hxxps://www[.]mediafire[.]com/file/j5n8enzvs5e9hg6/VapeLiteV3[.]4[.]2[.]zip/file

Analysis

user interaction
yes
max time kernel
259s
max time network
261s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/10/2026, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/j5n8enzvs5e9hg6/VapeLiteV3.4.2.zip/file
Sample261023-abvbvabg78

Score

9^/10

defense_evasion discovery persistence ransomware themida

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	VapeLite.dll

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	VapeLite.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	VapeLite.dll

Loads dropped DLL 11 IoCs

pid	Process
2176	MsiExec.exe
2928	Loader.exe
2928	Loader.exe
2928	Loader.exe
2928	Loader.exe
2928	Loader.exe
2928	Loader.exe
2928	Loader.exe
2928	Loader.exe
2928	Loader.exe
2928	Loader.exe

Themida packer 11 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2188-1156-0x00007FF676850000-0x00007FF677FC2000-memory.dmp	themida
behavioral1/memory/2188-1157-0x00007FF676850000-0x00007FF677FC2000-memory.dmp	themida
behavioral1/memory/2188-1155-0x00007FF676850000-0x00007FF677FC2000-memory.dmp	themida
behavioral1/memory/2188-1159-0x00007FF676850000-0x00007FF677FC2000-memory.dmp	themida
behavioral1/memory/2188-1158-0x00007FF676850000-0x00007FF677FC2000-memory.dmp	themida
behavioral1/memory/2188-1161-0x00007FF676850000-0x00007FF677FC2000-memory.dmp	themida
behavioral1/memory/2188-1153-0x00007FF676850000-0x00007FF677FC2000-memory.dmp	themida
behavioral1/memory/2188-1154-0x00007FF676850000-0x00007FF677FC2000-memory.dmp	themida
behavioral1/memory/2188-1160-0x00007FF676850000-0x00007FF677FC2000-memory.dmp	themida
behavioral1/memory/2188-1162-0x00007FF676850000-0x00007FF677FC2000-memory.dmp	themida
behavioral1/memory/2188-1171-0x00007FF676850000-0x00007FF677FC2000-memory.dmp	themida

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
177	3320	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
2188	VapeLite.dll

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Zulu\zulu-17\legal\java.xml.crypto\LICENSE	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\bin\le.dll	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.management.jfr\LICENSE	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.naming.rmi\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\bin\api-ms-win-core-sysinfo-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\java.base\LICENSE	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\bin\rmi.dll	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\java.management\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\bin\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.naming.dns\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\lib\classlist	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\bin\jimage.exe	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\jmods\jdk.unsupported.jmod	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.localedata\thaidict.md	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\java.base\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\java.desktop\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\jmods\java.prefs.jmod	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\java.sql.rowset\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\java.xml\bcel.md	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\demo\nbproject\jfc\TransparentRuler\nbproject\netbeans-targets.xml	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.internal.vm.compiler\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.httpserver\LICENSE	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.crypto.mscapi\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.incubator.vector\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.localedata\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\java.logging\LICENSE	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\demo\jfc\Font2DTest\src.zip	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.attach\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\jmods\jdk.charsets.jmod	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\lib\jawt.lib	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.internal.vm.compiler\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\java.management\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\bin\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\bin\api-ms-win-core-synch-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\demo\jfc\CodePointIM\CodePointIM.jar	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.httpserver\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\java.base\wepoll.md	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\lib\jvm.cfg	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.jdeps\LICENSE	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\conf\security\policy\limited\default_US_export.policy	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\jmods\java.net.http.jmod	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\demo\nbproject\jfc\SampleTree\nbproject\jdk.xml	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\demo\jfc\TableExample\src.zip	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\java.instrument\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\demo\jfc\Stylepad\README.txt	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\java.sql\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\java.sql.rowset\LICENSE	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.net\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.jdi\LICENSE	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.management\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\java.desktop\giflib.md	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\lib\ct.sym	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\include\jawt.h	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\java.xml\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\bin\management_ext.dll	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.naming.dns\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\demo\jfc\CodePointIM\README_ja.html	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\conf\security\policy\unlimited\default_local.policy	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.xml.dom\LICENSE	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\bin\splashscreen.dll	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\demo\nbproject\jfc\SwingApplet\build.properties	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\legal\jdk.dynalink\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\demo\jfc\J2Ddemo\J2Ddemo.jar	msiexec.exe
File created	C:\Program Files\Zulu\zulu-17\bin\prefs.dll	msiexec.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI6CD0.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b6020.msi	msiexec.exe
File created	C:\Windows\Installer\{7894792B-4180-4347-A7C2-CFD202F42636}\azul.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{7894792B-4180-4347-A7C2-CFD202F42636}\azul.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97E8.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b601e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7894792B-4180-4347-A7C2-CFD202F42636}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b601e.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4312	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005768639d43407d4e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff0000000027010100008838015768639d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e841015768639d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f5768639d00000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea715768639d00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Loader.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 43 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F15EBFE0300FD7A4C8FF02554F4F10DE\B2974987081474347A2CFC2D204F6263	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\SourceList\PackageName = "zulu17.68.203-ca-jdk17.0.20.1-win_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Zulu.jarfile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Zulu.jarfile\shell\open\command\ = "\"C:\\Program Files\\Zulu\\zulu-17\\bin\\javaw.exe\" -jar \"%1\" %*"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar\Content Type = "application/java-archive"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\ProductName = "Azul Zulu JDK 17.68.203 (17.0.20.1), 64-bit"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\Version = "289669323"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B2974987081474347A2CFC2D204F6263\ZuluInstallation	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\PackageCode = "992671493E40B4C418F2E6EE76164E2E"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar\ = "Zulu.jarfile"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Zulu.jarfile\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Zulu.jarfile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Zulu.jarfile\ = "Zulu jar file"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Zulu.jarfile\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Zulu.jarfile	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F15EBFE0300FD7A4C8FF02554F4F10DE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Zulu.jarfile\shell\open\ = "Open"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B2974987081474347A2CFC2D204F6263\FeatureOracleJavaSoft = "\x06ZuluInstallation"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B2974987081474347A2CFC2D204F6263\FeatureJavaHome = "ZuluInstallation"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2974987081474347A2CFC2D204F6263\ProductIcon = "C:\\Windows\\Installer\\{7894792B-4180-4347-A7C2-CFD202F42636}\\azul.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Zulu.jarfile\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.jar	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B2974987081474347A2CFC2D204F6263	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B2974987081474347A2CFC2D204F6263\FeatureEnvironment = "ZuluInstallation"	msiexec.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
5080	NOTEPAD.EXE
636	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4420	chrome.exe
4420	chrome.exe
2692	Loader.exe
2692	Loader.exe
4420	chrome.exe
4420	chrome.exe
4092	chrome.exe
4092	chrome.exe
1308	msiexec.exe
1308	msiexec.exe
2188	VapeLite.dll
2188	VapeLite.dll
2188	VapeLite.dll
2188	VapeLite.dll
2188	VapeLite.dll
2188	VapeLite.dll
2188	VapeLite.dll
2188	VapeLite.dll
2188	VapeLite.dll
2188	VapeLite.dll

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe
Token: SeShutdownPrivilege	4420	chrome.exe
Token: SeCreatePagefilePrivilege	4420	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
3320	msiexec.exe
3320	msiexec.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 5088	4420	chrome.exe	85
PID 4420 wrote to memory of 5116	4420	chrome.exe	86
PID 4420 wrote to memory of 5116	4420	chrome.exe	86
PID 4420 wrote to memory of 4312	4420	chrome.exe	87
PID 4420 wrote to memory of 4652	4420	chrome.exe	88
PID 4420 wrote to memory of 4652	4420	chrome.exe	88
PID 4420 wrote to memory of 4184	4420	chrome.exe	89
PID 4420 wrote to memory of 1808	4420	chrome.exe	90
PID 4420 wrote to memory of 4184	4420	chrome.exe	89
PID 4420 wrote to memory of 1808	4420	chrome.exe	90
PID 4420 wrote to memory of 4736	4420	chrome.exe	92
PID 4420 wrote to memory of 4736	4420	chrome.exe	92
PID 4420 wrote to memory of 572	4420	chrome.exe	93
PID 4420 wrote to memory of 572	4420	chrome.exe	93
PID 4420 wrote to memory of 2788	4420	chrome.exe	98
PID 4420 wrote to memory of 3784	4420	chrome.exe	103
PID 4420 wrote to memory of 1388	4420	chrome.exe	106
PID 4420 wrote to memory of 1376	4420	chrome.exe	107
PID 4420 wrote to memory of 4212	4420	chrome.exe	108
PID 4420 wrote to memory of 3368	4420	chrome.exe	115
PID 4420 wrote to memory of 3368	4420	chrome.exe	115
PID 4420 wrote to memory of 4000	4420	chrome.exe	116
PID 4420 wrote to memory of 4000	4420	chrome.exe	116
PID 4420 wrote to memory of 2728	4420	chrome.exe	117
PID 4420 wrote to memory of 2728	4420	chrome.exe	117
PID 4420 wrote to memory of 4092	4420	chrome.exe	118
PID 4420 wrote to memory of 3176	4420	chrome.exe	119
PID 4420 wrote to memory of 3320	4420	chrome.exe	120
PID 1308 wrote to memory of 848	1308	msiexec.exe	125
PID 4420 wrote to memory of 2888	4420	chrome.exe	127
PID 4420 wrote to memory of 2888	4420	chrome.exe	127
PID 1308 wrote to memory of 2176	1308	msiexec.exe	128
PID 2928 wrote to memory of 2188	2928	Loader.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/j5n8enzvs5e9hg6/VapeLiteV3.4.2.zip/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7fffd9b5c728,0x7fffd9b5c734,0x7fffd9b5c740
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,1095961205111508814,12837661039767939898,262144 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,9649478371844663211,17177216714700105602,524288 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,6455454556631075537,1128970190528306404,524288 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,6934142694584870701,1582331264661922643,2097152 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,354323164382897535,11112357111988582332,2097152 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,4214894933568226720,17288201976618645228,2097152 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4988,i,9415560754569938845,8306648592755496713,2097152 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,1834691792458889057,8030220610268628577,524288 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,14850579556275473190,16214628430820526080,524288 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3268,i,2486411934555183168,6491025542842951361,524288 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,15106990347380960848,326484367673531000,524288 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3940,i,12344415586660984349,17783164428060684769,524288 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4528,i,12319570135866200066,6409797822402933972,2097152 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4700,i,16033297399904129885,7457827356800065811,2097152 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6188,i,15708234462930777969,464926662809856834,2097152 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=508 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4560,i,13431310890825535553,10159641714952942861,262144 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,9197072408855074075,13061325738039241327,524288 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3056 /prefetch:8
  2⤵
  PID:3176
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\zulu17.68.203-ca-jdk17.0.20.1-win_x64.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,628450058117684463,3955914097634612674,524288 --field-trial-handle=2076,i,586327166021048983,18361616181746951011,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4152

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\VapeLiteV3.4.2\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5080

C:\Users\Admin\Downloads\VapeLiteV3.4.2\Loader.exe
"C:\Users\Admin\Downloads\VapeLiteV3.4.2\Loader.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2692

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\VapeLiteV3.4.2\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:636

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:848
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F840D2CE4BE463ACBD671F3957480CE0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2900

C:\Users\Admin\Downloads\VapeLiteV3.4.2\Loader.exe
"C:\Users\Admin\Downloads\VapeLiteV3.4.2\Loader.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\Downloads\VapeLiteV3.4.2\VapeLite.dll
  "C:\Users\Admin\Downloads\VapeLiteV3.4.2\VapeLite.dll"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5b601f.rbs

Path C:\Config.Msi\e5b601f.rbs
Size 146KB
SHA256 7209375e72c24bd015a5e8adee2eb3fd6b80d27449a7e16d3bea7aa34cbfacc3
MD5 8efd7921b1248fc4046a54a1529248ad
SHA1 71ad610d47e2b7e3b65b65713df115439c9d3f88
SHA512 ac28977ead4f934cdfdf3d1c4f0cd619cfc1273dd3ccba414425b0ebf2f47c27cd3e2f65ab015a404f34e99ad1279b4c7e343967ba25677c1716ef1bfa45cb43
SSDEEP 1536:ZqYwgOPv1Du+sQeBzTlR1DEJlwMvB//v8I+ZYYJEaEY4BahFv7lkwgfAzGBCFzXY:KE9bH3kusEdosY
TLSH
T155E39C878DD9D9D0F24134A033861B16C349D84D664A71AF33BDC39BECB3AF995A88D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extnet.dll

Path C:\Program Files\Zulu\zulu-17\bin\extnet.dll
Size 23KB
SHA256 1e85ee30ad2f6018f81e0f1c9ba2ec20151819d1a2edd72cb643b1d77ff5615e
MD5 b268412a5509cf39b3b12792bad66f25
SHA1 83bbb61d1348caaa7b4f8f8fce0073fa1030e652
SHA512 29873ad1fa341c96a5e9fe2836187958d237cc5ac3948dfe4377a3411711295e085bb690ba8a5c3d61c297b4813caeca886319da6bdccd6b11d747e49c74ce59
SSDEEP 384:GvIV18LniTo4rbcqGMH1IYiGA3rGy8RbmL4nNywaq4:GvxjiTY7aCYiGP5ALa4
TLSH
T18FB27E43CB94088AE9329570B4E61A17ED72B61057A193EF1334D11D5FB23423FEFAA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Program Files\Zulu\zulu-17\bin\java.dll
Size 143KB
SHA256 28295f5f619ab03e0a958f1f8b4c673584c6da99132a31203d98218383bf78bb
MD5 309fa8e39346fca8dc8048077bebefd6
SHA1 25db32dad546d4fb98aa75457742659d091563ec
SHA512 520cf64d9a1ee1e0b3a444e0ce0bcd08e30bdea088fd2e9af7be8c8c887429dde4a63a92fd416de948b303500f0bb4ac88bba157c2acd32534d6d6f0943ada3e
SSDEEP 3072:XGRGQ31gdQ/cHoV0qT1HoYdHL2Gjdf0HTwLJSr5V9cQEh:XwGQ3T0+V1xCNSz
TLSH
T1BDE33A0BB34240A6F41AB6B8701A810BD37A7461412DD3BA43E98A4F9F6F7317ED7791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Program Files\Zulu\zulu-17\bin\jimage.dll
Size 32KB
SHA256 e3d44d1b6afb2fe51fe3c5ea5c8f817b9b739ebfe457da0c97180b173d07b170
MD5 4239fc834fe54b8dfda43f93e4d79349
SHA1 42cf5da8d703bf7bcc8b85a48884420b38b7c9f5
SHA512 95322ff0ce1a578942c2fbedd04e4d8cb5ba9032403ea0705d390ecefc35e363bef544d2a286ca905fc26c1ecf6f493b99cca6e77e47fad15976006380c2f424
SSDEEP 384:C49JZPLu5NXUonW52Xrivq/zDV1fM/yvLbAPttrPHhIYiGAADy8RbmL4nNy/6J:H9JM1nW0iqnVFMavLsHf2YiG55ALly
TLSH
T183E26B06D6981C5AD927E538D8D79A1BE6B2F5525FA1C3CB6320434E0F323903F6D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsvml.dll

Path C:\Program Files\Zulu\zulu-17\bin\jsvml.dll
Size 849KB
SHA256 5ef929067012311d270f6fdb09a0b1620b788cc27b4cb3193a34fbe68d224da3
MD5 112e747fc01c47558bc659337495fd5d
SHA1 1a940c5e0516960abe9179dbb106b5cfd098d1dc
SHA512 0820694c91865951a9b258b7cbd12716561a978e908e37a6308199e2fc601ad74ebb61c162ebb6404cdbf26363accf005e6805413272ee525c345ab5e0d2b964
SSDEEP 12288:IRybOUKnvJNeCs5wHu6XTz/V71AVNV+Ssc3T:IobO7JN3qwHbXTzN7wj+9OT
TLSH
T13A05AF82F81284CDC03534B024FFBD95A91A1CE941BC0EB32772AE9D2AFD7467957A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Program Files\Zulu\zulu-17\bin\net.dll
Size 94KB
SHA256 69c85b4c1c7e8cdcc95a9bd8de4716ace032482c5ffa33aca285b1fe01a6f697
MD5 a1b97d0941204262afecf8d013178792
SHA1 73e8831217d2c080e0e1602e296d7a9c45ecdf40
SHA512 fb7583e3506c9afb1ba3984d61d364f8623c29a57ac27201f43c90236073c20116cfd851af517384629ef16be6014bd42550936c1fbd7b0e92c58c149f329af5
SSDEEP 1536:WmCZqFpaigs84/awvO4XdpSDeVU2+pKyPkExVKYWf8G0y/XXfq7N:WmIkpaigsF/awv9Xdp18pAExv88Gv/Xi
TLSH
T1BC936B05A36814C5FC77D2B88646861BC7B3B0B0265093DF13A5CA5E6FEB7713E19B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Program Files\Zulu\zulu-17\bin\nio.dll
Size 78KB
SHA256 66cd6ef8721ec002971ddb0ca8cfa08db20d2488fe9fe022fce0fc5b1f3a58f6
MD5 1a7cede1936ba43c714ba814743efb96
SHA1 0ae7c6c517145a8475eaf5f3f725e3fe261d9848
SHA512 a29c930cf85ec1f13837c29839311cfba1f583eb03826f20dbb77f098eea1b793d132c5c1baa68941a5e135e30d3e5ad05a8c0acd2e6952f5cd6d4b3f7b970bc
SSDEEP 1536:8PV78LY5PMBbHChz8lg0vmj8z3cjs/DID1g67xf:8PVSCUB7mz8lg0nz3cWDIDq6F
TLSH
T14E732AA24374488BE86AB138529A474BF732FC114510A75F5368C7669F2F2B23E3D7D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.jsa

Path C:\Program Files\Zulu\zulu-17\bin\server\classes.jsa
Size 11.9MB
SHA256 41df8bcafad96b90cae213a638dcfa33e4e40e715d5213d0484d2fdf0dedb52d
MD5 f97e5dda5cd95d1f4e10dd5ae6538ea1
SHA1 5df03e8c4e23be5191962302bb36afafd33205ad
SHA512 1e1e7a3e9d14d58ea412961fddcd2248125f9695d1d6ad06d10b834f4561286565fd2a77ddde060462825e339ba2f89ba1aded09cd37be1545adff78745cda53
SSDEEP 98304:c2Oz1szEgixvwo4GMBdQIKOrfayv1O+Hqhw:JOVgixvwo4GMBdQIKOrfayv1O+Hqh
TLSH
T191C6E517F690CAA3E53887798CA6C3906331E865AB438B073784E37EEDC32D54E465D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Program Files\Zulu\zulu-17\bin\server\jvm.dll
Size 12.1MB
SHA256 62a723804efe6563443234095c491e2f1cee5f0c64516f6f9382354228a643dc
MD5 23fd4830dc98b9cfdde3f48a66502a6a
SHA1 42510f95754b4a6ee17020c745fff132a041be4b
SHA512 5abaf974756a54577d60f89d112ea4a227257120235c6fd0e992091d07a05e7f6684b0d4484dfaf3736578f69aefed472c386436d7dcab330a8fc57c20df7253
SSDEEP 393216:iU+awusJkdOVZMcP0cP63HA7VpIwicR4WyhU9t+BuJkBvbKMwqeYl/WPMyGCoCYl:iXhbs
TLSH
T1F7D68C2AAAB440D4C82BE278C6675A0BD3F2B0A49374D7CF11B446495F27BE1667F730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.dll

Path C:\Program Files\Zulu\zulu-17\bin\sunmscapi.dll
Size 46KB
SHA256 5bbaeb1bc4005d38d943325c22330d051c59c55a243df5bca8bbd8a49414f1bd
MD5 5732328cbef0f967cbd66fcd205cde23
SHA1 0038e6558b077eb4d3d5a65c084396eef5fa0178
SHA512 e3f523b49058b76b5180e5e0e944d316b71ea88888d776a6aada025a839c3c97495004b0872387ccb541599c6ec0ef072cec388e6bba2508218083af242d043c
SSDEEP 768:Ylcukf0gEgKpHef9+l03BnmGr9cRs0mpoMIdWywYiG85ALY:YlcuYEgueVnr9cRs0mpoMIdWyw75
TLSH
T1FF234A47C7A204D6FCB3C8B8C02A861BE671F8965161CB8F0354CA199F97BA1B73C755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\Program Files\Zulu\zulu-17\bin\verify.dll
Size 53KB
SHA256 6b8191692d7b3c78a388e93f03be23c35ea9ce923651b8c80e63668b4b2934ed
MD5 635f55f8b13091df16178cde3af8c7a5
SHA1 9a590ed0a0a778931ff66c7bda8110a6844f32ab
SHA512 9de1f382232a7380f74a496a93c4399a1d20cdc956a9c0bd90f9643c3ebea268646911a161b1d768d3c2ec0c236444195b246898c7583931c0f61fa8d00778b3
SSDEEP 768:5N74B7WcxbLzE7krMalr8YuaItA0mkL4+5FR2hut8ANaYiGm5ALRjay:5N0B1WkfaA0mE4E+huuANa76jay
TLSH
T1CD435A1392A40876D8578A38C563AEEBEBF5F8020711C7CF529186DD7F93B503A646B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Program Files\Zulu\zulu-17\bin\zip.dll
Size 85KB
SHA256 3bd928ca2d2a274807cd2802e980dc6ab907155865ca5d6a975d47b9b4244c0b
MD5 00cd3d36ff9c059f33de5d8910716c41
SHA1 939378ad0f902a1e7f1e652558e14b2145c3b09a
SHA512 9a6d5fbbb81091ce8c17d4c72e023113047084ef7c527ca6520ea066a6435c263a904332542c63cd4ace1765ff7b814a5cd22c5d2f63e506a99bc821d2df33e2
SSDEEP 1536:SmQpTZbxgryaifFjceGTQKxUAIOxg3fq7w:SmQpTZbxg1iMTQsZxg3fqU
TLSH
T1E583AE968D605066DAF781B0C5E28A2FD375B01552D0478B639CC79B2F032623F9D3FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.properties

Path C:\Program Files\Zulu\zulu-17\conf\net.properties
Size 7KB
SHA256 56dd1f6095c189c1052f6baa32e457efc09de4832e19cdb82bb236dc8abfee9f
MD5 0c091bb338f924911db463aec454ba8b
SHA1 69e86a02207c1126a0d9faf9362a8d1798b140ad
SHA512 d0d257c7b0fc6059faef88603c07a9e1cfe6692359eb634b3436a02723ff015d36d523e1c2a252649db7cd4d0e24be114c042e3e209ce027ee07b7816466109c
SSDEEP 192:/LVGG4f4z346et5m27SnCgTe93hf7k9SrnF:ZGxYCUCgY3hzk9+F
TLSH
T1DAF17283BF46B7354399C291E21EA7EEE32C913C5C3375B831AC850D2619C76427F4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Program Files\Zulu\zulu-17\conf\security\java.security
Size 68KB
SHA256 5cd497073edfd7fc26c68e92caee264a739db43d6781f8d8e8b74efbd107cfe7
MD5 b7f2a6a734fefa7f9eb68227f25aaae4
SHA1 ecfd43ed4ee1663adb5a5e35657918e985444cd7
SHA512 014dc39c93a755d136fdd4cfeec9479d689e2b8da489e10dd04953d56e0c978b8c1e24d18dfd652fcb0b40ae12e879324f3cdbb8567635ed142355ca4a7d7097
SSDEEP 1536:r2My8SiqOpjJPFp5/jTGHu1UoQhzYilNndOcs8:3qOXPFD/jTGO1UoQhciDndOcJ
TLSH
T1AC63E622BB896B720AF211A3639EF1D9F76DA12A32325154748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Program Files\Zulu\zulu-17\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Program Files\Zulu\zulu-17\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

jdk.xml

Path C:\Program Files\Zulu\zulu-17\demo\nbproject\jfc\Notepad\nbproject\jdk.xml
Size 4KB
SHA256 5ab23acf89b98778b5885b46d500429e6906c4389cd4427d8d5bde6727bb6be3
MD5 8f8db67a23ae3efd024e91710f1a6739
SHA1 26c3f95e0007310a3f6a35cce6b61af71b9f1c8b
SHA512 7e3b2e9ef782b2d12feef7ddf78fcdf4500eca641e03af66181d03dc81b0cd5b54e5376b245b0460a25fea1af70d11cf974fbce1a5787d3310b50d56099fc2a1
SSDEEP 48:ceOorYJTrYJEfDWQvs432sD32scMEtu33tYTHD5wj9fV3ORoZVPp1TED2AZiUZGQ:YorYJTrYJEfiQX3f3jp2FBY0
TLSH
T1F1913333A5E0AF735D9209794B796641EECC5037666F60C732ED3B902F2A91F8127047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Program Files\Zulu\zulu-17\legal\jdk.crypto.cryptoki\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Program Files\Zulu\zulu-17\legal\jdk.incubator.vector\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\Zulu\zulu-17\legal\jdk.jpackage\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 7fa7c5749452bece2b7b3d5f0cae66dbf4de42dafebca2e1882d59ac93df0510
MD5 5e26df5ffc0e519e80f1d953b832644e
SHA1 a3af1e8998a2d031231a6c8bf3132af6c50891b3
SHA512 a84c5ccd791e1c1996743ebd7d25607ea6c00577d6bdbbcc7b75372596a85180fc0ee48f3626737f6f23df905b1ca4a5c4fb23bce7ddb6c96e509173b00fd4ff
TLSH
T128F0D4F3057E70E2220F5CB85BE887902496616C14E3885128757FF42D47BD1690EC2F
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_161B31A5395C6321DEAE68400FB0668C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_161B31A5395C6321DEAE68400FB0668C
Size 727B
SHA256 af12f8fa360195a457e2da9b9b35bfbba32c83e3904978c4ce1c46fcf6ee1983
MD5 8fc86c8ce25600d6908140b57195ec58
SHA1 23b9ed4226eae11e28910d6d8a031a9135f4a206
SHA512 19c65eddd96dd563dd46d92c088d4a4ce96b7acf0e7cde4bc0ef75c87692db49a469283fbf6372aa0e8594ff256bd6779ef3dbbe1ebc5f9d27f6522391e4ee54
TLSH
T14201940F7E683714969C0E809F913E047AB05ED2019D8EBF952186D2FD58332BE5043E
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 bb02ff717d514309b00a0e83888658e919a0f576ef5784825de39335379eb6f3
MD5 d229ed0ceefaa236e9df121cbb5d099b
SHA1 f7692ad67ceb89fd72d8e66b1a1443a7bc216474
SHA512 c5c799c2e722b576ca3c8b820850a3e7d5ffaeba7d446ad858537fab8e9b82355f162b9eb57b8409f070a225c1264cb894c4a687ab9d93725ccbe1efd4df1633
TLSH
T1270199AE44793E8178309EDDC55D44D43379D6B509D01B82B69A01FD009DAF7EE53942
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 fce207b5a5f1a27c482f6a740e96a89518fe8f11a24c54ed515e845908a345c3
MD5 fcb7b4ce2f2a2bd3f793954bfbdecb20
SHA1 11706ccf77343756c5d046d1080f6d95a29d9769
SHA512 35a8257231f7a4a3a3c1f2f847ee5900bc446f46f18ee52d6fb5a6e932e3a2a252b357b37fe8b31050b254bd326534a0052cfc876bcebc894e37ef3efb552571
TLSH
T1F1E0202827FE541EF274577843D5A0A65F36F1163C65527E1D91141DD91EE005C62C32
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_161B31A5395C6321DEAE68400FB0668C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_161B31A5395C6321DEAE68400FB0668C
Size 404B
SHA256 03765b33d32d84e97e09b1fa13d8e606bc63fa76b3a45741ac26abf90ed1c8c9
MD5 01ecb34e161cedca59bd600384d75969
SHA1 42f46be5bb2bad0c3c730f5ee36b73c748335c5d
SHA512 dc14943f215c5bb18cf38ae2b853ab74b110d21efb97dfb892e2e26e118753fcea7569dcd45eff2bda77ae2da559ee7ccc88a398938f75e08cd163a2539f0f56
TLSH
T1F9E0C03031FAC98FF1B4A47446E76C32984EF206151183AB0600330B6F15B400CD1526
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 a4ecf3435a5feabba5d9f8856e8bd7b014d8941b0e586733a32cd38061ff89fc
MD5 48e16f5ce4d62f6544425c47df22eb21
SHA1 8f2a168012487af9cde60353c43e384bb398dc89
SHA512 832ab330df9bcc0449510fb56dfc11866f8da2bf26fd9bd1acc5f5979516beefe46762608b9bee91dce187cccbe6bec495784f8f6486eb66f90527633d6f8de0
TLSH
T118E06F3C26EBB10EF090983246FAA17A0D4AF2012C00A2B806C2431CAB0AF405D24EB2
MD5 SHA1 SHA512 TLSH

Submit Download

082bd1fa-6bcd-4d39-ae5c-8cf4a176d010.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\082bd1fa-6bcd-4d39-ae5c-8cf4a176d010.tmp
Size 132KB
SHA256 474a3623e4cfc34942501c5fae4e255333bc422aba31d4eb8a682c178c2f3992
MD5 2577a290b76da2ccc5bf484412f13e26
SHA1 76fa17bd062920881a922b0aaf1fbe58e02ae0ee
SHA512 adb717b6150e0fffef4c0d6a24a3fb927aeedec526f4bf9083b9cf92657b10f1e7724c4f72b303a23f20ebf8d2759811fe931257e9b1b7a998679a21f58e9d90
SSDEEP 3072:z6IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:zaPtbmf1K49XLWbEPi4NTKlLzn
TLSH
T14CD302217D05BCB4A9EEDB21A1402A16E9F8D94B95397BE658DE3F4C06E36D8C304C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d929a8a-7e67-4192-8363-e250bc0aa87f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4d929a8a-7e67-4192-8363-e250bc0aa87f.tmp
Size 131KB
SHA256 dce0e842ab5177c92ed16e5d807caf8e21d321ae6ebe59da7a9eec75282f7d93
MD5 d889d18ac5203b4e4097a47dac8d476b
SHA1 7250cff43e66894c5133fa7654e5f5a7a44ae9a2
SHA512 188519115d8b65c66e3920050fee001b3830ea4f279df55ef8b295babdc5af7eb031b81ad574c8d236538ec4331f27dd23381d7140d2d312e0d483964d6cf4d3
SSDEEP 3072:7rIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:7TPtbmf1K49XLWbEPi4NTKlLzn
TLSH
T1BCD302213D01BCB4A9EEDB21B1902A15EAF8D90B95397FE65CDE3F4805A36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dfe5959-eedb-40ff-b112-b23b55042ae1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4dfe5959-eedb-40ff-b112-b23b55042ae1.tmp
Size 132KB
SHA256 d7a78e0f667dad909472020ae9960141d32bb25dbf97b908c67e2fa339987862
MD5 ef9c82f5bf13860a5871303f4f0e0e2d
SHA1 b042028fbdd438f43dd007f89eb94ae6d8c07ebe
SHA512 31f6a55c1a010a2d18cfec93d76b6bc641c9cbd04341ce41d288279d65f2cdfdbac1360a18bb06fee9742b9fe491611321e0ee75ea0404fa9cf830a7a4c2dbe8
SSDEEP 3072:T1IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:TRPtbmf1K49XLWbEPi4NTKlLzn
TLSH
T142D302617D05BCB4E9EEEA21A1402A16E5B8D90B953D7EE65CDE3F8805E36D8C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31be5f93-7c05-497b-99ed-7604b21233ce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\31be5f93-7c05-497b-99ed-7604b21233ce.tmp
Size 12KB
SHA256 4eecd33e2087cdb125a11ceea68d41c7b8167cee7eb0382924e0423b4f5f2e2b
MD5 49ec7266f24033cd91698390645f8ac5
SHA1 a382bb959ed08461a412fe55f10879336074c884
SHA512 9cabfa1ddd5b53e1bdb2af8f4d5d46e88adc465505bd7a51c035cd8d0e4d99e64507a742eef8138fa4db19a1450afe275559fea4250afb7d01b731ee4efed865
SSDEEP 192:uRDsIvwCWDMv7AWpAPRp2Wj9+Hsb+WNn0BoQ3evhrPqfkwlVyIsnAUge:uRDsImYzUXPgwG7eZrifze
TLSH
T1CC42C46EBE14793B9CDBD22AF9217B53D3F9102135941E84EAFC892C25D7ACC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4954b761-cdda-481c-8429-d98cfaebb8d2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4954b761-cdda-481c-8429-d98cfaebb8d2.tmp
Size 13KB
SHA256 88139db981fc62350e9a6c5e20607f14b2b56001ae30c34e776768e19095ca6a
MD5 569c48668af34934d828a19107f8cab3
SHA1 5852509302198032d1087a59224b9bb613dd53c1
SHA512 5e1d20eeabc25dd14060d57ad274ddc95d165d652beb3e0c01f8013deb32eef91c40703051b4741224ee9af051d5d99753e76b9925a049ed029419efe87460b6
SSDEEP 192:YRDsMvwCWiAv7AWpfPRpyQhj9+Hsb+WNn7xF39A0Q3eUhrPqfkwUVyIsnAUgE:YRDsMVczZXlgwNzA/egrifwE
TLSH
T1CA52D56BBD14797B9CDBD22AF9217B57D3F9102135901E84EAFC892C25D7ACC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b4983b5-b443-4f9d-b5b2-247373af82ce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4b4983b5-b443-4f9d-b5b2-247373af82ce.tmp
Size 13KB
SHA256 e53c10e330ed829ee56e27353a76b144f81fdc9c96de0ab2dc9064284674602d
MD5 54f84e53946bb9e34869058a437a3c79
SHA1 d8636a7d1471bb4195821db8cd91207c2e81ebab
SHA512 56af532977d225fd6d8fa1428550c0dec2537e14f20ccca011b81db483cd8e49332bd010e89e6bf04ec3c6d135e04c7d62af445a82c5c781abb29c66e1d58e88
SSDEEP 192:YRDsIvwCWiMv7AWpfPRpyQwj9+Hsb+WNn7xFzh9Q3eMhrPqfkwUVyIsnAUgE:YRDsIVYzZXqgwNTaeIrifwE
TLSH
T1B752D56BBD14797B9CDBD22AF9217B57E3F9102135901E84EAFC892C25D7ACD2213413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57fe55a2-2eb4-4829-b3d5-a8a3ea14eb79.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\57fe55a2-2eb4-4829-b3d5-a8a3ea14eb79.tmp
Size 414B
SHA256 f538c6e2e0be825c2f124754e4fa7107262fba23b9cf8f6de9db265d19964f7a
MD5 362f94734233add1b29ad6053d42e36c
SHA1 84b09d9a1e66050c7105fe28290558f4d116de4a
SHA512 f37598901a42af594020ae1e269cba9859fa082ee4b5f6a8f3cb2b9ded0d812b74774da43bec1753f426ab77b3f3624098a4b44ba26700f25d146113d8b42258
TLSH
T1D2E02B76CD29A83718F9AB2DA0504B46E71413372B90D94F3A3C810C8FB16B7459A96C
MD5 SHA1 SHA512 TLSH

Submit Download

87efa77a-336f-41e7-be9f-6e811a26aabf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\87efa77a-336f-41e7-be9f-6e811a26aabf.tmp
Size 17KB
SHA256 32e6c0a3f05682d1e24f62135a16a559239bad390f6d29f2c3f6be9606c5db00
MD5 dd640a034f45376f3fcaa0a994fd4c07
SHA1 84453886df3f8873a24f080834e8931fb45a049c
SHA512 f4914452222e94317f3fd39a2a4bf91384dae0f2bcb11a077cd1c0143c27df3b5988a42d81e29fc71842f0242fa488537d4bbb16e9e30f0e2c39407ce6dc1661
SSDEEP 384:nVjD27KxkXqKf/pUZNCgVLH2HfgslDZ7pLuLceSx8XODDS+ErU3s7HG+I4QEry:nFD27KxkXqKf/pUZNCgVLH2HfgsFZ7p5
TLSH
T1D772E8677C4899370F94CAC8D8267F4FACB9025B65ED886553FA582503D4BCF110A2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87f60e26-5bf9-40b4-9ec8-b97c3748338e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\87f60e26-5bf9-40b4-9ec8-b97c3748338e.tmp
Size 12KB
SHA256 8ecca0c536d0c46445271808bc55b9a170a632a1ea154392d03b6f09eefa42ec
MD5 66c7a7a32aa35bf3bee4bdf2a92585b6
SHA1 e358cabe15b2d61f25d76a7a20f4892569830597
SHA512 5c59dafedad0ad89067743ac1730389f5f258820d4b6e9f731b4c109b0dec7123eaa8ff5b20afb7622464422412f791e35a77f4daf72506d34dddde56b4cd5cd
SSDEEP 192:uRDsIvwCWDGv7AWpAPRp2Wj9+Hsb+WNn0BoAH2/hrPqfkwlVyIsnAUge:uRDsImyzUXPgwGj2Jrifze
TLSH
T1BE42C46EBD14797B9CDBD22AF9217B53D3F9102135901E84EAFC892C25D7ACC2227427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 67KB
SHA256 7c0693df55e88f1c9bf9ed0c98b375c1bd5bd07bcf2e755152a198b9e14974de
MD5 9d5b11b008cc7951b85993ea6e1d0247
SHA1 9c74c2565f09d8e604978f8515888bd395917d55
SHA512 44cff67113cbaf9a6eb542885a42381f508d8502d917a70f04bfb1a4c2e5ccacda43f5321ca56e1e3a30fbfc89a110fe1b81c8c422738b8bbbad58a9d5c8d966
SSDEEP 1536:So01PiBKUNgjRZyFYZ+6XqIgmF0SoGC9euck8KNKoaIwa:So0ALeye+6aIg2oSJ/oqa
TLSH
T16C6302CF883C10596193F0F7FD7C972751F36014A8AD5913EE03C6A7A60A90C59EE5AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 16KB
SHA256 d56358125eb7283492170294d0c5c9c77b4e3065e3e0b8f30561352df8d1e49c
MD5 6e9f3c63b9a393bf7604d3267ee89d05
SHA1 b14b519efeaffb1147b77fb271e7045e7b0ef4b8
SHA512 61bfe5630a37776410bae390cf6ee3e4a6f05a187d781eb557207340866fc73a2228600a778e6384855d44016dc7d1b683758f970b732e04f8e6c67298ccd751
SSDEEP 384:oB6VQId9PGmJDVd6e3ybE2zqwsPCUs202GrPsMWfOjiQaMl6:g6VV9umDVdr+Ea8PC3202GrUZol6
TLSH
T10172D06EE0DE09704FA9270611D1C781CF8AB122EA6496C0D2D2CDBA466F47AFCCD665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72c7163a67c31497_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\72c7163a67c31497_0
Size 258B
SHA256 b4e3b658e3458ea2bd28dbf1fea3fa5691ac41e7809ca144fa9ee183444784ec
MD5 b6f7520f02a2a2d910357f95e657b640
SHA1 cb346d4bb8519854b85c4447e316d319c1e5ef9c
SHA512 3f0069bfb21d9cf771b6703db7d195c0282edd12d8c7a868e260acc387bf4c08d235d8a978f325690dc78b852ba2f9611de6d35f3420b17af20a44f50a46c2fb
TLSH
T14BD0A7778DD59849F83D42F4D1BF624DC33285C85588D691D140E1EB57200F376A4D05
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 456B
SHA256 dbeeb864c0f7022fa8a8b98acf0bfff68c79328b40c7d829d2259acd0aea1952
MD5 07a969d4ff5e50e211c8f56798713a9f
SHA1 906df7a37eb0290377edb60481b941fe7bbf08c1
SHA512 795dd656838eba25aefe8ce32d30f8888d723b0781b645e33740728a2a9790d13d1bf99cbccf80dfee699b283c5582a5c2bedad1a9ed94581e4a0e2cd88c504e
TLSH
T115F0DF05ACEB7000FB447678786B4C722724E6B044C24B1E54B1FD721B674E0C8B156C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 470240abaa0d90801a4b4e74d43d60a25b657f3975dee25af890e8104665565b
MD5 5631544cdbd694184020574eb872f8e8
SHA1 d277ef9a614f9c219a31c0bd561596d91cddbdf8
SHA512 5c606b6366dff8d5f48bec51220d0d4e78f19bf7f7ce923b02701a2455cd0274973370a44b75a7e9650f81daca220af36e49e9f4223b0a3dd6582c1af9f8174f
TLSH
T11631ACC9A8FA1092EF04EBB076B25DAA3733661004871F0B1B72EA7316D77E094606DD
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 7e8d8a72ca64bfd97f17bdc3f59c3eb38ec18f7433978945034af3691926f348
MD5 37784130e93c693a14b30ad3bc636935
SHA1 05e3ba1df4217652b9fec16b0f628c267a4bdcdf
SHA512 b0cb6c06b182d9c9f5fd51fd8982fcd57b59294d5ed9e437b50c47f78d771a37fc59212944a5f7ac2de9e4fb5d4f5749f7e4b806b5644e0dc0685a77670822ce
TLSH
T1C22123C5ACBA2011EB086D7436F65D6237376664088B2F1B1F66E831169A7E094617CD
MD5 SHA1 SHA512 TLSH

Submit Download

034924bb-5636-4eee-922f-02a3bc05630c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\034924bb-5636-4eee-922f-02a3bc05630c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

04458898-3b35-4882-a6b7-b963d083cc57.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\04458898-3b35-4882-a6b7-b963d083cc57.tmp
Size 7KB
SHA256 5dcd32cf218d405bd517dc2e9025e9e11bc6729e0d458e87827c7c983ade2812
MD5 d0f043cd9c9d012924919111afd4b3d1
SHA1 525deee57d95d6997a4af9d15c4aee36930d98e8
SHA512 91421c27b1d639743595d71142d315ede389bb940b56e654315f945e43b09bd36d500405487c7ea78f5d269eaf8a69ca9944132227c24b929a5936ca976e13f3
SSDEEP 192:DqPBvLXcIlOlEc+lPlDteaIaEdKIxV46vnYPYg4VOhNi7qk4vGFJXHBK:DmZLbwG59ZcaIaEdKIxV46vnYPYg4VOv
TLSH
T10AF1AAF383E5C66E890157F496146E2BCF1D0A28432C3C6688D4EE4BE3E3572E15964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05a680c8-d16c-45c0-a35e-2242c2a90b10.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\05a680c8-d16c-45c0-a35e-2242c2a90b10.tmp
Size 14KB
SHA256 51e840ebb5729c6b4cb485c901e7233d4c03a9f12d90b7bbc7fc3099460f6459
MD5 33bd26bdc1406cf2580a3dadd6829a8d
SHA1 950c9823020b4f473cea5e3e8b5500b44efb581a
SHA512 7e616d0fe1f6c5b04245963d3e7805b1bfdad3d9903a071080a6a8359e4ed869113b6fcb7b00c27f176386a0daa661838613917e7ff06fff5747ad4aa4c61e2a
SSDEEP 384:DmZLbwG59Zgo0NlEIICTV6G6klaIzuV46vnYPYg4VOhNi7qk4v8HOOCS7K8MbUmW:fxTw6r2DTai
TLSH
T191627AF7C7E4C66EC81256F49A247E1BCE1D0A59422C3C16C8E4EF4BA3E2471E29564F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 defc5ff0ad2ea58c7813d79301f15a1d19f742850873fa4f993e7df1cffdfd81
MD5 ef7a8798f08d90edbd1597147bc1f4cc
SHA1 a03676c958b576975e5e99e9d7d1f598778aca29
SHA512 b138c8bf14fcfb3a52c35d9b3c6ad9c7fb73d45fa081cba8ccc7af9d9bb54272bbb3ac50be3f639f3a3aa8d0e8dba9fff51b0b9a14be67548db85fb2396e44f7
TLSH
T174B0124484415301C05203F4215414C8399CDF10E7151301C1F40E51CC35151C01F159
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 3c403511d00a7d30f81bc656c5aa6442ee648ad351c806f2ab5e9d3b7b29290e
MD5 4fc1523c934c5222a65e6bd1d36ba5b5
SHA1 888ed10d5125267a9c077860b107edf43a8946c7
SHA512 e98ad87c3e5074a55dc9fee325e1483ebe73af80089ad66b07ca76a420b034edb1821957acc4817275d28594526694bf0b5daed817c663617c9bd755f3de8d5a
TLSH
T136B02223C0022223C00303B038C280CC3030CF20CE03020382E00E33CC2A3200020020
MD5 SHA1 SHA512 TLSH

Submit Download

ef6e0e59-a173-4ea0-a6a9-48f08cfb6250.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ef6e0e59-a173-4ea0-a6a9-48f08cfb6250.tmp
Size 13KB
SHA256 d2cafe7978859a6fde65b39f2635b40b98e0d03d81647aeca1cd910c0c3d5dd0
MD5 7bc7acd79bd77157c97c62844f1ba554
SHA1 16b1887005fcd1f391f77de16e645929318ab097
SHA512 d4d681fb07951687b6791419e5627f7cd23dd68094069c1113a7800f5976ca508d313aa8263b9b7bbf3edc0b5bd7f82bdd8ce6eba4df1e27cb771c17bea1aad8
SSDEEP 192:YRDsMvwCWiEv7AWpfPRpyQhj9+Hsb+WNn7xF39A0Q3eUhrPqfkwUVyIsnAUgE:YRDsMVgzZXlgwNzA/egrifwE
TLSH
T15D52D56BBD14797BACDBD22AF9217B57D3F9102135901E84EAFC892C25D7ACC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6b9aa84-81ee-4723-b625-9447bea3d127.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f6b9aa84-81ee-4723-b625-9447bea3d127.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

e8e1046e-ece3-4bac-803c-24dd79ec7afc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e8e1046e-ece3-4bac-803c-24dd79ec7afc.tmp
Size 132KB
SHA256 6a7a8bf678fc8f00ec9ef624fe549dac92c4c32f7fdc6f9d0b0a0d57638a3b29
MD5 e2e0e86da6e1f8978a5442041f3c1f0d
SHA1 548491013c195a212ab18e768d04e985ae5423bd
SHA512 442cd0e88d0c66f77342d534e28c95f05018fea365137d068c8d8c3d65d2e691bed3bf3e3125819907ec3728b27d43a8dbc2587b3831f68a3e5db7e0714383b7
SSDEEP 3072:z1IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:zRPtbmf1K49XLWbEPi4NTKlLzn
TLSH
T181D302717D05BCB499EEEA21A1402A16E9B8D90B953D7EE658DE3F8805E36D8C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ead95023-e475-43a8-9091-9e24be8f82fa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ead95023-e475-43a8-9091-9e24be8f82fa.tmp
Size 132KB
SHA256 72dab3db0d28e9634554f19dd5f6822da1127e9c05353f5d3c7e4fa4153df5c1
MD5 75cf477604592d76ef155609c51e21f8
SHA1 b6872bd6afcb2ffc9091adc59e585eaac99ef0eb
SHA512 f041b2d95c64912e14d175b548f7d3636e47439a9d1383db823d5172e3923df37c4ce2cca831d6a41ea02d1e55da08e170cce740d9d95d6b0fbffdfdfda96a6a
SSDEEP 3072:26IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:2aPtbmf1K49XLWbEPi4NTKlLzn
TLSH
T16FD302317D01BCB4A9EEDB21A1401A16EAF8D94B95397BE658DE3F4C06E36D8C304C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VapeLiteV3.4.2.zip

Path C:\Users\Admin\Downloads\VapeLiteV3.4.2.zip
Size 12.8MB
SHA256 50bcee764e58a8fdcd525ac20bf0105d660aec2184f7ad0622cd0e7ceaef5c74
MD5 7b2c093163211f33353a9c570fee01dd
SHA1 7379348a9f9896eccd3d1424b78a1e84516096f6
SHA512 2e3f2e1298d8da38a87031e187da064c0321b02ae0b49ee803ed53b619b201604e7f745dc0ddb599f089d4ee0fed2dae9defc3f8b2b3c1cdac8a77331ebe6bb0
SSDEEP 393216:iJVl/lMdTtGKv7/qY2wWOiSE+MSa4KtnLXi:iJLOWUyY2wZiqd6nu
TLSH
T15CD6334C92859366DDCD7AB0DF46FBA0C28618D9C767C7956EF03396BC124C07BAA093
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI97E8.tmp

Path C:\Windows\Installer\MSI97E8.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 7d8d3184f9572fda43a1e972c50e4d537d14baf44b1b869010a0b2c3d50fb2ce
MD5 689a5073e9c2e6b15283cf12252e3d95
SHA1 d4ef406015570ba78a94a6ea7ef6c852f88b2841
SHA512 3812dc16963435390be98cc719bd63660e3e890e3a78efe0e5a45f966816411d0b79e4ed1ea60783b6a91bfaff74763cc2f08e3f571cd7daed8941b715e094fc
SSDEEP 24576:QEpmg3MZdoO/vvTLjyQea5GOYs7hNI/2sQ4tmDsC8FKDs2eAYlDmF8xbDx:WY
TLSH
T12C47D62436FD2110E7F79E3CACF06A2749397D5BAC16DE8D05451B4E0822B71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a58a04c6-79d5-4270-8165-0dc3e54dcf8e}_OnDiskSnapshotProp

Path \??\Volume{9d636857-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a58a04c6-79d5-4270-8165-0dc3e54dcf8e}_OnDiskSnapshotProp
Size 6KB
SHA256 55c656e17ce1163e7180b00e09258d315499782f14b2baee2fd7df592ee43cb4
MD5 cac02bcc83c580c5bc7a3dd56a947084
SHA1 569e38844adae12d426369fe6cd5e0aab5fa854e
SHA512 1ea6422deecf84943cd8ac74ea55d8fbe0996c000a6b99086b59d573d9eddf2316c3b5d007171b74c934bdc7ecd89a8f46abc17bc4257a80afbdc91b769935bd
SSDEEP 96:FAsGGHgrcvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:6x/rGb++ZVm
TLSH
T181D18A185AE54711E2B3AB3129F18547A477B811FF33CB8E0298238E6671910F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2188-1156-0x00007FF676850000-0x00007FF677FC2000-memory.dmp

Download

memory/2188-1157-0x00007FF676850000-0x00007FF677FC2000-memory.dmp

Download

memory/2188-1155-0x00007FF676850000-0x00007FF677FC2000-memory.dmp

Download

memory/2188-1159-0x00007FF676850000-0x00007FF677FC2000-memory.dmp

Download

memory/2188-1158-0x00007FF676850000-0x00007FF677FC2000-memory.dmp

Download

memory/2188-1161-0x00007FF676850000-0x00007FF677FC2000-memory.dmp

Download

memory/2188-1153-0x00007FF676850000-0x00007FF677FC2000-memory.dmp

Download

memory/2188-1154-0x00007FF676850000-0x00007FF677FC2000-memory.dmp

Download

memory/2188-1160-0x00007FF676850000-0x00007FF677FC2000-memory.dmp

Download

memory/2188-1162-0x00007FF676850000-0x00007FF677FC2000-memory.dmp

Download

memory/2188-1171-0x00007FF676850000-0x00007FF677FC2000-memory.dmp

Download