c58c99ee22d89012a2250d2716993180bd6d497f2d0d7a124b27de1873eae0b0

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sarv-0.2.0-rc.1-windows-x64-setup.exe
Size 21.0MB
Sample261113-vcvdfsys6n
SHA256 c58c99ee22d89012a2250d2716993180bd6d497f2d0d7a124b27de1873eae0b0
MD5 f2649df4e24dc7ec0ce61d675ff7dbf1
SHA1 e95ee4ac8e4194c4282e2cd9f1b7aac893af5e3b
SHA512 97ee8d462db1ce3371e71d6eedfb8b7b0312fb9718524c4c1afe8b05455fcd1336600b797985ffe4276757b86bacad43f9cb3816318b73add346ee36e1a1d10a
SSDEEP 393216:YzA4o9FLQXFSGkGRSCmDwI1kbS5ToltHTzSHeT+4MKdAMeaVPaCuxGTh48qsFAjI:YsrxsPxcjvm6clt0q+6d+OuxGFq7j33o
TLSH
T1CE273373F0E18C6BE172403B8A126FC1ECDF067EB2F04C17A6665A61EEA7953B355049
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2164	Sarv.exe

Loads dropped DLL 39 IoCs

pid	Process
4332	Sarv-0.2.0-rc.1-windows-x64-setup.exe
4332	Sarv-0.2.0-rc.1-windows-x64-setup.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe
2164	Sarv.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Sarv.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_2017387709\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_2017387709\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_2017387709\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_2017387709\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_2017387709\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_2017387709\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sarv-0.2.0-rc.1-windows-x64-setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2212	msedgewebview2.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 2164	4332	Sarv-0.2.0-rc.1-windows-x64-setup.exe	88
PID 2164 wrote to memory of 2212	2164	Sarv.exe	90
PID 2212 wrote to memory of 4908	2212	msedgewebview2.exe	91
PID 2212 wrote to memory of 2752	2212	msedgewebview2.exe	92
PID 2212 wrote to memory of 2752	2212	msedgewebview2.exe	92
PID 2212 wrote to memory of 2752	2212	msedgewebview2.exe	92
PID 2212 wrote to memory of 2752	2212	msedgewebview2.exe	92
PID 2212 wrote to memory of 6004	2212	msedgewebview2.exe	93
PID 2212 wrote to memory of 5892	2212	msedgewebview2.exe	94
PID 2212 wrote to memory of 5892	2212	msedgewebview2.exe	94
PID 2212 wrote to memory of 5892	2212	msedgewebview2.exe	94
PID 2212 wrote to memory of 5676	2212	msedgewebview2.exe	95
PID 2212 wrote to memory of 5676	2212	msedgewebview2.exe	95
PID 2212 wrote to memory of 5676	2212	msedgewebview2.exe	95
PID 2212 wrote to memory of 5676	2212	msedgewebview2.exe	95
PID 2212 wrote to memory of 5676	2212	msedgewebview2.exe	95
PID 2212 wrote to memory of 204	2212	msedgewebview2.exe	98
PID 2212 wrote to memory of 204	2212	msedgewebview2.exe	98
PID 2212 wrote to memory of 204	2212	msedgewebview2.exe	98

C:\Users\Admin\AppData\Local\Temp\Sarv-0.2.0-rc.1-windows-x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Sarv-0.2.0-rc.1-windows-x64-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Local\Sarv\Sarv.exe
  C:\Users\Admin\AppData\Local\Sarv\Sarv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Sarv.exe --webview-exe-version=0.2.0-rc.1 --user-data-dir="C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2164.5124.869501455207079753 /pfhostedapp:754bd5ce619440e4e4a50e88ef8959d3eae8092c
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView /prefetch:4 /pfhostedapp:754bd5ce619440e4e4a50e88ef8959d3eae8092c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9ad9f5fd8,0x7ff9ad9f5fe4,0x7ff9ad9f5ff0
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView" --webview-exe-name=Sarv.exe --webview-exe-version=0.2.0-rc.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1784,i,13451732473804650127,13737897080651170368,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:754bd5ce619440e4e4a50e88ef8959d3eae8092c
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView" --webview-exe-name=Sarv.exe --webview-exe-version=0.2.0-rc.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2100 --field-trial-handle=1784,i,13451732473804650127,13737897080651170368,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:754bd5ce619440e4e4a50e88ef8959d3eae8092c
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView" --webview-exe-name=Sarv.exe --webview-exe-version=0.2.0-rc.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1784,i,13451732473804650127,13737897080651170368,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:754bd5ce619440e4e4a50e88ef8959d3eae8092c
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView" --webview-exe-name=Sarv.exe --webview-exe-version=0.2.0-rc.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3496 --field-trial-handle=1784,i,13451732473804650127,13737897080651170368,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:754bd5ce619440e4e4a50e88ef8959d3eae8092c /prefetch:1
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView" --webview-exe-name=Sarv.exe --webview-exe-version=0.2.0-rc.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4504 --field-trial-handle=1784,i,13451732473804650127,13737897080651170368,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:754bd5ce619440e4e4a50e88ef8959d3eae8092c
      4⤵
      PID:204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Sarv.exe

Path C:\Users\Admin\AppData\Local\Sarv\Sarv.exe
Size 44.4MB
SHA256 2d86220fa5aff50c08ce000e6fb414622d44ef2088ef9267de8e0c4051e0a0ab
MD5 99bd202ad2cc6e7d78a11145168cd8c0
SHA1 c706b75abdcdf28d20ce327bc0724e1d3a0d3090
SHA512 d798fdaf393543af77a7d3bcc198e4fc4e11c329f7c04deaacdd3c60363cd033ae30b22096761d0e3b414b0d1976a91de253fdfb94b1a5b8d77916730afa6f16
SSDEEP 393216:N3kQebWrbESiQ+n9/qYyfECATIZNYA819oY28:N3kQRXC/qYyfEhBqY28
TLSH
T1C4A76D93F11A088CC57BCA3B4376663AF6713A5A6630B7775E888F325F1ABC05B09714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Sarv\WebView2Loader.dll
Size 157KB
SHA256 86545b66cdb0603bc26b626fb9ad610cb6e71f28d468f5ea66df23b03dda96d5
MD5 ff3ab627947e2c1c58f13694a8651c7f
SHA1 280e4cb1c735b3ee7cfedc82a5bfe7c134a89d90
SHA512 45a167e90716a08abf79f76fba42681cc8bc76f0087f62d028350c5d28e79b922dc1bc799b0dd0a086e7add20c17b9bd6a355674d7f1b0854f217432e4c7d555
SSDEEP 3072:lKpb6T599mlMpgeMiqa5agdTl0RflJGhaTcZYEtJomT+JJg7yl:uGf9m9XkagdTlMvEtJKJg8
TLSH
T10BF35C57B3E510B7E07BC27485A34A42E772B81157609AEF0364467A1F23BD0EE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libbrotlicommon.dll

Path C:\Users\Admin\AppData\Local\Sarv\libbrotlicommon.dll
Size 136KB
SHA256 121006fe45e8bd12b1929f86e1efb1dbd1c6291118f9a409693ce8c030f1cefb
MD5 df1e7a643471171cf948e4e90c3a5e0d
SHA1 e6711b72dd05eb788385f8b0b0eac070835ad8f5
SHA512 be94b1022928d8f916fc2b3b4b6becf64fc41efdce5d7256fc197ec592e67ceb519eb6260c01ab9e5828dc451ab274188f506fb31f65cc3550c3f745712969df
SSDEEP 3072:OLUk4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBdFg:O4AhdNorGvHdbi09GJnFg
TLSH
T14AD36B61F3051736C26B627AE49A6BB8F375827493630521B4AD426D60C3CA4873F6FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libbrotlidec.dll

Path C:\Users\Admin\AppData\Local\Sarv\libbrotlidec.dll
Size 58KB
SHA256 dab7d47981ee887865d1f82dcbcc8fc4c7a43942278bb27877e168909e10d346
MD5 f83f82b25bdd67ba3ae0499b6da6a2c3
SHA1 db5703489e3e345d6c1ba5b82ae72848ace05e88
SHA512 d6b4d18cfabe9d7be4e3e95a3f59824e804c37ad98a4f3fdb84425f188b80ee29581870fc084b139bc05bd915933825a98cd7a89a659071855de829d3aa94595
SSDEEP 768:yOR3oQsdgYLb5LBLtLvXIL0LrVP4HbCtEyzk1059v6IfrX1szaoQazQxARbYs34c:F9oQsdgWR/VP5pz00HSqj1szao3OFQx
TLSH
T1DB434A12B3A3A8ADDF4781388BD39772F6397C482325EBB76184F5312E26D606F5C521
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libbz2-1.dll

Path C:\Users\Admin\AppData\Local\Sarv\libbz2-1.dll
Size 106KB
SHA256 a4fbb97c26662d2b8a80bf4597ed3effb69b12048b0cb1eef2c3f211e2e66673
MD5 834cf6e7e36cd87412f8b32171baf61a
SHA1 dc9316fe49df6c07fc5b31de1510185d4b2278d0
SHA512 f27a54e0daefb14666eb658d226cdd0e41fbb2cd45d53c1d54b29392819d13669e71ffc81fae76371e5b7b764c0b956b0400289a87e45e64bafb5713754b0039
SSDEEP 3072:kuJFnd2Q5f90UAP7mcv4jePfOvAT5oBJ9F3o:kuJFndr1aUMNa9F3o
TLSH
T14AB35B19F0E329ECD60381304A974F7AFA71BC590A20AF7BE560D6396D37F501E29E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcairo-2.dll

Path C:\Users\Admin\AppData\Local\Sarv\libcairo-2.dll
Size 1.2MB
SHA256 aa794d8f62e122d7739523643e293d26e05f2c1c723035079ba01dcaeda0dad6
MD5 6869de417bf373e96b5868a50cdc29c3
SHA1 9a965bc39de24645a6c643c2d09079717faa4624
SHA512 fedbe60dbac7ad18daafb9c1f870ffe1f09582c1d5c1c2d9de791378d2d5d7591b2f0e28d652549b9c7a2ce010f09ab0f2af88116e8b38efa64fd83cf3e8977c
SSDEEP 24576:zHj5nUiSDx7/jO44iUbBZ0XFx7DfM6H6NF4PJsc8o34VUNfRoGkQYoOYmoL0:npUtjjh4iUMFdf+FsJsO3iUNfRoJ1YmJ
TLSH
T1B0454A57E2A364ECC56BE034D227AB72F531B4151038AD7F5698CF302E22E60665FB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcairo-gobject-2.dll

Path C:\Users\Admin\AppData\Local\Sarv\libcairo-gobject-2.dll
Size 30KB
SHA256 2fbc11e9949328df850a5803162a8d812133208a3ad091630e6cb339b081cddb
MD5 16f0a2be302cf2cd9d835b1a49d19470
SHA1 86e3eeeefdd8f34d41b7a7edca543b254657d2ee
SHA512 5f8ab4e8787662a2078611039c6b4b3666834fffc37c75d2ae6266317134d0b2d2eadd4870ee51ff2f2249a5e4ae8677b8ee4d67c374de511cfc9adffe1cefbd
SSDEEP 768:jjd/xaR+xeymzNGBWRRRRRRRRRRRRRRRRROkZ2aFShp:jjdVFG8Gap
TLSH
T13AE2E706D2CBFC96E599837F44A56731F0F6B5402670B33F4262CAB16876F2A46BC163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libexpat-1.dll

Path C:\Users\Admin\AppData\Local\Sarv\libexpat-1.dll
Size 231KB
SHA256 d96eafff7e3356e13aab6b569cc373ef61b1b2b9489803f45561cbfeaf70ee1b
MD5 f9f4d4da778068bb743c7085409a151c
SHA1 204ba199add71d0f100cf9b627507c32765730f7
SHA512 ad26e9a4c9a9bbb56b4823386a7be3477625cae9f90b1d6fd89161cc66339aeb4bc61777aa95881bf7d776e6db8339f9f13cc8896dfa30c954b74fcefd4e0682
SSDEEP 3072:srnyslX1N7Mubsn3OORX/2y5GvwZIZUXYbBZKoLdG89ePfOtDWgIPoxErwHF3V8:9s1zMugneoX/EBBBZKoLdKOx7F3V8
TLSH
T1C1345C6BF193D4ECC19BD0748397ABB2FA33BC341220BD771590EA396E63E502529725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Sarv\libffi-8.dll
Size 38KB
SHA256 b649c515907436a3299326f83aea0e8d75c61853eb1609602603bbcb9b00b4db
MD5 82df84458ed90aa710d29cdcb9ee32b1
SHA1 b4505730cc945cfdb0b4585e2c083fcdc0ef4309
SHA512 413f8c3debf768c499c2541d47e5876a4be2823d7ed3eea3b1901e2def59197b60d5194831ad87cf5b4ed11df19705136e418acfecc96de672299e8dd94a8035
SSDEEP 768:IxqJQgp7VFldTswKTAkZ6Mh8+Of0i2146oi9eMNsAbBcR:I6VFfmsMSB640eMaASR
TLSH
T179034A2BB2D294BCDA93D13095A79BB2F032F8110322BFFF45D8E6722D14D94572CA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfontconfig-1.dll

Path C:\Users\Admin\AppData\Local\Sarv\libfontconfig-1.dll
Size 496KB
SHA256 bed1827dbb226483026b2b33127866ce173aa2423d89ae7da6f88d6328792ec9
MD5 8608d81113c3249946ea763f284eca92
SHA1 474a2e54934015992af0261cb82faaf9313f3b0d
SHA512 a956a89e1128c04df60915d9a6c0475702b924e476124c2d7d5d967c02a31415db4dbe8b6d2938b8c6ab6891665adb00073aab9a7dc9508ec6c1d4c6a22cfa45
SSDEEP 6144:511hGm7ebM5Zh3m9PpfipHxE35HTQ/1As38WmUNfDjpR2mBo8JT:33+MzhW9Pr5u5Pf2mBo8JT
TLSH
T120B40517F282D2A8C51B81354E96D6FDB570BC11CE21BD2B72D0F73F2E71A504B2AA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfreetype-6.dll

Path C:\Users\Admin\AppData\Local\Sarv\libfreetype-6.dll
Size 788KB
SHA256 9f62ad75bdc24573940f2e0b0db1848464ce02928926808885e3744fc5272add
MD5 8fd17e8c5611f428edad124ba3f13f3e
SHA1 9bb54496aecf06e8f88cbf591781b2548c06c9b5
SHA512 5e6b4232e549b739231edfc6f26cea1d975db44a3e972cf475da61ffa114c92d3236791b10e3334400cd9475db07876f4376488e0a120613b14196d52b830b18
SSDEEP 12288:X5C4ys3JMBiAjWdMnVaHAWfLT6nm3iSXPy3Srk5VmOknaRCWE7FPWSfEWmhPuf97:X5CVkMY8GQaHAeT6nn1R/RCEZhPuf9FV
TLSH
T1BD054B93E3A760FDC66BC23442679772F931B8141134AEBF91A0CB313E61E60675DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Sarv\libgcc_s_seh-1.dll
Size 145KB
SHA256 661f70dc19fde8c25bb56387b807b7a9ab7e532cf58fa8aeee078256c19d8980
MD5 358372ca95fa793727b8f5d342d976be
SHA1 2f29593d36697564c2cbc204ec072eb8695d25cb
SHA512 82d84de7ded3e7c6bbcd03dce923c87eb714d51ef2b57c85864e30f39c768e5c9ba27254f4cd7dacbf0c7c6ee128081a5a939c03e7b2c57bc0169d56da272a1f
SSDEEP 3072:l7RIBq44t9pjU8E3qYuIrSl2vYAh2xDhWWFFa:h9UW9epU1HFFa
TLSH
T107E31852F19371F8C697E2309A939FB5E833BC740230A8772399FA342CB1F815A5D652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgio-2.0-0.dll

Path C:\Users\Admin\AppData\Local\Sarv\libgio-2.0-0.dll
Size 1.8MB
SHA256 eef35a18138b7afefaf5ade36b07b3b3ec25d21080a1c2c5eccefad383482016
MD5 8a254b19d259d089b17037ff9dc6558e
SHA1 beb86988cef4356c0d8f2457a09f042b8395b077
SHA512 3f22d712a2a9d1cd65e1ee48051f4aff1ab40b7605b022ed7100707443831e63d94d18c7e232a592d868b4d6ed5387e64337f053f316402b2438850c70ca495b
SSDEEP 24576:Obvyn21k7/9v2VG6s0+sK5VYFyW7mQx4sJzAAvlm:Obw218/9OVIVj5W7m24mEAvlm
TLSH
T10695392B9296605CCABBC2358597B732B470B4241231BD7F6824C7357F70EB1836EE5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglib-2.0-0.dll

Path C:\Users\Admin\AppData\Local\Sarv\libglib-2.0-0.dll
Size 1.5MB
SHA256 84b15dc907fd1d3bb1cd799fc034d2edcbc3946c8c4acd6a8dd3ace381f9e568
MD5 400be5dbb5f885a2874f7ba230fe1495
SHA1 dda6e0aed4e2008d1f92543ca689d5d443eb7217
SHA512 ca60a82feaed82d31443fda8a48f9b0b22b8e135ba1c88655fed2ad8bbcef6a3ccd32e11977aad28714d5d533654ea9eff391666e11d3282f8924735b82c6d57
SSDEEP 24576:7QFa09Zlp3W6oLcReln1Q1tWYf9nrJIt0LY/tvhLjeqVyAH:7QFa0jSzLk2n1QnWYf9rJDYtvhBVyAH
TLSH
T104751817E24678AFE79BCD3485A6A3B2E530B8140F336D7A2D9CC6351E2DD53021AF16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgmodule-2.0-0.dll

Path C:\Users\Admin\AppData\Local\Sarv\libgmodule-2.0-0.dll
Size 22KB
SHA256 79a7646945b520966dcd2541d40c109f26c42979b47bed9aabec796a8cbe20d0
MD5 5d0776560cb92572e1268093829fc0ff
SHA1 f74f2ff6de3520413ffb06d699002fb2e8eedd70
SHA512 9275b508d485f3ad97c4bf7134b0acac32b4d273bb4101363cb77e2cfa7831a61664e678a3b269afe8647fda8795f106bf6e8be80f9c980e827bb23b29f54af9
SSDEEP 384:9pI4SK+uyo6VsHaNAAPRmRRRRRRRRRRRRRRRRRRRRFU6653ifW3enl+3/QWP:LI4SKPL6aaOApmRRRRRRRRRRRRRRRRRy
TLSH
T198B2F93AB5886C8BD9A5C33CE1DA9632F6BE78551776BA1F4708C1F4AE70730427C642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgobject-2.0-0.dll

Path C:\Users\Admin\AppData\Local\Sarv\libgobject-2.0-0.dll
Size 349KB
SHA256 a417864358cbe7a1da74b7cfcc61f7d49b03772b02f29fa611b01a67d5b99632
MD5 15ae35fd66f77c3b0b885701eae4458b
SHA1 ac2ffc4b03a2e59a510770cc24a7168b0842b96e
SHA512 13ef65612daad2d14a231e04151a12367ad06dd797a6756dbcb575f61cbc7fe19e79f6471d7c7a79501e68cc7f37fe9a93db2f025fa96eb99a4a611116b2eb48
SSDEEP 6144:Tbmd+jDpkkUHBZMBf4ve7x6aNeAk5U7BJrKllWaO5gBJLZTMxZclviEolvW4xnJQ:TbGk4MxQeLkAk50Bo5JpMxIiHW4xnJQ
TLSH
T10F74293BB216786DDA6BC0388196E733B571742C13327DBB6698C3702E68D60572EF19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgraphite2.dll

Path C:\Users\Admin\AppData\Local\Sarv\libgraphite2.dll
Size 163KB
SHA256 063a9ad34a5ec87d038b4646660957395224ecf2cf707917256b7d251a7c5f57
MD5 bea21bd44c67f800b43995141065194b
SHA1 a7ce558e7874a6ee36b388dd880aa4828ae7384d
SHA512 5eb8ce4bc500803683118a7b4d02d933db23b03f283a9371f6e3667fc954f71d884ced502feea4ce57e011e3a5f75adbd9bde01c2e5a40efe0620543d08387fa
SSDEEP 3072:/NROFeUaR6/v6MmBtSGvk7yauSxQMHIIZB1zOKfbFkF3iph:/yFeUaR6/v6MtGM7yawMHIbKfbFkF3iL
TLSH
T17EF33A87F1E761FCC56BE034625AA677F832780407286CBB53D0DB311FA6E905A9CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libharfbuzz-0.dll

Path C:\Users\Admin\AppData\Local\Sarv\libharfbuzz-0.dll
Size 1.8MB
SHA256 042059d5fcb90daaabd2af52ac60b1aed43df9a2f785ce92ec4cfdc08234d2e2
MD5 d2d054a0405b653b36636e27e5093d5a
SHA1 08d0486451a06b774c039778ce8e7cf3a62412a1
SHA512 1fa6d0fd0e823dd86b6684c7c2f4c52dbcc148804851b992402ee7a21834701bcd3aaf5af858fcad810991357d1efbeb8e758efc51a1edfdf2a94b1b4c766033
SSDEEP 24576:cjuVrfCZm+PQPUleo0Al8psrAGVE3k9OKJffHazs2wN3kLkH0lDXF2El:cK1MleorlbAG9P2wNqkUlzF2El
TLSH
T10D955CD7E193A0ECC12FD13052679A73F931784140286CFBD7A0DB346E62EA0669DB79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libiconv-2.dll

Path C:\Users\Admin\AppData\Local\Sarv\libiconv-2.dll
Size 1.1MB
SHA256 587bd8c780e89f5d834c251accc6053f479713184c433e0f1bab898ee0aa3751
MD5 dc6b56214ea62c287d04f860a81b3b97
SHA1 201b530f010dee6f4b1410ecaa1dd3c7a67e757b
SHA512 3b83befa2a1e96da92a19c1a459effe998fee7ebbe1f9573cbc369d2aea3539e980378001060764edb3a454769bced69a058443b79e484dc4108b589d9931610
SSDEEP 24576:hHSd+C3QvmHguKcDfbAA6n2/rn1BAUZLY3wPKU7VbbTOZGavkg3NyeuQ6l9fH+fJ:I1BAUZLYgiU7IZGaXBuQQ9eOo
TLSH
T1FE35BE51F3D3CB2BF263C674C9AA5B66E427EC216B0648373660B7BC5D33BA014C4666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libintl-8.dll

Path C:\Users\Admin\AppData\Local\Sarv\libintl-8.dll
Size 291KB
SHA256 0537c3dd2378218508ebe3cc416d72a99ee2d24ae1c5525e23458f32544ef861
MD5 edf8f1b85f2f01ff0a28a6a31c3e427d
SHA1 ff1bc2ec0a952a27b728f32c0c00c7c066097614
SHA512 41269d7ddc99104e950934e0eff78c306a8a73bdfb34a8535f133b0442001e489ba8a7a6b3d399a26f83982f8c83070afd8393ebb32cfc529549417be279e9ed
SSDEEP 6144:ZqvWcwWaX1Ziu21y+7DE4a0onJMFEdd+TuoJo:0WcOXow+8Wmiwd+TuoJo
TLSH
T1B5541907B247A9D9E153D5308987C7F5B973BC720BA0AAB726A0F33C2E318515B19B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpango-1.0-0.dll

Path C:\Users\Admin\AppData\Local\Sarv\libpango-1.0-0.dll
Size 424KB
SHA256 078881c139e7dd422c4cb5f9c43b939712eb7ad4f3d7d25c41639873e8aec6d6
MD5 93e09600c2326fc61b14d0dca195f206
SHA1 03dd1a42508c8209ea1ecf0d703a1fc239852a03
SHA512 dc7793895836729a1de7cdb526fb0c53e9af027d09673342fe172641a48dc0c14dbb63399b8189410f8d94027adf9c5da9d7182c193715988589f2bd35e97bfa
SSDEEP 6144:deRABf3UI8m8nMoAOrkJMIwfyACppMFeQDfZoAiI/w5Wo1gXN9c1dF:kE32vTyfXQFoAiIwWo1gXN9c1dF
TLSH
T14F944B2BE25358EDC167C03996A7A732B430B4394721ED7B4790D631BE60FA4362FA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpangocairo-1.0-0.dll

Path C:\Users\Admin\AppData\Local\Sarv\libpangocairo-1.0-0.dll
Size 81KB
SHA256 b9f800abeafd27c07dc9f9fa4a41bb614564038ce7ac5753ca6c60c1d7d555cc
MD5 aa7ece211fac6cffc1add4dbad1ad5f2
SHA1 1dacc5efb9afd2b805a7025ce3c965735e795386
SHA512 28eb4de5da3d4b99bc7d29d31e118558c68f8a96de91c52cf711cb156a06c2c202becd83b5a069a8066305b1c931044c1fce2c7b877e23d49897243889a8e751
SSDEEP 1536:77lx5ZEcK97B9bdVqYCVThtaY+LbQYnZxRIKLtvBYR:nltEvbdYbcPLPnZxRIOtvBYR
TLSH
T11B83F92BB441EC9EC4A2D53D91E9B631B33A76280227973F4750C534AE71F71BC6BA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpangoft2-1.0-0.dll

Path C:\Users\Admin\AppData\Local\Sarv\libpangoft2-1.0-0.dll
Size 109KB
SHA256 38602e75c85e149bf7294bccb8792f54299daed45509a8ac4b3a18e3921ec56e
MD5 f41a4e76f000131fc6ebd96d5a99dcef
SHA1 791e15d083dec1421f53244d8a825ca96811c059
SHA512 2ef76c545f0d89ac6f1253d1829c07c11c4e6449772149283cd2ef3fa2f876b18c57d7dd87898144f75332b396090dffed5879b68fca9c3e6317266248ffd70d
SSDEEP 1536:OgqzJnAqJmverjbwNqs9KiqFJc3cmIwAhC4zit8iOLoL+aeU8E7iv2SmJk:hUJnJ29XqncBtA88icaeUJ7iv2SmJk
TLSH
T169B3162A7482989DC5A7C53CA5D5A731B73974281225FB3F4760C630AFB1B703E6FA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpangowin32-1.0-0.dll

Path C:\Users\Admin\AppData\Local\Sarv\libpangowin32-1.0-0.dll
Size 108KB
SHA256 2fb6d21cce830182c9d4bf22015dec9abbb0846ebce828ca0a5d4cefc74e46c6
MD5 373cbac7cdeec7570b7f047c83b3b507
SHA1 f1c87a717f7cd97b9029178b9d52af8ae898b98c
SHA512 4db8e43ff6bc5b43773f85b1bb3ad1a3f7e7a1dff80c1f7b2acbb868cb085d76e0b9cbd88b115589f0ec1855e5a7569bb92abc035d0e6d1711f5a092e56a7f8d
SSDEEP 3072:UqlC5QjIeYaePfOIrnqaoXnG1L13v37HUMbFCTaMCS:HcpRsHnGJRHUM5CTaMCS
TLSH
T1E3B31827B61258DDC1A7823CA5EA9731B736B8284221FF3F4740C6749E70A607E2B795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpcre2-8-0.dll

Path C:\Users\Admin\AppData\Local\Sarv\libpcre2-8-0.dll
Size 690KB
SHA256 68a7cee2acc36d6a61d73f78825d17dfd32f8580f4bb1bc399134719518213d5
MD5 7f6f3d60bfff99160e1dea2edee42272
SHA1 e3ad41e23ceb514ef84b1a9c817a92cdbfacd545
SHA512 c20ec8fb56ca7a46ecddf3804f721eacba7a63090011ebe08e196e85eaad6421c7a9dd1b7cae40a2366a5694c711dd99d6c1729d2f2e554879e9561a943e613d
SSDEEP 12288:v0Ate+De/RE0GUMNRx0Ake28B55TfMkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkE:v03R6l0A3vAkkkkkkkkkkkkkkkkkkkkj
TLSH
T150E4F617F1D361E8CD23C675DBA33672F8363AD801347EEA5A9493713E23E105629A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpixman-1-0.dll

Path C:\Users\Admin\AppData\Local\Sarv\libpixman-1-0.dll
Size 723KB
SHA256 55ce45825eb8e825c635416171be4736147a6b0b690469f545d8c4ae8e85b4a3
MD5 e8e3335d0129744c5d37e531fee6ab2a
SHA1 a35ae0a098a66e7169ce9e385103d12362bde850
SHA512 d495d128987ab7b1c0ac06ea2650d57071ac2e90256cd372554fdca5a6267833d64d71d862289719fa47fc34b5b159190742380cfdb138ee3eab833c7baa6338
SSDEEP 12288:d048F7dgLimXh7ZaW7wAxz/zSNZG7H6DmlApd9PgOLnNDS7cZuF2GK2L+pWei7oA:dqF7dwZ7wTNZk6DmapdpgOLnNMQlGXLz
TLSH
T1ADF46D9EE59720ECE26BD4B04255FFB7F930382881109DBB52D1C9346B63EC15A1BF29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpng16-16.dll

Path C:\Users\Admin\AppData\Local\Sarv\libpng16-16.dll
Size 253KB
SHA256 4a33007395f1d30881d0c185c120f1ecf05c8ebb520933068902ddc1f6c58506
MD5 1cedc8cca15629d3b65b997acb6e3538
SHA1 2f36b7e822e28def0c16393724da0ea2de65f391
SHA512 7657907da55a17f82bbe95ecdd126b985c4e2e82d9e7dcb4af2ae5c934ff724ad072c2d60677b182a53726f8228dc1c725078c064c349d5a448dd1bed0394f1c
SSDEEP 3072:xWqSBrSVRt8rnV7OxQZDv3SWj9JJQsQi3odADDQqjhHsJ5fDePfORXgiIjhWB3NS:kPBrSVRtWV6mpvJ2UYLIAi5gxJRrC88
TLSH
T1BF444A97F2A368BDC7A7C1348217EBB1F53178641224BEBF46D4CB302D22D606729E65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Sarv\libstdc++-6.dll
Size 2.5MB
SHA256 b720a96289bcd6d9ec6f5f1f5612f1b1a523ce15d3ada20fe119791274cb512f
MD5 8d6ae50f6bc3631ebc9d3f933647e36d
SHA1 a041c1711150f45ce5ec80d2bfb67d6ce2b0af03
SHA512 610e23e330a470d2d5977ddf4bde40d1c554104f6caf399aa31451852cabe06479bc5448a45090dfbad436e190fa5e40956bbde32760e0371b8ef2a1aa4eb4cf
SSDEEP 49152:0EB0DVztAYxEx0/XYEtoATWdxxFmSnF/tNCMAILBKPYQN2cPrEY:0EBBx/bxFFsP/N2cPrEY
TLSH
T10AC56C03E5934CACC9E7E7B4525B5336E660BC1989387D6F5E9CC7302B62E40962FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Sarv\libwinpthread-1.dll
Size 71KB
SHA256 98a4fea591385952cad1c532f4a92606358630976e9ede5fcf115ab945305a09
MD5 1a1c24895961e7dbd46db4015acbc088
SHA1 c5732da26821ff7145b3da811ba34ce8e128bd97
SHA512 c14a63469fcb792e4e6871d5053496e84536b37b86465d99fca650c9e180f5025568ab9b94c691b7f2a1acfb3a81923e696845c275bd4972ba660ec06026c165
SSDEEP 1536:5EI51iUI9yhOUA19qU7iJdWMcPQxtigIJyZ31:2I51zHhOzBitcPQxtigIJyZ31
TLSH
T18963092B729B20FDC557D23484E65771B533B8102226EFBFA324D2352F74D608E6D8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Sarv\zlib1.dll
Size 186KB
SHA256 72df18f3a7c8e9341c776a5a23c2dfb2524dbbf1f343c3012cb1178436535a29
MD5 254f9ab8e9e2d2917fea19e7d2af1b02
SHA1 ab994ec417ba39aba6eadc65d86e6eb70f458b04
SHA512 cd83a6af80242481dfaceef9c1ff9f144fdce21c7fe9813e2d8d5250c9a90a4208a1fa0872eabb37866fcba1f12ae423e87c8570f50dae6c7ebf02af326cc6be
SSDEEP 3072:LcNwQRB63JQaqJvlbvhaanPWqRRd4y24d1KDEMBvZ/N7UlVoNF+FUGeVIBe7i/Bx:L6wC43qb5aWnIy245vFUGeVXf559YIYR
TLSH
T1D6146B5BE5D365FDC6A3C17092939B76F43178544638BEBFA284D7302F22E406B48AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmDEBF.tmp\System.dll
Size 12KB
SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
MD5 564e01f2c6edfb8475573e1b809cb5eb
SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
TLSH
T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsmDEBF.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmDEBF.tmp\nsDialogs.dll
Size 9KB
SHA256 9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb
MD5 79c27de4d1c6d295fefaa70f608f1c67
SHA1 feba90c93db3fedd450a81eb2603f793332d1a83
SHA512 fbd79f3946032821584ea2fa4b559ac5809ab45fdc9107eb47c9ff3fa3229d7748a7b2ed588709e59cce16a4f8e58ed98b46cb061acf1080e78434d184f51ec7
SSDEEP 96:oQEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YbNqkzfFc:oQEvCu5e81785qHFcU0PuAw0uyBIFc
TLSH
T1E612E892A2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0078b093-99a4-4532-b665-af12828f9b90.tmp

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\0078b093-99a4-4532-b665-af12828f9b90.tmp
Size 15KB
SHA256 451da9fc36d2362a118f6935fe9510bf72e20bba3cea7d1faffab22281a900f6
MD5 c21ae96150f2d114b1008bd16b8e1e7c
SHA1 5976918fb22ae687099c882f120c2daa4f825b7d
SHA512 dde3a89d98059a3706a12ecfde8cbe0f917cb5b6edecbf9c16c361b03a058a13f4b5969bfa2f970caa2158cde16181fba51b8e75e4cdedc4af10c9a82348a353
SSDEEP 384:Z+OBqImmJvGBLx3NaFMJFNNBSzU/3Ykg6rF:0cvGtlNroah
TLSH
T15A72AE7A2C696F232CB7890ABACE3B478B696253C0917BD4DCED9F0E412F4841392955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9b215d1de4042644dc6fb312c37545798fdcc7f66d83bdb61318303b494502bc
MD5 a4e9413ab01b0ecd1f883a126e3be819
SHA1 31da8def758ee97ce149343f02e0a039de9e7c20
SHA512 747b5ac3dc5d0d7cacf2469f43391d5a7de14cc68998e46c13f15999baf97d6d2f400847d1dcfb3545ee0f578baa7500a8642e1052a65ac225ea39d0aba95366
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 11311e148a8b9fac240205d20a226fe706a10e878162208e26f5e0e4dbf6d458
MD5 26635bf977a5f1d4eba20f293c09b70c
SHA1 2c38e2c52d8f8e65985ac7cf0c7c9c194edb9a1e
SHA512 547701d2d545829fc581a6e9674ea747a1abe4f6302d6e7eda58cd955e1d74b9f8f33a435a471f813c9e49105a22280d4cd475a164998f60fbf79e9397fde171
TLSH
T1F2D012363202C234C01024330042A58C0480C90BC0054148F42C9E1E1A144501986442
MD5 SHA1 SHA512 TLSH

Submit Download

863a5184-65a5-4163-b694-d8aa539cb702.tmp

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\Default\863a5184-65a5-4163-b694-d8aa539cb702.tmp
Size 6KB
SHA256 d52b5a1325d255eb8b571db7cadddbd61b60d329fabcf6dd8e30a6e520e193a7
MD5 7e02395d98dcf00b51193f769b3c7c30
SHA1 811cfe62c84d6c1bb3a83f5029aa9395fb52c387
SHA512 abb8a3c9e44b44e7982a1566540206577f64f477198abe13da0ee746d6cb4a0e6efcbfba7b64e8356ecac16db13ebb01aaec0e86d9feb084b9ce940edfc9f948
SSDEEP 96:stj/dyhjFLCb9XkO+o5h16Z0As7/x+6MhmuecJ47S1ejeoK+g628XM1C7K:stbMhS9+onAsV+Fd4eQjccG6K
TLSH
T122D194066E24797B4CC6E509BA257E07E3F9607270D51E58E7FC8A2C04DB6CD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 864B
SHA256 c3fed35e2df2a66fdfa2b7347e87f496dc7dd4550069c3a09c6acfcb95bb4e46
MD5 c07d9f1b4ba846708fa4a3d4be2f198e
SHA1 905f6bb5d7111563cb7b7a73a2854ed643858115
SHA512 519f333ceab6e0478506ce418f7425db7b68120070d288acb9e1f245ce982d924c8418a97f91a399761abc98781265585b8f80d6f8d85753ee65def860621275
TLSH
T14D11CD8CCCED2828C700C2BE52E377413AB07B63267F0F8632AB44B6E504BD5971C045
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 67ced6bc8a2fc3c130bb611356d130ab01705785dfbf58baea3fb79a7162b5f8
MD5 b74ebc61c52556f5b2135fbbe950be5e
SHA1 6aaae3b816296b30656920f2a966700e6026ce70
SHA512 286c49438203c30deaa24ff82b3ef2eea8b43ebab49d95e5f309718dc7dbb3bfa55cf7ebd9d78379ae87d790d44d6b31928a711f299715536e057ec9739e41ab
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ec8dd657-3e3e-4b4f-b9d3-4925352213f9.tmp

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\Default\Network\ec8dd657-3e3e-4b4f-b9d3-4925352213f9.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\Local State
Size 1KB
SHA256 0bf4715442f453195896f5c73d5a51a49661fd140c52d46877e7d07166052838
MD5 122ee679345cd29ed05a5e80802560f1
SHA1 3d0cf8e9c1bdfe0f5c451d93c9d5c861c1fe13cc
SHA512 e874cbe75aa180f8eb52ba197dea24312418851d39ac74830f313ed60cbee7e6700b11fa07b06dbae8767860e85f7d652635f03c516a7e0141c6ae9a928d678f
TLSH
T17B21657298782B33ADA1660A2186BE535F356037D2519E00E4DE8F1C41971CCA56BC36
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\WidevineCdm\4.10.3112.0\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

ad40ed3e-9a24-4c37-8bae-f957489b9ccc.tmp

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\ad40ed3e-9a24-4c37-8bae-f957489b9ccc.tmp
Size 2KB
SHA256 8bb85ec3355a3b24bdf3de1c66b657f50ae5d83e113822b52377fe2c5f4d9599
MD5 c1232ef4af14a477bca88c96fe24a191
SHA1 398417e57a98c6958495ebd33047dfb8e63e3d62
SHA512 9e6754eb14b5cdac89380b062af95b67d3979a57b88418a6f7c38757b0d26b38444a6807d6b2175f08cb1f024218f0f460b0b7946ab85b31d18fac421449e6ad
TLSH
T12251753368247B339AB25A09794A3E238F3D9166AA522F50E9DD0F1C409769C2343C36
MD5 SHA1 SHA512 TLSH

Submit Download

b1a3072b-e868-4bd2-8b68-dbd4374f04f7.tmp

Path C:\Users\Admin\AppData\Local\ir.sarv.accounting\EBWebView\b1a3072b-e868-4bd2-8b68-dbd4374f04f7.tmp
Size 3KB
SHA256 df047f9ffc10599d6773bbc544963fc24af5bf32b6030102b541f94c26016a53
MD5 b55d8f2e02908167658093754f475899
SHA1 2ba3eac2490efdd95e7657ff24cacdce7107520d
SHA512 ef91cb8dcbabb4a6678f019e375978e94448f781fe997f1fd1df2585d01e3e286f631b437be970b62daaeabb19523451392b7051c8adf1cc13d1f8551ad71d36
TLSH
T1BA6163366974BA374EB29A09B8863F13AB695127E5913F95D9EC0F0C41D72D82382C27
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_2017387709\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_2017387709\_metadata\verified_contents.json
Size 1KB
SHA256 a6ce8c1d0d27c54034e67a83270bf3fd2bdfcc45ffc4b9084357169c00c90f77
MD5 42b331a107b7320d16f115eb7872b3c5
SHA1 3438a81f13c76becc7eb8bf0a7881088e5ad358b
SHA512 afc9393c7a63ec8d95c708eab601ab76887e4600a03b10f3c8c6e6c78c1c48d8b8bc6f059f8f38e66f1e54c5040656b75b6d46b91a795f76dbb5d3c6ac59b333
TLSH
T12F31B7414DD5369EA14E42245AB873AB9F0E71B372C8A51DA9C5900CF4F914ACBD308F
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_2017387709\_platform_specific\win_x64\widevinecdm.dll
Size 21.9MB
SHA256 e1f9ad648017e2cb0f0cd798d815dc51012b279ba32571e7b6eb5120b0ed2c05
MD5 046fdd0c07bbac0c160b03a2cea5ad4b
SHA1 fbe9107b962ff2c77070579a8769ce7188c4b473
SHA512 0a3e385a3d27883e6495e4cb4fd20bd5dd0c61176e04df2762fca9d13847c9ae88de7ac57648732ce6d6cce27f2eb9da4dbf9c54d1953504de784c4cb35c8fd2
SSDEEP 393216:DKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHk:MWCmz0dwJIkpqCw
TLSH
T15A37E14AE35350E9E81ECDF0866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_2017387709\_platform_specific\win_x64\widevinecdm.dll.sig
Size 1KB
SHA256 868171d91275d1e180a452621f66428afec0a9288ab96344ce92fc904ac1f70d
MD5 c7bf17a2f118fdb4a4344196706b6393
SHA1 d07695b35bf2f4bd746586fe56ce2ae9d7c99f69
SHA512 11abb5b2ea4120df63216ac38aa85c8deaa7d96b9e0a8867b8f281b0652211f4600bd4107d182f3ea0c657d8a1675ff56d0279837a7c33410a7968f2c5a9a754
TLSH
T1742108F4A215A94A7F50C142053DE827CF3E8AC12C6188B644BFC23628EE7C00F8457C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_2017387709\manifest.fingerprint
Size 66B
SHA256 56d1fe98928ebd4be664fc103e35673a15c2dfa98ff241478bbd39beb15a0754
MD5 bef72178d2d9f61006676a8323ac4a20
SHA1 281541cc22aaab5d71703791192ef66ee2e831ba
SHA512 ee3664c72ee9a894249799b642ed8c1f10b7a7a422d1277d7097f43b4f892d7b267200d323f861bb90b0436262da13dd3c674c4425dfdc264c1cce3755a593a3
TLSH
T154A022CE0CC208BC30008300FC8C8B222000282823280022F8A023CA32EF30AB000C02
MD5 SHA1 SHA512 TLSH

Submit Download

memory/204-722-0x00007FF9CF040000-0x00007FF9CF041000-memory.dmp

Download

memory/204-721-0x00007FF9CEB00000-0x00007FF9CEB01000-memory.dmp

Download

memory/2164-314-0x00007FF9B1850000-0x00007FF9B1A22000-memory.dmp

Download

memory/2164-315-0x00007FF9BFFC0000-0x00007FF9BFFD6000-memory.dmp

Download

memory/2164-303-0x00007FF9ADF60000-0x00007FF9AE1EE000-memory.dmp

Download

memory/2164-298-0x00007FF9C4BA0000-0x00007FF9C4BFB000-memory.dmp

Download

memory/2164-297-0x00007FF9B4CD0000-0x00007FF9B4E54000-memory.dmp

Download

memory/2164-295-0x00007FF9B8FF0000-0x00007FF9B9124000-memory.dmp

Download

memory/2164-310-0x00007FF9B8ED0000-0x00007FF9B8F16000-memory.dmp

Download

memory/2164-309-0x00007FF9C1E70000-0x00007FF9C1E80000-memory.dmp

Download

memory/2164-308-0x00007FF9BBFA0000-0x00007FF9BBFE1000-memory.dmp

Download

memory/2164-307-0x00007FF9BF930000-0x00007FF9BF982000-memory.dmp

Download

memory/2164-304-0x00007FF9B4A20000-0x00007FF9B4ADB000-memory.dmp

Download

memory/2164-306-0x00007FF9BF990000-0x00007FF9BF9BA000-memory.dmp

Download

memory/2164-302-0x00007FF9B8F20000-0x00007FF9B8FEB000-memory.dmp

Download

memory/2164-301-0x00007FF9C2200000-0x00007FF9C220E000-memory.dmp

Download

memory/2164-300-0x00007FF9C4B60000-0x00007FF9C4B7D000-memory.dmp

Download

memory/2164-299-0x00007FF9C4B80000-0x00007FF9C4B98000-memory.dmp

Download

memory/2164-296-0x00007FF9C4C00000-0x00007FF9C4C82000-memory.dmp

Download

memory/2164-311-0x00007FF9B4960000-0x00007FF9B4A13000-memory.dmp

Download

memory/2164-316-0x00007FF9BBF80000-0x00007FF9BBFA0000-memory.dmp

Download

memory/2164-317-0x00007FF9B8EB0000-0x00007FF9B8EC7000-memory.dmp

Download

memory/2164-320-0x00007FF9B5940000-0x00007FF9B596C000-memory.dmp

Download

memory/2164-432-0x00007FF9AE9C0000-0x00007FF9AEB90000-memory.dmp

Download

memory/2164-399-0x00007FF7E2CE0000-0x00007FF7E4AE2000-memory.dmp

Download

memory/2164-321-0x00007FF9B58D0000-0x00007FF9B58E8000-memory.dmp

Download

memory/2164-322-0x00007FF9C1E00000-0x00007FF9C1E10000-memory.dmp

Download

memory/2164-323-0x00007FF9B4B20000-0x00007FF9B4B4A000-memory.dmp

Download

memory/2164-324-0x00007FF9B4930000-0x00007FF9B495F000-memory.dmp

Download

memory/2164-325-0x00007FF9C1960000-0x00007FF9C196D000-memory.dmp

Download

memory/2164-318-0x00007FF9B09F0000-0x00007FF9B0B0D000-memory.dmp

Download

memory/2164-279-0x00007FF7E2CE0000-0x00007FF7E4AE2000-memory.dmp

Download

memory/2164-319-0x00007FF9B5970000-0x00007FF9B59DD000-memory.dmp

Download

memory/2164-313-0x00007FF9AE9C0000-0x00007FF9AEB90000-memory.dmp

Download

memory/2164-312-0x00007FF9C0360000-0x00007FF9C037F000-memory.dmp

Download

memory/2164-305-0x00007FF9C0E30000-0x00007FF9C0E64000-memory.dmp

Download

memory/2752-182-0x00007FF9CFEE0000-0x00007FF9CFEE1000-memory.dmp

Download

memory/5676-266-0x00007FF9CFEE0000-0x00007FF9CFEE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads