f02d3edbe9fd40da53bdf0
          • MD5 SHA1 SHA512 TLSH

          2692.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\2692.png
          • Size 83B
          • SHA256 34a4a4d3c487cfc7a8b9c8bde5820e42879f7a8129acd750057247eb31c4ffb1
          • MD5 SHA1 SHA512 TLSH

          2824.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\2824.png
          • Size 81B
          • SHA256 4eb4ae34880bada2a7f27beae3f85915b2bad86c79cffe2c61128a384117cfa3
          • MD5 SHA1 SHA512 TLSH

          2938.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\2938.png
          • Size 80B
          • SHA256 96c7a27f005bd472c75b13f10c6e457fb6ddb298135530733079439e85bfdf2f
          • MD5 SHA1 SHA512 TLSH

          3336.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\3336.png
          • Size 72B
          • SHA256 03e7e0b10a784e0ac20a351255f02761b086f65a7bce7889b4f5ba0fe4df9ef6
          • MD5 SHA1 SHA512 TLSH

          3350.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\3350.png
          • Size 75B
          • SHA256 9136d9c96fdabe993edcc2f33bf871697461b9c39c2fbcf8b421de00a2c74b2a
          • MD5 SHA1 SHA512 TLSH

          3742.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\3742.png
          • Size 77B
          • SHA256 320dad20de1a0af6e50ad93be1efb19b4de53bad8046a4f83306efa4d158d86c
          • MD5 SHA1 SHA512 TLSH

          3951.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\3951.png
          • Size 83B
          • SHA256 a6ad1bec9b073969cce0b126f9bcf9c9f1e18973f4ea84c5620f0a5da4d1fc74
          • MD5 SHA1 SHA512 TLSH

          4336.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\4336.png
          • Size 89B
          • SHA256 196e77c1d5e1b0e28677ab57dca87dd8a758ad2a20b29d0b8ae26ba76095e924
          • MD5 SHA1 SHA512 TLSH

          4549.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\4549.png
          • Size 83B
          • SHA256 502cce141390b59c37cb2f52d0a960968b8bfb9c8562498fdb1de88c04051fa5
          • MD5 SHA1 SHA512 TLSH

          4898.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\4898.png
          • Size 75B
          • SHA256 7074f74f39a8ad752db14a876089e9867d92b2425c37a6d44a74660f900a877d
          • MD5 SHA1 SHA512 TLSH

          4946.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\4946.png
          • Size 74B
          • SHA256 716326173f96724c19eb990d196239545df6e63106d14a331b7dad43a93fc88e
          • MD5 SHA1 SHA512 TLSH

          5065.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\5065.png
          • Size 88B
          • SHA256 4aa1f89a66ccbe29345581d370bcd2a1753868bfbb5915a7f61de3b5c2d1e14e
          • MD5 SHA1 SHA512 TLSH

          5413.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\osrs\5413.png
          • Size 93B
          • SHA256 c3a1fc4f8084550a3b7629605af11481fa4d4273e7b544a2249d70a9a21d49be
          • MD5 SHA1 SHA512 TLSH

          modicons 63.png

          • Path C:\Users\Admin\.OakHavenCache_v1\cache\cache\sprites\player\modicons 63.png
          • Size 174B
          • SHA256 9896386097d71eba6a17937c41dd1fc489d02ac58c3d13dc6a1547dc63108741
          • MD5 SHA1 SHA512 TLSH

          java.exe

          • Path C:\Users\Admin\.OakHavenCache_v1\java\jdk-11\bin\java.exe
          • Size 53KB
          • SHA256 95f9dfc53e94e630a33868d8d6e4fea04f0863d4be6084a9b1f5db6a2f86041a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jli.dll

          • Path C:\Users\Admin\.OakHavenCache_v1\java\jdk-11\bin\jli.dll
          • Size 89KB
          • SHA256 f43be28ec29ac4ff997ba1a4bb9712c4c04b036f014f903842946a86991db5fb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jvm.dll

          • Path C:\Users\Admin\.OakHavenCache_v1\java\jdk-11\bin\server\jvm.dll
          • Size 11.1MB
          • SHA256 8fa80abc294e324a657014fedbad0db0aa575174d7a154dba585ad08dc07c3a4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          version.dat

          • Path C:\Users\Admin\.OakHavenCache_v1\version.dat
          • Size 1B
          • SHA256 4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce
          • MD5 SHA1 SHA512

          OakHaven.exe

          • Path C:\Users\Admin\AppData\Local\OakHaven\OakHaven.exe
          • Size 795KB
          • SHA256 77b6930eebd0a1fc93963702e08d15e7dbaaf8712e2f6e561f48db893bc2b742
          • MD5 SHA1 SHA512 SSDEEP TLSH

          OakHaven.cfg

          • Path C:\Users\Admin\AppData\Local\OakHaven\app\OakHaven.cfg
          • Size 128B
          • SHA256 041529032bb1376d1398ae9f9fc6cbe0e4a41ecec517636e809809d0589b7ee3
          • MD5 SHA1 SHA512 TLSH

          launcher.jar

          • Path C:\Users\Admin\AppData\Local\OakHaven\app\launcher.jar
          • Size 420KB
          • SHA256 07f15df25b2719f381dbb4d9362fe04b627e7c8d3b240817e33871c8a3020def
          • MD5 SHA1 SHA512 SSDEEP TLSH

          VCRUNTIME140.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\VCRUNTIME140.dll
          • Size 106KB
          • SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          awt.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\awt.dll
          • Size 1.4MB
          • SHA256 a49c7fe3063e9a09eff562e3b7cd811f6bd31e6a9773ec7767ac42dbdbd3f27f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fontmanager.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\fontmanager.dll
          • Size 885KB
          • SHA256 3c0548f1fc523f4e76c816534355bb482c5b33f5c38652c833792847c1e3ebca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          freetype.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\freetype.dll
          • Size 534KB
          • SHA256 399cfd49fe57f6c78093e026d9ab0091988cf35c31c31b1118ab234e38356f23
          • MD5 SHA1 SHA512 SSDEEP TLSH

          java.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\java.dll
          • Size 143KB
          • SHA256 5b26c6c962b42a8405665f957cd16b0acff94b84ec71c612018e75b798987d5e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jimage.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\jimage.dll
          • Size 32KB
          • SHA256 3ef5e6937ff8127dc933a7694e5e57e0adfc3884cddcea1baa74a4d5d7f64a06
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jli.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\jli.dll
          • Size 90KB
          • SHA256 aaae87028a4938ab7a0c2407b30ecc2585f714b465bca83af7aba173b05350ff
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jsvml.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\jsvml.dll
          • Size 849KB
          • SHA256 11d87852577308261aaa7d23766cd419cc9ce97d37f53c2889c0f907e1207d6c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          msvcp140.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\msvcp140.dll
          • Size 564KB
          • SHA256 74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823
          • MD5 SHA1 SHA512 SSDEEP TLSH

          net.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\net.dll
          • Size 94KB
          • SHA256 b33884eefc7bc71b63ab5945f85a9f0f1622c7252bc8ab28551182e267377cd4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nio.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\nio.dll
          • Size 78KB
          • SHA256 9fde3d0eeeb8ecd4790a9938cc554f342da747e5a5e82a01730612e934d2a63e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jvm.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\server\jvm.dll
          • Size 11.6MB
          • SHA256 0d0dffd2f99760ff850b03afa179e60b4730f982377fdf475d6428084889ae25
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sunmscapi.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\sunmscapi.dll
          • Size 46KB
          • SHA256 b948a6efd85b7ea46e73cad1083d4969639846d7f14cac56850c11fa54f07545
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vcruntime140_1.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\vcruntime140_1.dll
          • Size 48KB
          • SHA256 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zip.dll

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\bin\zip.dll
          • Size 87KB
          • SHA256 8854e90c32c657c131d9dabebf78f80f295cd14e6b9b92767a09085c9d644dca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          net.properties

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\conf\net.properties
          • Size 6KB
          • SHA256 5bc726671936e0af4fdf6bed67d9e3a20a92c30b0ba23673d0314baa5e3ffb08
          • MD5 SHA1 SHA512 SSDEEP TLSH

          java.security

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\conf\security\java.security
          • Size 58KB
          • SHA256 def331e59bca4eda427febd98f44a2785a21654dc0a1251649c8d11175bc0513
          • MD5 SHA1 SHA512 SSDEEP TLSH

          default_US_export.policy

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\conf\security\policy\unlimited\default_US_export.policy
          • Size 146B
          • SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
          • MD5 SHA1 SHA512 TLSH

          default_local.policy

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\conf\security\policy\unlimited\default_local.policy
          • Size 193B
          • SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
          • MD5 SHA1 SHA512 TLSH

          LICENSE

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\legal\jdk.internal.le\LICENSE
          • Size 33B
          • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
          • MD5 SHA1 SHA512

          COPYRIGHT

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\legal\jdk.jsobject\COPYRIGHT
          • Size 35B
          • SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
          • MD5 SHA1 SHA512

          fontconfig.bfc

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\lib\fontconfig.bfc
          • Size 4KB
          • SHA256 968ac99bbaaf8a49a474c934e73ad58f88c6c7f2a363cb44771e0378444e36ba
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jvm.cfg

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\lib\jvm.cfg
          • Size 29B
          • SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
          • MD5 SHA1 SHA512

          blocked.certs

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\lib\security\blocked.certs
          • Size 2KB
          • SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
          • MD5 SHA1 SHA512 TLSH

          cacerts

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\lib\security\cacerts
          • Size 121KB
          • SHA256 c168b4ac51bfb5c6fd206917e1afe45b019baa3fc39a80a85153742ca204b0ff
          • MD5 SHA1 SHA512 SSDEEP TLSH

          public_suffix_list.dat

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\lib\security\public_suffix_list.dat
          • Size 225KB
          • SHA256 d5a0e25d7d46039beab0cdb7e6d114a94972b09a75f0e1fbd795d94ad7244a1f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tzdb.dat

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\lib\tzdb.dat
          • Size 101KB
          • SHA256 108a63fb316b1eaa8949f3ff7265c2af0402c9ff13f360578e658caaafc40faf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tzmappings

          • Path C:\Users\Admin\AppData\Local\OakHaven\runtime\lib\tzmappings
          • Size 21KB
          • SHA256 b41575b332809b37ad423bdca30c7c48cdef3d82f82fa9d534781a6f15d6a2ab
          • MD5 SHA1 SHA512 SSDEEP TLSH

          main.msi

          • Path C:\Users\Admin\AppData\Local\Temp\240723921.tmp\main.msi
          • Size 48.2MB
          • SHA256 7d59e2d8f607793bb2dae611b8c1e2dab2190bc09728dd2a0dc5a4e96c0d2533
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jna3107069612593925433.dll

          • Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna3107069612593925433.dll
          • Size 390KB
          • SHA256 5cc2e504800cf4ed2f4781364f661ea22349658ddc391b5d54195e573109d87b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          MSI889F.tmp

          • Path C:\Windows\Installer\MSI889F.tmp
          • Size 234KB
          • SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          metadata-2

          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 3c1bdf702eae814fa62d72187dcb020cf1ff756b3af9a165a1a5f8f75d56300d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          {12f825a7-cac1-468d-9961-3d252514bbcb}_OnDiskSnapshotProp

          • Path \??\Volume{cb180e94-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{12f825a7-cac1-468d-9961-3d252514bbcb}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 50126a7a504986ca0b9b2d5f0de765486258e7d54674f19519e0df4e7925b576
          • MD5 SHA1 SHA512 SSDEEP TLSH