2541a09593dc271cd28b93ff97e8ef7bb2311cd568176f008bc906b1da932968

Analysis

max time kernel
151s
max time network
160s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_2bdd3696ca3537212fff361ea8bfa0af_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Size 109.4MB
Sample260813-2wewfazsft
SHA256 2541a09593dc271cd28b93ff97e8ef7bb2311cd568176f008bc906b1da932968
MD5 2bdd3696ca3537212fff361ea8bfa0af
SHA1 9f2ca5084504745e093ddb1279dcaf68409877cd
SHA512 71aac65ace372c7ac871c65c7a335514ee0632989f6c7002164a10168607f17301b9a20ca876f41b2aef9f9e56d9eeac477c164855d92ac6c29e547fc92b47b2
SSDEEP 393216:xlJ0u0Il+6ZL1M/aDWDiTlqtEbX4y5IWPZQSI8w5SvDazn1d5VR4FpO6nw0UpJVY:xhBz3ZQlRhvyM1Q3vxOtx52pb
TLSH
T1E748BE4267EA04C5F9F79A3589F25213D673BC066F3082CB325C176A1F736E09976B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4cb-220.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Executes dropped EXE 10 IoCs

pid	Process
5448	javaw.exe
4692	runtime_helper.exe
1884	runtime_helper.exe
2608	runtime_helper.exe
5340	runtime_helper.exe
5932	runtime_helper.exe
4528	runtime_helper.exe
5900	runtime_helper.exe
3532	runtime_helper.exe
5800	runtime_helper.exe

Loads dropped DLL 12 IoCs

pid	Process
5448	javaw.exe
5448	javaw.exe
5448	javaw.exe
5448	javaw.exe
5448	javaw.exe
5448	javaw.exe
5448	javaw.exe
5448	javaw.exe
5448	javaw.exe
5448	javaw.exe
5448	javaw.exe
5448	javaw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "wscript.exe //B C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\wus_watcher.vbs"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
17	raw.githubusercontent.com
21	discord.com
1	raw.githubusercontent.com
1	discord.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	javaw.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
5904	wscript.exe
5144	wscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
968	cmd.exe
5864	cmd.exe
2940	cmd.exe
3172	cmd.exe
3528	cmd.exe
5256	cmd.exe
5328	cmd.exe
5188	cmd.exe
4184	cmd.exe
1328	cmd.exe
6036	cmd.exe
3080	cmd.exe
2784	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javaw.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2096	wmic.exe

Kills process with taskkill 13 IoCs

defense_evasion

pid	Process
4384	taskkill.exe
3852	taskkill.exe
5556	taskkill.exe
4476	taskkill.exe
2588	taskkill.exe
5056	taskkill.exe
4620	taskkill.exe
2004	taskkill.exe
3152	taskkill.exe
1536	taskkill.exe
1044	taskkill.exe
1980	taskkill.exe
1360	taskkill.exe

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
1584	reg.exe
3920	reg.exe
5860	reg.exe
3600	reg.exe
4188	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4180	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5448	javaw.exe
5448	javaw.exe
5448	javaw.exe
5448	javaw.exe
2096	wmic.exe
2096	wmic.exe
2096	wmic.exe
2096	wmic.exe
3384	wmic.exe
3384	wmic.exe
3384	wmic.exe
3384	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3152	taskkill.exe
Token: SeDebugPrivilege	3852	taskkill.exe
Token: SeDebugPrivilege	1536	taskkill.exe
Token: SeDebugPrivilege	5556	taskkill.exe
Token: SeDebugPrivilege	4476	taskkill.exe
Token: SeDebugPrivilege	1044	taskkill.exe
Token: SeDebugPrivilege	1980	taskkill.exe
Token: SeDebugPrivilege	2588	taskkill.exe
Token: SeDebugPrivilege	1360	taskkill.exe
Token: SeDebugPrivilege	5056	taskkill.exe
Token: SeDebugPrivilege	4620	taskkill.exe
Token: SeDebugPrivilege	4384	taskkill.exe
Token: SeDebugPrivilege	2004	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2096	wmic.exe
Token: SeSecurityPrivilege	2096	wmic.exe
Token: SeTakeOwnershipPrivilege	2096	wmic.exe
Token: SeLoadDriverPrivilege	2096	wmic.exe
Token: SeSystemProfilePrivilege	2096	wmic.exe
Token: SeSystemtimePrivilege	2096	wmic.exe
Token: SeProfSingleProcessPrivilege	2096	wmic.exe
Token: SeIncBasePriorityPrivilege	2096	wmic.exe
Token: SeCreatePagefilePrivilege	2096	wmic.exe
Token: SeBackupPrivilege	2096	wmic.exe
Token: SeRestorePrivilege	2096	wmic.exe
Token: SeShutdownPrivilege	2096	wmic.exe
Token: SeDebugPrivilege	2096	wmic.exe
Token: SeSystemEnvironmentPrivilege	2096	wmic.exe
Token: SeRemoteShutdownPrivilege	2096	wmic.exe
Token: SeUndockPrivilege	2096	wmic.exe
Token: SeManageVolumePrivilege	2096	wmic.exe
Token: 33	2096	wmic.exe
Token: 34	2096	wmic.exe
Token: 35	2096	wmic.exe
Token: 36	2096	wmic.exe
Token: SeIncreaseQuotaPrivilege	2096	wmic.exe
Token: SeSecurityPrivilege	2096	wmic.exe
Token: SeTakeOwnershipPrivilege	2096	wmic.exe
Token: SeLoadDriverPrivilege	2096	wmic.exe
Token: SeSystemProfilePrivilege	2096	wmic.exe
Token: SeSystemtimePrivilege	2096	wmic.exe
Token: SeProfSingleProcessPrivilege	2096	wmic.exe
Token: SeIncBasePriorityPrivilege	2096	wmic.exe
Token: SeCreatePagefilePrivilege	2096	wmic.exe
Token: SeBackupPrivilege	2096	wmic.exe
Token: SeRestorePrivilege	2096	wmic.exe
Token: SeShutdownPrivilege	2096	wmic.exe
Token: SeDebugPrivilege	2096	wmic.exe
Token: SeSystemEnvironmentPrivilege	2096	wmic.exe
Token: SeRemoteShutdownPrivilege	2096	wmic.exe
Token: SeUndockPrivilege	2096	wmic.exe
Token: SeManageVolumePrivilege	2096	wmic.exe
Token: 33	2096	wmic.exe
Token: 34	2096	wmic.exe
Token: 35	2096	wmic.exe
Token: 36	2096	wmic.exe
Token: SeIncreaseQuotaPrivilege	3384	wmic.exe
Token: SeSecurityPrivilege	3384	wmic.exe
Token: SeTakeOwnershipPrivilege	3384	wmic.exe
Token: SeLoadDriverPrivilege	3384	wmic.exe
Token: SeSystemProfilePrivilege	3384	wmic.exe
Token: SeSystemtimePrivilege	3384	wmic.exe
Token: SeProfSingleProcessPrivilege	3384	wmic.exe
Token: SeIncBasePriorityPrivilege	3384	wmic.exe
Token: SeCreatePagefilePrivilege	3384	wmic.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 5448	4608	2026-08-13_2bdd3696ca3537212fff361ea8bfa0af_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	89
PID 5448 wrote to memory of 5904	5448	javaw.exe	91
PID 5448 wrote to memory of 5144	5448	javaw.exe	92
PID 5448 wrote to memory of 1584	5448	javaw.exe	93
PID 5448 wrote to memory of 4180	5448	javaw.exe	95
PID 5448 wrote to memory of 4692	5448	javaw.exe	100
PID 4692 wrote to memory of 4260	4692	runtime_helper.exe	102
PID 4692 wrote to memory of 4260	4692	runtime_helper.exe	102
PID 5448 wrote to memory of 1884	5448	javaw.exe	105
PID 1884 wrote to memory of 4264	1884	runtime_helper.exe	107
PID 1884 wrote to memory of 4264	1884	runtime_helper.exe	107
PID 5448 wrote to memory of 2608	5448	javaw.exe	108
PID 2608 wrote to memory of 1048	2608	runtime_helper.exe	110
PID 2608 wrote to memory of 1048	2608	runtime_helper.exe	110
PID 2608 wrote to memory of 6000	2608	runtime_helper.exe	113
PID 2608 wrote to memory of 6000	2608	runtime_helper.exe	113
PID 5448 wrote to memory of 5340	5448	javaw.exe	114
PID 5340 wrote to memory of 5108	5340	runtime_helper.exe	116
PID 5340 wrote to memory of 5108	5340	runtime_helper.exe	116
PID 5448 wrote to memory of 5932	5448	javaw.exe	119
PID 5932 wrote to memory of 2504	5932	runtime_helper.exe	121
PID 5932 wrote to memory of 2504	5932	runtime_helper.exe	121
PID 5448 wrote to memory of 4528	5448	javaw.exe	122
PID 5448 wrote to memory of 5900	5448	javaw.exe	124
PID 5448 wrote to memory of 3532	5448	javaw.exe	126
PID 5448 wrote to memory of 5800	5448	javaw.exe	128
PID 5448 wrote to memory of 5328	5448	javaw.exe	130
PID 5328 wrote to memory of 3152	5328	cmd.exe	132
PID 5448 wrote to memory of 5188	5448	javaw.exe	134
PID 5188 wrote to memory of 3852	5188	cmd.exe	136
PID 5448 wrote to memory of 2784	5448	javaw.exe	137
PID 2784 wrote to memory of 1536	2784	cmd.exe	139
PID 5448 wrote to memory of 4184	5448	javaw.exe	140
PID 4184 wrote to memory of 5556	4184	cmd.exe	142
PID 5448 wrote to memory of 968	5448	javaw.exe	143
PID 968 wrote to memory of 4476	968	cmd.exe	145
PID 5448 wrote to memory of 5864	5448	javaw.exe	146
PID 5864 wrote to memory of 1044	5864	cmd.exe	148
PID 5448 wrote to memory of 1328	5448	javaw.exe	149
PID 1328 wrote to memory of 1980	1328	cmd.exe	151
PID 5448 wrote to memory of 2940	5448	javaw.exe	152
PID 2940 wrote to memory of 2588	2940	cmd.exe	154
PID 5448 wrote to memory of 6036	5448	javaw.exe	155
PID 6036 wrote to memory of 1360	6036	cmd.exe	157
PID 5448 wrote to memory of 3172	5448	javaw.exe	158
PID 3172 wrote to memory of 5056	3172	cmd.exe	160
PID 5448 wrote to memory of 3528	5448	javaw.exe	161
PID 3528 wrote to memory of 4620	3528	cmd.exe	163
PID 5448 wrote to memory of 3080	5448	javaw.exe	164
PID 3080 wrote to memory of 4384	3080	cmd.exe	166
PID 5448 wrote to memory of 5256	5448	javaw.exe	167
PID 5256 wrote to memory of 2004	5256	cmd.exe	169
PID 5448 wrote to memory of 2096	5448	javaw.exe	170
PID 5448 wrote to memory of 3384	5448	javaw.exe	172
PID 5448 wrote to memory of 3920	5448	javaw.exe	174
PID 5448 wrote to memory of 5860	5448	javaw.exe	176
PID 5448 wrote to memory of 3600	5448	javaw.exe	178
PID 5448 wrote to memory of 4188	5448	javaw.exe	180

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-13_2bdd3696ca3537212fff361ea8bfa0af_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_2bdd3696ca3537212fff361ea8bfa0af_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\bin\javaw.exe
  C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\modules.jar;C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\* e C:\Users\Admin\AppData\Local\Temp\2026-08-13_2bdd3696ca3537212fff361ea8bfa0af_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe --force
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe //B C:\Users\Admin\AppData\Local\Temp\wus_1786661855964.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5904
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe //B C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wus_watcher.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5144
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d "wscript.exe //B "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wus_watcher.vbs"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:1584
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn WindowsUpdateService /tr "wscript.exe //B "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wus_watcher.vbs"" /sc onlogon /delay 0001:00 /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4180
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe chrome -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_0dc8de9f -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4260
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe edge -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_878bea5f -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4264
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe all -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_d7dc6070 -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6000
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe chrome -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_9210d715 -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5108
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe edge -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_66e67e24 -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2504
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe brave -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_7c7b3cf2 -k
    3⤵
    - Executes dropped EXE
    PID:4528
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe avast -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_a0140aa0 -k
    3⤵
    - Executes dropped EXE
    PID:5900
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe opera -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_73b71bbe -k
    3⤵
    - Executes dropped EXE
    PID:3532
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe vivaldi -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_578e7dd2 -k
    3⤵
    - Executes dropped EXE
    PID:5800
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im brave.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5328
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im brave.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3152
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im waterfox.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5188
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im waterfox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3852
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im msedge.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1536
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im yandexbrowser.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im yandexbrowser.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5556
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im firefox.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4476
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im librewolf.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im librewolf.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1044
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im chrome.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1980
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im opera.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im opera.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2588
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im vivaldi.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6036
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vivaldi.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1360
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im opera_gx.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im opera_gx.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5056
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im waterfox.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im waterfox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4620
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im firefox.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im librewolf.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5256
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im librewolf.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2004
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Roblox /s
    3⤵
    - Modifies registry key
    PID:3920
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Roblox\RobloxStudio /s
    3⤵
    - Modifies registry key
    PID:5860
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Roblox\RobloxPlayer /s
    3⤵
    - Modifies registry key
    PID:3600
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Valve\Steam /v SteamPath
    3⤵
    - Modifies registry key
    PID:4188

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\bin\VCRUNTIME140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\bin\java.dll
Size 119KB
SHA256 bd32ce0677b5dc044305db88153414ed2e2529e7d07b29c70599d569f6eab503
MD5 fc68db8ab902b37fe547926f27c9ca90
SHA1 8a8098727d05f023fd1fbca4c95395e976831e93
SHA512 1b0d2ad2e4eb6068c0cd3a88b8c31494a82304764df2f66f6edeb93fc5c97ee5a9799ffea990acf4e85e6f77c74533e6e09ba7612c6b70546e17c0419f04e0f3
SSDEEP 3072:J3wQqkpOFiVohaEOvYej06M4yNGBv3UfrRaXj+v:RIkpOFiVoKgeyaO
TLSH
T146C35B1BB3558096F47EB1BC806A864BD37274B11141E30E43A9CA6EDF8FB713D1AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\bin\javaw.exe
Size 49KB
SHA256 0773cc34c8468eae9caf31fc2c36548a2b5d92762cd912a43354f2bee9dcab87
MD5 3b172ab79593cc71041eb59b4145d8b8
SHA1 a3f38ff05e00d7c389cf876470d351ccffc82a2f
SHA512 e553a4d00af4aae846658b7c09ce52b81f80202c0298a6549bd7d0edc4de9203ada2105aa6805cf312b887193dda6c135a116f4aa12009b6f25b9c9ecc5d3609
SSDEEP 768:kgKzK2RM5R2TyJ5R3s8D/bkt5Ruz3Vb3PM5NYiDLk5kIvK:RKzxM5RdJ5R3sozkt5RA3PM5N7VIvK
TLSH
T1BD336C47AE082C81F42F84F158A7352655B4BD032BD1B3EBBDC6B21E0971391A9176DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\bin\jimage.dll
Size 33KB
SHA256 3720bd728631cca1fbfdb328adc6d9aca225c766118952c59e0721b429597741
MD5 261b0d6868f1bcdfa3167b4d255c4269
SHA1 43b850bab525eb9f81dac3ea4a16fe7becd3a604
SHA512 2672a1274280bf266321146d99e4d5019550af75b3b0b6d89336616f5f7f1a535363d59406a1c766362b84b94fba8cfa6270bdac3c04531ec98bb1fd94e1f724
SSDEEP 384:w55kBR2x3tCn9LD+YuNIpfByvh7GB4AzNyEIYi2mL4/y8RFvIIvZuI4f:wFHCnFDCIpfIvh76QYiDLk5kIv
TLSH
T19CF27C5AE6841C98DD6BE538C4AB9A1BE6F5F9524F50C3CB2720825E0F333813F69356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\bin\jli.dll
Size 87KB
SHA256 4ac0488a5604ad6d509cbfa88eeabbd6ed59d8c3f246b7eecafb0280c6d84171
MD5 eca58518fdab13af01d807d36ca694cc
SHA1 ffdaaec8756ec6f0a2a26cbeb56243c1b70ff15b
SHA512 323f87aee6450440fb0e220d290111651a349150a34ec89cf1c558d822667562a09d43408d069b1613c176acd190ff69cd3045a581cb5ee955ab016e9f5fff1f
SSDEEP 1536:oGt/i+vN6d/wYAkzx0kbtVH7CIOPQm+tGItYgh7VIvy9q:7tdvNHYAaTb7cPQm+gIFh+vy
TLSH
T1F9938D5653E021A1DEB7C579D9B4960BC3F2F0522B21938F136885EA0F637623E1CBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\bin\msvcp140.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\bin\net.dll
Size 58KB
SHA256 7be667a7a539a410a0fe28808068f57a01a011f6a6899c930823a8d7229a7815
MD5 e7af88f39ac1df202e0821d224411513
SHA1 6c1189128b5f95f86dd709a421a21c0b2720bb7b
SHA512 11ef20943e981cc333cda992a8c63b96844ee8d6a74b2b52f11e068b5b250b73bbde8d9d044bf30211685db010bc6f9f40a8214ef4233f677cf04c2d736dc256
SSDEEP 1536:0rBn2zLBxyvTtPnhv5awOYwT2eBIUmXgXW7VIv1:wnUevxl5arpfBIUmwXW+v
TLSH
T1F5436D0597D454C4F86BCA7886A75E16DBB2B470225083DF1379C56EAFE73B23B29380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\bin\nio.dll
Size 78KB
SHA256 258ff5c878daf328ad6dca0df2101ac432b4461cb7669077659a1431bd8e6224
MD5 2c6b9ea27a250378dbd8519e57e46bf1
SHA1 5ed71b807359a9278bdaf815c709ad5170156e0f
SHA512 58366a99cfcffb9e0a6c863d01d036d50c454315048208e7f5f849f4afd641745b7ffb6eb8e36e700caecfe8630e303265d7bc3533d600bab3874c8eb002ac01
SSDEEP 1536:luKDrKVqEiWtCnNXHlJ4Ozuwc7tGaRHpiys6gu7VIv:luKDuVqaMN3lJhXw/RHpi1Ju+v
TLSH
T1337339A243A4849BE86A7538825A4747E733FC114510A35F5368CB699F5F2B33E3E783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\bin\server\jvm.dll
Size 13.3MB
SHA256 9dac8ae1dfe88cb107e27ee952071682f48ab67266920cbecf03b15bb02ce181
MD5 e0d77cbc30bf03af6e78b43b0cb0c92e
SHA1 f7b06565bb09ad7152f89c63923131616e97e798
SHA512 c0de5c4831e0a66dc013b3963f1c850ddb028a06046aa7fad40bb02abc6dc641cfca1a809840b9194e6895df88ab6b01c22506c06dce4338dc1e9bf38087f3d4
SSDEEP 393216:YhQGDgO065OTXJ5ILPPrDOJ7TOD9Ey/cocqpfm7ApiCjoBYGsiFVUo83X+mq0sEB:nG
TLSH
T1D5E67C17A77840D1D06BD078CAAB9E0BD7F2B894433197CB61A056AD6F63FE2153E360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\bin\vcruntime140_1.dll
Size 48KB
SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
MD5 2bd576cbc5cb712935eb1b10e4d312f5
SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
TLSH
T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\bin\zip.dll
Size 85KB
SHA256 a7730f7aedad64aa48dc9d1b886ff96f22ed7f43497a8b8f4683cd55f9c36fb3
MD5 e93279f45b6f0ea348ce4cde6dd5342a
SHA1 cbb170ad50fd0bb06f8fa409a419955287e46330
SHA512 14f9cbca3fd65038fef4350d0089f777cf3537c3817c56ac20472b7f480a0f8bb0476a76abc50c7c992082e2adad639b8973639efb6e42b1062973c3cecab81b
SSDEEP 1536:5gXMxC9p/oorxZtRi58KSUXbIOxgWjBy7VIv:5gXMxC9p/Nr48IxgCBy+v
TLSH
T11483AD959AA05051DAFB95B0C9F34B6ED3B9B04653A147CF6358836A2F532213F0C3FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\conf\security\java.security
Size 70KB
SHA256 de75a6bb6a9cd330717507cd16b3179d0caac696e98063c0bc98c99070099b96
MD5 da5713e00093248c4165339461098c7c
SHA1 33a647adfe0d921408c34c7d72827cd6b6bd2739
SHA512 b9c1b642449fde63da3685a51412ae09b818e4e0ee64718781e124469f7a62d8e52b397a00e57908d9d14c5fbc50823228e15e92ab3dd7e4ddf7bcac1d55579f
SSDEEP 1536:r+My8Si8MRjJPFp5/jTNHu1UoQ2k/gl0ugzYilNndOc90:v8MfPFD/jTNO1UoQDciDndOcC
TLSH
T1E363D422BB896B7206F211A363AEF1D9F76DA12A36325154748D420C7326F71C3736E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

modules

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\lib\modules
Size 22.1MB
SHA256 21041258ad52c04b4ed840307943232a88cb8fa432f9cd2ebd5bd50ba590c780
MD5 4e233b026febe36ab94f2c336b81e326
SHA1 e274a4058109783a1e43cb3ce2c6f061a7021f49
SHA512 a4d4d0ced265e67252f22d0a2ddfaa7f50ac3be515da83b0ae3d255dcb23d771e8bf40fa942cb29b9a8532ecf0f8916d4631bdc27f9314dad30633aae13356e9
SSDEEP 196608:YdxpQQRR/DqXYXE/b5h1ZPGTRJ4c2uzVvZeM:Y97XgZuNJ4cD
TLSH
T12B379E0BEBC2DF5EC6424B7A94F70B1177B0E0954B13A39BA15C7236AEC31A90F59394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocked.certs

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\lib\security\blocked.certs
Size 2KB
SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
MD5 8273f70416f494f7fa5b6c70a101e00e
SHA1 aeaebb14fbf146fbb0aaf347446c08766c86ca7f
SHA512 e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
TLSH
T1CC512CCAD15E02DA9D407BE208EC82A7779381B2AB2C442A2BF60F420577C5DD73B8C5
MD5 SHA1 SHA512 TLSH

Submit Download

cacerts

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\lib\security\cacerts
Size 183KB
SHA256 c3ca801bfc5d9f9e50c69f55537e78dc83e4e50c1ddea30db81e4b672b5a8aee
MD5 faf363df278f33274379e7b3741ea02c
SHA1 c3c9de883fdcd6f94b6617dbbf72db916cd69fb4
SHA512 cc91b77fb5cfd6f2f4cd16cc4f70ed34ee2f052c8d82a20e428cad04e8278f95a67b131f568ebc4e7eda035a9ca7a5e2ede2fbb3f8b2d2f9d6e2928dd4287def
SSDEEP 3072:XCW6ba9dYD+4alMwjhShvDPKwiNgsQyAQpNYFVQ/JKtwnGlmpIaG9lmXPBTiMLW1:yW6GcD+Ty3i5Lgsz5TqQr7VsJ25pG
TLSH
T16504394B9FBD2409BFF29F04A598DA236D76BBE22D59D42B101180DD1961F90BC9833F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\lib\tzdb.dat
Size 100KB
SHA256 36cf71e63ce2816fe4456e9195e6c27fa7c9cd431c89ba762eba394ec2c7a1e3
MD5 df8a313edca47a1b2537b7ec047ce4de
SHA1 449cd5af08a45e2b017e670b3df9c8bf06de0c7e
SHA512 7c4c67d5793bdbf3f9b7dec1360b9278ad7206e66f6917568e2fc04e0fbc019b504edc35870eae143f9f313d5b7eca81404d5c4783c7fc61e0f8a1ec1d18e36e
SSDEEP 1536:N0ExeF88hPdr92L674jAGubVj0Lg/////UzJbPdJPNL0mIT/M4Z3jyxU:NPeq8hPdrcWzbVj0hJzdxuT/5ToU
TLSH
T149A3C4B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\jre\release
Size 110B
SHA256 0727484b6c682a5cad1baf656e36582c89565ec15b82aa115cdf1b4ca01eb141
MD5 52d83408bb11d932a2a65ec073028490
SHA1 b38a6520806fb92318767d3335d9a7da1ab12188
SHA512 c2310826e6345bca3e78a5ce17614061123b3f392cea49bdb333b8433e6d064105abb5c34ba7e08381337163e3d8435c91a69b7353f7c733c906568ed145e7e2
TLSH
T166B0126F145AE0C4896151C53479948BF4D94C70C724B054BB47780296A25A8057653C
MD5 SHA1 SHA512 TLSH

Submit Download

imgui-java-binding-1.86.12.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\imgui-java-binding-1.86.12.jar
Size 145KB
SHA256 be59b856753f40159cf2847e40eeb833e7b512ef2520218af47244029f930fed
MD5 a07b7ee3a39e016a89636657a3cbde95
SHA1 a13fa049c952f68753b7f7a3a38facea59f390be
SHA512 78f84a1d7bd84d3fefff484cefa5eca8f1ccdc7afae6f32af38b2fbaddc729681428207314a4b97770c60483e244632b6a40ea370c848293b3e62c4ee3e7ada7
SSDEEP 3072:yLbwoP1tYn/kv2SGsKV13RRRXi154jkCqVeQ9jCX7:ynJtan/kxG/VNJX6rCq7RCL
TLSH
T180E3BE61A1F932A6D9F74376C45183D3BA3E01CCA64BB1F634E4DF9B6432509CB1632A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imgui-java-lwjgl3-1.86.12.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\imgui-java-lwjgl3-1.86.12.jar
Size 33KB
SHA256 ada91c37cd42b261e1f92b305f57f5b5da1d9ba1f569422644cd44b035171721
MD5 278d84d76d0091bee5c867f55d8f92d7
SHA1 fc17cc082d58b7c0c858afe509f6b955df8b01f9
SHA512 6ed09fe820301816b7283f6f46c5d7e4f5ac80dc33ab9058918efeeea4ddccbf8d5dfe7fa15398f503bd45136bb29a672cfeba5389e98754ab86ea714b907133
SSDEEP 768:R9HEx6Wp9MoP8J/Clhnifn8lgAD68OxIw81+TiYaf8r:R6x66h8MPOng68OxIw4+TirEr
TLSH
T199E2AEA439A97161F0721334855B33562275886CE205B7F134D1ABEBEF2F829FB45437
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imgui-java-natives-windows-1.86.12.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\imgui-java-natives-windows-1.86.12.jar
Size 6.0MB
SHA256 789ed35d2faf6a126c38a231c65b9428ec49fc7a4b9898bff47763e1056bf75a
MD5 c2487ebfca1885b5fb9db077451b5445
SHA1 d991575ce1cf3f3f82ed37fcd6248a1e1ebd12d8
SHA512 46175bc1ea51198c19c273bbe1190fd2333f2d32ee435c4783b76391ae2e516e4cca484de9172b1d1807fac4788cae15b3eacf3cb90801d5286a35d32acff974
SSDEEP 49152:LHVnrsMIR3Hisr3Me5a6Y0fG2eCuv6IZmu2XUC09qLdTS9Mq4p77lXzYj2wVJMMP:LHVU3e65QvWCO1sC3qLaEXB
TLSH
T1A4564B66E193909CC1ABF0306663B673F6317448012869FB57E4CE306E7BF205A9FB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna-5.14.0.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\jna-5.14.0.jar
Size 1.1MB
SHA256 219ebc9f87a5d3a1ebb002609eb1ad4d661a1cfc7a0a19eb35f529543af58d37
MD5 916c61e26d02519ed0f1b6adfa20adae
SHA1 d7deaa2653fdee5b56e95c8c9a14dfd99026a192
SHA512 e10ad77006dffe5c0ca53680abf9000960e52724a281e3b808eaaf728293e83374f55d5faf4513dedefdf709a139161d4329e685f07890d6c9d405dabd396b2d
SSDEEP 12288:TJgQuD8XzuaHZRevasvyx4avgBtbNNR+yjzss1+11Xlc4O+MbMOEe3m0:inaKEgBtF+1s1+O4Npim0
TLSH
T180356C07F216D953F9E2D2BD06A20351A23974304321EAEB5B854C1B8FE37E19B35BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna-platform-5.14.0.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\jna-platform-5.14.0.jar
Size 2.2MB
SHA256 431bf8640907fabb42738edaf40312277b87581fe24c68aee1e8297ea7b60ae0
MD5 84085581631a861939d3d71f28e0ae74
SHA1 d37889815f93e2849569d3c506b7b6a2efb8c701
SHA512 f324e1420b06afafe6ae0d8eed767b97892786d07b64a302a5188984afb7a0c953bddb9a8cfd973ab03b5a1f88a11eeb1641186058b1c1e62723a71b0226a8b8
SSDEEP 24576:/+4LBRwItYRmG5PgXk2DtK2BB8d0N0GD/x:W4LrtYRmG5MtK2BB8du0GDZ
TLSH
T189B56413EA53CD62DFB84AF7A2D303451637BA602D0B86BD47D4AD91CF9114B5BA0BB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

json-20231013.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\json-20231013.jar
Size 72KB
SHA256 0f18192df289114e17aa1a0d0a7f8372cc9f5c7e4f7e39adcf8906fe714fa7d3
MD5 1a0702c57783ce9e948252c34644f328
SHA1 e22e0c040fe16f04ffdb85d851d77b07fc05ea52
SHA512 a5cdd1ed984448d6538746429f2d1a0ec8f64f93af0e84870ce898a9f07a81d11bf27d2ee081471975772efc8a0d3d5e05541197a532066e9edb09ad032d31a3
SSDEEP 1536:I8H/7uh2MbfZ7bPKkktY1yLvZoW/4LbxzSPWFopXIJeD59Hlz+v:IAusOlutIkZoW/4LFSPWCIJeD59Fz+v
TLSH
T15573F119B691A866F10FB2395CC2C40DF69948E8009519CB94986EC9FC66EC70F07BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl-3.3.3-natives-windows.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\lwjgl-3.3.3-natives-windows.jar
Size 161KB
SHA256 5ee63a19187efe5bb8747fd24f7b13257db348df5ad641113a3695e43f213959
MD5 57b9ecc451e79997e3d5432f5dffe571
SHA1 a5ed18a2b82fc91b81f40d717cb1f64c9dcb0540
SHA512 490ee96c4cd40a6ba7354d15f6c4bb966523dd8804a029376c7f6b462e34d9dd7e96e6d9f3b19a2abf80d7326955120818e664b07989c844bb7eaba286bdf6f3
SSDEEP 3072:mai1TYe2rHl6w265HUPyPMMXa4K/Q6jSG2xZGmcofCJphGxhdI5y/xOgNWos6TY:RiGJHl6w26VsSjBKY/GhpS55/vs6k
TLSH
T1AEF3130046B186C3E1680177D75A21967AFA69C00F5BE3606773331DED39AF7F9B805A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl-3.3.3.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\lwjgl-3.3.3.jar
Size 1.9MB
SHA256 3f02b87c845178f5be9463a506123f730cdd65b908634c3baa29b6303fb22b9e
MD5 eaa0a29e5661e46c48fc5edc2a87527b
SHA1 fdf63d310420fc376ddcbae5636bcc523f5eb442
SHA512 e3da55bdc52543fb6431e25eea6acd5b409cf45f7490dcea2ccce4dc49332fa146e4b52db253ed47179cca590584c37936c3ee51427336f015cebde104a6dd19
SSDEEP 49152:U4euBIEnIQxGzff1oh3Hu3uLZirYyag6lir9DrEVRN8ZgGZiCeWOfQsJtpQWp:cop
TLSH
T15B9595116F628E8BE158BB3D04D2134663346BE16F478B865ED0B07DDCD21B65FA2BB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl-glfw-3.3.3-natives-windows.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\lwjgl-glfw-3.3.3-natives-windows.jar
Size 162KB
SHA256 98155b451dfc6f585089dec77a12f9c05789c4dceb8da472f9d308160101a70d
MD5 135887d54b4ce08d087f3644ca75469e
SHA1 e449e28b4891fc423c54c85fbc5bb0b9efece67a
SHA512 acf919d9d01d90f4d49dce09c9990e1676c981b7bcd60a49a712bad2acc7cf8b99fb2a25d252d2ca60f73190e23bbc01d4e35ccab3a434d30731285e05feb00a
SSDEEP 3072:YuRNTpkIDe7VJWPpXiNiYrV6IWcED0Sa3oB28V8rPqmCcBDNx4V4VUOvCQainG:YuD9HP1fYrV1oD013oB2Ccnc4eOvCTiG
TLSH
T1D0F312743D6C197CDABB8E353656FA07E43A9BD83D6ABB821D41500470198D9F4CE2CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl-glfw-3.3.3.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\lwjgl-glfw-3.3.3.jar
Size 132KB
SHA256 bedc757fd2b1b255146db26b74b9cbd1fcf5644b89b47b104fa721c741604259
MD5 41c1287c1219fd0b67e8d51879f4c812
SHA1 efa1eb78c5ccd840e9f329717109b5e892d72f8e
SHA512 a64a9fee5b3c58e0a90826eaf0edea55694674e5589813f1d50f55a80356f658a786194aba52609aee7bd83b00356de336fba2f99ff2d4644c0df39179b53cb0
SSDEEP 3072:IGm4DZbkWyXYmHL3sJDqHOXt8sZE30AJZbu87:N7dXyBH7iZqsy0o7
TLSH
T173D39E717D72E9AAF436033A427B5BD3747D5788AA9AAF801C5D53C2F82283167433E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl-opengl-3.3.3-natives-windows.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\lwjgl-opengl-3.3.3-natives-windows.jar
Size 99KB
SHA256 f45e5f60596b03b2e3d8b98a123c855ebd0b5154c8155dc2a56b890ccc907477
MD5 6577f923b0cf80ee8edbd644fd242cfd
SHA1 e6c1eec8be8a71951b830a4d69efc01c6531900c
SHA512 5056f75d3933729f9c18661c373d705ea6d6751dd729e374cf4e3f47f94c6fc19a876108f6e1132a29cf509cb2f18526cc030e3c49a57d72795850a484df3234
SSDEEP 1536:0SE2N7JIHaEU4xAuo35FN2sVT5qxezK+BWcu0dEPaB3KlciLDyMrPXbZVSU8NuH3:e2XIPxADcoE0dElnLDyMPfSU8Nut9DHL
TLSH
T1CFA3023796DA9DC8EA3C06F15795F01A006731B9288AF747524C3956383BCB635397E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl-opengl-3.3.3.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\lwjgl-opengl-3.3.3.jar
Size 2.5MB
SHA256 d23384756655dc9b4985aee8e419b0109ae964a0f97f78db06c8ddae547afb97
MD5 821e1dde353193aea42f190744af16b8
SHA1 f9c2a0d0c631fb464d456ea8cf2bab1047e260e1
SHA512 528fa04cf1a8f4e3b35dda3e8b0438bb89120ca05c2208b3229f17f3f3597bb8a7624a7384ccb7a93d5cca63661ab838d206e9b12e025b9e31d2cc06e606ac9f
SSDEEP 24576:qmuHKDuou04LGQAoUgm6mWUona0ecvBIwG:S04LGQAoUgmpWLa05vewG
TLSH
T11DC5D302F8974F0BD4066F3985EB4B6A233416D06F578B074E986019EDD31B0AFA7BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

okhttp-3.12.0.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\okhttp-3.12.0.jar
Size 412KB
SHA256 71787f2c599e0441c7a4413983bfdd93d40b56e1badc5e0413d6a4c485ba3f35
MD5 2a0ca42298238d76d9b7f4dcf750c01a
SHA1 b36f4a04584c0fb0d9af2d3401cdff8dacb1ea54
SHA512 11da48455283684b8ffe8353403c9e57e81a35868a3a15a5eee98ea7b10a8438f2992583bdcff519116cc27d07ce6b61cc28212841541d708c646f912f8871ce
SSDEEP 12288:ZQ0ljorlPXN0wv/KFW4XTzRFh0UvTguPNTd0w7:6yccsGW4XTz9088UNOw7
TLSH
T11394F1FBBA409627ED53E032E1B2F956F42C12D98023E49225F0C69B58F38549759BCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

okio-1.17.6.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\okio-1.17.6.jar
Size 90KB
SHA256 8e88b055523cc80613dfb844d598740e10ada62f4bd98304cdd140c5854cc3b6
MD5 26495cb0317ba27245f92ce57cfa600c
SHA1 fca77ce5f3ce6fa8a65738a31e34b87ccd289f71
SHA512 47eae3855284d37cea11befd8c5a298764cd32eb297a4a1fffc73700431f40890dde1a1d5f286ce5304f41c10c7293d350fdab1ac55b855222a8a22a963fda0d
SSDEEP 1536:yT3P01oeV4oUKJDXD0mlnX6QpfzCoKMnrZHrYh9pzAPuc4uy+I5s+A5E4c1CRdd:AP01Z7DXImhHfO4nrprYhL0G/uYafWyH
TLSH
T10893F1223CCD983DD4FBE4798DFE69A7321E26DD90B932D768A13887093DC806AF1115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

slf4j-api-2.0.9.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\slf4j-api-2.0.9.jar
Size 63KB
SHA256 0818930dc8d7debb403204611691da58e49d42c50b6ffcfdce02dadb7c3c2b6c
MD5 45630e54b0f0ac2b3c80462515ad8fda
SHA1 7cf2726fdcfbc8610f9a71fb3ed639871f315340
SHA512 069e6ddce79617e37d61758120c7e68348ee62f255781948937f7bec3058e46244026d7f6a11e90fbc15cd4288c4bb1acee4f242af521c721a9e68a05e64d526
SSDEEP 1536:wE1sO9m2obNMBEplcMmVFKseV/wk3t6FTKMBCm:RV9m2Uo+zmVFKseay6A6
TLSH
T1C953BF98FEAD802DF90FB4F5406355EA7BAC51E8029A910305E95E5D9637D8A0B33FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite-jdbc-3.44.1.0.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\libs\sqlite-jdbc-3.44.1.0.jar
Size 1.4MB
SHA256 58da3c4070c59363efd86b4f10b07fdbd2bd4ba334fb563efdeec6a13b43c314
MD5 694dd6187acac8aee2eaf0945e00f268
SHA1 3f540877c7a52806502d3de09c836ca7b7f1f346
SHA512 1db20ca3b40ec6e2866643b86d2428b5160e7185dd711ab444f6b37f9e3fdc29a96982b6bd517e2bfb4714e70e9f8a00638164c24a2b2e58ef7261678a7cb06d
SSDEEP 24576:e36F9LO1ii5GOMxczl93QtR/bKNr5mQj5qjiN5HZv4:AgLOi/Gzlut1aqjiN5Hq
TLSH
T14B658D07F241056BD06AD378462B83527730F024A632E65B7F5C9B266FE2EA05B1F7C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modules.jar

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\modules.jar
Size 916KB
SHA256 f58e97b79eb1a3a7968c0b97984442f4ffd344ca50dd2e9810c744a8dd7a0780
MD5 4516838806823d9b622fcf5b3f0eedb2
SHA1 2c4254fe9b541b55a2405331bae6aa56de1ce64c
SHA512 11ef13fffe433b6664c72a9917dd17e5939095695b84bd978d36a8f1eea16f0c78afc8aae83107b3e71cb889d1f714a07d68f64a12ff5e19ff5e5502ebc584ac
SSDEEP 12288:Wni9bosk7zm9Ue/LdG8oU/evy5P36TXa4AMMxIc7tgN+MQT:c2oskG9Ud8jky53Aa/MMxItLQT
TLSH
T1DB15E82FE4887C73A268FD3E0750413C8226D8E4DEC4FC97B9DBD46BD481A595A3C689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_key_dll.dll

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\chrome_key_dll.dll
Size 153KB
SHA256 eab8d2d75e9571e1b91e1b02774c3871d3e944556fc77453c0934d1c55aa16d5
MD5 c5b6171c2d631edfdca80b88f14285d1
SHA1 4a6e944c220e2410c91115eb08685a93980d5008
SHA512 ea5bd15a2bed3b3cbbeaedc487cc4ce6c80df2e15af836646843a8aaa8678d2f921669e79b1e8beb052c35459adc909326cafc1506b92081671f9e6c95457671
SSDEEP 3072:2MzFlC5vaYZSp+Frv0k1nZxRJV9EUf4N3V5TlWVP:2MzF+vxa++k1Zb20l
TLSH
T19FE33B17AAA6507BE26B8934C9534901EB737C565BA0EADF03500EF60E27BD09F3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

runtime_data.dll.jenc

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_data.dll.jenc
Size 153KB
SHA256 b08bf1b62defeb0699f06aab0b312d60030ef8b0be2c2cf81e6346c33cf6f452
MD5 af9fb294c638388b68bd88ff4fb792f6
SHA1 35a2d5821e0504f7f9d292a159f5810d448b5f30
SHA512 07d2e29f1058362bc3b0504e95f9fdb3356c6f33f8c8f5fe55f3c3c35e58fed5847ccd155868b56cd63f5db4fa4db509910588600af247552b704a2b26c35fdb
SSDEEP 3072:OBAuMWSDNgWEY2nUwth47bRmiRDQH1VD71soHqEbWAkR867g6jyf4l67gCI++ku:OBcJQlUWiRDmf76En6AkeEgshbku
TLSH
T103E3493F5BE5E08A47811D27251194EC83DFE5EF49C6F6AEBA778A924E61812C4C43CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

runtime_helper.exe

Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\686c197948b1cfaee6c3\native\runtime_helper.exe
Size 1.4MB
SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
MD5 1d04536714bb22a3e909525a7dd627f0
SHA1 affc166fa1874ff3ec0e42646e008cec972b76ab
SHA512 ec2028983c8c5939545c572f13e1d24e730ca1601c6a8840769d1a6b28b8e12d7c9bd1850007ec0be8abc7c44e12bafcd64dc5b4c842155b75a70d8c71769166
SSDEEP 24576:+7JVbIr44BR1IVOe4waHbTkEFhA+b3XYXKXjAOY5MBmYBREkM2eU25gooYHJLUY:moj15e4w8xhACEKzs57Xci5NLd
TLSH
T14565020BA6A401F9D5F3C174CC42590ADB76F84A47A5EB4F03E449961F276B09E3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna14037803416236043727.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna14037803416236043727.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sacma_debug.log

Path C:\Users\Admin\AppData\Local\Temp\sacma_debug.log
Size 1KB
SHA256 bd2b021f61d0383916c6057f8ff13e45c2947e243930f2b8202fd1a6a431b759
MD5 b1b48ac1ecca3578a363a4aacc8304c9
SHA1 930e569088cc9e92ee9a334fb4608dcd8166af2e
SHA512 0b87b171bcb2793f7066a5bd1e8d106c05b246727d922c9fda15496d8479882bfb388f62def8dfee468537a9f66156890f40b11f4d993ddc22ce2d208b19622a
TLSH
T1BC31F51099CACF2B0841B4E71EE9C2DED1E1DE1CBACD2A26CB15848D21D3C49E6E5703
MD5 SHA1 SHA512 TLSH

Submit Download

sacma_debug.log

Path C:\Users\Admin\AppData\Local\Temp\sacma_debug.log
Size 3KB
SHA256 701aa4f0e4b44e70811b7b66b849d7ff9f6cf9cf032c2f01ad7630bfa417b02d
MD5 3061cf4111a3f4f0357f98b6838a0c66
SHA1 934578a7adc3ce772fea4d96e3111a3e733353c1
SHA512 2bdf3bcd1e30ffe747481e945f69b34008810c4656d9859415224af1af235a95b797a105f66f64d25202997576e253e45a396a69be535ada3bdee1639625d1eb
TLSH
T154716860A9CADF3B0850E5E60EA583CED5F0DE5C7ACE1A75CB2485CD25C3C0AE6A5713
MD5 SHA1 SHA512 TLSH

Submit Download

sacma_debug.log

Path C:\Users\Admin\AppData\Local\Temp\sacma_debug.log
Size 3KB
SHA256 9d770099da0e54224c693fdecfaa15eda0226f102c9cab4a2244b527dc395106
MD5 f4cb8e3b2619bfc80624561fb290b7de
SHA1 0ad817e027b6ed9fbd7af679922dd0b4c10983c4
SHA512 e6cfe758d184dfb50ce431f83e3936f09b6bfb9506d21a8ad915c1f0f5505a6f11afa2cc748c7249e345a2506517898d1d3cd71ff99c1d4c2ac51ffd1bbf6cee
TLSH
T11D816864E9CACB7B0850E5E60DA5C3CED4F0DE1C7A8E1A75CB2485CD25C3C0AE6A6753
MD5 SHA1 SHA512 TLSH

Submit Download

sacma_debug.log

Path C:\Users\Admin\AppData\Local\Temp\sacma_debug.log
Size 4KB
SHA256 9af07878b8c046f80f38acf5474d14ce6c21f52ffe63bfdba904fa690a88e109
MD5 eefe3f3dabb298e32d56b82e33c94c59
SHA1 56e37663ec345c0394a4ece42d2d56dc5e81021e
SHA512 d46a9e8559f5a2ce84b64dc9ff501f2c5d302df1993c3ba2fde45c9fb27d9000f38d66538311d20c202a47a6f3e0bf073e0f6d5d2cc632306114f50734defb59
SSDEEP 96:JspBOFZmBL4rbL/ZmBbLkZ/ML44eL/Z/0eLgLhL5y5ksX660IIUZm3L4OIUZ/4L7:JXFa4b/ukQ43/5OdA5kgJ24oc4y+/+/R
TLSH
T155A16864E9CADB3B0850E4E71DA583CEC4F0DA1C7ACE1A71CB2495DD25C3C1AE6A5713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

soul_debug.log

Path C:\Users\Admin\AppData\Local\Temp\soul_debug.log
Size 4KB
SHA256 6e38f1c5c020d3b29c7ba6df34be5f42497375db25989c60ca7c1a5f4aa7accd
MD5 801aab9d6868f7da261fc12da808d814
SHA1 4387d63df7513cb0d8031cdf2b402159cc813aa2
SHA512 bb8661dff0e299a20ca3b4ca689e4a5ca43b430d209d3b3b1b5bb6e186093f1cec7e2e74fa75ddc5f00f6c4193def1f56d810602b738563834f0dff6abf32b24
SSDEEP 96:W5Ovh+hB5Ef5o15j5k5OEmBjz0zBqtgg3S5r8I4Uzq1/F5WfI/ZmmP5NE2E2lmI/:JvI5tyMKGZKp2H/
TLSH
T1B6A1516497DA966FAC50D62B03A489E8CE4C1854A98FEC535B1C05342B47077F3FAF2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite-3.44.1.0-bfcba5ee-4ab3-47e6-a9ed-cddfb7a226e9-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.44.1.0-bfcba5ee-4ab3-47e6-a9ed-cddfb7a226e9-sqlitejdbc.dll
Size 933KB
SHA256 393e8faa8231ac4090f4feabecaf2db00c7bff4b2671c685850b36910d694967
MD5 e1d69e2d6b6b96891a16068b9e4cf439
SHA1 e32f4dc6dbe9e5cd3a33508757feec9f5d4e198a
SHA512 1bd0f6d958086b20f37431f043d35637f7a99d4bef442c0092a15799bba66fc622c9f356791fb0a8b8b15fd6d6863bbb0acf1bc70fea8e1be35e0f325e9363e1
SSDEEP 24576:oii5GOMxczl93QtR/bKNr5mQj5qjiN5HZv:H/Gzlut1aqjiN5H
TLSH
T1AD156C13E39244BDC47BC2B0872FA323B631F4497134EB5F6AA48B642E61E60971F759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wus_1786661855964.vbs

Path C:\Users\Admin\AppData\Local\Temp\wus_1786661855964.vbs
Size 1KB
SHA256 139693ba35dc0d8d1e4f9f3d9fee1e337732086beb1e1fa84a1ded6d0290d0dd
MD5 23e70cf4ab5cd04a646fb754df7ddae9
SHA1 a147256f926a9d851af61a88dd664ec89b7be65f
SHA512 fa76c77a5cc749d19e86ead178c69007dc6052611664aa36508c944a8add5b84d2f748353cd6b8c1e36cae7a176e6fb10184866a1df10c104c06096dad7cc0eb
TLSH
T1222107016BE84254F7F71BC9A9F5A1285E3AFDB6A920FA4C0018450F19B2F54EE62727
MD5 SHA1 SHA512 TLSH

Submit Download

wus_watcher.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wus_watcher.vbs
Size 1KB
SHA256 9d1173af551edd1b9a9ec7ff43ff07dea84554f0ba0545c4c7018cd2e7092386
MD5 35ceeaf7cb67604652fa0eeb935bddab
SHA1 6b8a2a2807d833f627b63e6c16690c68dd1cd1a7
SHA512 2afe564436df0590a1a0f8cf7d80690c74d0a56e5e6cb7d8b695dd4d2675a27aa2a4e441fc00ed1d4be74d895119a26b22cde29f7cbaf912b036ede6169979b2
TLSH
T1F631F20197F90104B3B36F9989B696B50F37BAF76D39D54C04941A0B0AF2F40DDA1763
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5448-361-0x00007FFEC0B90000-0x00007FFEC0C80000-memory.dmp

Download

memory/5448-241-0x00007FFEC0B90000-0x00007FFEC0C80000-memory.dmp

Download