de1246579cc3b69e021edb97bd2b2968778e062d9e94b0f8172ac1e2913b4a56

Analysis

max time kernel
149s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rara Audio.exe
Size 213.4MB
Sample261014-e17exsfw3y
SHA256 de1246579cc3b69e021edb97bd2b2968778e062d9e94b0f8172ac1e2913b4a56
MD5 1caa7a38efef367a8536cf6139902c3e
SHA1 4745a1199a61ae174db93e5840249e1d0877012b
SHA512 02adeacf62eebec2f067b31f9526b8ea515f9d88eb60e9fabf0c5cd617b41fb21a783c52b7cd3aa25d880e2ae6f385d2a1187c60a236abb9f2362e85e1327cfd
SSDEEP 1572864:h95ha2qtuQLwla4Z+0h9XzjCMQkNdn7gfbuYEHZNzwH4CaezGkC1GKse9J2Xlq0n:nrf7bjHUKTU+E
TLSH
T1C9B88C03E29A41D9C01DD1B5975A9233FE71B8454B24B3DF2BA447522F76EE82B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RaraAudio = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Rara Audio.exe"	reg.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	Rara Audio.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	Rara Audio.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	Rara Audio.exe

Loads dropped DLL 2 IoCs

pid	Process
5644	Rara Audio.exe
5424	Rara Audio.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3344	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4596	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Rara Audio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Rara Audio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Rara Audio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Rara Audio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Rara Audio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Rara Audio.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Rara Audio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Rara Audio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Rara Audio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Rara Audio.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3344	powershell.exe
3344	powershell.exe
512	Rara Audio.exe
512	Rara Audio.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe
Token: SeCreatePagefilePrivilege	5644	Rara Audio.exe
Token: SeShutdownPrivilege	5644	Rara Audio.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5644	Rara Audio.exe
5644	Rara Audio.exe
5644	Rara Audio.exe
5644	Rara Audio.exe
5644	Rara Audio.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
5644	Rara Audio.exe
5644	Rara Audio.exe
5644	Rara Audio.exe
5644	Rara Audio.exe
5644	Rara Audio.exe
5644	Rara Audio.exe
5644	Rara Audio.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5644 wrote to memory of 3660	5644	Rara Audio.exe	89
PID 5644 wrote to memory of 3660	5644	Rara Audio.exe	89
PID 5644 wrote to memory of 3344	5644	Rara Audio.exe	90
PID 5644 wrote to memory of 4596	5644	Rara Audio.exe	93
PID 4596 wrote to memory of 3364	4596	cmd.exe	95
PID 5644 wrote to memory of 3752	5644	Rara Audio.exe	96
PID 5644 wrote to memory of 1300	5644	Rara Audio.exe	98
PID 5644 wrote to memory of 2512	5644	Rara Audio.exe	101
PID 5644 wrote to memory of 2912	5644	Rara Audio.exe	103
PID 5644 wrote to memory of 2912	5644	Rara Audio.exe	103
PID 5424 wrote to memory of 552	5424	Rara Audio.exe	106
PID 5424 wrote to memory of 5328	5424	Rara Audio.exe	107
PID 5424 wrote to memory of 5328	5424	Rara Audio.exe	107
PID 5644 wrote to memory of 512	5644	Rara Audio.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe
"C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe
  "C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\RaraAudioApp" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,16064175020773476542,29654422005031860,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,179992486300925423,10974718984654949518,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:3660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\ProgramData\windows\RaraAudioApp\_spatial_audio_off_5644_1791952255779.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RaraAudio" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RaraAudio" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe" /f
    3⤵
    - Adds Run key to start application
    PID:3364
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /TN RaraAudio /TR "\"C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe\"" /SC ONLOGON /RL HIGHEST /IT /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3752
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN RaraAudio
  2⤵
  PID:1300
- C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe
  "C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\RaraAudioApp" --field-trial-handle=1832,i,16064175020773476542,29654422005031860,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,179992486300925423,10974718984654949518,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2512
- C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe
  "C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\RaraAudioApp" --app-user-model-id=com.raraaudio.app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1791951711728624 --launch-time-ticks=546474048 --field-trial-handle=1832,i,16064175020773476542,29654422005031860,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,179992486300925423,10974718984654949518,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2608 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:2912
- C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe
  "C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\RaraAudioApp" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,16064175020773476542,29654422005031860,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,179992486300925423,10974718984654949518,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:512

C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe
"C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5424
- C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe
  "C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\RaraAudioApp" --field-trial-handle=2348,i,15371680514345377630,611771732305610315,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2352,i,16591703699340720855,8896105080741270198,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  PID:552
- C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe
  "C:\Users\Admin\AppData\Local\Temp\Rara Audio.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\RaraAudioApp" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2348,i,15371680514345377630,611771732305610315,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2352,i,16591703699340720855,8896105080741270198,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:5328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_spatial_audio_off_5644_1791952255779.ps1

Path C:\ProgramData\windows\RaraAudioApp\_spatial_audio_off_5644_1791952255779.ps1
Size 3KB
SHA256 23cd9cafd4eacba617af96a49b04d02c8bde40e4fa13b8930f03e792e991ab6e
MD5 06cc4424782d7ba767c40133c5847c47
SHA1 837f71c43cd88e890ae3bb6e23d74bb9f47c8a63
SHA512 15fd2d848157ddca0f066bfdc455857c5dd968a7a64d42e2d4dd28c26b22c28cc9b6d1d16008dc50671f67816489cac03c060b0227afb317cb1de8ce97e596d6
TLSH
T12D71106679A7DC01444B6257C4FB61801F3175BB889C2015B9FE4582AF7ED22CB627CA
MD5 SHA1 SHA512 TLSH

Submit Download

config.txt

Path C:\ProgramData\windows\RaraAudioApp\config.txt
Size 882B
SHA256 a617833ba5372b5a00ec09ec9ed90854bb2cf53078363cd662db3d08bef2831e
MD5 a18cf462953bfc21801fd16a3e75ea78
SHA1 febce6ab0f615dd0cd58d09dd6c6361b69a9ef51
SHA512 65bef5dc0452a8b50714a035015ead160e2726ccc253385e0642ed6fb9d4a7aa6e13134a48cfadf126d8e558ff72dd8a3a0c31f6f26ff97934de0847b7bd8f85
TLSH
T13D11590C18028C79835B67CFCECA1A2595FD05E96F9C894CC99FCF0132DA3668A17342
MD5 SHA1 SHA512 TLSH

Submit Download

setup-trace.log

Path C:\ProgramData\windows\RaraAudioApp\setup-trace.log
Size 1KB
SHA256 11ad8e624ff27b43869ac869358e6f3460b8ac9e18b062640d4290b0f180fbf9
MD5 ab8025ad43de7cd2037f5168b38c276c
SHA1 898f5c626a8035a4fffc0663e9154b9bfa2be0e0
SHA512 33cf7d3d8d06e3f87eccac1f8986e3ae0eb617c612f977be704668bde76eeea8a773514ef22f125686d6b795ae96bd4db4c052ce998fed3a72a927f6669db339
TLSH
T14A312495700974BC4A6E47CAC626970037F1FDD0258C0EE6F6F1D835224E75D3A2EB56
MD5 SHA1 SHA512 TLSH

Submit Download

5f788f01-83d8-4d59-b5a8-812917be3d2b.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\5f788f01-83d8-4d59-b5a8-812917be3d2b.tmp.node
Size 2.2MB
SHA256 31838fdc8f660392939cbcc30738005fd5e0a2749d47005abbc17cec5e4a25e4
MD5 2082b83dd60ede1b9f59921d6ed9d1b4
SHA1 e6f5b68f816a21a15777db5ed5fcf48c783a6427
SHA512 9f2d6137882d57864e234d2b1be4557baffe0a55c3b004559a4d79494561f91ce7287d40c19390e4646dc16cef676f2f3a0f3df13d8a5bd734f0e42086e22289
SSDEEP 24576:3iMprRUmicA9vqGT0592tMXm0P6DSGZN48sj34sPsecz6ugxt+kAlF72PAjxtj+S:3rprVzcWEi3AqsMNlbhW
TLSH
T11CB5BD064758C8E9D83EB022B417677AE56A221B483D52DF04F48D61082ABFD5DEFFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mfodd1o1.m4h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mfodd1o1.m4h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\RaraAudioApp\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\RaraAudioApp\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\RaraAudioApp\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\RaraAudioApp\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\RaraAudioApp\Local State
Size 490B
SHA256 7c3b8ce99701b4244756f07862d1a1541a7418fd4cc99cb243c914034522c0a3
MD5 97c028e3f92a00c0205bba006202389c
SHA1 6b941c23bd3c15f3f9f0859acd62c7134a27416e
SHA512 d8d5b1710e8ec7ae63d3925ede723af821c59f64081adf4333c2a404f1e2387dacce22aa6806dbf7099d5741554869a15f727d73d3ba719189d64602e20a1604
TLSH
T1B1F00EF128A2DE612E2653BA0A4E2A030DF426AB2A0417442292000280B6E5AEB15837
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\RaraAudioApp\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\RaraAudioApp\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d98c1694-b35c-489d-badb-ee96bf1b2008.tmp

Path C:\Users\Admin\AppData\Roaming\RaraAudioApp\d98c1694-b35c-489d-badb-ee96bf1b2008.tmp
Size 490B
SHA256 dbc7e7f73231c36b542bc3ce99b6f8d75f545afb04387744a54e76b24cdd4850
MD5 72752c1bd879484b373da05e13814107
SHA1 e36be1c8078bab55c5e40bab2759c2b328baf9b1
SHA512 5008decd99d0c986fdcb40e59ce7c47a1df92f271fd4e25cfa804813abd0a4596ae94f5ad11d43cc97d965f2889ccaab4a963e98b0c48b1ab9801774d15918d4
TLSH
T1AFF09E726DE05AADAB5083AC111726030F2439B7A0465621F65D071553FBC849346B7C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/512-175-0x0000015E96F30000-0x0000015E96F31000-memory.dmp

Download

memory/512-185-0x0000015E96F30000-0x0000015E96F31000-memory.dmp

Download

memory/512-180-0x0000015E96F30000-0x0000015E96F31000-memory.dmp

Download

memory/512-181-0x0000015E96F30000-0x0000015E96F31000-memory.dmp

Download

memory/512-182-0x0000015E96F30000-0x0000015E96F31000-memory.dmp

Download

memory/512-183-0x0000015E96F30000-0x0000015E96F31000-memory.dmp

Download

memory/512-184-0x0000015E96F30000-0x0000015E96F31000-memory.dmp

Download

memory/512-179-0x0000015E96F30000-0x0000015E96F31000-memory.dmp

Download

memory/512-174-0x0000015E96F30000-0x0000015E96F31000-memory.dmp

Download

memory/512-173-0x0000015E96F30000-0x0000015E96F31000-memory.dmp

Download

memory/2912-158-0x0000015B9E9A0000-0x0000015B9EA4C000-memory.dmp

Download

memory/2912-48-0x00007FFAF2DE0000-0x00007FFAF2DE1000-memory.dmp

Download

memory/2912-47-0x00007FFAF3020000-0x00007FFAF3021000-memory.dmp

Download

memory/3344-15-0x0000021BFA560000-0x0000021BFA582000-memory.dmp

Download

memory/3344-19-0x0000021BFA550000-0x0000021BFA558000-memory.dmp

Download

memory/3344-20-0x0000021BFA590000-0x0000021BFA59A000-memory.dmp

Download

memory/3344-21-0x0000021BFC990000-0x0000021BFC9B6000-memory.dmp

Download

memory/3344-22-0x0000021BFD7B0000-0x0000021BFD972000-memory.dmp

Download

memory/3344-23-0x0000021BFDEB0000-0x0000021BFE3D8000-memory.dmp

Download