f9b526d269daae93b6fb783e36706148b349717529aa0bd608885c76d9cfedc2

Analysis

max time kernel
152s
max time network
162s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f9b526d269daae93b6fb783e36706148b349717529aa0bd608885c76d9cfedc2.exe
Size 113.3MB
Sample261011-rmqlgasycx
SHA256 f9b526d269daae93b6fb783e36706148b349717529aa0bd608885c76d9cfedc2
MD5 3ff84afa1f019232258302e235f005db
SHA1 32dba1ab7dbe0b68211c4b76fe4d639e91c9ce26
SHA512 e64b43cafc655d035ea15bc4bdfc0bf55fb33b09122f6e7aecf66b5714fb567ceb2246dd3bc4018c368e8fb69ebb65e25725c0f26a63c1eb4763cd2cc4918fe1
SSDEEP 3145728:gHz9yE58d1G3MQoihBUv01FF154rTAT5GgSsy7:KpfcQHUv0vyrTAT8Mq
TLSH
T124483386CC688612E058BD34B1A482E7ED614D066D0D7DA2FFDF37A4FD10AD2DC1672A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4308	CacheHost.exe
1148	CacheHost.exe
3316	CacheHost.exe
2756	CacheHost.exe
5440	CacheHost.exe
4620	SearchHost.exe
2912	CacheHost.exe
5048	CacheHost.exe
1876	CacheHost.exe
4056	SearchHost.exe

Loads dropped DLL 43 IoCs

pid	Process
4604	f9b526d269daae93b6fb783e36706148b349717529aa0bd608885c76d9cfedc2.exe
4604	f9b526d269daae93b6fb783e36706148b349717529aa0bd608885c76d9cfedc2.exe
4604	f9b526d269daae93b6fb783e36706148b349717529aa0bd608885c76d9cfedc2.exe
4308	CacheHost.exe
1148	CacheHost.exe
3316	CacheHost.exe
2756	CacheHost.exe
3316	CacheHost.exe
3316	CacheHost.exe
5440	CacheHost.exe
5440	CacheHost.exe
5440	CacheHost.exe
2912	CacheHost.exe
5048	CacheHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
1876	CacheHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4056	SearchHost.exe
4056	SearchHost.exe
4056	SearchHost.exe
4056	SearchHost.exe
4056	SearchHost.exe
4056	SearchHost.exe
4056	SearchHost.exe
4056	SearchHost.exe
4056	SearchHost.exe
4056	SearchHost.exe
4056	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Queries registry keys for unique system GUIDs 1 TTPs 7 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
4544	reg.exe
1724	reg.exe
544	reg.exe
6028	reg.exe
5844	reg.exe
5596	reg.exe
5668	reg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CacheHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CacheHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CacheHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CacheHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CacheHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CacheHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CacheHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CacheHost.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9b526d269daae93b6fb783e36706148b349717529aa0bd608885c76d9cfedc2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4500	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SearchHost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2144	reg.exe
3520	reg.exe
5028	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
3044	chrome.exe
3044	chrome.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe
4620	SearchHost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4604	f9b526d269daae93b6fb783e36706148b349717529aa0bd608885c76d9cfedc2.exe
Token: SeShutdownPrivilege	4308	CacheHost.exe
Token: SeCreatePagefilePrivilege	4308	CacheHost.exe
Token: SeShutdownPrivilege	4308	CacheHost.exe
Token: SeCreatePagefilePrivilege	4308	CacheHost.exe
Token: SeShutdownPrivilege	1148	CacheHost.exe
Token: SeCreatePagefilePrivilege	1148	CacheHost.exe
Token: SeShutdownPrivilege	1148	CacheHost.exe
Token: SeCreatePagefilePrivilege	1148	CacheHost.exe
Token: SeShutdownPrivilege	1148	CacheHost.exe
Token: SeCreatePagefilePrivilege	1148	CacheHost.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3044	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4620	SearchHost.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4308	4604	f9b526d269daae93b6fb783e36706148b349717529aa0bd608885c76d9cfedc2.exe	89
PID 4308 wrote to memory of 1148	4308	CacheHost.exe	90
PID 4308 wrote to memory of 3316	4308	CacheHost.exe	91
PID 4308 wrote to memory of 3316	4308	CacheHost.exe	91
PID 4308 wrote to memory of 2756	4308	CacheHost.exe	92
PID 1148 wrote to memory of 5440	1148	CacheHost.exe	93
PID 1148 wrote to memory of 5440	1148	CacheHost.exe	93
PID 1148 wrote to memory of 4620	1148	CacheHost.exe	94
PID 1148 wrote to memory of 2912	1148	CacheHost.exe	95
PID 1148 wrote to memory of 5048	1148	CacheHost.exe	96
PID 1148 wrote to memory of 5048	1148	CacheHost.exe	96
PID 1148 wrote to memory of 1876	1148	CacheHost.exe	97
PID 1148 wrote to memory of 1876	1148	CacheHost.exe	97
PID 4620 wrote to memory of 2144	4620	SearchHost.exe	98
PID 4620 wrote to memory of 3520	4620	SearchHost.exe	100
PID 4620 wrote to memory of 5028	4620	SearchHost.exe	102
PID 4620 wrote to memory of 4056	4620	SearchHost.exe	104
PID 4056 wrote to memory of 3044	4056	SearchHost.exe	105
PID 3044 wrote to memory of 4168	3044	chrome.exe	106
PID 3044 wrote to memory of 2244	3044	chrome.exe	107
PID 3044 wrote to memory of 4500	3044	chrome.exe	108
PID 3044 wrote to memory of 2244	3044	chrome.exe	107
PID 3044 wrote to memory of 5956	3044	chrome.exe	109
PID 3044 wrote to memory of 5956	3044	chrome.exe	109
PID 3044 wrote to memory of 3496	3044	chrome.exe	110
PID 3044 wrote to memory of 3496	3044	chrome.exe	110
PID 3044 wrote to memory of 5740	3044	chrome.exe	111
PID 3044 wrote to memory of 5740	3044	chrome.exe	111
PID 3044 wrote to memory of 1136	3044	chrome.exe	112
PID 3044 wrote to memory of 3860	3044	chrome.exe	113
PID 3044 wrote to memory of 1136	3044	chrome.exe	112
PID 3044 wrote to memory of 3860	3044	chrome.exe	113
PID 3044 wrote to memory of 6004	3044	chrome.exe	114
PID 3044 wrote to memory of 6004	3044	chrome.exe	114
PID 4056 wrote to memory of 3044	4056	SearchHost.exe	105
PID 4620 wrote to memory of 5668	4620	SearchHost.exe	118
PID 4620 wrote to memory of 4544	4620	SearchHost.exe	120
PID 4620 wrote to memory of 1724	4620	SearchHost.exe	122
PID 4620 wrote to memory of 544	4620	SearchHost.exe	124
PID 4620 wrote to memory of 6028	4620	SearchHost.exe	126
PID 4620 wrote to memory of 5844	4620	SearchHost.exe	128
PID 4620 wrote to memory of 5596	4620	SearchHost.exe	130

C:\Users\Admin\AppData\Local\Temp\f9b526d269daae93b6fb783e36706148b349717529aa0bd608885c76d9cfedc2.exe
"C:\Users\Admin\AppData\Local\Temp\f9b526d269daae93b6fb783e36706148b349717529aa0bd608885c76d9cfedc2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe
  C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe
    C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe --install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe
      "C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\CacheHost" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1668 --field-trial-handle=1680,i,875894636799529026,1536700550189863489,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5440
  - - C:\Users\Admin\AppData\Local\wsvc\jdk\bin\SearchHost.exe
      C:\Users\Admin\AppData\Local\wsvc\jdk\bin\SearchHost.exe -jar C:\Users\Admin\AppData\Local\core.jar
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4620
    - - C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        Modifies registry key
        
        PID:2144
    - - C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
        5⤵
        Modifies registry key
        
        PID:3520
    - - C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f
        5⤵
        Modifies registry key
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\wsvc\jdk\bin\SearchHost.exe
        
        C:\Users\Admin\AppData\Local\wsvc\jdk\bin\SearchHost.exe -jar C:\Users\Admin\AppData\Local\core.jar abe Chrome C:\Users\Admin\AppData\Local\Temp\wsvc-abe-12278734981947573723.bin
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:4056
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --disable-gpu --no-first-run --no-default-browser-check --disable-extensions --disable-background-networking --disable-sync --disable-dev-shm-usage --disable-features=TranslateUI,MediaRouter --window-position=-32000,-32000 --window-size=1,1 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005 about:blank
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ff946e1c728,0x7ff946e1c734,0x7ff946e1c740
        7⤵
        
        PID:4168
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1904,i,9456314991377856706,10489181519209357651,262144 --disable-features=MediaRouter,PaintHolding,TranslateUI --variations-seed-version --mojo-platform-channel-handle=1776 /prefetch:2
        7⤵
        
        PID:2244
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1904,i,9456314991377856706,10489181519209357651,262144 --disable-features=MediaRouter,PaintHolding,TranslateUI --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:4500
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005" --force-high-res-timeticks=disabled --field-trial-handle=1904,i,9456314991377856706,10489181519209357651,262144 --disable-features=MediaRouter,PaintHolding,TranslateUI --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:13
        7⤵
        
        PID:5956
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1904,i,9456314991377856706,10489181519209357651,262144 --disable-features=MediaRouter,PaintHolding,TranslateUI --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
        7⤵
        
        PID:3496
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1904,i,9456314991377856706,10489181519209357651,262144 --disable-features=MediaRouter,PaintHolding,TranslateUI --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:1
        7⤵
        
        PID:5740
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1904,i,9456314991377856706,10489181519209357651,262144 --disable-features=MediaRouter,PaintHolding,TranslateUI --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:9
        7⤵
        
        PID:1136
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1904,i,9456314991377856706,10489181519209357651,262144 --disable-features=MediaRouter,PaintHolding,TranslateUI --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
        7⤵
        
        PID:3860
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1904,i,9456314991377856706,10489181519209357651,262144 --disable-features=MediaRouter,PaintHolding,TranslateUI --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
        7⤵
        
        PID:6004
    - - C:\Windows\SYSTEM32\reg.exe
        
        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:5668
    - - C:\Windows\SYSTEM32\reg.exe
        
        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:4544
    - - C:\Windows\SYSTEM32\reg.exe
        
        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:1724
    - - C:\Windows\SYSTEM32\reg.exe
        
        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:544
    - - C:\Windows\SYSTEM32\reg.exe
        
        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:6028
    - - C:\Windows\SYSTEM32\reg.exe
        
        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:5844
    - - C:\Windows\SYSTEM32\reg.exe
        
        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe
      "C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\CacheHost" --mojo-platform-channel-handle=1856 --field-trial-handle=1680,i,875894636799529026,1536700550189863489,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe
      "C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\CacheHost" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1908 --field-trial-handle=1680,i,875894636799529026,1536700550189863489,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe
      "C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\CacheHost" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=2288 --field-trial-handle=1680,i,875894636799529026,1536700550189863489,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1876
- - C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe
    "C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\CacheHost" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1692 --field-trial-handle=1696,i,9636684899764398074,2229618758765086479,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3316
- - C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe
    "C:\Users\Admin\AppData\Local\Temp\CacheHostd05\CacheHost.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\CacheHost" --mojo-platform-channel-handle=2224 --field-trial-handle=1696,i,9636684899764398074,2229618758765086479,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    PID:2756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jna4302335644268984599.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna4302335644268984599.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nf_17664844377244523696.db

Path C:\Users\Admin\AppData\Local\Temp\nf_17664844377244523696.db
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nf_2052092316300048070.db

Path C:\Users\Admin\AppData\Local\Temp\nf_2052092316300048070.db
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nf_4569041700947638959.db

Path C:\Users\Admin\AppData\Local\Temp\nf_4569041700947638959.db
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nf_8540672797170538387.db

Path C:\Users\Admin\AppData\Local\Temp\nf_8540672797170538387.db
Size 138KB
SHA256 f3323c1b97ad69ac9fdca36309ff2c1bb375346bff9e1192df9efbe618d8937c
MD5 71c262fed4f0b0404a91a27f9b13e396
SHA1 8995191dd7fea121117a02b8a5168832e552de5d
SHA512 412e4e303e0b847aa519c7d8c20e35c2da7d2a43215b06449c234427eef30fa0d4f73a7c10bea6f2cb9a5eb9b2a8790a39986044e66395d917cfd78b46688d18
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2Or8pX6ZcqQVumxwkUd:zeuvBnhJsueMEGvIW1DcP2OsTVumxnUd
TLSH
T13ED3864B3A743002EDE59A721CE050BB5D3CB16D8F55E5D428B620688EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nf_9864048290307266761.db

Path C:\Users\Admin\AppData\Local\Temp\nf_9864048290307266761.db
Size 224KB
SHA256 395a427ee2ce3087d12a7ab69c827f7cf27addc369722e3ed4856a77cc59f229
MD5 134cb4917b0d949d16bc782227c520ef
SHA1 6d0cca3ce9a9066d3ca94605e09ea1a9843cdf70
SHA512 d73096ccf768686e009abc4df4847c5b74b21840e211da9765ee45c129a617a4afd21c781c40018c970c1bd464547561a35c136dfb2ea797f9ee4ed4d8e6ecd1
SSDEEP 96:bZ3FtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqrn:bMH+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T14F24EF4E5F343722CDBD913668E744A35C7CF03F8B5366DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\chrome_100_percent.pak
Size 163KB
SHA256 b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
MD5 4fc6564b727baa5fecf6bf3f6116cc64
SHA1 6ced7b16dc1abe862820dfe25f4fe7ead1d3f518
SHA512 fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2
SSDEEP 3072:IOzwJCGIekwdLpsXYFAXg6IL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:IOzw1Iekam5QpK18Gb0OV8ld0GecQ3Ey
TLSH
T142F3E1D7B7B4EE3DCA5752B7626600B1ECB7452807A1434B178BD8763A72348D8C8793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\chrome_200_percent.pak
Size 222KB
SHA256 fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
MD5 47668ac5038e68a565e0a9243df3c9e5
SHA1 38408f73501162d96757a72c63e41e78541c8e8e
SHA512 5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89
SSDEEP 6144:QsDQYaSN6svydHLhQegx5GMRejnbdZnVE6YoppO4:QBfSN6svydrx6edhVELoXO4
TLSH
T1F024E1CB67B8DD3CC96706B3622601F1FCB6113856B6525B03DBEC357A9668988CD383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\ffmpeg.dll
Size 2.7MB
SHA256 c8476ee68088d72b9fab25703093df19237d14387016b77f472e10c99c9415ed
MD5 fa145097e0274da929aacd68c31338ab
SHA1 a999806ef0c15593100e21bc8632d7b1806bac47
SHA512 d4898eed2ea09cb9b1810d783558ee7bf284701734437fbd9e1035138216e1ddbddd77d588a0b722adc5c5fd4a245871537bfb9b168910fc2bffbd6cb78c3c9f
SSDEEP 49152:pPDtyvMYqXiOaeQ3NZ+GEMDbG7m8x7n6mfu/oBLpweNsgMzqvU9n7xN:9SOONYbQG7m8bdazl9n7r
TLSH
T1D7D5AE06F6D640D9D01DC074869F9223F631354A8B24A7EF1B909A252FBBFD46E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\icudtl.dat
Size 10.2MB
SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
MD5 e0f1ad85c0933ecce2e003a2c59ae726
SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
TLSH
T1B8B63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\libEGL.dll
Size 467KB
SHA256 7bee4e33d89e5a4f2b3bc74d632f7c773ae9a399b6b2ba6d29b1192e25695a8b
MD5 5db499ae909083620e47eeea1623b2af
SHA1 bc23303d6885b8f5c3fb84b3fecdf1a678e94a25
SHA512 d656bfa6d59c495d85eee872b372f7fba24f89101c38de1de904ece0d9ffa6eb93de81fdf674efa5ef724ea73188b908b8ad32cfee03c656accb835683929311
SSDEEP 6144:ZuF2Dw0NiKxN6YTfDVTCanVJhPadWQo+gehJp/Ej4:w0iKbbTfDVJ2dWQo+genp/EU
TLSH
T1A2A48D15779444A9E06BC174CA534642EE72B8960F25FBDF03A492392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\libGLESv2.dll
Size 7.4MB
SHA256 ee039e42a4948e9f26ece8515f3c699014fa7803ae597cd3427fa1548962f9af
MD5 57c23aa2c39f11528e56a48ea1824036
SHA1 d4fbf180266eb210f8d83360cbbd3804249c60b8
SHA512 77487060b824cc70b30b30b144b8f174fd08ca6a298fd8c8f45d8417b90b7914a0d135edab39d6a5b2b883d49e9386da382a9ce5c52dc07ecd147f49118efa63
SSDEEP 98304:Ceo+zGD6g/ZXxUhH2jsS5Tgg+uPGOja21pcwXm3zq:C1u0MhHUmkjFCzq
TLSH
T1C6768C03F29641D9C05DD2B98B5B9123FA30B8944B34B6DF2A5847253F77BE06B3AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\locales\en-US.pak
Size 428KB
SHA256 0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb
MD5 809b600d2ee9e32b0b9b586a74683e39
SHA1 99d670c66d1f4d17a636f6d4edc54ad82f551e53
SHA512 9dfbe9fe0cfa3fcb5ce215ad8ab98e042760f4c1ff6247a6a32b18dd12617fc033a3bbf0a4667321a46a372fc26090e4d67581eaab615bf73cc96cb90e194431
SSDEEP 6144:5GdVxPtFXqVtOMP9eXe9HfaYvaVP51SLngF/cjjwB:yVpwOMge9B251SXjwB
TLSH
T110944C1FF7442229069312627F09A6A2FF36D06DA35112563CBD812C33B6B66C3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\resources.pak
Size 5.1MB
SHA256 1d241f5d4403a6e802e898c61e4753f8508ae4dda8fcb7750558ec1ecade52c6
MD5 0e69910860463d5045ec257234bd8dd4
SHA1 33c923c33129d1dccf0bb2dcbe8af983a7000444
SHA512 f6bb7c7b51bb202877739801498522095637caf8a03e2e1f2c6319fede3d3ca656f552061e171ec5e35e176c267fe278c326805d760add1371590bed58e12375
SSDEEP 98304:Ct1j25juJgWPVcz+cd31rJ7JBXbwHgf3IvVrwrWBpcdmTHWCF3UlfPcauPFcHNp:Ctp8CJPdB831FJ5wHwOVkrWBQmTHWo0l
TLSH
T1EE363320F6385C36D0F0A2BE816812738B39D8139665781DB1DF932C5F7CA5E85B47AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\resources\app.asar
Size 129KB
SHA256 a6e3b65be8e719e6e875e9cd5c5b38b3f041b99de83f0455fbf5172293e93164
MD5 7b1407a81a78e24b724e8bd6d0dff968
SHA1 80d36f32661377c760982718ed17dfe415f3e916
SHA512 e149dd9c401446ec7be5dfbbebfcf6b009d256d4c6df347561cc9a37003832f34ac58c2971d6a83690ab968c3d07b521660f598a534603cfaae2711d07c14c0d
SSDEEP 1536:6tlqBzVwWt6g+64/i2iC9zskIzLV5mRopKPx9qeDMKA4S7ufNkGZ0z04/xYX:6tlqARgd4/iLC9zsTfKPx9qCNzSq
TLSH
T11DD3C84E2DF333110963B2789B5F94057325F117360ACA547E6D83846F88A3CA6F6BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.zip

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\resources\app.zip
Size 32.4MB
SHA256 d6c30e4afb5e0971b6c3b3774519cba52a4dff88606d1d635052c4c1bfe24670
MD5 ff479a30559a289483fd561b71543f9e
SHA1 7fd8ceddec101cf65fbc198f9991004680ef1fd4
SHA512 8255e7bb225449a527a7de0e2eb99353cdf63922af26b7ccf1d3448e289551755f13ee0e2469a65e2c7a13b8b8010af4f9c61a34754ceda211ecd7adad270201
SSDEEP 786432:CilIhaxc1cLyQ6a2GhbYIQCAldUTdA8c1aWkq1/KJ4DVs4:mD1qyQ5hbYIulmZA8cdkiiu
TLSH
T14B773347C050D821D12E77321634630B9CC62B6A691C7E76FBDD1B7DAF12AE1E42AB4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

core.enc

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\resources\core.enc
Size 17.1MB
SHA256 4a9b897132f027a95210f8555d9ea06bb322158b0c9e8f1b796800b732b5ea16
MD5 3ee1f85b360f38f5586bffaed838d2e3
SHA1 5aaa5116978d638bea567aa79385f8d95d7c1135
SHA512 68abb51b51944e9fec5153217eb97286bd92088d00bebc7fd56c46e3e11a40743af08b53ef9c7be4c91d4c9d1996cde3d241da8a8545e17d934e4520263be2f6
SSDEEP 393216:fFjF6KEJNcFaRCGQvDgc4ifCkbbEXWeA+rMODxvX:JYKI7JiDgCC5XFrMODd
TLSH
T12D07338180E981118EF37D5886EB4BA38FC597951B530739F42B12349F77EEED1891E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

salt.bin

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\resources\salt.bin
Size 266B
SHA256 f7e0b0ba14692635881a8500d9fd3a6a4bd5191109707e2b1639b153184bf670
MD5 e8283fdb84dc6e3e8efad365f448ccb7
SHA1 aeedcf90594cc4fc9a9f45c07305238fd4ad7f59
SHA512 3dfa2ecd7171b5ee5547b0e236c609b492adb311e57dae91403005d1531b2f58cb1ff2262cfdadef137866fb3af84990e5d9edcffd5217b71cbb58bbceeeaf7f
TLSH
T122D0EB20036BD8A28090B2A96FC96880668200412E1CE482234940884DAF01F878D09C
MD5 SHA1 SHA512 TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\snapshot_blob.bin
Size 270KB
SHA256 b6bea91727efb8c88e7c059856553d3a47abd883e60dd60efc01b04dc6eec621
MD5 d20922aefcad14dc658a3c6fd5ff6529
SHA1 75ce20814bdbe71cfa6fab03556c1711e78ca706
SHA512 dbd63a9f01feb3c389c11b55d720b5d689558626041fb1dd27ded2be602e5e2a8d210f785fde025d7b9959f81de3df7fef06981269b58be564df05aec190dd1c
SSDEEP 3072:FPXttcgbBDoChde06wbRMYKHUeynXtxZ4fQe1:tXPh9oCWCNMXo6
TLSH
T12B445493B180DF27D12536B4B8CFA58A6126712A7F86420B3779B3BD3F712722F05166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\7z-out\v8_context_snapshot.bin
Size 627KB
SHA256 2db4a98abe705ef9bc18e69d17f91bc3f4c0f5703f9f57b41acb877100718918
MD5 1e4da0bc6404552f9a80ccde89fdef2b
SHA1 838481b9e4f1d694c948c0082e9697a5ed443ee2
SHA512 054917652829af01977e278cd0201c715b3a1280d7e43035507e4fa61c1c00c4cd7ed521c762aebd2ea2388d33c3d4d4b16cee5072d41e960021b6f38745a417
SSDEEP 6144:LlAKlrnVVc/eK7cPg9oCWCNM+MFjfjfGJCWXecRvUsoA4EytPcAzCYY:LZ0t7cP+Yz7Vcrz
TLSH
T176D48FA3B345CF67C1642DB0BACAD656B5B43449BF4A062B7368A3BE37396311F14072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf7518.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite-3.45.1.0-ef92b160-16f7-452c-8e15-901c84d94a0c-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.45.1.0-ef92b160-16f7-452c-8e15-901c84d94a0c-sqlitejdbc.dll
Size 946KB
SHA256 d7098290c4f013c6cbfb731e4db28053e377fdd34f3a41811eccfb485c3efb49
MD5 cd7ebbb31c4782708b3c8accc6458ae7
SHA1 52b904182056d59defb6543b7f424895785c18f7
SHA512 5b2ab3f646998bf1320afc0cf832e61332d3bf17af941c54f21f9e2ddde9d08430b5b6c204ef693a54492eb4650332bb06d15dea3cb3bc0a4c8fb65654581506
SSDEEP 24576:USiCV0DvBp8w+IQDAKazEK5pQ3zG2DpqPMqBFk9:UmwpXrQkKuIqPMqBF
TLSH
T123254A13E3D244FDC57BC2B0872FE723B632F4492134A94F6AA48B642E61E60975F758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005\Crashpad\settings.dat
Size 40B
SHA256 fa1141626a78feedef30029a95edb1c2db95ee743f32323c29a6caf28ff58b08
MD5 a890b526c2a5c970c23e5db12e4572c0
SHA1 db2b2d82d410ec77d82c337b643a5cbf0bf9b06a
SHA512 59787201c96f7278efaf3c66692a35dab9ab4b988af4b723fc31478fed015cadb300cd1b5779a3ca991476efa062c81d57b55448f80e5fb53e5f9c0aedc6bdae
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 c6cc3d2521a1c3d7b95cb85b397322180e5b6f20e68611c4b7618499dc788686
MD5 26de0e0de681b78eb20533d0c36a9fef
SHA1 214e588c0bb03ad751c6599c7f8ae6750398ef0e
SHA512 ccb3662c7cd761f15c02b70b9ffec3cde61272a36186b56a87dd116d679cbc87540f9a25dbecdeeb8cf5dbcc6f72cbf8e67c8b6ef955b0646631eaf58c2dcfac
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005\ShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\wsvc-8382497225521691005\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.jar

Path C:\Users\Admin\AppData\Local\core.jar
Size 17.1MB
SHA256 fb601e50ddf8430ca3b1016e0be78ddbc29320edc733df698bbd4852a79c75fc
MD5 349a01440be9778456a0ba7f5c90f21c
SHA1 cdfc94be82fe501d9fa1f1ea84354237ca9d7fc5
SHA512 ebd9a0999e51d06e1e4b9e7ace7c949fc3abcba6570d27bd832e7155c1d225bb1ccae7acfba6357eb9a22c69ee4e9b137bac027491b6abb78cba5f76998f8082
SSDEEP 393216:edFIf6gSOsVfPIfCS8/EJ6pGBw1i8nJ0Hp+tR/qPyHJf3CADsoW:cFIpSOsafyEopGa1nJgeR5HJvjjW
TLSH
T196072327BECAC929EA2754B351C28156647E55A8EC0B807F03A89DC6CD21C4B1753FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dropper.log

Path C:\Users\Admin\AppData\Local\wsvc\dropper.log
Size 198B
SHA256 9caab052bd34ea80dd0fe2bb834810c23d38cafee1fd4f17f2a840ad99b91660
MD5 dda28eba455c1a80bc25fd4b6be16076
SHA1 731090d66a0593fab0c36d66e4fd564b4336417b
SHA512 122ca20af98fe9f6d52678eeea6284eeb2e43d54392cc6307543528d6e727e7aa20c0858903bcd22f674f15dadbd50fc25983976b1c7f3cbee138e1aab263474
TLSH
T1DAD0124447F7C5650EE85E77167FE058D1F108193BA8239A5721E30C224FA0CFAD2725
MD5 SHA1 SHA512 TLSH

Submit Download

SearchHost.exe

Path C:\Users\Admin\AppData\Local\wsvc\jdk\bin\SearchHost.exe
Size 49KB
SHA256 c2f9e643e8524746de522e1b907abf6f8fce1840ca875008ffacd2eada6c27c0
MD5 96f0bc75cf27748a1971b3e0031cf022
SHA1 285bcc4c01bfc352675551b780941604f52ba655
SHA512 b547a124b895d05318ede2c87578e49d129d51b3af4b01085cd6e68a0ff713ec73dda1edecb9d972bb376dfa1c87e487188d73a69a64436756741e27cbff7dea
SSDEEP 768:hgKzj2JM5R2TyJ5R3s8D/bkt5Ruz3Vb36y5lYiDLk5uIvrP:qKzmM5RdJ5R3sozkt5RA36y5l7lIvL
TLSH
T156337C47AE082C81F42F88F158A6752615B4BD032BD163FBBDC6B21E0D71391A9276DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\wsvc\jdk\bin\VCRUNTIME140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\wsvc\jdk\bin\java.dll
Size 119KB
SHA256 9b484b6a703e890292ab3bdb43c81c17eac1eecce585a28205d32ae42c3bc049
MD5 71e0b8b254ce0a6a6cb057e5c8d63989
SHA1 b9c8755987ed825398a74384720ce3bb3be36188
SHA512 bf546a4c25297ba50407874be3272c26d9fef9d7659bc0bba5e1ce17ea6db4849f1fa96712b607c20a78b49a7708a2faf04edcd0cc1f787812daebfc44c4e486
SSDEEP 3072:g3wQqkpOFiVohaEOvYej03X4yNGBv3UfrRa2wOv7:YIkpOFiVoKgeYaY7
TLSH
T18FC35B5BB3558087F47EF1BC806A864BD37274B11141A30E43A9CA6E9F8FB713D1AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Local\wsvc\jdk\bin\jimage.dll
Size 33KB
SHA256 8123408896077c9fcdcb0d5809d5bdf6e96a3e3a1a15bec2dc7432f68b42acf4
MD5 ab5c5bc5323ff54e4abd592d9a0c9c1c
SHA1 3f68fbd319c77eb8552f7d52e2dfa9d66e0e2399
SHA512 30a03cfb414e08a1260de5c6b873b0d0e73b3ab8aff94324523237ed53e5a67d770ea2f3d4cda669919b6ba3ec011b726b0e29c9a348a464a56a228c21775b2b
SSDEEP 384:r55kBR2x3tCn9LD+YuNIpsByvh7GBmBNyEIYi2mL4/y8RbIIvZgZ2dm:rFHCnFDCIpsIvh7L+YiDLk5uIvxm
TLSH
T137F27D5AE6841C89E927E438D4AB9A1FE7F2F9524F51C3CB1720815E0F333813B69792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jlc.dll

Path C:\Users\Admin\AppData\Local\wsvc\jdk\bin\jlc.dll
Size 87KB
SHA256 1e189c727f043e924cb8779b673702ba836faa7c9e752e2743b69cde70a2c1fb
MD5 16f5214869501fdb6ed2a788185dcdb5
SHA1 5c4d54a97111a47edc4c80863b4550d9d77d2035
SHA512 4cff432682afca40cbe43562c7780ebd8d8377411a6ae85bde05624a23c8c12b5b9afd79242fe442abb47f3cf095d7f4dbad35d42a4aa633793173a0f2e754f3
SSDEEP 1536:Hamt/822Yaqd9/MoU4XTZA+DyzdQIOPQ9BtG3aSq7lIvd:dt6qdzZu+2zIPQ9BgKSqOvd
TLSH
T16B938E9713E011E1DEB7D578D9B4960BC3F2F0522B61838F136885AA0F636623E1DBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\wsvc\jdk\bin\msvcp140.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\wsvc\jdk\bin\net.dll
Size 58KB
SHA256 da8fe694d71e287cb1c74d478d8854f55d6ea26aba17e58050b772a0a7ef79d8
MD5 a6d4a08b8776fc3b29893b93045319ba
SHA1 ab9d159042d71a8981ca08d6970dca1244bd9213
SHA512 2c8df49934e6dee44b16d8d9fab8ec5bd3f5c7a242bf8490b7ceab649b153a1156807bf6c52973b738b5c0757f2c7c928bed72ad16b5147fcc8d2f67eac40037
SSDEEP 1536:5rBn2bLBxyvTtPnhv5aw+YwT2e+IUmXKKPn7lIvO:XnMevxl5aLpf+IUm6KPnOvO
TLSH
T122436D0597D454D4F867CA7886A74E16DBB2B470225087DF1378C56EAFE73B23B29380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\wsvc\jdk\bin\nio.dll
Size 78KB
SHA256 50cddbcea627390ed9dee80da7ca9d1942c4c7b1e3f138276693d487a6dd589c
MD5 02d6ea954bab92b5fff6bf6360977c4d
SHA1 b130b43bd02285ddf3835935c9ffe4f2db30d11c
SHA512 3b1d594def58ce579e36b5f0607cf933a8658ea283ebe26aa33b6a8971e6af8e7f13f04b14a1d999f7bf7da1a99ca6a2cd3505d0f99de79279b5b165fe872327
SSDEEP 1536:zuKDrKVqEiWtCnNXHlJ4OzuwcTNOaRHpiys6hD27lIv9:zuKDuVqaMN3lJhXE3RHpi1eD2Ov9
TLSH
T1C17329A343A4889BE86AB538425A4747E733FC114510A75F5368CB659F1F2B33E3E782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\wsvc\jdk\bin\server\jvm.dll
Size 13.3MB
SHA256 3df13bd73c7dbeef26693cef664b4ede84649720f7a12f0203215a65656d25f4
MD5 9499ba688fc7119fcd6f1ae2328afef8
SHA1 ac4a922693f221cd80d6bcc2d29d6a47fe447a36
SHA512 19550f2df0703ee7e2c7d1f1337248fd6455c341282965eaaa31f5877714b49a26d65309e919067bf95b64e07a375b084b6587daf1bb3f727a9c7cf93ed7f130
SSDEEP 393216:p2BHL1WWxRXvIVZwHbvxXKQTT+w9Q4kiKPZBCCb+7zErv18K35t5YJGTOIqSQW+K:w3W
TLSH
T10FE66B17A77840E1C06BD179CA97AD0BD3F2B4944331A7CB51A016ADAF67FE2193E360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\wsvc\jdk\bin\vcruntime140_1.dll
Size 48KB
SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
MD5 2bd576cbc5cb712935eb1b10e4d312f5
SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
TLSH
T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Local\wsvc\jdk\bin\verify.dll
Size 53KB
SHA256 dd1d4af0d2c1348f29a143c358922be9d071addbf0d103d15910332cf3b74a58
MD5 e9fe8aceeea4b9adb01172354bb1edc8
SHA1 c5d3dc4e5d37b376b3173892631c2b56c70ee0c5
SHA512 23add4c23ddc206b0afe689411de04107e8c4c52b3cebfe1874d2372de824cd419a7228d9342a9e5b956f4dae7701fb52b94ad14cf6d51a63083a771c9ca1374
SSDEEP 768:4/CLyeM3rBXI38xzmjNSbYpviCCu+pXr5KZ6We2b5PM2D1qJYiDLk5uIvvU:8CU7O38d3bIRCu+Z5QDbdM2BqJ7lIv8
TLSH
T16D336B5792640476E483C638C663AEEBDBF1F4450B0083CB525487DD3F97BA0AB257AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\wsvc\jdk\bin\zip.dll
Size 85KB
SHA256 a9ae352e10a098403f497ea69442818be1148a737792a21a7d568a4836d2dc06
MD5 42206886971420feb25f7c246c4b9df3
SHA1 32f64cab00db08a428f03d4238661a5d1d01bc7d
SHA512 4aec7eb7aba3b47c5cf6ef1e03e475462feef532dca7d45f9cb4210877bd2d7c690a80281b9780118f403a0d2d46367f5364e97eb6efded791cf29644d2cebae
SSDEEP 1536:eWXMxC9p/oorxZtRi58KSUXbIOxgljJ2y7lIvP5:eWXMxC9p/Nr48IxgNJ2yOvx
TLSH
T12783AE959AA05051DAFB95B0C9F34B6ED3B9B04553A147CFA358836A2F532213F0C3FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logging.properties

Path C:\Users\Admin\AppData\Local\wsvc\jdk\conf\logging.properties
Size 2KB
SHA256 b62d2733ab99556b108a1951d894c5a8d76b1ac7a00c02c388f9eb9be046c56f
MD5 0f00ec3e7a7767a4efeae1875fb5f3d4
SHA1 167808418571e9209b952188ddab2f4e62920e68
SHA512 e869f4a3b821a9933796dc9a56ee00483493369dfbfe07b3b1d895cb8318c6821cd44134eb37513f15b830c25861b596646824ed56672d08b678fefe6a4c7504
TLSH
T13B51EE5EAB4E2D35434E00AA5A7FF6527E1898BC1C23A5F6B35E6304711D83485DBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

net.properties

Path C:\Users\Admin\AppData\Local\wsvc\jdk\conf\net.properties
Size 7KB
SHA256 56dd1f6095c189c1052f6baa32e457efc09de4832e19cdb82bb236dc8abfee9f
MD5 0c091bb338f924911db463aec454ba8b
SHA1 69e86a02207c1126a0d9faf9362a8d1798b140ad
SHA512 d0d257c7b0fc6059faef88603c07a9e1cfe6692359eb634b3436a02723ff015d36d523e1c2a252649db7cd4d0e24be114c042e3e209ce027ee07b7816466109c
SSDEEP 192:/LVGG4f4z346et5m27SnCgTe93hf7k9SrnF:ZGxYCUCgY3hzk9+F
TLSH
T1DAF17283BF46B7354399C291E21EA7EEE32C913C5C3375B831AC850D2619C76427F4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Local\wsvc\jdk\conf\security\java.security
Size 71KB
SHA256 7eff0eef66774d0c6a07f6c69fae02d8a7dff9b2ef3d7751af9af87a4dda33e6
MD5 20ffb7871b57243e82d798b265a429f9
SHA1 f6582cd24bc26c2f0cc85cfa9dd03ba5c308287e
SHA512 20c251ba71f0ee417131150100df3eae06f861f02a08f442770a6a742a8152337ad2a96da892a47f137b584ec195b280e683afd80d0d95a00fe41ff7b329e456
SSDEEP 1536:r+My8Si8MRjJPFp5/jTNHu1UoQ2k/gl0ugzYilNndOc98:v8MfPFD/jTNO1UoQDciDndOcm
TLSH
T14663D422BB896B7206F211A363AEF1D9F76DA12A22325154748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\AppData\Local\wsvc\jdk\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\wsvc\jdk\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

modules

Path C:\Users\Admin\AppData\Local\wsvc\jdk\lib\modules
Size 24.4MB
SHA256 0b7e1c9a64ed07c015291378a91b42be7f7ab972474cb5bfacd7b602bd8fd6ab
MD5 96d2261e80f34667ebe68449d37adff3
SHA1 d0df2d9d474d05e3dbeac064f1a6ec2ebaa72364
SHA512 bf35a9b75f8e4cb4fa4a7bf7ee507e853b0c55f129258d9e02403869462a8d208698813ddd2e608ef6c320bde28b1c276b34b73631a9876f952e5dcfaab531cc
SSDEEP 393216:a1C5fbHsGKcY3TbaGSzBq8GWwD0VoWKP3Av+cd/w/r62h3RuAPXW3:aejjpY35SFxthKP3AWUaGwuAO
TLSH
T1F347120EB8C18B11D99A59F78562A6D56730A4C4FE89839F1085325E3CBB923CB3F57C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Local\wsvc\jdk\lib\tzdb.dat
Size 100KB
SHA256 5906b44e25a8a730131d7ba1beb5d15af27043f6536f1a169ca8a5d8b8bed8f8
MD5 1c666dde9e9c6fe77715e29d61960af2
SHA1 b6df03d1b9231bdce9ee6f5a3eeac881994f5f1a
SHA512 2a015071df1b3eaf6f5ce1c15989c874c48ca1f4818e3a24b650151292945e70b07b43baf0dad72828621a5748b8276b3ac7c17dbf0768b1881a30dd140daf2c
SSDEEP 1536:y0ExeF88hPdr92L674jAGubqn0Lg/////UzJbPdJPNL0mIT/M4Z3jyxU:yPeq8hPdrcWzbqn0hJzdxuT/5ToU
TLSH
T16AA3C4B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Local\wsvc\jdk\lib\tzmappings
Size 21KB
SHA256 b41575b332809b37ad423bdca30c7c48cdef3d82f82fa9d534781a6f15d6a2ab
MD5 4c30d7867505379a18a27d0e8f03198c
SHA1 0cc871d5bd91e061d676a861749af68bbc0ca9c6
SHA512 873d329682ce67267f438b88eee0fc25cecbbcc1f7d694118417ad12756ec2b6ae7502ec4eea0cc9b4ae8b9e68f5f8877762fa13dea89c4a6dcd54fd8bf82c56
SSDEEP 192:3nqW46ARn1+RQ7wbNQQSaapvQZglEcCDqvOCJqGic3yzA6bbAdOFmYXKhJmBW:3nqW46ARnGQqN2KhcQ+qAa9W
TLSH
T1CDA25386B06662D4C073EC0D7B527AD3F886F3C899C69A4D2943C366BD019B767E1837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

009e8c7d-c294-41c1-a672-3db4a0989482.tmp

Path C:\Users\Admin\AppData\Roaming\CacheHost\009e8c7d-c294-41c1-a672-3db4a0989482.tmp
Size 434B
SHA256 6f40d3d59284eee38a3aa8caa4252c9a58b78a98499e3bf25b3e4ad125eb437f
MD5 f4220f54450f80397426590af91ece15
SHA1 85e9459930750e17161fee0533f1c148efed7874
SHA512 f5d6aaf5cdffc52b278b664bcd4c1ab8b64b5be842a16189c2c23f646ec45801e81186fe7c8b249bbbbecbcbce2a6d16e01ac21a91384a2118de84153277bd1f
TLSH
T15BE02B727AA91ED12F15BA821A21A61B0C3C6AF340A81B80706B060322E3A83C300E35
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\CacheHost\Local State
Size 434B
SHA256 8dd57ce67fae654b94ad74b80b859bb05176bfb7af6b373287c1657bbdee2393
MD5 ebd274c90d29dede3ac550fe37ad39e5
SHA1 2e7def847c6378ec568b7197308396c47974a1d5
SHA512 6018505ae12f839be37aaf7b1329ef2a426842d8bd6b1719a7da910e9babf8850927e83dea870f68a0bceb07583bc439998ec0ee19605bc2d4253111c4d1552c
TLSH
T102E0AB3220B127E9FF28954A893AE3134D7C652BCA1A297C6D5EA6074A67586CA04D38
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4620-700-0x00007FF94D290000-0x00007FF94D384000-memory.dmp

Download

memory/4620-810-0x00007FF94D290000-0x00007FF94D384000-memory.dmp

Download