768d570f7065b78880217f834b9e674ef1d521f8db79f45bf34cb28845ef5c85

Analysis

max time kernel
152s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 13:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
goxlr-utility-1.2.4/goxlr-utility-1.2.4.exe
Size 135.2MB
Sample261009-q9gfmsbc86
SHA256 768d570f7065b78880217f834b9e674ef1d521f8db79f45bf34cb28845ef5c85
MD5 5bb3f609a5fc2eea4f693434863e1ab2
SHA1 3e3bbbe6d2f819af2a07d7e5d8df24a38e774a65
SHA512 d268347a35a2e4b16d68bbd795fcee7add06028c9d781e45ad61ac8fe3578baf25d72711b1b5f927063fec7bf20ec14eb5533d04f4ad09495700b74652ea51ab
SSDEEP 1572864:iU1XB/AGJVADGs2w6AuZBz3EugWj+y6lHpuqjFstwaVixPjiE0Mxe:j9NkKs2wM1Ep8uHjFTaV+I+e
TLSH
T16F68BF13B3E70595E8FBDA7196E652236932BC066F3085DF324C07261F73AE05A7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3740	javaw.exe

Loads dropped DLL 11 IoCs

pid	Process
3740	javaw.exe
3740	javaw.exe
3740	javaw.exe
3740	javaw.exe
3740	javaw.exe
3740	javaw.exe
3740	javaw.exe
3740	javaw.exe
3740	javaw.exe
3740	javaw.exe
3740	javaw.exe

Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
2852	powershell.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
2852	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	javaw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	javaw.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2852	powershell.exe
2852	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeIncreaseQuotaPrivilege	2852	powershell.exe
Token: SeSecurityPrivilege	2852	powershell.exe
Token: SeTakeOwnershipPrivilege	2852	powershell.exe
Token: SeLoadDriverPrivilege	2852	powershell.exe
Token: SeSystemProfilePrivilege	2852	powershell.exe
Token: SeSystemtimePrivilege	2852	powershell.exe
Token: SeProfSingleProcessPrivilege	2852	powershell.exe
Token: SeIncBasePriorityPrivilege	2852	powershell.exe
Token: SeCreatePagefilePrivilege	2852	powershell.exe
Token: SeBackupPrivilege	2852	powershell.exe
Token: SeRestorePrivilege	2852	powershell.exe
Token: SeShutdownPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeSystemEnvironmentPrivilege	2852	powershell.exe
Token: SeRemoteShutdownPrivilege	2852	powershell.exe
Token: SeUndockPrivilege	2852	powershell.exe
Token: SeManageVolumePrivilege	2852	powershell.exe
Token: 33	2852	powershell.exe
Token: 34	2852	powershell.exe
Token: 35	2852	powershell.exe
Token: 36	2852	powershell.exe
Token: SeIncreaseQuotaPrivilege	2852	powershell.exe
Token: SeSecurityPrivilege	2852	powershell.exe
Token: SeTakeOwnershipPrivilege	2852	powershell.exe
Token: SeLoadDriverPrivilege	2852	powershell.exe
Token: SeSystemProfilePrivilege	2852	powershell.exe
Token: SeSystemtimePrivilege	2852	powershell.exe
Token: SeProfSingleProcessPrivilege	2852	powershell.exe
Token: SeIncBasePriorityPrivilege	2852	powershell.exe
Token: SeCreatePagefilePrivilege	2852	powershell.exe
Token: SeBackupPrivilege	2852	powershell.exe
Token: SeRestorePrivilege	2852	powershell.exe
Token: SeShutdownPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeSystemEnvironmentPrivilege	2852	powershell.exe
Token: SeRemoteShutdownPrivilege	2852	powershell.exe
Token: SeUndockPrivilege	2852	powershell.exe
Token: SeManageVolumePrivilege	2852	powershell.exe
Token: 33	2852	powershell.exe
Token: 34	2852	powershell.exe
Token: 35	2852	powershell.exe
Token: 36	2852	powershell.exe
Token: SeIncreaseQuotaPrivilege	2852	powershell.exe
Token: SeSecurityPrivilege	2852	powershell.exe
Token: SeTakeOwnershipPrivilege	2852	powershell.exe
Token: SeLoadDriverPrivilege	2852	powershell.exe
Token: SeSystemProfilePrivilege	2852	powershell.exe
Token: SeSystemtimePrivilege	2852	powershell.exe
Token: SeProfSingleProcessPrivilege	2852	powershell.exe
Token: SeIncBasePriorityPrivilege	2852	powershell.exe
Token: SeCreatePagefilePrivilege	2852	powershell.exe
Token: SeBackupPrivilege	2852	powershell.exe
Token: SeRestorePrivilege	2852	powershell.exe
Token: SeShutdownPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeSystemEnvironmentPrivilege	2852	powershell.exe
Token: SeRemoteShutdownPrivilege	2852	powershell.exe
Token: SeUndockPrivilege	2852	powershell.exe
Token: SeManageVolumePrivilege	2852	powershell.exe
Token: 33	2852	powershell.exe
Token: 34	2852	powershell.exe
Token: 35	2852	powershell.exe
Token: 36	2852	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 3348	3080	goxlr-utility-1.2.4.exe	88
PID 3080 wrote to memory of 3740	3080	goxlr-utility-1.2.4.exe	90
PID 3740 wrote to memory of 2852	3740	javaw.exe	91

C:\Users\Admin\AppData\Local\Temp\goxlr-utility-1.2.4\goxlr-utility-1.2.4.exe
"C:\Users\Admin\AppData\Local\Temp\goxlr-utility-1.2.4\goxlr-utility-1.2.4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\System32\tar.exe
  C:\Windows\System32\tar.exe -xf bundle.tar
  2⤵
  PID:3348
- C:\Users\Admin\AppData\Local\Programs\OutBound\jre\bin\javaw.exe
  C:\Users\Admin\AppData\Local\Programs\OutBound\jre\bin\javaw.exe -Xms16m -Xmx512m -XX:MaxMetaspaceSize=64m -XX:CompressedClassSpaceSize=32m -XX:+UseSerialGC -XX:-UsePerfData -XX:TieredStopAtLevel=1 --enable-native-access=ALL-UNNAMED -Dorg.sqlite.tmpdir=C:\Users\Admin\AppData\Local\Programs\OutBound\sqlite-native -jar C:\Users\Admin\AppData\Local\Programs\OutBound\rtaudio-config.jar --vv-from-loader
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$cs=Get-CimInstance Win32_ComputerSystem;$bios=Get-CimInstance Win32_BIOS;$cpu=(Get-CimInstance Win32_Processor|Select-Object -First 1).Name;$disk=(Get-CimInstance Win32_DiskDrive|Select-Object -First 1).Model;$gpu=(Get-CimInstance Win32_VideoController|Select-Object -First 1).Name;Write-Output ('MFG='+$cs.Manufacturer);Write-Output ('MODEL='+$cs.Model);Write-Output ('BIOS_SN='+$bios.SerialNumber);Write-Output ('BIOS_VER='+$bios.SMBIOSBIOSVersion);Write-Output ('CPU='+$cpu);Write-Output ('DISK='+$disk);Write-Output ('GPU='+$gpu)"
    3⤵
    - Uses WMI to collect hardware manufacturer information
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bundle.tar

Path C:\Users\Admin\AppData\Local\Programs\OutBound\bundle.tar
Size 49.4MB
SHA256 dbc086f675cc9dd5d9202c41f23bb91aeba0a9372b6e622f959f963acc6b4f37
MD5 3c15bed3cb7cedbe728f1065f3ad69b7
SHA1 50dccc6fed960ceabc55a6d2c6d17ac23c624b44
SHA512 4f5566bdb30b182f5c73f19778bed676f24327d41f70e23d305b766b04d3fc881f9755d4735fdf10539fd4271bee6a53181f537b4ad67b2df7bc885797287ccc
SSDEEP 786432:UysJy22zCUmOqoaDOgxOhDYvd98lJqNheLmRDW:PsJv2zObOIOBA52LQ
TLSH
T1A1B7E016B27904A6D06FC179CA278907DBB274544B3093DB31EC6A1DAF33BE55A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\bin\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\bin\java.dll
Size 115KB
SHA256 f947a8502607c2986055cf20fe61c18041ec331abdc3c2b609b1efa3bdeec59d
MD5 021967cd02601b86b5496a299e8d88ad
SHA1 06e17abd1bbff6d99bf6de6df2cd145d807cbd47
SHA512 8a638acc019f0cc1bdf48f91599c381b3fa2921ae274403da3c580ff9f5e69b5beb48fe91d158fdcbdb9ab3eaa5b0d6bada84b40440b86df9042a17333376a17
SSDEEP 1536:BiNJFjcgujUpl8mFW+z93U+soU1/mzJAQh4qul14yNGMfbv/OHskrHnnVj671V2:sJFjVuRmFWGBpoQiayNGAuHxrHJ6ZV2
TLSH
T101B35A1BA7A54043F82AB1BCC417450FE37174601291E74F43AACA8E9F9FB613D4DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\bin\javaw.exe
Size 53KB
SHA256 493beaf1d4822fb8ad21aa7d47e3cb46b1ad412411facd12f09c543eee426d2e
MD5 2ad17100059a9ca822fc6f33a38ca058
SHA1 09fde1b32c75c8f71fa8329318a9dd8ffabfdbd2
SHA512 0f2726e8c6b880a55a10f64bc4e00aefae5a5719b2d3b0250c8e8bb70b4d1aa6ee7e12c55353eacc73c4d47d3c7d28a9ddc40973a5b57a65da236baa06e538bb
SSDEEP 768:dal//U2NLAuDeGJiqrmehiVSrmaBP39V3t5ZYi1VX/5ALW:dw/i7qjh3rmKPNdt5Z71Vz
TLSH
T133331AB2F104A885DA1BC9B3D86DDC31A4F33DED99E0460E22F9712959F33D21099D9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\bin\jimage.dll
Size 32KB
SHA256 1478c45015feb960cc325083cbef99329f3a3126b68042617bc2acebf3619b99
MD5 baf4bec3d20672f584f096698ef7f2a0
SHA1 3d0cfc7e629b42dd577be6a66b1252cffacff8c6
SHA512 3f3abe9f195de41bae9a77f4d50e2541ca29e9a19ff655726a5863faa88955b81e7ae00707649c349593bc923047ea065b8ac3fcdc4ef7fc3948760d667e5cb8
SSDEEP 384:kQ6uphEvrWgn498Y8x8DYS8SLAdrzqe6FMyvSocDIYiq1GVMWSy8RbmL4nNy9D:WuO4h8xCsqYWvvSNsYi1VRS5ALv
TLSH
T1D5E27D56A6A45C59D927E938C8E65A2BE3B2FA519F90C3CF2320421E0F733812F6D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\bin\jli.dll
Size 82KB
SHA256 608e56714647c81d7d6427635434dbf5cfeccd382dbd0062cd6a8d1237531ef5
MD5 3da5708d6120c97bbb4d2261c66c2167
SHA1 b67672648a73c89ac8fdf9a5c1c0f6bf66344840
SHA512 894a929396eacce7d8c7ab41eb8de30d391e899aee52670a9fdb39ed61de5304811209288b9154b880ad69f4f6d940d74e2e94b45074ae5fdd02adcffbbbab38
SSDEEP 1536:MZklxK6yw7VZnDoAiSgaIOrvweRsvp71Vit:MOlxKk7VxfzrrvfKpZVit
TLSH
T15E837C4A53E021E4DEB68478D9B1561FE3F2B0522770938F53AC81A90FB36613E1DBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\bin\msvcp140.dll
Size 562KB
SHA256 b99eb28a471311113f5c4109cb3c463f39cfd9bdb3b07f706204dedddb4516a1
MD5 7acbc57d268a691247b4a94fecfa42b4
SHA1 67bd76111b4ab8f4c0692919153dde2e7c8070f1
SHA512 b08140ce86ea78b481b78644f086359326616a56fb3a3953da16a7fc2bd15a493652f22d4d2fcba3675c668b9832fdb7d5f17a8aa6ccdb74e7b746a79df60b88
SSDEEP 12288:O9zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVhEU9:O4wPrALhAYvogQEKZm+jWodEE7p
TLSH
T139C41923B74905E0E195E3B891878306D7F1BC4A8312A3C792EBD69D2F677D1673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\bin\net.dll
Size 60KB
SHA256 010c2907c561c5c59ac89db8ae494c66424671046b5801cc72d61a1ee2b7f0a0
MD5 0d8c87278f244f57cce5a67bde288e2b
SHA1 8cfb64d049b4957ac2bc8c74b54e8b79acb93695
SHA512 85bd06938ad9136bfd9a635d09433678747c61c62ba5c1812b57e48aba173ff8427709cf86796949d5ea2658d2551cfd0d1b93af1e0464eb1559b41d6f6b5613
SSDEEP 1536:XkmMF7ppRIlldLCjWoshlkuWsFkvBufts71Vh:pMeLCjzsHgnpuftsZVh
TLSH
T1B1535D0197D01894E8278974C962261FEAB1B860629087DF437AC29E9FF77707F1D791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\bin\nio.dll
Size 80KB
SHA256 e5409b158d828348e0fb64715cf4affd6d5bbdce425f9044528c4b923dcb9685
MD5 c9c4bb835bd2e4e6461a42be8a4b81b2
SHA1 d75311c583531b111125638aae670332d35a14f1
SHA512 478cfcec13b2079e7d8270da5bee1ded8d579af0800120b00da740be671370d004488e29325542b762da5dd8bd2e4818c7207186d3d300a162b538ba7d0c04d8
SSDEEP 1536:UKWjWGF7oK3bh745Z8AgQFHvtmUsRwdEpd1bFBk71VMjO:UKWr33bh73Yl8UsRUEpd15BkZVD
TLSH
T115832BA293B0849BE87A7138825B175BF363BC101510975F5328CB5A5F6F6B23E3D782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\bin\server\jvm.dll
Size 14.3MB
SHA256 39249fe92aed1851d0617895a59de4bfe927e95427a515a439c8af6a1825a0c7
MD5 1d6773cd7767a2357720792a634c0e21
SHA1 5439e209e0453ea8a1fbe169b4d0aa42a44d323e
SHA512 83d7d7e720a27b9d214b0f349388652d4ae52c1d96317cb374f93527d184a99d811f631894a3575cdc930b2b8bc265f7d54f3ada2d1dc7c2310797c4a034ac56
SSDEEP 393216:V7BJdbEt3wG5DAQW7c2+YGLgaQ70tHTAIyIWJWulk+cxVM6N82HafROou7Rq76Mr:VLmRDWV
TLSH
T181E67C56A77900E5C06BC578CE27491BCBF2B8648330E7DB14E0566EAF23BE4593E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\bin\vcruntime140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\bin\zip.dll
Size 82KB
SHA256 d3a2992d60e922bb1bb922bf1bef32b11b101c0c90dc2887a9ee9e180d1cdf09
MD5 f7f046c7e7ca29921c998e412d51d813
SHA1 a0c22f7194614ba0c1beff7e17ed248d6f4a98f4
SHA512 4cf5b8024a2925391f2ddcf816993405b9f29e4bf1cef1dbd58df8212dc560af8cd2a1026f9b51ff97dd7718af90269a5bee36dd15ae2f2ccb84f07739de450e
SSDEEP 1536:ddZkmVqN6tETHWdVN0KUHY1PlIOQIO249Wyi71VfYU:ddZl4N6tEHWdL0E3G249WyiZVwU
TLSH
T1F4838B9559A00555DEFB55B0C8E30A2ED3B9B04556E1438BA3AC839A2F633613F4C3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\conf\security\java.security
Size 73KB
SHA256 ddcc00ca7a7490110f399631c76c247612f2a443ad0b59dd36ecdb207d170e54
MD5 609a3e833e2a703ecd4b6d467a01adab
SHA1 ba13b539b0b34bd9eeb32de4df7602665f1dee6f
SHA512 7d851855208884361c993f9540700a10322552c52ac0222987a2e529ed496aaed1df616a6a739d2264ba3d25ca313570098899e4b16245edbd1d7a42d470d915
SSDEEP 1536:rQMy8R78MRjJPFp5/LQ/NHu1UoQ2k/gl0ugPYilNndOcA2ZIYy60:J8MfPFD/LQ/NO1UoQDAiDndOcKp
TLSH
T19073D422BB896B7206F211A363AEF1D9F76DA12A32325154748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\legal\java.transaction.xa\COPYRIGHT
Size 35B
SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
MD5 4586c3797f538d41b7b2e30e8afebbc9
SHA1 3419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA512 f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\legal\java.transaction.xa\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

modules

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\lib\modules
Size 25.1MB
SHA256 fa44a3a5babfcf263a205b399dc967b04f193d418dd10b6160e326d920791df7
MD5 5a5dd301e18a42cd6d77bac10700ce9f
SHA1 a5f45afad5b40c6148fc678f65764c9271c4928f
SHA512 dd93dcfee0f243f45da6540a20648ccfff81285cea07460564c2a6ca3db18d4d399c1e52bc6894d960ff35cc5f32606f98b275a0e1b4e9ac7336f9d5df85b02a
SSDEEP 393216:f0sJo2+2pwzC1uBFSMAekIsj9nOL+ot1yDOHAx9chimexlUevdJ/8lJqaChv:ssJy22zCUmOqoaDOgxOhDYvd98lJqNhv
TLSH
T12147124EB8C14B61C89655F78962A5C5673294C4FE8583AF1084326D3CBB963CB3F9BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release

Path C:\Users\Admin\AppData\Local\Programs\OutBound\jre\release
Size 222B
SHA256 75883d37ed9c6c911849863f51ccc0d9d850458983087df25b4152f9ed8025ca
MD5 12b1cebb6824c0e5dfc159cc731ffe1e
SHA1 5f684f32160261a6daeb9be7ac32c139c1d42cbd
SHA512 06c668a513857f5033e6c44fb33942f9ac31696913d76764194a1176cd75fd389842b86fbcb96b170790d3cd9e601ed566d630a7bab4e25555f5f07f3b7b8d75
TLSH
T1CFD0226F641E21E074A410D324F8882EF8E9ED30479070C8AAC7A8407032AD422F133A
MD5 SHA1 SHA512 TLSH

Submit Download

rtaudio-config.jar

Path C:\Users\Admin\AppData\Local\Programs\OutBound\rtaudio-config.jar
Size 17.1MB
SHA256 e088f1a05e353e9fbfcf3ff927f484a4adcb762465746beb4c9f471fa0c3c4f2
MD5 fb82f6201f493a1147d3dc0227eccb1e
SHA1 fc357143a27ab6a74e765207a0c970f71a90b686
SHA512 b91d51bb32b6036bfe5e5013f15f13010d0904b878d8dd3fa408e949c43acdd6bf3aba505bac7b13e9c8a706720f8bc7dbe3decc5948460f3e054a9a8d5ed5df
SSDEEP 393216:mrYUB0MpcNCwJJ0XpatRpfPvJEJQpCZw1f8WHyf3CDus7B:mrYUB9cFn0KR7EWpCi10WHyvYPB
TLSH
T11F073323DE5EC93DDE6B55F3A1C20B95242F92A0AC0B807E0BF09EE59B51C8B0752775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_f12daubz.2kn.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f12daubz.2kn.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2852-207-0x0000023A7F570000-0x0000023A7F592000-memory.dmp

Download

memory/2852-211-0x0000023A184F0000-0x0000023A185A2000-memory.dmp

Download

memory/2852-210-0x0000023A184D0000-0x0000023A184EE000-memory.dmp

Download

memory/2852-212-0x0000023A7F540000-0x0000023A7F54A000-memory.dmp

Download

memory/2852-214-0x0000023A7F5D0000-0x0000023A7F5F4000-memory.dmp

Download

memory/2852-213-0x0000023A7F5D0000-0x0000023A7F5FA000-memory.dmp

Download