1cde1c541ec2d9715f9fafb1643c76027f7326186634c69678145dadd62b7718

Analysis

user interaction
yes
max time kernel
391s
max time network
401s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WolfClient-Setup.exe
Size 87.0MB
Sample260930-wbhtpsec83
SHA256 1cde1c541ec2d9715f9fafb1643c76027f7326186634c69678145dadd62b7718
MD5 11b09d12cdcb60ef536e1d1d2bd3e628
SHA1 5d33fc5c6906396cd08164168d0b84aeb6a0f713
SHA512 3e9da86b8117fc01a8d4fa95d75dc57627aeb2998f2f29d6e389f3a21b4116acb2e5d1eea65bd78719b4527b37dc185ca81012687575241fc527934569ac1e0f
SSDEEP 1572864:JTylPjCmmtLI+5Rf5K4YaCTvriZUCZZkU4qTPb+o2KPygZWtq9Y0wsTnCw:aPWR5Rf5K432/YuUvTPb+Z8L79rwYnn
TLSH
T18418333FE19BB53ED53A9E793536D250343AB66261514C279EE8F44CCF210702A2E6CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
936	WolfClient-Setup.tmp
4884	WolfClient.exe
1852	WolfClient.exe
4392	java.exe
832	java.exe
3664	java.exe

Loads dropped DLL 64 IoCs

pid	Process
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe
1852	WolfClient.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WolfClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WolfClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	java.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	java.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	java.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	java.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	java.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	java.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WolfClient-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WolfClient-Setup.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/5488-0-0x0000000000010000-0x00000000000F9000-memory.dmp	innosetup
behavioral1/memory/5488-15-0x0000000000010000-0x00000000000F9000-memory.dmp	innosetup
behavioral1/memory/5488-1103-0x0000000000010000-0x00000000000F9000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WolfClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WolfClient.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
936	WolfClient-Setup.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1852	WolfClient.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5488 wrote to memory of 936	5488	WolfClient-Setup.exe	89
PID 936 wrote to memory of 4884	936	WolfClient-Setup.tmp	91
PID 4884 wrote to memory of 1852	4884	WolfClient.exe	92
PID 1852 wrote to memory of 4392	1852	WolfClient.exe	95
PID 1852 wrote to memory of 832	1852	WolfClient.exe	97
PID 1852 wrote to memory of 3664	1852	WolfClient.exe	105

C:\Users\Admin\AppData\Local\Temp\WolfClient-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\WolfClient-Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5488
- C:\Users\Admin\AppData\Local\Temp\is-HL95WXW3C2.tmp\WolfClient-Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HL95WXW3C2.tmp\WolfClient-Setup.tmp" /SL5="$50020,89967306,893952,C:\Users\Admin\AppData\Local\Temp\WolfClient-Setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Users\Admin\AppData\Local\Programs\WolfClient\WolfClient.exe
    "C:\Users\Admin\AppData\Local\Programs\WolfClient\WolfClient.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Users\Admin\AppData\Local\Programs\WolfClient\WolfClient.exe
      C:\Users\Admin\AppData\Local\Programs\WolfClient\WolfClient.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1852
    - - C:\Users\Admin\AppData\Local\Programs\WolfClient\jre8\bin\java.exe
        
        C:\Users\Admin\AppData\Local\Programs\WolfClient\jre8\bin\java.exe -Xmx4096m -Xms1024m -XX:+UseG1GC -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M -XX:-UseAdaptiveSizePolicy -XX:+AlwaysPreTouch -Djava.library.path=C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\natives -Dorg.lwjgl.librarypath=C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\natives -cp C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\versions\1.8.9-WolfClient\wolfclient.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\google\code\gson\gson\2.2.4\gson-2.2.4.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\google\guava\guava\17.0\guava-17.0.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\ibm\icu\icu4j-core-mojang\51.2\icu4j-core-mojang-51.2.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\mojang\authlib\1.5.21\authlib-1.5.21.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\mojang\netty\1.8.8\netty-1.8.8.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\mojang\realms\1.7.59\realms-1.7.59.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\codecjorbis\20101023\codecjorbis-20101023.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\codecwav\20101023\codecwav-20101023.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\libraryjavasound\20101123\libraryjavasound-20101123.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\librarylwjglopenal\20100824\librarylwjglopenal-20100824.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\soundsystem\20120107\soundsystem-20120107.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\commons-codec\commons-codec\1.9\commons-codec-1.9.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\commons-io\commons-io\2.4\commons-io-2.4.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\commons-logging\commons-logging\1.1.3\commons-logging-1.1.3.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\io\netty\netty-all\4.0.23.Final\netty-all-4.0.23.Final.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\dev\jna\jna\3.4.0\jna-3.4.0.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\dev\jna\platform\3.4.0\platform-3.4.0.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\jinput\jinput\2.0.5\jinput-2.0.5.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\jinput\jinput-platform\2.0.5\jinput-platform-2.0.5-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\jutils\jutils\1.0.0\jutils-1.0.0.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\sf\jopt-simple\jopt-simple\4.6\jopt-simple-4.6.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\commons\commons-compress\1.8.1\commons-compress-1.8.1.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\commons\commons-lang3\3.3.2\commons-lang3-3.3.2.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\httpcomponents\httpclient\4.3.3\httpclient-4.3.3.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\httpcomponents\httpcore\4.3.2\httpcore-4.3.2.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\logging\log4j\log4j-api\2.0-beta9\log4j-api-2.0-beta9.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\logging\log4j\log4j-core\2.0-beta9\log4j-core-2.0-beta9.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\lwjgl\lwjgl\lwjgl\2.9.4-nightly-20150209\lwjgl-2.9.4-nightly-20150209.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\lwjgl\lwjgl\lwjgl-platform\2.9.4-nightly-20150209\lwjgl-platform-2.9.4-nightly-20150209-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\lwjgl\lwjgl\lwjgl-platform\2.9.4-nightly-20150209\lwjgl-platform-2.9.4-nightly-20150209.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\lwjgl\lwjgl\lwjgl_util\2.9.4-nightly-20150209\lwjgl_util-2.9.4-nightly-20150209.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\oshi-project\oshi-core\1.1\oshi-core-1.1.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\tv\twitch\twitch\6.5\twitch-6.5.jar net.minecraft.client.main.Main --username tralalerotralalainutil --version 1.8.9-WolfClient --gameDir C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft --assetsDir C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\assets --assetIndex 1.8 --uuid 9969d611-f3c4-39b0-8b7f-39ac6cafad43 --accessToken 0 --userProperties {} --userType Legacy --versionType WolfClient --width 854 --height 480
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Programs\WolfClient\jre8\bin\java.exe
        
        C:\Users\Admin\AppData\Local\Programs\WolfClient\jre8\bin\java.exe -Xmx4096m -Xms1024m -XX:+UseG1GC -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M -XX:-UseAdaptiveSizePolicy -XX:+AlwaysPreTouch -Djava.library.path=C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\natives -Dorg.lwjgl.librarypath=C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\natives -cp C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\versions\1.8.9-WolfClient\wolfclient.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\google\code\gson\gson\2.2.4\gson-2.2.4.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\google\guava\guava\17.0\guava-17.0.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\ibm\icu\icu4j-core-mojang\51.2\icu4j-core-mojang-51.2.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\mojang\authlib\1.5.21\authlib-1.5.21.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\mojang\netty\1.8.8\netty-1.8.8.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\mojang\realms\1.7.59\realms-1.7.59.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\codecjorbis\20101023\codecjorbis-20101023.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\codecwav\20101023\codecwav-20101023.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\libraryjavasound\20101123\libraryjavasound-20101123.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\librarylwjglopenal\20100824\librarylwjglopenal-20100824.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\soundsystem\20120107\soundsystem-20120107.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\commons-codec\commons-codec\1.9\commons-codec-1.9.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\commons-io\commons-io\2.4\commons-io-2.4.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\commons-logging\commons-logging\1.1.3\commons-logging-1.1.3.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\io\netty\netty-all\4.0.23.Final\netty-all-4.0.23.Final.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\dev\jna\jna\3.4.0\jna-3.4.0.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\dev\jna\platform\3.4.0\platform-3.4.0.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\jinput\jinput\2.0.5\jinput-2.0.5.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\jinput\jinput-platform\2.0.5\jinput-platform-2.0.5-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\jutils\jutils\1.0.0\jutils-1.0.0.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\sf\jopt-simple\jopt-simple\4.6\jopt-simple-4.6.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\commons\commons-compress\1.8.1\commons-compress-1.8.1.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\commons\commons-lang3\3.3.2\commons-lang3-3.3.2.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\httpcomponents\httpclient\4.3.3\httpclient-4.3.3.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\httpcomponents\httpcore\4.3.2\httpcore-4.3.2.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\logging\log4j\log4j-api\2.0-beta9\log4j-api-2.0-beta9.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\logging\log4j\log4j-core\2.0-beta9\log4j-core-2.0-beta9.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\lwjgl\lwjgl\lwjgl\2.9.4-nightly-20150209\lwjgl-2.9.4-nightly-20150209.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\lwjgl\lwjgl\lwjgl-platform\2.9.4-nightly-20150209\lwjgl-platform-2.9.4-nightly-20150209-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\lwjgl\lwjgl\lwjgl-platform\2.9.4-nightly-20150209\lwjgl-platform-2.9.4-nightly-20150209.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\lwjgl\lwjgl\lwjgl_util\2.9.4-nightly-20150209\lwjgl_util-2.9.4-nightly-20150209.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\oshi-project\oshi-core\1.1\oshi-core-1.1.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\tv\twitch\twitch\6.5\twitch-6.5.jar net.minecraft.client.main.Main --username tralalerotralalainutil --version 1.8.9-WolfClient --gameDir C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft --assetsDir C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\assets --assetIndex 1.8 --uuid 9969d611-f3c4-39b0-8b7f-39ac6cafad43 --accessToken 0 --userProperties {} --userType Legacy --versionType WolfClient --width 854 --height 480
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:832
    - - C:\Users\Admin\AppData\Local\Programs\WolfClient\jre8\bin\java.exe
        
        C:\Users\Admin\AppData\Local\Programs\WolfClient\jre8\bin\java.exe -Xmx4096m -Xms1024m -XX:+UseG1GC -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M -XX:-UseAdaptiveSizePolicy -XX:+AlwaysPreTouch -Djava.library.path=C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\natives -Dorg.lwjgl.librarypath=C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\natives -cp C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\versions\1.8.9-WolfClient\wolfclient.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\google\code\gson\gson\2.2.4\gson-2.2.4.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\google\guava\guava\17.0\guava-17.0.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\ibm\icu\icu4j-core-mojang\51.2\icu4j-core-mojang-51.2.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\mojang\authlib\1.5.21\authlib-1.5.21.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\mojang\netty\1.8.8\netty-1.8.8.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\mojang\realms\1.7.59\realms-1.7.59.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\codecjorbis\20101023\codecjorbis-20101023.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\codecwav\20101023\codecwav-20101023.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\libraryjavasound\20101123\libraryjavasound-20101123.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\librarylwjglopenal\20100824\librarylwjglopenal-20100824.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\com\paulscode\soundsystem\20120107\soundsystem-20120107.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\commons-codec\commons-codec\1.9\commons-codec-1.9.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\commons-io\commons-io\2.4\commons-io-2.4.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\commons-logging\commons-logging\1.1.3\commons-logging-1.1.3.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\io\netty\netty-all\4.0.23.Final\netty-all-4.0.23.Final.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\dev\jna\jna\3.4.0\jna-3.4.0.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\dev\jna\platform\3.4.0\platform-3.4.0.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\jinput\jinput\2.0.5\jinput-2.0.5.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\jinput\jinput-platform\2.0.5\jinput-platform-2.0.5-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\java\jutils\jutils\1.0.0\jutils-1.0.0.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\net\sf\jopt-simple\jopt-simple\4.6\jopt-simple-4.6.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\commons\commons-compress\1.8.1\commons-compress-1.8.1.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\commons\commons-lang3\3.3.2\commons-lang3-3.3.2.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\httpcomponents\httpclient\4.3.3\httpclient-4.3.3.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\httpcomponents\httpcore\4.3.2\httpcore-4.3.2.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\logging\log4j\log4j-api\2.0-beta9\log4j-api-2.0-beta9.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\apache\logging\log4j\log4j-core\2.0-beta9\log4j-core-2.0-beta9.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\lwjgl\lwjgl\lwjgl\2.9.4-nightly-20150209\lwjgl-2.9.4-nightly-20150209.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\lwjgl\lwjgl\lwjgl-platform\2.9.4-nightly-20150209\lwjgl-platform-2.9.4-nightly-20150209-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\lwjgl\lwjgl\lwjgl-platform\2.9.4-nightly-20150209\lwjgl-platform-2.9.4-nightly-20150209.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\org\lwjgl\lwjgl\lwjgl_util\2.9.4-nightly-20150209\lwjgl_util-2.9.4-nightly-20150209.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\oshi-project\oshi-core\1.1\oshi-core-1.1.jar;C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\libraries\tv\twitch\twitch\6.5\twitch-6.5.jar net.minecraft.client.main.Main --username tralalerotralalainutil --version 1.8.9-WolfClient --gameDir C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft --assetsDir C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\assets --assetIndex 1.8 --uuid 9969d611-f3c4-39b0-8b7f-39ac6cafad43 --accessToken 0 --userProperties {} --userType Legacy --versionType WolfClient --width 854 --height 480
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:3664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-console-l1-1-0.dll
Size 20KB
SHA256 89384f8f64a9b7f67c8deccaa721e2d76b8a17026d8083630859ed0cd1a9b58b
MD5 2c146bc8d73b8944f35506241b9953a9
SHA1 ac64abd745418cea35c0506b9cb0331b171b51ea
SHA512 02713948a156baccb2e7c38646193e82fef65400c086644866b698bc3e0a8c155a8eab829463e3868ce2b8a06608c5ea6de1e390bff976c5f92e2e42dd6c04f1
SSDEEP 384:WyWfhWoLm0Gf21MgKlx+YEL1MgKlx+YybT:AVRig8Xg8yf
TLSH
T151923AC38EBC9443EE976DB017A8D9837C3C9BC72910916515BAF5A91CC37D6EB0462C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-2-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-console-l1-2-0.dll
Size 20KB
SHA256 f901b0bc8c00b3afc80e151e6f54b18f7672f932602c304fbfeedd5aa3ad63c8
MD5 7a55e51d07e1f15221eb11479adbc53f
SHA1 8d8e2beff4dfa78372201b26a67b9dc4b116290f
SHA512 e89c0e45014abdaf7548de0352949c4ad496d97cad2f9e2f6c83a90f853b7b71354b9abbb957eff89076df79bdc9cc1c431b6f35875550bfb4198c3a68124197
SSDEEP 384:WiWfhWcLm0Gf0WsXqldlx9yN9jBscRqldlx9yN9i:I9RNFhXA
TLSH
T17B922BD38ABC9143EE93BD7017A8E5837C3C67D72910909125AAF9ED2CD37D29B1492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-datetime-l1-1-0.dll
Size 20KB
SHA256 12d801992bbb09d43bb90330bb96e77bf12e669c325dda4b5235942221c301c8
MD5 f0c9c56f56ffa3adc548173569dbd793
SHA1 220a56b84cdb8cd403483d3f6b4bb526fe198fd9
SHA512 28e24a2ccedfaf01aef615c1df7f8c76ff0eb06d992eb1b422f902d6d96357ba6a353e31ca9b1fd305e7de7a437ee6a7f2f01bfdf27c4a88c805693ae2b6352c
SSDEEP 384:W1WfhWFLm0GfYKllGBwLeqvYqldlx9yNZ7:FsREL7gl
TLSH
T1F5922BD29ABC8443EE93BD7013A8E9837D3C67D72A10916605BAF5ED1C837C2DB1452D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-debug-l1-1-0.dll
Size 20KB
SHA256 64a9ac181fd91b79270bf01759749394f57be171436ed46f43d165325bb82067
MD5 02d669afdabfe420598041b848b71158
SHA1 25c0fdbc04ffcd570db041d02842d7530afeeb6e
SHA512 5321290ec277fca8840e6c9cb7e77d39e820b1d98ef9c29040efaf2a7628c023209c936e08abfb6962a795130874544db25e1bac0d16256a1ebbca0fdcdaa81a
SSDEEP 192:W9WfhWaf40V2sms/nGfeMiQd8fZvqnaj9WWPMFwJEfFF/WWFYg7VWQ4CWWPu2uo5:W9WfhW2Lm0Gf38xlZWWkiJEB+2ZlxrXr
TLSH
T1BC921AD2CBBC9443EA937E7013A4D9837C3CA7C72D10916505AAF4E91CD37D6AB14A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-errorhandling-l1-1-0.dll
Size 20KB
SHA256 44822ae123a3d6c3a8bdf9a4d65a4dc89eb31004c72fcfcefa1dc3a53ff3eab0
MD5 944a33d971704ff815a6c90733d0a72e
SHA1 7d8b9f68a3983a1b86bf4bae085cd5ca6f464921
SHA512 4d93dece856a24e50f12a53155e07f1aab501b17e7bbfcce205e1b37d2799caf3681b1770c522ba986ac3badba59d5d95a7526fe19f86a7b0d3d933ea73754e2
SSDEEP 384:WeAbDWfhW7Lm0Gfr1MgKlx+Yz2OwkZJl0huSwpvPr:DAbgiRRg85wkWhepvPr
TLSH
T178921AD29ABC9443FE937DB023A8D983BC3CA7C71D10819505A9F5E92C937D2EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-file-l1-1-0.dll
Size 23KB
SHA256 c15dacec228f40ce4c5b9d69bba5e6627bc484c6e9d6550a76db6f332e9f7734
MD5 fec01082bccddadad0814f30b43ab078
SHA1 a6f6d9b61bb743651d3f65824d06427ca492c120
SHA512 c6039c366cb47ca31c7501423384afc0678a07abeb0ca1d97ecb5aa3c3e3acf84c9551dea1e56d1dbd4472dab70eed1c79d1c0612ba2730327ce6d0dc151c441
SSDEEP 384:WmBPvVXuWfhW7Lm0GfQ2zlxCHLXYEv0l9K8e:7PvVXvGRtLl
TLSH
T112B22BD3D9B8E143ED8FAD7112A1D9437C3C93C7082540951AA9E6AD2CD73C2E74896D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-file-l1-2-0.dll
Size 20KB
SHA256 27878021c6d48fb669f1822821b5934f5a2904740bebb340b6849e7635490cb7
MD5 b5060343583e6be3b3de33ccd40398e0
SHA1 5b33b8db5d6cfb0e8a5bb7f209df2c6191b02edb
SHA512 86610edc05aa1b756c87160f9eefe9365e3f712c5bed18c8feca3cae12aef07ccc44c45c4be19dc8f9d337a6f6709b260c89019a5efcfe9fa0847d85ab64d282
SSDEEP 384:W7WfhWnLm0Gf0Kuh1MgKlx+YTVtZKllGBwLx:3yRREg8JtcLx
TLSH
T1AD9209D29A7C8443EA937D7017A8DA837C3C97DB2A1081A505BAF5ED1C837C6EF1462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 c55eb043454ac2d460f86ea26f934ecb16bdb1d05294c168193a05090bf1c56c
MD5 2e8995e2320e313545c3ddb5c71dc232
SHA1 45d079a704bec060a15f8eba3eab22ac5cf756c6
SHA512 19adcc5dd98f30b4eebefe344e1939c93c284c802043ea3ac22654cf2e23692f868a00a482c9be1b1e88089a5031fa81a3f1165175224309828bd28ee12f2d49
SSDEEP 384:WnVzWfhWSLm0GfHJl0huSwJU5YiKllGBwLbyr:CVQnRHheJUadLbyr
TLSH
T1C99209D29ABC9443FA937DB013A8DA837C3CA7C71A10816505AAF5D92CD37C2EB1496D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-handle-l1-1-0.dll
Size 20KB
SHA256 6dcbdab7fa8cf66f4a05d1f5166bed33cd88bee1d37af6128f18184e6c301709
MD5 31ffff2c6539b3d2f575500300b93d6b
SHA1 e28e8919150fca0cb385f55a4ec4d23058d92fbf
SHA512 716f42f0dc530774665982f189a1fbf0371aceb4087de67e5b677cb18a687900c73165a57ae8229b53744e2490d4f04a54686e09da3b5d8705e1df5b804fe27d
SSDEEP 384:WIWfhWgLm0GfE8xlZWWkiJzebPqldlx9yNVLzX:OxRviWhX
TLSH
T16D922BD2CABC8043EE937D7017A4EA837D3CA7C7291091A505AAF5ED1CD37D6AB1062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-heap-l1-1-0.dll
Size 20KB
SHA256 2e00c0176952d7c009b93c40949f91f0ab367a1b274ee78b736bf563f0344da3
MD5 c7120579bb8f56f8cd4e0d329ece3e9d
SHA1 0b35862dcc9654fc4ede338c26d0368c112d4ba9
SHA512 6172179c349f9952e6fb47a72a459ee29563a511d9da2a16a265625f1d8ca40ff9bd52f78a26d29b5297e7413bfa22a9797df2934a68ea551d0ab45914ee7822
SSDEEP 384:WMlKWfhWGLm0Gfomv0l9K8hHTRQg6gl9iI:zLRftuU
TLSH
T1A6924AC6CABC9043EA977D7023A8D9837C3CA7C72C20816515AAF5992CD37D2DB2563D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-interlocked-l1-1-0.dll
Size 20KB
SHA256 d4d86e560a22d833fcdf0ba165d3bd3f6059e69830f4d2f9748af08905b2d4c8
MD5 1144ced0d8198c39f62fc71c1ecf6cb1
SHA1 43ca991199a46ca1860f8a295209dee6d32d040d
SHA512 006b420d4513fd2be1e07f7512891275cb76243fd4d49855836da53ff779fa695b9bd5661fa16b1c8f83d8cec6342c9719def8d3242431b13e803bdbc2d81e4b
SSDEEP 192:W/WfhWfv40V2sms/nGfecTTCeJgLIyqnajV4hhZ7si8WWFYg7VWQ4mWwsMbus/qm:W/WfhWtLm0Gf3CeAplx4bZxcyv0l9K8
TLSH
T16D923CD28ABC9083EAA37D7017A4D9877C3CA7C71D20816505AAF5E91CC77D2EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-libraryloader-l1-1-0.dll
Size 21KB
SHA256 655bade7ff61f01a803e7532082b14ae354442b0f65ef8164f824d0cfa033e6f
MD5 2acf6db396a86e2bef9d6ddf6919581f
SHA1 c67615b97b74776fa64407e7644f92cd14336cbb
SHA512 9a804bad2a9f220281cd3c20dbc96c023819da96cd24341c597a9d076b5fd176ec9da8e6a227628156827294cfb460e78d41eb053e133b1038a305c996453a36
SSDEEP 384:W7vuBL3BrWfhW5Lm0GfwMs2ZlxrXwulS+Jl0huSwpMu:ZBL3BIsRT8uhepMu
TLSH
T1F8A219D2CABC9183EAD36D7053A4DA837C3CA3C7592080A505ADE5DA2CD37D2EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-localization-l1-2-0.dll
Size 22KB
SHA256 646b28a20208be68439d73efa21be59e12ed0a5fe9e63e5d3057ca7b84bc6641
MD5 54d2f426bc91ecf321908d133b069b20
SHA1 78892ea2873091f016daa87d2c0070b6c917131f
SHA512 6b1b095d5e3cc3d5909ebda4846568234b9bc43784919731dd906b6fa62aa1fdf723ac0d18bca75d74616e2c54c82d1402cc8529d75cb1d7744f91622ac4ec06
SSDEEP 384:WXOMw3zdp3bwjGjue9/0jCRrndbWsWfhWkLm0Gf7t6gl9i7uBJl0huSwprv/N:6OMwBprwjGjue9/0jCRrndbGVRdGOheT
TLSH
T121A229D2D6B8D143F94EBC71226AD5437C3CA3CA1821859102FAFA992CE37D6E71463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-memory-l1-1-0.dll
Size 20KB
SHA256 13ae84007249d532f326a00ad62e5c1f463581f30701e662bb1b3658c4c32a07
MD5 e7b662ffa023b7f07a85ac3fb8910c11
SHA1 261edc0c4068771f0d070c17e0721d8a1bfcaf9f
SHA512 8df890a9aa191b594bbc033bc384deb27f9e4110e51632f681b33061b4370cec6ff2d637b20a38fc882ddc74dd8247f177cea2b05a13655e7b49e07bc280d756
SSDEEP 192:WJqWfhWN940V2sms/nGfesTvMbus/qnajBMh8PAU8QWWFYg7VWQ4SWbSeJgLIyqE:WJqWfhWtLm0GfDv0l9K8oWXeAplx4bZw
TLSH
T122922AC69ABC9443EA937D7017A8DA83BD3DA3C72C10816505BAF5961CD33D2EB1493E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\.openjfx\cache\21.0.4+1\amd64\api-ms-win-core-namedpipe-l1-1-0.dll
Size 20KB
SHA256 84cec1a1aaf344a93581b0f0c293623cd07652982a9f54f2fc879092512c4d92
MD5 da29d8d5a978e12d07f930f402e14180
SHA1 568943dedabc74749db557cbb398b9d72d57501a
SHA512 da65f9490f46b2509c4e15a82879ce64baa947fc978f20e052fb9bb9d002bb9c21a5b847d1d6258a4fa5747fcd22542f246b14653f5a67c528d60f919ede70c5
SSDEEP 192:W/WfhWNs40V2sms/nGfesdIeMbus/qnajBMh8XXWWFYg7VWQ4SWZCAzNXO0vqnaS:W/WfhWgLm0Gfuev0l9K8X1ZY1lxd3EQO
TLSH
T12A9219D296BC9043EE977DB013E4DA837C3CA7C72910816515AAF8E91CD37D1AB2463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WolfClient.exe

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\WolfClient.exe
Size 461KB
SHA256 acc25c9248b0d29dc81fd8fd27953707f4e3d70d6118bed486fd287e91e351f4
MD5 82b3fcff35a691207ece7d61bbe55692
SHA1 ac26a8738f40b774d9b6638544a47ff58cce1bcb
SHA512 fba5f8ca71c10158b87aaa72a1de13dfcc195ab298803d797a6f7abbc7757286b13a0f68aebec1aa759ee70f00b83ace57d464abfb8e0b2cdb58057bd66e5bc0
SSDEEP 6144:qzeAmgykn0yqEvegZEvYaDUIpIVVfEyYLebKh2v8:qSTgv3/X6vYRIpAhbv8
TLSH
T1EAA46D5AE66414F9D0A7C278C9534902E6B27C5E47B1D74F03E87AA61F332A09E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WolfClient-Launcher.jar

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\app\WolfClient-Launcher.jar
Size 13.7MB
SHA256 c94daf7fec1008d20fe4d29ac58f75156ce943d814679167f54b2160ba26a991
MD5 5599121618d30804d72a613ca6251a03
SHA1 8446ab2f5d40ef74547ae898df63035b75d77775
SHA512 c5d16ded23ab321e6f8e1c8c4aa7557b44fe6c3c4bfc3b7c7d3407b85c3add4934261589dcd3e3c227ae28c434649942bd39d168a29fb42c020817ca265ef4b4
SSDEEP 393216:x9ahKJbi2A38dDhcdykF6RX0Ag6qSrt4AYJcp7:TahGObqadFlEq5AYQ7
TLSH
T15EE60227BE9EC4BADC43C0B5F681CB02B45851F9D206617B05E94A8E9870C5E4F63EDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WolfClient.cfg

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\app\WolfClient.cfg
Size 169B
SHA256 681917ecc70914592b0c69e968322f73d5a4b51430b8b282219264bc712f1893
MD5 d6d5a1a84e4237a1dc014ee4cee96e22
SHA1 fdde584344b78612560056a5e51bc12a8312c594
SHA512 eb653a6c3551fe02dbda941d7ffdc6af72ec7d0c81bcf8051ed11ba8e0e3e2cdf282dd0c5c865061f7a250d8ec9b207899906bd6dec351e30d301583c3844d5c
TLSH
T100C080D115C4376451E74BEC472C5160727972E8D95526220470010D3E1D41D9F5E100
MD5 SHA1 SHA512 TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\jre8\bin\java.exe
Size 202KB
SHA256 e871e48f75b213a51cf13a3a397c1b31b10b516cb4cfb5f0682c85387d3c5ed9
MD5 16463e52682e38d532c0a7465c68a7a3
SHA1 353ceb795e0ad4ba76a7a83c9f51fe9b90df4463
SHA512 4c18ba186f3d9a6bd90e5153b8643ed858500432e6ffce1e44360a876d67c80e7c75dc46a00b8af6a8951ce267dae0be763e96016d9d1fcfad15b638876324f8
SSDEEP 3072:UtrwyLE6DuZsVDaLJ4TzqCOkXFTPrLa3mPmTn0TBfLpbxJXq4jZqMNzf9XVW:UzLLu2lA4TzSetrLa3muT0TB7QYv7LW
TLSH
T1EA149D92739010F1D9A79276C4958E12E6B27C9A47B0830F13F872765F733A2781EB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-RXPCSJ5CTC.tmp

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\jre8\lib\images\cursors\is-RXPCSJ5CTC.tmp
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
TLSH
T100C08C88F34888828A4AD2384874138C68A4C4BB8A224B88144A2A94A2935A2C1D0302
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\bin\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\bin\java.dll
Size 121KB
SHA256 4075d8eb11f4f8f2b765808c00c4516310de1e70a921b3c3e0e61df89c50abb7
MD5 e8a7bea406ec90b3b3f32babb3f551ef
SHA1 152fc235e36d820364250443e315ec3920cffd8a
SHA512 048903272cfd8baf0cb117a12763c861506e689c33142c793268d7fd27df11051d0f2e213c78016215af61b2525cb3bf165b8ddeb294c7ff607da8b1d0f6484c
SSDEEP 3072:S55QL1Eo2dCc/dGw9+oMSbhSByNGB6o+ErMi3clZV7:+5QL1AcwUGx/GcV7
TLSH
T153C35B0BA6A44082F42EB5BCC4138D0EE771B4600295E34F436AD64E9FDF7727D19BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\bin\jimage.dll
Size 33KB
SHA256 af7bce7920207ca917dec0b8584ed44e4cfa59f03cb6ced4a5cd3f498ef90427
MD5 4e8187a34fad085997d25294c83a899f
SHA1 7242e2a87c28202539e2dfc3c193e02a2559d640
SHA512 227b4052a192180a365e161a87c163db7700bc884e2baa5d6f89d74a519bb3a58fc1daf5bfbf2e3f24c32057ba5880978e718002a12b9c940d60178ee4293484
SSDEEP 384:C6pv8DPrWC5e0pfA+085Bltul3qYlZyvhaDhV2IYiq1GVM8Ovy8RbmL4nNycJ:XpClA+Bttul3qYlgvhadVrYi1Vev5ALW
TLSH
T193F28D56E7945859D966D938C8978B2BE3F2FA514E90C3CF2720826E0F333803A6D752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\bin\jli.dll
Size 90KB
SHA256 36fd7d871887c84089e4bd77116894cdbba2a2fa8f4883d97cba67eab01778b2
MD5 cf673d9366cbf5b5c03e617f4bc3ec36
SHA1 d4428e654f63ca2ea560358354a142066792d4df
SHA512 40ba452df2ceac09515e86b0a7d2922f2679dfd78b5787c793b5919444a85f61cdf90e6a21dce2c1fd9c5b79dfe5ab726e4b131652d25c300b763d370200b14f
SSDEEP 1536:jaMrb6Eb6SJccAAUGRVkpIOPnwT5/K563MtwxGsSc71VsnT:TrGk6xAUMVEPnwT5/K563MqxGsScZV+
TLSH
T136939D4A53D021E1DEB699B9DDB0960BD3F1B0562770838F4368859E0F636623F1CBE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsvml.dll

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\bin\jsvml.dll
Size 849KB
SHA256 170e1cc4c7fddfb27ff2832228461af95228fb40c2ca21cae7628002c843d302
MD5 d66fcbae3635ba94296c3513fac4541e
SHA1 4089821006fdb70705a43cd15317711dab25b8ef
SHA512 85d7c5bb8d9811792a173fc51f342671574a0c3e6cb1adb448ab702eb27fe55549ed8e8f15597602333a580a337446a37b8a266db090465f5259401f45fdf139
SSDEEP 12288:cRybOUKnvJNeCs5wHum1j/V71AVNV+Ssc3b:cobO7JN3qwH/1jN7wj+9Ob
TLSH
T11C05AF82F81284CDC03534B024FFBD95A91A1CE941BC0EB32772AE9D2AFD7467957A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\bin\msvcp140.dll
Size 562KB
SHA256 b99eb28a471311113f5c4109cb3c463f39cfd9bdb3b07f706204dedddb4516a1
MD5 7acbc57d268a691247b4a94fecfa42b4
SHA1 67bd76111b4ab8f4c0692919153dde2e7c8070f1
SHA512 b08140ce86ea78b481b78644f086359326616a56fb3a3953da16a7fc2bd15a493652f22d4d2fcba3675c668b9832fdb7d5f17a8aa6ccdb74e7b746a79df60b88
SSDEEP 12288:O9zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVhEU9:O4wPrALhAYvogQEKZm+jWodEE7p
TLSH
T139C41923B74905E0E195E3B891878306D7F1BC4A8312A3C792EBD69D2F677D1673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\bin\net.dll
Size 59KB
SHA256 05492c6ba059d292e6c02ddaec2a3ef0cf21b8a9670bb90d6cdc7cf252c6af11
MD5 8904585930509f48f81ba49c0dcac1a6
SHA1 c92c060cd8ef2dc935d3ca4e87d02b15f7e9a0f7
SHA512 8bde7a943156e5ab3de76778392920f626cce8aa08bdc5cfa8c1c3c7fb2587c22dc46191da698304c7ba7f4158f3ba39f1c31c7c0c368dcc725b27dbde221b00
SSDEEP 1536:/39xRTQvuv55er8BsWAcqqXKLYUR+71Vb:PHHezWvY8UR+ZVb
TLSH
T1B9434B1297D41480E827C978C953151FDAB1B860629087CF83BAC65EAFF37717F19B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\bin\nio.dll
Size 79KB
SHA256 adfb88135ec2aa23bcf31b6ca1e83299e7c96edbee65a9d0dfa46622bc8784e5
MD5 c3e1f59dd38826dbf2277db8c3301638
SHA1 7a2c43129b35c2fbd5ecf7796c828e327ce83349
SHA512 550d4c3067f9bc7580c7dfcf216eb54992e3b3b1336bba0c14a344c022ec78ba20cdfe13ffa1d1970828b54fcb16327514fe1ed3b4f577cbc1ccb87fc07948a7
SSDEEP 1536:Rifr6nnXJvMNZo44m/FMFOaG1xRSpi3MvB71VA:RLxMNiEuG7RSpi3mBZVA
TLSH
T1F0832AA253B4889FD87A7138865B535BF272BC104510974F53289B69AF2F2733D3D782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\bin\server\jvm.dll
Size 12.8MB
SHA256 2e6210b90dee4f89d2456ea9ec964ab221e5bdae71d4492f592e4cf395466cb7
MD5 8f5ed2c2595ff074a0642fdcb0c07fe0
SHA1 22ff11993ef9f57da78c438a49e730a61194bd19
SHA512 46957cbcb0c2b16f48f5eaddd01be08b375508776a295805d5fcaf770e33f94266f40d2027ee3f2216e915fd4a1019946dcd0d95a3b636ca3d654013d411f8b9
SSDEEP 393216:VG4rEyWlfSPRe6RIBtbK3tN+i506jnHLzND8YdplRZAsOptLPdVhQNb8vUrggNy+:Ymf
TLSH
T17AD67D17A7A550D1C12BC179CA578E0BC7F2B4D88731A7CB12A01AAF2F53BE255BE314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\bin\vcruntime140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\bin\zip.dll
Size 85KB
SHA256 1af7f46267e8e14b74adf131c1656b5a5bc2b9aa140541eac7d3cc25a756d425
MD5 617d3533e3aaf6ceb0db3c03959ef951
SHA1 bcf71f00e192f182a6300e0a8504d19689453702
SHA512 9650dc37b5238e87b4b487d76418eaec3fd8f4373f7d5aae35ecf33e414ea2a8a041806072e6d06188779e89ee4a789cb4bf2d56766a39b4050c3b5f1a1492d5
SSDEEP 768:dnFxjyuvXk8TJiY8HCeYiiRJO1Zm3dRMz3DYbJTJsRx2DV8IKRaFB3cSL22OL1zJ:dKudJrOb8mKOCKjnYIOxg24BRp71VWqR
TLSH
T15B839D9199A45055DEF789B0C9E34B2ED3B9B05156A043CFA398835E2F532223F4C3FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logging.properties

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\conf\logging.properties
Size 2KB
SHA256 b62d2733ab99556b108a1951d894c5a8d76b1ac7a00c02c388f9eb9be046c56f
MD5 0f00ec3e7a7767a4efeae1875fb5f3d4
SHA1 167808418571e9209b952188ddab2f4e62920e68
SHA512 e869f4a3b821a9933796dc9a56ee00483493369dfbfe07b3b1d895cb8318c6821cd44134eb37513f15b830c25861b596646824ed56672d08b678fefe6a4c7504
TLSH
T13B51EE5EAB4E2D35434E00AA5A7FF6527E1898BC1C23A5F6B35E6304711D83485DBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\conf\security\java.security
Size 71KB
SHA256 68bf37d3cc2effb2725eb6d2076adeeb6ce306764891c755c65cf145a1de34b9
MD5 56a400fee9af32309c0d145fec9df932
SHA1 c3077a24fc3b926edb0112f53d919ab11ec484cb
SHA512 591f1f221c7cc4d1bd1f2280c0cf280533f43b19a0c4ef97791aab46f03a81926c2dad3168bfd98adc87f70e97c9b5ae6602a78ff9828a7af4050e48075e0b86
SSDEEP 1536:r+My8Si8MRjJPFp5/jTNHu1UoQ2k/gl0ugzYilNndOcl0:v8MfPFD/jTNO1UoQDciDndOc6
TLSH
T19B63D422BB896B7206F211A363AEF1D9F76DA12A22325154748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-I5DHVXF3NK.tmp

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\legal\java.desktop\is-I5DHVXF3NK.tmp
Size 35B
SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
MD5 4586c3797f538d41b7b2e30e8afebbc9
SHA1 3419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA512 f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3
MD5 SHA1 SHA512

Submit Download

is-OUOPYD1X5N.tmp

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\legal\java.desktop\is-OUOPYD1X5N.tmp
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\lib\tzdb.dat
Size 100KB
SHA256 5906b44e25a8a730131d7ba1beb5d15af27043f6536f1a169ca8a5d8b8bed8f8
MD5 1c666dde9e9c6fe77715e29d61960af2
SHA1 b6df03d1b9231bdce9ee6f5a3eeac881994f5f1a
SHA512 2a015071df1b3eaf6f5ce1c15989c874c48ca1f4818e3a24b650151292945e70b07b43baf0dad72828621a5748b8276b3ac7c17dbf0768b1881a30dd140daf2c
SSDEEP 1536:y0ExeF88hPdr92L674jAGubqn0Lg/////UzJbPdJPNL0mIT/M4Z3jyxU:yPeq8hPdrcWzbqn0hJzdxuT/5ToU
TLSH
T16AA3C4B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Local\Programs\WolfClient\runtime\lib\tzmappings
Size 21KB
SHA256 b41575b332809b37ad423bdca30c7c48cdef3d82f82fa9d534781a6f15d6a2ab
MD5 4c30d7867505379a18a27d0e8f03198c
SHA1 0cc871d5bd91e061d676a861749af68bbc0ca9c6
SHA512 873d329682ce67267f438b88eee0fc25cecbbcc1f7d694118417ad12756ec2b6ae7502ec4eea0cc9b4ae8b9e68f5f8877762fa13dea89c4a6dcd54fd8bf82c56
SSDEEP 192:3nqW46ARn1+RQ7wbNQQSaapvQZglEcCDqvOCJqGic3yzA6bbAdOFmYXKhJmBW:3nqW46ARnGQqN2KhcQ+qAa9W
TLSH
T1CDA25386B06662D4C073EC0D7B527AD3F886F3C899C69A4D2943C366BD019B767E1837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WolfClient-Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-HL95WXW3C2.tmp\WolfClient-Setup.tmp
Size 4.2MB
SHA256 fb86e63181219e125645878c9ad1813e72356140dbcf500fddc939643e2b1c49
MD5 bed1823ee316733df6511f02706dfd93
SHA1 fc87fa9de11162dd1541054080cbac2b7fab8b38
SHA512 3235dfa1815a3ce025e132476dd61c576a9c662eaf0f042765d7b4c88a758f0b36361b38da847b2d212dbb83415753018cfbe37e8f7038da54776183191c3aa0
SSDEEP 98304:z9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Jc333Px:IItJj90Z6RgKwNx
TLSH
T193268F03F388753EE4A71A3A883FA254583F7A213916CD476BFC295C4F396416D2A787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accounts.json

Path C:\Users\Admin\AppData\Roaming\.wolfclient\accounts.json
Size 366B
SHA256 3905830e889edc3b32b37cd7f6009cbb8d1d13de0c2854f4b198027aa3ac9f02
MD5 890449caa7465095e0626e19cce723c1
SHA1 c3f8b45b8dc91d6325e0a8e981e6b82076153d06
SHA512 5b7a7ef64a765079e1ca88e6e8ffecb656aaaa6b30f72711c8d638bb6f18addc5674d21fc2e64f9c2a18aa9326531b8016320cf5ae3d5033944bbce12fc9ecaa
TLSH
T19FE04F79CAD01C974A82556F9C6A674311801C534CAC3C44FB9C885C2F9D92B2BF6B9E
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\.wolfclient\config.json
Size 471B
SHA256 f98c013ff1b17a122c465af59c44fbfdcb14ae606f024216748b104071f63258
MD5 5f0bbf5fc25af4edaf42beec79620302
SHA1 84e7d7b8db7e08e9efd88dcfe890f7a90b846fcf
SHA512 d57fec011beb539426a0e98c122154fb894d6b595cf12b3d7905457cc686329d34e4b2b53fb991bd0176801735587b35d08392d0f946adfadfcdf65a0cab6ea6
TLSH
T1C6F02738D78118BF4681012F9C7A676326A00C970C6E3D04F752948C3F9D52B26F5F6E
MD5 SHA1 SHA512 TLSH

Submit Download

55da1856e77cfd31a7e8c3d358e1f856c5583198

Path C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\assets\objects\55\55da1856e77cfd31a7e8c3d358e1f856c5583198
Size 4KB
SHA256 09d5879722c54c86d39d83df919f7f712ed92044ffb5b0a6757b9fc2e02281a3
MD5 db6deee4c221859885a69a10fb062467
SHA1 55da1856e77cfd31a7e8c3d358e1f856c5583198
SHA512 146a3189403c9437b6e74ed754ddd8d6694f6cd375c7c687ba77f0a97e7037df31df7c5123eeda260e3bdc163e637bcdff418e6a468a43188c9a72736b552fd2
SSDEEP 96:gaBVAfY5gK6f9bJdnieRgdaUjuweDbAPPPPPtPPPPPPPwPPPPPPPPPPPPPPPPPP8:gajAg5oV9dnrgXjuvAqFikDtAae1ag
TLSH
T178A129E5DCB0B1C7FC4B307B725803E82AA33E84A56ED6D6BB1409851DBBDE106B4589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56c1d0ac0de2265018b2c41cb571cc6631101484

Path C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\assets\objects\56\56c1d0ac0de2265018b2c41cb571cc6631101484
Size 4KB
SHA256 139fc234e51f7825fcdedf10c93d8d60c59df9b4955334f409a624e4b3e6bfbb
MD5 04136fa704ddf7b6a0d5101adb0de640
SHA1 56c1d0ac0de2265018b2c41cb571cc6631101484
SHA512 d0acce8422bee523dac86ca130bfab55e2e0e50906b47ae599d4f5ec0d0627e5c4ef263c77c708586ab4b32786f8aca72f3d39c49926a09a2d5277e7652e4373
SSDEEP 96:SVAfY5gK6f9bJdnieRgdaUjuweDbAPPPPPtPPPPPPPwPPPPPPPPPPPPPPPPPPPPs:cAg5oV9dnrgXjuvAqFiwotx5RGW83s
TLSH
T123A15CD9DCF091E5FC0730F3B1260BD03AA17E84AA96E6E5BF4106895C67DB12374126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5887d10234c4f244ec5468080412f3e6ef9522f3

Path C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\assets\objects\58\5887d10234c4f244ec5468080412f3e6ef9522f3
Size 6KB
SHA256 a0d603f69ad58662e688d74b9ca2f345eebc0938b4af954f16840adf436fe8d9
MD5 1545455944217e6467c30bc9cf0ba0f6
SHA1 5887d10234c4f244ec5468080412f3e6ef9522f3
SHA512 f27e519c219c4d3053c698ac641dc6e252cc208e83b004e0db7fb3015cb9fe5f99bb7739d0b16337f03379dd5775c29456c7ae4f37b15c74b1c851b620df56d3
SSDEEP 192:rDJomrimXOct5g6kf8npoBhieO0y6AIEVG:/imzp26zn6hDOPIgG
TLSH
T149D17CEADE30E4D6EC0531B25A6C0E68BF96BA600234E2EADF54531F08B7D532DF1158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5fd568d724ba7d53911b6cccf5636f859d2662e8

Path C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\assets\objects\5f\5fd568d724ba7d53911b6cccf5636f859d2662e8
Size 4KB
SHA256 8a716f2a3cbfb5d330d3aa9999ff56f0636cf388991caa06d866576989c9f36e
MD5 1dcad8cfe89774102ad3dd284a2f6d6d
SHA1 5fd568d724ba7d53911b6cccf5636f859d2662e8
SHA512 09b45d02b1af69500c616386867a9cc9a0a925007c7bc4419ab90463316511b3083400cd176b8b0d0ee3d6e31cc837ba10a31128d22bccc5e2a8cc556666ae8f
SSDEEP 96:2VAfY5gK6f9bJdnieRgdaUjuweDbAPPPPPtPPPPPPPwPPPPPPPPPPPPPPPPPPPPx:4Ag5oV9dnrgXjuvAqFiZIjoUaI1
TLSH
T16CA12ACADC7099C6FC4B32B775591BD43BE13F48A566E7D6FB4021980827DA0437461E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92750c5f93c312ba9ab413d546f32190c56d6f1f

Path C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\assets\objects\92\92750c5f93c312ba9ab413d546f32190c56d6f1f
Size 5KB
SHA256 2496adc8631bb3ab42ea5a737e2b39242e6a1ca86a90855f7d204a086de35fe9
MD5 4c664febe29f0ca75ac519f0465be466
SHA1 92750c5f93c312ba9ab413d546f32190c56d6f1f
SHA512 8ccc41d86bbd669da8db5132e3c11f91d3a0386cc6048fb54da28274a388a14065970ff507344cf3cf1522e3ea2297a20576ceaa4d88b0dab56ad7eb2187754f
SSDEEP 96:27SDZ/I09Da01l+gmkyTt6Hk8nTKDgarPQErm/R7awdQ8H/TawgLS4uv:oSDS0tKg9E05TKDgxim/RBQ2uR+4K
TLSH
T132B1AF56ED68910F7CFD72200F8E93467BDA713DBD0B121CE6C5A9CD4A20D075F65055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c63f2a3681832dc32d206f6830360bfe94b5bfc

Path C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\assets\objects\9c\9c63f2a3681832dc32d206f6830360bfe94b5bfc
Size 4KB
SHA256 ac49293ab32aa3154eb5c1251e3175a55d28f9e6866bf74fa76c2cefdf6cc40e
MD5 62459d5e2818252fc2ecdf2c18dcdcbc
SHA1 9c63f2a3681832dc32d206f6830360bfe94b5bfc
SHA512 429897cde2e4f4307fb042eed6b987046e420aecdbd5d78acf3736b9a0284bc8429eab5109c96b39bd604f2a59390d69772dd42921c173ecc4fbbbd9b33a55f2
SSDEEP 96:9VAfY5gK6f9bJdnieRgdaUjuweDbAPPPPPtPPPPPPPwPPPPPPPPPPPPPPPPPPPPY:XAg5oV9dnrgXjuvAqFiKI/3hsJV9mf
TLSH
T152A13DDACC71A1C1FC0734B7B1B517C43AB63ED49A7BD6DABB080564242BDD153B444A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4bc069321a96236fde04a3820664cc23b2ea619

Path C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\assets\objects\a4\a4bc069321a96236fde04a3820664cc23b2ea619
Size 6KB
SHA256 ae97513c5bcac9d08f5c8bcbaf55b7a3112134603c141b5de70e15a06c77e325
MD5 02a9f2786ae1487a583495db000551a8
SHA1 a4bc069321a96236fde04a3820664cc23b2ea619
SHA512 18605d797527b44234a6f2b6a99b2915e7fc30c8c88192252fa3dd02e0b801b78a3f509c44beedc887ef9a38556758279c576d922c8558b2d7b44d795ef25192
SSDEEP 192:HCDJomrimXOct5g6keBoDzD+Bd40dDuKR/qwz:HEimzp26XoDSxpRz
TLSH
T163D15DD6CFA0F485D82573B099541DA47F6273A80539BBF5AF50237D8CD290B6BD019C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdf48ef6b5d0d23bbb02e17d04865216179f510a

Path C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\assets\objects\bd\bdf48ef6b5d0d23bbb02e17d04865216179f510a
Size 3KB
SHA256 6c51d4ef0405f5b7ca5d7ee505ce6160783588926dcdff8099169f7e2b10165b
MD5 1eea6fda0ca03698efba7b045b5375f9
SHA1 bdf48ef6b5d0d23bbb02e17d04865216179f510a
SHA512 48bcb65bdbc6db12decb70a8020b3316e2af7af4b15b868bda15a761c4a2e77ebedb2a5d3c57ae8582aabccc6d6c09d840467f61ace3ca14b14c452a03d334dd
TLSH
T115717D6F9164B0AF794EBE810C9E0503D7A4216CD93B37B8A8E208DF54D9D461F114B1
MD5 SHA1 SHA512 TLSH

Submit Download

e26fa3036cdab4c2264ceb19e1cd197a2a510227

Path C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\assets\objects\e2\e26fa3036cdab4c2264ceb19e1cd197a2a510227
Size 6KB
SHA256 c7918a0b58c45a6f0d29fa990bbd31a7b482ef61387c83a02eb7f70b672e4761
MD5 8db68cc6dce4b8e01fc10385f2eac7bd
SHA1 e26fa3036cdab4c2264ceb19e1cd197a2a510227
SHA512 150be040bbf4d7d8dcb35aaea7b21908964b4cb86a9f33c4a3126b523b6ba964f36384b0c7dbe3f9dc49a3fa10ed04f355832e9ee5dfa8a53f799b2761ad297f
SSDEEP 96:ncczOrVko1BJoQhri4BXOYwgucPaMN+BPPPPPnQYyMXkM940n8Kp24wVjN5nyD0/:wDJomrimXOct5g6kXa0/24wVjrQ8Oq
TLSH
T13ED14BE6D9E0E988EC2B327156450A166EE277B84134C3C79FB8621F48F7A6F9C65044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9833a1512b57bcf88ac4fdcc8df4e5a7e9d701d

Path C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\assets\objects\e9\e9833a1512b57bcf88ac4fdcc8df4e5a7e9d701d
Size 6KB
SHA256 5998bf8ee2eecc2779ef896f04a540f9d48d4e96cc9227aae4646f4d9b817749
MD5 26a15393379cd7d6072f09f196027786
SHA1 e9833a1512b57bcf88ac4fdcc8df4e5a7e9d701d
SHA512 73f6fa5e911fd64a3e45037876cc9edd8606c4590d0db5488de2169fddc6d5f80649c0108631e37af2fb52618b477d1a9086c734f8ac901a6b64cb06f64ef0e1
SSDEEP 192:dXDJomrimXOct5g6k2fFttQfWohWydus2KUHSd:Rimzp26FfFrQ+ofus2KUHSd
TLSH
T1F4E17DFECD31E2CCCD5931305A271FA43F5B2AA50634EAD58E94132D09E2A199685998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9bab7d3d15541f0aaa93fad31ad37fd07e03a6c

Path C:\Users\Admin\AppData\Roaming\.wolfclient\minecraft\assets\objects\e9\e9bab7d3d15541f0aaa93fad31ad37fd07e03a6c
Size 6KB
SHA256 f7e03bb5bcc487cea313bfd72ded4cfd4e215b82228cf9744760f61da4c496bb
MD5 246bb0ace989af2b492c055b1d55cf26
SHA1 e9bab7d3d15541f0aaa93fad31ad37fd07e03a6c
SHA512 5f6128d4645a2e3ea9acf81a6ac55f00776995d5d1b7d72c4539e8fad65db2e32bbb75c195c9b7c96a7189408fd402992f506feffb3728ce8d28002bf9fad1b8
SSDEEP 192:kDJomrimXOct5g6ked/w5s+DqL4IqCTuY:uimzp26hYy+DOKY
TLSH
T1FDD17DEADF90A1C6FC36B23445054EB1BFB62B784875A6C7CB54036D0CA2D9F558108E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-6-0x0000000001720000-0x0000000001721000-memory.dmp

Download

memory/936-17-0x0000000001720000-0x0000000001721000-memory.dmp

Download

memory/936-16-0x0000000000770000-0x0000000000BBC000-memory.dmp

Download

memory/936-1045-0x0000000000770000-0x0000000000BBC000-memory.dmp

Download

memory/936-1102-0x0000000000770000-0x0000000000BBC000-memory.dmp

Download

memory/1852-1835-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1618-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1847-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1922-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1547-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1909-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1545-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1546-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1543-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1548-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1559-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1561-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1557-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1560-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1869-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1840-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1820-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1785-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1781-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1711-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1706-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1688-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1701-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1676-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1675-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1672-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1673-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1671-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1668-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1670-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1638-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1593-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1950-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1951-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1603-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1588-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1598-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1578-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1574-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1795-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1753-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1562-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1558-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1553-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1549-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1719-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1715-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1698-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1687-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1674-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1544-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1669-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1667-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1658-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1642-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1617-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1616-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/1852-1609-0x0000020468390000-0x0000020469390000-memory.dmp

Download

memory/5488-0-0x0000000000010000-0x00000000000F9000-memory.dmp

Download

memory/5488-1103-0x0000000000010000-0x00000000000F9000-memory.dmp

Download

memory/5488-15-0x0000000000010000-0x00000000000F9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads