Analysis

  • max time kernel
    153s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 00:30

General

  • Target
    Jarvis.exe
  • Size 220.5MB
  • Sample260813-atts2ayajf
  • SHA256 1ca46d339e4d8d3308ad59b82ab47f459f2c2861c77bf35b6dd1d8825d603432
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Jarvis.exe
    "C:\Users\Admin\AppData\Local\Temp\Jarvis.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1412
    • C:\Users\Admin\AppData\Local\Temp\is-YICYXV2RXV.tmp\Jarvis.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-YICYXV2RXV.tmp\Jarvis.tmp" /SL5="$4018E,229908803,852992,C:\Users\Admin\AppData\Local\Temp\Jarvis.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4400
      • C:\Program Files\Jarvis\Jarvis.exe
        "C:\Program Files\Jarvis\Jarvis.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1640
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ver"
          4⤵
          • Executes a command shell one-liner
          PID:252
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /c ping -n 3 127.0.0.1 >nul & del /f "C:\Users\Admin\AppData\Local\Temp\Jarvis.exe"
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:1300
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4140
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004F4
    1⤵
      PID:4768

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Jarvis.exe

          • Path C:\Program Files\Jarvis\Jarvis.exe
          • Size 16.7MB
          • SHA256 12953692b40dd728766b7e00ff4e85266ac000018a46936b30b5697a8ce83a8b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-F4JKMTK36A.tmp

          • Path C:\Program Files\Jarvis\_internal\PyQt6\Qt6\qml\QtQuick3D\Helpers\designer\images\is-F4JKMTK36A.tmp
          • Size 253B
          • SHA256 20367abdb3621f0bbbe473dc2c16708318303c600356dd3a53c9465c8a694e22
          • MD5 SHA1 SHA512 TLSH

          is-QULWKAMMZ5.tmp

          • Path C:\Program Files\Jarvis\_internal\PyQt6\Qt6\qml\QtQuick3D\Helpers\designer\images\is-QULWKAMMZ5.tmp
          • Size 499B
          • SHA256 ac0ced9846290510f32ffb115d29e5329442fec01b6527a863ebf541ca8c8ed5
          • MD5 SHA1 SHA512 TLSH

          is-T45D327FTR.tmp

          • Path C:\Program Files\Jarvis\_internal\PyQt6\Qt6\qml\QtQuick3D\Helpers\designer\images\is-T45D327FTR.tmp
          • Size 375B
          • SHA256 fbc370c541a931e22eeba5157b47f30fc60c7e29580b9b4904703b6e17910bf3
          • MD5 SHA1 SHA512 TLSH

          is-KWTT07V1LB.tmp

          • Path C:\Program Files\Jarvis\_internal\PyQt6\Qt6\qml\QtQuick\Controls\Imagine\is-KWTT07V1LB.tmp
          • Size 841B
          • SHA256 bfb44b28be8636cf5fedd504b41ded92dde35350a9e437f61f327e413cb18f07
          • MD5 SHA1 SHA512 TLSH

          is-YDH3OOHNYC.tmp

          • Path C:\Program Files\Jarvis\_internal\PyQt6\Qt6\qml\QtQuick\Controls\Imagine\is-YDH3OOHNYC.tmp
          • Size 851B
          • SHA256 529300dab184b8b597775933d749e973a37377c9e15fe295ea232204a0865e3b
          • MD5 SHA1 SHA512 TLSH

          is-V63QW28YG0.tmp

          • Path C:\Program Files\Jarvis\_internal\PyQt6\Qt6\qml\QtQuick\Controls\Universal\is-V63QW28YG0.tmp
          • Size 1KB
          • SHA256 981ab6db297e985d37b6d83f26801075ec35abeaff38c28adb2e7255ceae1a31
          • MD5 SHA1 SHA512 TLSH

          is-TNWYSNMTS1.tmp

          • Path C:\Program Files\Jarvis\_internal\PyQt6\Qt6\qml\QtQuick\Controls\Windows\is-TNWYSNMTS1.tmp
          • Size 215B
          • SHA256 a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a
          • MD5 SHA1 SHA512 TLSH

          is-3OQ4U0CW8G.tmp

          • Path C:\Program Files\Jarvis\_internal\PyQt6\Qt6\qml\QtQuick\Controls\designer\is-3OQ4U0CW8G.tmp
          • Size 608B
          • SHA256 142c0d41d8334db63f999a95a2dade0ec056d9d7dc293578e80cd1f9f30d8ba6
          • MD5 SHA1 SHA512 TLSH

          is-RZ426SRNGE.tmp

          • Path C:\Program Files\Jarvis\_internal\PyQt6\Qt6\qml\QtQuick\Controls\designer\is-RZ426SRNGE.tmp
          • Size 543B
          • SHA256 c31ac58e3f61750fc1eba0c1d205263dd8f9411b1e31f2f7fcf8e09504650964
          • MD5 SHA1 SHA512 TLSH

          is-9AF0T7KEY4.tmp

          • Path C:\Program Files\Jarvis\_internal\PyQt6\Qt6\translations\is-9AF0T7KEY4.tmp
          • Size 33B
          • SHA256 494ac9a2b2cb2fdeced353f4a9f898ed8dcf616e9bc667438c62681e3f7f79cf
          • MD5 SHA1 SHA512

          _bz2.pyd

          • Path C:\Program Files\Jarvis\_internal\_bz2.pyd
          • Size 82KB
          • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _ctypes.pyd

          • Path C:\Program Files\Jarvis\_internal\_ctypes.pyd
          • Size 121KB
          • SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _lzma.pyd

          • Path C:\Program Files\Jarvis\_internal\_lzma.pyd
          • Size 155KB
          • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd

          • Path C:\Program Files\Jarvis\_internal\ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd
          • Size 216KB
          • SHA256 fc17eb621ecf2325e3c2d7501d3ee2c3848e3c7fec7027fda7c7fa1782874743
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-console-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-console-l1-1-0.dll
          • Size 21KB
          • SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-datetime-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-datetime-l1-1-0.dll
          • Size 21KB
          • SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-debug-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-debug-l1-1-0.dll
          • Size 21KB
          • SHA256 591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-errorhandling-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-errorhandling-l1-1-0.dll
          • Size 21KB
          • SHA256 d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-fibers-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-fibers-l1-1-0.dll
          • Size 21KB
          • SHA256 91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-fibers-l1-1-1.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-fibers-l1-1-1.dll
          • Size 21KB
          • SHA256 fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-file-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-file-l1-1-0.dll
          • Size 25KB
          • SHA256 1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-file-l1-2-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-file-l1-2-0.dll
          • Size 21KB
          • SHA256 4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-file-l2-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-file-l2-1-0.dll
          • Size 21KB
          • SHA256 93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-handle-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-handle-l1-1-0.dll
          • Size 21KB
          • SHA256 39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-heap-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-heap-l1-1-0.dll
          • Size 21KB
          • SHA256 8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-interlocked-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-interlocked-l1-1-0.dll
          • Size 21KB
          • SHA256 53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-kernel32-legacy-l1-1-1.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-kernel32-legacy-l1-1-1.dll
          • Size 21KB
          • SHA256 a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-libraryloader-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-libraryloader-l1-1-0.dll
          • Size 21KB
          • SHA256 7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-localization-l1-2-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-localization-l1-2-0.dll
          • Size 21KB
          • SHA256 6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-memory-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-memory-l1-1-0.dll
          • Size 21KB
          • SHA256 0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-namedpipe-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-namedpipe-l1-1-0.dll
          • Size 21KB
          • SHA256 c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-processenvironment-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-processenvironment-l1-1-0.dll
          • Size 21KB
          • SHA256 c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-processthreads-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-processthreads-l1-1-0.dll
          • Size 21KB
          • SHA256 5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-processthreads-l1-1-1.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-processthreads-l1-1-1.dll
          • Size 21KB
          • SHA256 4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-profile-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-profile-l1-1-0.dll
          • Size 21KB
          • SHA256 7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-rtlsupport-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-rtlsupport-l1-1-0.dll
          • Size 21KB
          • SHA256 9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-string-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-string-l1-1-0.dll
          • Size 21KB
          • SHA256 60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-synch-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-synch-l1-1-0.dll
          • Size 21KB
          • SHA256 3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-synch-l1-2-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-synch-l1-2-0.dll
          • Size 21KB
          • SHA256 efc1e4460984a73cf47a3def033af1c8f3b1dbc1a56cd27781d3aacf3e3330cb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-sysinfo-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-sysinfo-l1-1-0.dll
          • Size 21KB
          • SHA256 b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-sysinfo-l1-2-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-sysinfo-l1-2-0.dll
          • Size 21KB
          • SHA256 2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-timezone-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-timezone-l1-1-0.dll
          • Size 21KB
          • SHA256 33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-util-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-core-util-l1-1-0.dll
          • Size 21KB
          • SHA256 6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-conio-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-conio-l1-1-0.dll
          • Size 21KB
          • SHA256 b762061b688aae679afe788904d2c9970f74a7dac98f3b42463d08f25e483d3f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-convert-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-convert-l1-1-0.dll
          • Size 25KB
          • SHA256 ebb2ae5535a64f65daeab8235585114fc9dd2cf1a49f5852d446250b998b6ae4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-environment-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-environment-l1-1-0.dll
          • Size 21KB
          • SHA256 17d63275d00bdd8670422b95bd264c532998e0a1b041079e54fce4b6b7a55819
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-filesystem-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-filesystem-l1-1-0.dll
          • Size 21KB
          • SHA256 9a9e2a65a281644e368d0f272b95ba5f6b445d1c35910d06056c5ebeb77402db
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-heap-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-heap-l1-1-0.dll
          • Size 21KB
          • SHA256 bab9ac3ec83e380ae51e4295ef3bf2c738627812d3a49d1e713661abbc8dc57a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-locale-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-locale-l1-1-0.dll
          • Size 21KB
          • SHA256 bd14c67ea28e21d6257ad780a37122c9b5773f69e693f5db6bffaee4d839526e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-math-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-math-l1-1-0.dll
          • Size 29KB
          • SHA256 606d66d82db562ea7979179d06486a0f94d079941d26b80a1e2c49d29959df6f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-multibyte-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-multibyte-l1-1-0.dll
          • Size 29KB
          • SHA256 95f49efbe8107786733fa7c474025cf3fee0ac632f240367b296c736d06572aa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-private-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-private-l1-1-0.dll
          • Size 73KB
          • SHA256 1bc82bed6143d2bf1b6b08a7809f4a5e29317d6fddd338a7da3c0223522e4bbf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-process-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-process-l1-1-0.dll
          • Size 21KB
          • SHA256 f6156b1020380ec4f0e48577ebedaaef5fb1ab1f337d8b4e72e6a33a7567a9cc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-runtime-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-runtime-l1-1-0.dll
          • Size 25KB
          • SHA256 c5902934d026d7e15fbe9917d474f3322846a41a25e66f4b2b1f758801879f4b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-stdio-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-stdio-l1-1-0.dll
          • Size 25KB
          • SHA256 a9c5a153d8c0286f9b41a2b1c65854ad9e6471b8755b7de87bae4470e60bcab6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-string-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-string-l1-1-0.dll
          • Size 25KB
          • SHA256 25b8f83a7767211b11132775a0e27a45aa4ec8ab4e6572599f9c172ae3606b40
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-time-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-time-l1-1-0.dll
          • Size 21KB
          • SHA256 7c7f6393f06de11750adb09cc5698ae55cd9fb27b2e51e207286feb1b5b2b156
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-utility-l1-1-0.dll

          • Path C:\Program Files\Jarvis\_internal\api-ms-win-crt-utility-l1-1-0.dll
          • Size 21KB
          • SHA256 d8ba5f17b9ffcbf3aeaf3fa1da226832d2fa90f81acce0cd669464e76ce434ac
          • MD5 SHA1 SHA512 SSDEEP TLSH

          base_library.zip

          • Path C:\Program Files\Jarvis\_internal\base_library.zip
          • Size 1.4MB
          • SHA256 6b74ee395d7b1b2ddb960766ea6d35f14233d5e234834b4088512b632408d9af
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-PAWOTRK0W4.tmp

          • Path C:\Program Files\Jarvis\_internal\flask-3.1.3.dist-info\is-PAWOTRK0W4.tmp
          • Size 4B
          • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
          • MD5 SHA1 SHA512

          libffi-8.dll

          • Path C:\Program Files\Jarvis\_internal\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          python3.DLL

          • Path C:\Program Files\Jarvis\_internal\python3.DLL
          • Size 65KB
          • SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          python311.dll

          • Path C:\Program Files\Jarvis\_internal\python311.dll
          • Size 5.5MB
          • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-H86438O33I.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Africa\is-H86438O33I.tmp
          • Size 190B
          • SHA256 d19aebe2435c4e84bf7ae65533d23a9d440f98162e5b4d69c73f783e02299ec8
          • MD5 SHA1 SHA512 TLSH

          is-KE41EZY4RL.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Africa\is-KE41EZY4RL.tmp
          • Size 180B
          • SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
          • MD5 SHA1 SHA512 TLSH

          is-LZ0C8VFIB5.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Africa\is-LZ0C8VFIB5.tmp
          • Size 191B
          • SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
          • MD5 SHA1 SHA512 TLSH

          is-R3I3U293XB.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Africa\is-R3I3U293XB.tmp
          • Size 130B
          • SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
          • MD5 SHA1 SHA512 TLSH

          is-WEXRLKDDNB.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Africa\is-WEXRLKDDNB.tmp
          • Size 131B
          • SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
          • MD5 SHA1 SHA512 TLSH

          is-BBNGPB8YPH.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\America\Argentina\is-BBNGPB8YPH.tmp
          • Size 708B
          • SHA256 502d1fc71ed93e68cfc370f404afb9bdaa7e735701cdb811dbddcc76611f3b1d
          • MD5 SHA1 SHA512 TLSH

          is-O0AEIATY00.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\America\Argentina\is-O0AEIATY00.tmp
          • Size 708B
          • SHA256 f488f75a34fd99630a438dcb792508a90b836fdcd2dc54a51d83d535025315fd
          • MD5 SHA1 SHA512 TLSH

          is-2Z412BS7GI.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\America\Indiana\is-2Z412BS7GI.tmp
          • Size 531B
          • SHA256 e678f42a13efbd7be0f26a9ce53e04b1c28a582eab05611cb01c16836432f07b
          • MD5 SHA1 SHA512 TLSH

          is-3R1JVKR4L3.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\America\is-3R1JVKR4L3.tmp
          • Size 1KB
          • SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
          • MD5 SHA1 SHA512 TLSH

          is-5JWSTJTXFJ.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\America\is-5JWSTJTXFJ.tmp
          • Size 1KB
          • SHA256 af9aea4aee505143fa5e847643c0ffe164190c38411010ac7f0b170f4098a6c8
          • MD5 SHA1 SHA512 TLSH

          is-EP01KDCOVC.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\America\is-EP01KDCOVC.tmp
          • Size 149B
          • SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
          • MD5 SHA1 SHA512 TLSH

          is-LYANB6UYN1.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\America\is-LYANB6UYN1.tmp
          • Size 240B
          • SHA256 ae11453c21d08984de75f2efec04dc93178a7b4e23c5e52f2098b8bd45ccb547
          • MD5 SHA1 SHA512 TLSH

          is-TIAC07B68Z.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\America\is-TIAC07B68Z.tmp
          • Size 177B
          • SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
          • MD5 SHA1 SHA512 TLSH

          is-W7F56BOJCH.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\America\is-W7F56BOJCH.tmp
          • Size 1KB
          • SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
          • MD5 SHA1 SHA512 TLSH

          is-R9DQMGKWTO.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Antarctica\is-R9DQMGKWTO.tmp
          • Size 1KB
          • SHA256 0e06e7e55aedbc92ef5b3d106e7c392ab1628cfd8a428b20e92e99028a0bfbb9
          • MD5 SHA1 SHA512 TLSH

          is-3RV7R48E9R.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Asia\is-3RV7R48E9R.tmp
          • Size 152B
          • SHA256 cdc8e2c282d8bc9a5e9c3caf2fc45ff4e9e5cd18f5dec8cb873340ad7c584d64
          • MD5 SHA1 SHA512 TLSH

          is-E36XHV5BI6.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Asia\is-E36XHV5BI6.tmp
          • Size 133B
          • SHA256 46853e94276af2eea8e86c2f152a871c092df195dc51273b8fc7091faa4b461c
          • MD5 SHA1 SHA512 TLSH

          is-JXCMXE2QHC.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Asia\is-JXCMXE2QHC.tmp
          • Size 594B
          • SHA256 fbe23c3fafdee01b5121edf009290fb701cebbf93dacfb30f8aa90287242f6f3
          • MD5 SHA1 SHA512 TLSH

          is-S9NM83GNT2.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Asia\is-S9NM83GNT2.tmp
          • Size 393B
          • SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
          • MD5 SHA1 SHA512 TLSH

          is-UGI7F3B537.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Asia\is-UGI7F3B537.tmp
          • Size 1KB
          • SHA256 9fcde8d584dea0585f5c8727aaf35f48a149e0dbd3a83bf6cef8bca9c14021e3
          • MD5 SHA1 SHA512 TLSH

          is-VOI8QM338Q.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Asia\is-VOI8QM338Q.tmp
          • Size 256B
          • SHA256 0954b2d9a301d94f4348024606a71bbcb2fa24d3cd3709f5bc8bca605039785d
          • MD5 SHA1 SHA512 TLSH

          is-3A7E5ZB0TZ.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Australia\is-3A7E5ZB0TZ.tmp
          • Size 904B
          • SHA256 820d45a868a88f81c731d5b2c758b4ed000039b6260a80433f8e0f094a604b59
          • MD5 SHA1 SHA512 TLSH

          is-LM7GBNEZAC.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Australia\is-LM7GBNEZAC.tmp
          • Size 1003B
          • SHA256 d4801581fd00037b013d71616b119fbbd510fdca5de06369b10f718a8da5e32d
          • MD5 SHA1 SHA512 TLSH

          is-R22DQYT1LN.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Brazil\is-R22DQYT1LN.tmp
          • Size 418B
          • SHA256 563b9052bebaf2986ae5b707e34afde013e7641287cc97ff31005f33a0dbf7a5
          • MD5 SHA1 SHA512 TLSH

          is-JP3C63WNBN.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Canada\is-JP3C63WNBN.tmp
          • Size 970B
          • SHA256 0eada6c5c48d59984c591ab1c30b4c71aab000818cc243b3cfe996f1f26c715f
          • MD5 SHA1 SHA512 TLSH

          is-N3MNR8NSZP.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Canada\is-N3MNR8NSZP.tmp
          • Size 1KB
          • SHA256 00dcf0606054d4f927416e0b47e1fdda2e5ce036fde4b53e51084f8566428c3a
          • MD5 SHA1 SHA512 TLSH

          is-09JJ9KG0P2.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Europe\is-09JJ9KG0P2.tmp
          • Size 1KB
          • SHA256 2a7163b16b94806f69991348e7d0a60c46eb61b1f0305f5f4b83f613db10806f
          • MD5 SHA1 SHA512 TLSH

          is-1JKCP3RLSO.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Europe\is-1JKCP3RLSO.tmp
          • Size 1KB
          • SHA256 44d2f6cf84737e6a1e0daf914109e94256beca40b40c9a11b7a04e8bddaee4ec
          • MD5 SHA1 SHA512 TLSH

          is-29Q17ZP9Q0.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Europe\is-29Q17ZP9Q0.tmp
          • Size 558B
          • SHA256 0589e80ddecebf9d3077898c12975d2be7393df2856ee9926c534763e1e26bf2
          • MD5 SHA1 SHA512 TLSH

          is-4BVMQYK7VS.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Europe\is-4BVMQYK7VS.tmp
          • Size 947B
          • SHA256 86bd26a06fe3057b36cf29dd7a338f2524aff8116ef08d005aa2114ea6122869
          • MD5 SHA1 SHA512 TLSH

          is-7Q0CSI27Y8.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Europe\is-7Q0CSI27Y8.tmp
          • Size 705B
          • SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
          • MD5 SHA1 SHA512 TLSH

          is-EAEBDU6I05.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Europe\is-EAEBDU6I05.tmp
          • Size 478B
          • SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
          • MD5 SHA1 SHA512 TLSH

          is-H2WYX9V7CM.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Europe\is-H2WYX9V7CM.tmp
          • Size 1KB
          • SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
          • MD5 SHA1 SHA512 TLSH

          is-QWEO5GC8WG.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Europe\is-QWEO5GC8WG.tmp
          • Size 1KB
          • SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
          • MD5 SHA1 SHA512 TLSH

          is-VW2JVYL9VS.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Europe\is-VW2JVYL9VS.tmp
          • Size 497B
          • SHA256 199062b1c30cfeb2375ec84c56df52be51891986a6293b7a124d3a62509f45e9
          • MD5 SHA1 SHA512 TLSH

          is-1571VFRGJ8.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Indian\is-1571VFRGJ8.tmp
          • Size 133B
          • SHA256 0d9ea5053e83188032a6fb4d301d5db688f43011e5b6b1f917a11b71a0da7b16
          • MD5 SHA1 SHA512 TLSH

          is-HBLBSAZNO0.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Indian\is-HBLBSAZNO0.tmp
          • Size 187B
          • SHA256 e89d835c811d4da44aa8b386782ce8828df085aa0ee8f25661a9881d2f00e90c
          • MD5 SHA1 SHA512 TLSH

          is-E0DF1CU3MU.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Pacific\is-E0DF1CU3MU.tmp
          • Size 134B
          • SHA256 522f0f374b61e2c6f5fa7d19f1c7acccd09e4a213462ee3b42c90d32bf2bf18c
          • MD5 SHA1 SHA512 TLSH

          is-R37KFRB4KX.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Pacific\is-R37KFRB4KX.tmp
          • Size 154B
          • SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
          • MD5 SHA1 SHA512 TLSH

          is-TFFH5RH1A4.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Pacific\is-TFFH5RH1A4.tmp
          • Size 134B
          • SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
          • MD5 SHA1 SHA512 TLSH

          is-Y0A7USG6U9.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Pacific\is-Y0A7USG6U9.tmp
          • Size 221B
          • SHA256 1daa5729aa1e0f32cd44be112d01ad4cc567a9fe76d87dcbb9182be8d2c88ff0
          • MD5 SHA1 SHA512 TLSH

          is-ZH96OSECAB.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\Pacific\is-ZH96OSECAB.tmp
          • Size 146B
          • SHA256 650d918751366590553063cd681592fdca8a09957e0ce2c18d6697ec385ef796
          • MD5 SHA1 SHA512 TLSH

          is-4822H4V0TU.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\US\is-4822H4V0TU.tmp
          • Size 969B
          • SHA256 abfb1980e20d5f84ec5fd881c7580d77a5c6c019f30a383aaa97404212b489e0
          • MD5 SHA1 SHA512 TLSH

          is-4D4XDM8CNW.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\US\is-4D4XDM8CNW.tmp
          • Size 1KB
          • SHA256 d7f2206b3a45989fc9ad63d558922532fa7352280d5f87176bf1db79cb1d1fa9
          • MD5 SHA1 SHA512 TLSH

          is-6BT45Q440A.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\US\is-6BT45Q440A.tmp
          • Size 1KB
          • SHA256 200d05754f6d83a371cf408d7085125797657b3b0bebeba1e508cffe86a3e5c8
          • MD5 SHA1 SHA512 TLSH

          is-NB6ARB99BS.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\US\is-NB6ARB99BS.tmp
          • Size 1KB
          • SHA256 c27b739ff46a7df0594e120d725b439217e11e44ea9a50cdc49130383b5482e7
          • MD5 SHA1 SHA512 TLSH

          is-PTTHXQE0CE.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\US\is-PTTHXQE0CE.tmp
          • Size 1016B
          • SHA256 2890b35dcb7c093308b552d82d8781a8ce9a4fa6f9de058283a6836ec1f9f282
          • MD5 SHA1 SHA512 TLSH

          is-5NFLFRKSXD.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\is-5NFLFRKSXD.tmp
          • Size 111B
          • SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
          • MD5 SHA1 SHA512

          is-FT6XEAXWOQ.tmp

          • Path C:\Program Files\Jarvis\_internal\tzdata\zoneinfo\is-FT6XEAXWOQ.tmp
          • Size 111B
          • SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
          • MD5 SHA1 SHA512

          is-CHENRXLQHS.tmp

          • Path C:\Program Files\Jarvis\_internal\werkzeug-3.1.8.dist-info\is-CHENRXLQHS.tmp
          • Size 82B
          • SHA256 1b68144734c4b66791f27add5d425f3620775585718a03d0f9b110ba3a4d88db
          • MD5 SHA1 SHA512 TLSH

          Jarvis.tmp

          • Path C:\Users\Admin\AppData\Local\Temp\is-YICYXV2RXV.tmp\Jarvis.tmp
          • Size 4.2MB
          • SHA256 3e4578595eec756362ae647d9255f010df168e4c9bf9688c5cb96ca9eda778a3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          memory/1412-8-0x0000000000FB0000-0x000000000108F000-memory.dmp

          memory/1412-0-0x0000000000FB0000-0x000000000108F000-memory.dmp

          memory/1412-6230-0x0000000000FB0000-0x000000000108F000-memory.dmp

          memory/1640-6240-0x00007FFCF0390000-0x00007FFCF03BC000-memory.dmp

          memory/1640-6241-0x00007FFCEE580000-0x00007FFCEE5E4000-memory.dmp

          memory/1640-6264-0x0000017881A60000-0x0000017882036000-memory.dmp

          memory/1640-6259-0x0000017881A60000-0x0000017882036000-memory.dmp

          memory/1640-6254-0x0000017881A60000-0x0000017882036000-memory.dmp

          memory/1640-6249-0x0000017881A60000-0x0000017882036000-memory.dmp

          memory/1640-6244-0x0000017881A60000-0x0000017882036000-memory.dmp

          memory/1640-6242-0x00007FFCEB370000-0x00007FFCEB413000-memory.dmp

          memory/1640-6239-0x0000017881A60000-0x0000017882036000-memory.dmp

          memory/1640-6243-0x00007FFCED280000-0x00007FFCED29F000-memory.dmp

          memory/1640-6231-0x00007FFCEF290000-0x00007FFCEF51F000-memory.dmp

          memory/1640-6232-0x00007FFCEE710000-0x00007FFCEE949000-memory.dmp

          memory/1640-6233-0x0000017881A60000-0x0000017882036000-memory.dmp

          memory/4400-10-0x0000000002F80000-0x0000000002F81000-memory.dmp

          memory/4400-6229-0x0000000000640000-0x0000000000A79000-memory.dmp

          memory/4400-6-0x0000000002F80000-0x0000000002F81000-memory.dmp

          memory/4400-6165-0x0000000000640000-0x0000000000A79000-memory.dmp

          memory/4400-4855-0x0000000000640000-0x0000000000A79000-memory.dmp

          memory/4400-3087-0x0000000000640000-0x0000000000A79000-memory.dmp

          memory/4400-9-0x0000000000640000-0x0000000000A79000-memory.dmp

          memory/4400-159-0x0000000000640000-0x0000000000A79000-memory.dmp

          memory/4400-621-0x0000000000640000-0x0000000000A79000-memory.dmp

          memory/4400-1659-0x0000000000640000-0x0000000000A79000-memory.dmp