Analysis

  • max time kernel
    158s
  • max time network
    197s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/01/2024, 01:03

General

  • Target
    VapeV4.exe
  • Size 69.5MB
  • Sample240108-berwkahdfp
  • SHA256 1484faf1d56c38e31ff4c64707487c94e8677f0291c5e50d2122b462d07e87d5
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VapeV4.exe
    "C:\Users\Admin\AppData\Local\Temp\VapeV4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1644
  • C:\Users\Admin\AppData\Local\Programs\VapeV4\VapeV4.exe
    "C:\Users\Admin\AppData\Local\Programs\VapeV4\VapeV4.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Users\Admin\AppData\Local\Programs\VapeV4\VapeV4.exe
      "C:\Users\Admin\AppData\Local\Programs\VapeV4\VapeV4.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\VapeV4" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1792,i,11678247747974943437,2585972849413508794,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3632
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      2⤵
        PID:2224
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          PID:1292
      • C:\Users\Admin\AppData\Local\Programs\VapeV4\VapeV4.exe
        "C:\Users\Admin\AppData\Local\Programs\VapeV4\VapeV4.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\VapeV4" --mojo-platform-channel-handle=1976 --field-trial-handle=1792,i,11678247747974943437,2585972849413508794,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:1256

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VapeV4.exe

            • Path C:\Users\Admin\AppData\Local\Programs\VapeV4\VapeV4.exe
            • Size 82.8MB
            • SHA256 5f59202be2771076f454ae59525bbb83afba2cb816eacd6ec7c3ed8d447c3687
            • MD5 SHA1 SHA512 SSDEEP

            VapeV4.exe

            • Path C:\Users\Admin\AppData\Local\Programs\VapeV4\VapeV4.exe
            • Size 41.4MB
            • SHA256 0ea49dea2a91ca645390c9b2c8453529a6985353b5e3065bad2bc7a0741f8b61
            • MD5 SHA1 SHA512 SSDEEP

            chrome_100_percent.pak

            • Path C:\Users\Admin\AppData\Local\Programs\VapeV4\chrome_100_percent.pak
            • Size 126KB
            • SHA256 9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e
            • MD5 SHA1 SHA512 SSDEEP

            5b2630e6-4d85-428d-a688-91f7dded9e8c.tmp.node

            • Path C:\Users\Admin\AppData\Local\Temp\5b2630e6-4d85-428d-a688-91f7dded9e8c.tmp.node
            • Size 149KB
            • SHA256 addfa75f7fe6b1832088a4723a7a2f2bb1a1c53af63fdba10134cf01c98c33fe
            • MD5 SHA1 SHA512 SSDEEP

            972ff846-4e7f-433e-87b2-e9429448c5ee.tmp.node

            • Path C:\Users\Admin\AppData\Local\Temp\972ff846-4e7f-433e-87b2-e9429448c5ee.tmp.node
            • Size 2.7MB
            • SHA256 7988cb68cec5ac7b1b8ea81fbe9671713f4bf43c49f02370ad6c324b43b7cf2d
            • MD5 SHA1 SHA512 SSDEEP

            LICENSE.electron.txt

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\LICENSE.electron.txt
            • Size 1KB
            • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
            • MD5 SHA1 SHA512

            LICENSES.chromium.html

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\LICENSES.chromium.html
            • Size 6.5MB
            • SHA256 9f3f2b4d9bbd3113486839eca85de119fab766450cdca08a4574b80748885708
            • MD5 SHA1 SHA512 SSDEEP

            VapeV4.exe

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\VapeV4.exe
            • Size 150.3MB
            • SHA256 6016f3457b3e280ff067a580fdabcf3aec6df8badf5344c693c30ccf5f85750c
            • MD5 SHA1 SHA512 SSDEEP

            chrome_200_percent.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\chrome_200_percent.pak
            • Size 175KB
            • SHA256 1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c
            • MD5 SHA1 SHA512 SSDEEP

            d3dcompiler_47.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\d3dcompiler_47.dll
            • Size 4.7MB
            • SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
            • MD5 SHA1 SHA512 SSDEEP

            ffmpeg.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\ffmpeg.dll
            • Size 2.6MB
            • SHA256 aad7e7ac9d74ac18892801950c9728e9c4eacd3b676cbb5d6f63382da2ce0559
            • MD5 SHA1 SHA512 SSDEEP

            icudtl.dat

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\icudtl.dat
            • Size 10.0MB
            • SHA256 97b978a19edd4746e9a44d9a44bb4bc519e127a203c247837ec0922f573449e3
            • MD5 SHA1 SHA512 SSDEEP

            libEGL.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\libEGL.dll
            • Size 473KB
            • SHA256 85f238fb7ace3cbdf7c29c72b01307c440f13491b07a509cbc5b9f257a637164
            • MD5 SHA1 SHA512 SSDEEP

            libGLESv2.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\libGLESv2.dll
            • Size 7.2MB
            • SHA256 25d49934fc220b169cadeb21fc99dc2a8fb1dd5a4f244265799392f0f5f2f8f8
            • MD5 SHA1 SHA512 SSDEEP

            af.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\af.pak
            • Size 340KB
            • SHA256 d63222c4a20fa9741f5262634cf9751f22fbb4fcd9d3138d7c8d49e0efb57fba
            • MD5 SHA1 SHA512 SSDEEP

            am.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\am.pak
            • Size 551KB
            • SHA256 55357baf28716a73f79ac9a6af1ae63972eb79f93c415715518027fc5c528504
            • MD5 SHA1 SHA512 SSDEEP

            ar.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\ar.pak
            • Size 602KB
            • SHA256 e34d5cabaed4634c672591074057c12947bc9e728004228a9e75f87829f4a48a
            • MD5 SHA1 SHA512 SSDEEP

            bg.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\bg.pak
            • Size 631KB
            • SHA256 fc4a59ea60d04b224765be4916090e97ed8ddda6b136a92a3827ed0fcc64bb0e
            • MD5 SHA1 SHA512 SSDEEP

            bn.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\bn.pak
            • Size 812KB
            • SHA256 e325d936cd97c3f9ddfca2d87caefb8b6e7465ffa31d0386ae2456b18f7a92da
            • MD5 SHA1 SHA512 SSDEEP

            ca.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\ca.pak
            • Size 384KB
            • SHA256 e1d6b5fd0bc411f2895eaaa1409916f5ffe39a5c6bd1bafe8af7ce33da5be17d
            • MD5 SHA1 SHA512 SSDEEP

            cs.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\cs.pak
            • Size 393KB
            • SHA256 936466784a55b965d23b016bc49377655bc5d281d012c8369c0809c961e05c74
            • MD5 SHA1 SHA512 SSDEEP

            da.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\da.pak
            • Size 356KB
            • SHA256 1b0793b1cbeb6a56ff1e64523c37ba753457320aa29f9718022caa07b4981d8f
            • MD5 SHA1 SHA512 SSDEEP

            de.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\de.pak
            • Size 381KB
            • SHA256 e0f632ce324951002c80e019dd0169be9f6b0640533fa434cd6ca80f28a1d3f7
            • MD5 SHA1 SHA512 SSDEEP

            el.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\el.pak
            • Size 691KB
            • SHA256 92403b6160e38746597d4dd7f64d64cf19e30b5e7862901263c39679187b2c91
            • MD5 SHA1 SHA512 SSDEEP

            en-GB.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\en-GB.pak
            • Size 310KB
            • SHA256 463af7da8418d7fb374ebf690e2aa79ee7cb2acc11c28a67f3ba837cf7a0937b
            • MD5 SHA1 SHA512 SSDEEP

            en-US.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\en-US.pak
            • Size 313KB
            • SHA256 bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f
            • MD5 SHA1 SHA512 SSDEEP

            es-419.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\es-419.pak
            • Size 380KB
            • SHA256 5aff3762747a6e8c6df9f2a3b470bf231b44163006b17ce87e2a03694be27b81
            • MD5 SHA1 SHA512 SSDEEP

            es.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\es.pak
            • Size 380KB
            • SHA256 267e7b6376e7e5ab806b16fde93bbbcd961bf0c3a7b3a2cabccab37faa9a1d16
            • MD5 SHA1 SHA512 SSDEEP

            et.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\et.pak
            • Size 342KB
            • SHA256 d984aee4d18ca24a88846b1b6e0294d373733430f30bb4f1b97bc7d50d512c2e
            • MD5 SHA1 SHA512 SSDEEP

            fa.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\fa.pak
            • Size 557KB
            • SHA256 221bbbde078d135f6daca4978a31cc6a82f8f46536467ebc9a0cd322c58a7785
            • MD5 SHA1 SHA512 SSDEEP

            fi.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\fi.pak
            • Size 351KB
            • SHA256 5339b8ca52500bd0082e0ba5a5f440c5f04733803da47963280479760c7fff2c
            • MD5 SHA1 SHA512 SSDEEP

            fil.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\fil.pak
            • Size 394KB
            • SHA256 4cd3fa70487e894400ad29e3bfbfba3e1c5edd799aab12c62c3aff3c2580ce5e
            • MD5 SHA1 SHA512 SSDEEP

            fr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\fr.pak
            • Size 410KB
            • SHA256 1f6bc09499ee37456968a28b67b81bbf5b9df4f0c6035a388242d2037a3b65a1
            • MD5 SHA1 SHA512 SSDEEP

            gu.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\gu.pak
            • Size 787KB
            • SHA256 c36a20730d5f2b91cb61b5b2a5912db2ea5a328a9b8abe0fca0af300446d3c20
            • MD5 SHA1 SHA512 SSDEEP

            he.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\he.pak
            • Size 488KB
            • SHA256 875712bb852c698f677c0c74e088f62d31adb2bce65648fc390607aad8705c45
            • MD5 SHA1 SHA512 SSDEEP

            hi.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\hi.pak
            • Size 821KB
            • SHA256 1e9623c7407ae8b8a88df3f69a47ae8117f74c4dcb56897bb794a9c38ee5805b
            • MD5 SHA1 SHA512 SSDEEP

            hr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\hr.pak
            • Size 381KB
            • SHA256 3d7685163c5eb6a11e745ff934312b8681c5f85dfa8d9ea701e9dcaee1e7a285
            • MD5 SHA1 SHA512 SSDEEP

            hu.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\hu.pak
            • Size 411KB
            • SHA256 3ec43893c6de5ec0f9433841afd5fa9feaaf59ddcef05f7e1cab14dba799887f
            • MD5 SHA1 SHA512 SSDEEP

            id.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\id.pak
            • Size 336KB
            • SHA256 9210c4c4c33e7ceb5f70005a92a4fd36ca4facdd41701fdc1d2ce638db8adf22
            • MD5 SHA1 SHA512 SSDEEP

            it.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\it.pak
            • Size 373KB
            • SHA256 c0dc0a4a87f7bb054a30eb1174c3228ea2014bd94668a7d22995b99c4937d817
            • MD5 SHA1 SHA512 SSDEEP

            ja.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\ja.pak
            • Size 456KB
            • SHA256 3accfd9a1833ddeedb2082fb94101beb59b555c60f42e3070e9e04a372eba84a
            • MD5 SHA1 SHA512 SSDEEP

            kn.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\kn.pak
            • Size 910KB
            • SHA256 90b2df3338468e84e2cf2f2f67597cba5c3ceb5dba9c59ebd072ec15a70ce741
            • MD5 SHA1 SHA512 SSDEEP

            ko.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\ko.pak
            • Size 383KB
            • SHA256 b04c1b91cab31054be70cb851dc6716065545445801045daceb96eeee4d2334a
            • MD5 SHA1 SHA512 SSDEEP

            lt.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\lt.pak
            • Size 412KB
            • SHA256 9200a9509bd77834d9912f4ba8f4219d2b9bd2cdad49a11873db30e99b9d1350
            • MD5 SHA1 SHA512 SSDEEP

            lv.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\lv.pak
            • Size 410KB
            • SHA256 b5a31cbfcb40ad8d911de1618c4eb7e8cc67b97eb8878220f15d40eb014d8ac8
            • MD5 SHA1 SHA512 SSDEEP

            ml.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\ml.pak
            • Size 948KB
            • SHA256 61a372f170de0a22712be980c3c78b22035ebf40ce79332fab75cdcc4208c9e6
            • MD5 SHA1 SHA512 SSDEEP

            mr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\mr.pak
            • Size 772KB
            • SHA256 481faf7dd66cf10a476d8b156fb4ea452f920322d8007f7e25d41b2837bdbc09
            • MD5 SHA1 SHA512 SSDEEP

            ms.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\ms.pak
            • Size 351KB
            • SHA256 fe58cc4f62fc31e32c1fb9a0893a5483391ab6a91b1c92ed4a5e3103a962da7a
            • MD5 SHA1 SHA512 SSDEEP

            nb.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\nb.pak
            • Size 344KB
            • SHA256 d565c6c95dad89d3f2b7210de4ec3fc437633de4dcfc994fde0704b92bb53ff8
            • MD5 SHA1 SHA512 SSDEEP

            nl.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\nl.pak
            • Size 356KB
            • SHA256 55413d5eddb3300e0ae0fa5d79d26fdf1e5a12922d7018c8054b1faa9d660301
            • MD5 SHA1 SHA512 SSDEEP

            pl.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\pl.pak
            • Size 396KB
            • SHA256 53b59486361b11512fb90f15065104b15ee2322bb7804f859cde2f2ecf9581fb
            • MD5 SHA1 SHA512 SSDEEP

            pt-BR.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\pt-BR.pak
            • Size 374KB
            • SHA256 c9ec3822044365457b8736348cf95a8e39bdfe3ed36267449bf3ed739accef2e
            • MD5 SHA1 SHA512 SSDEEP

            pt-PT.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\pt-PT.pak
            • Size 376KB
            • SHA256 c89170385b3afb2ec89fbd61b8470ac718713c7296441c8430f173dac218e74b
            • MD5 SHA1 SHA512 SSDEEP

            ro.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\ro.pak
            • Size 387KB
            • SHA256 7247470057a936d03bfa2a8776508ab66aa1040c41a4eb8f79c1e93551c74bb8
            • MD5 SHA1 SHA512 SSDEEP

            ru.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\ru.pak
            • Size 634KB
            • SHA256 b4223b56ec88235819a427d60bb937eb3984076523f02a018f57819e0429bea9
            • MD5 SHA1 SHA512 SSDEEP

            sk.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\sk.pak
            • Size 399KB
            • SHA256 75f179897cad221ca6e36b47f53cead7f3fb4159ee196f1d10a5181b84e1b5b7
            • MD5 SHA1 SHA512 SSDEEP

            sl.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\sl.pak
            • Size 385KB
            • SHA256 6002c129a56558832e9bd260c427c0bd2e1566e0aea3ad999f89c8e479534f9b
            • MD5 SHA1 SHA512 SSDEEP

            sr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\sr.pak
            • Size 595KB
            • SHA256 524acc64e70918a77cda43fd9b27a727645b28ad2d4cce16b327105101c8bbeb
            • MD5 SHA1 SHA512 SSDEEP

            sv.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\sv.pak
            • Size 347KB
            • SHA256 3420a1fbcca5bf8c2d65d6dcb0db78b03f95f7f2fc56479a0de6e3312333ce6f
            • MD5 SHA1 SHA512 SSDEEP

            sw.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\sw.pak
            • Size 365KB
            • SHA256 690027c4a31c4aea00b7d1b32ec6cd3fa50b1eac412ae273ab15e72eb485dd6e
            • MD5 SHA1 SHA512 SSDEEP

            ta.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\ta.pak
            • Size 936KB
            • SHA256 7e818deedd50a533851bbf08e056bf2ad8d45f442a1a61d9b48e66804ea848db
            • MD5 SHA1 SHA512 SSDEEP

            te.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\te.pak
            • Size 869KB
            • SHA256 d839531c4ff4a2885c993e0d358f78667215b0950c77a06ef01a6acff9221c5b
            • MD5 SHA1 SHA512 SSDEEP

            th.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\th.pak
            • Size 731KB
            • SHA256 cd80bf232f2f128a3d411f52c8039987559dbc1055f746eed6e0e8478b116dc1
            • MD5 SHA1 SHA512 SSDEEP

            tr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\tr.pak
            • Size 371KB
            • SHA256 b22fc7b75c52cc142f201d5cf107d17c1b173a494a6add022127f559fb46bcb0
            • MD5 SHA1 SHA512 SSDEEP

            uk.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\uk.pak
            • Size 634KB
            • SHA256 28ea88f19b2c34699d535ca0c691449b7e4001c12e8aed8d04b2078916e88a37
            • MD5 SHA1 SHA512 SSDEEP

            ur.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\ur.pak
            • Size 552KB
            • SHA256 4c7affdcc324cd791d10e235da809ce7501e8005be64340b6e8bf5595647a707
            • MD5 SHA1 SHA512 SSDEEP

            vi.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\vi.pak
            • Size 439KB
            • SHA256 b75694e390bd2e20780b3bc72f6e1473ba45d7537c27642a7d888dfd3bb6c3bb
            • MD5 SHA1 SHA512 SSDEEP

            zh-CN.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\zh-CN.pak
            • Size 319KB
            • SHA256 a7ac9fda6f4cd189b75fdadc4b70cd0d369a09b66eaeb5d032678cb97ffc98f6
            • MD5 SHA1 SHA512 SSDEEP

            zh-TW.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\locales\zh-TW.pak
            • Size 316KB
            • SHA256 c5061ec00bd969f76f3c0c6ff15ddacafed7491260bd8ced78118691ba57bdff
            • MD5 SHA1 SHA512 SSDEEP

            resources.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\resources.pak
            • Size 5.1MB
            • SHA256 4f29587bcd952de1dbc0b98df0aa506bd9fcf447e6a7258c5eb7e9eb780e6d6c
            • MD5 SHA1 SHA512 SSDEEP

            app.asar

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\resources\app.asar
            • Size 21.6MB
            • SHA256 d9ac367c70d2810afef4a09926a463fcec46745e6fee99c28c964ececf5b9889
            • MD5 SHA1 SHA512 SSDEEP

            elevate.exe

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\resources\elevate.exe
            • Size 105KB
            • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
            • MD5 SHA1 SHA512 SSDEEP

            snapshot_blob.bin

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\snapshot_blob.bin
            • Size 168KB
            • SHA256 8613412ebcf462373d4d50f5729f5b9a61ef2b5c599b267f750276c8e29caf25
            • MD5 SHA1 SHA512 SSDEEP

            v8_context_snapshot.bin

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\v8_context_snapshot.bin
            • Size 471KB
            • SHA256 add78f3f85f0b173cbe917871821f74c5afe0a6562462762b181180d16df4470
            • MD5 SHA1 SHA512 SSDEEP

            vk_swiftshader.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\vk_swiftshader.dll
            • Size 4.9MB
            • SHA256 a32c3fbbf74699a10e7642bf4901191f29c88c5aec93ae7ba28c79ab28462a69
            • MD5 SHA1 SHA512 SSDEEP

            vk_swiftshader_icd.json

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\vk_swiftshader_icd.json
            • Size 106B
            • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
            • MD5 SHA1 SHA512

            vulkan-1.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\7z-out\vulkan-1.dll
            • Size 894KB
            • SHA256 1f8b647f161f20d45d554e349b3e5ef0b7b5da8c7bdbc1ff631d37dc9c819503
            • MD5 SHA1 SHA512 SSDEEP

            SpiderBanner.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\SpiderBanner.dll
            • Size 9KB
            • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
            • MD5 SHA1 SHA512 SSDEEP

            StdUtils.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\StdUtils.dll
            • Size 100KB
            • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
            • MD5 SHA1 SHA512 SSDEEP

            System.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\System.dll
            • Size 12KB
            • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
            • MD5 SHA1 SHA512 SSDEEP

            nsis7z.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nszE943.tmp\nsis7z.dll
            • Size 424KB
            • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
            • MD5 SHA1 SHA512 SSDEEP

            memory/3632-709-0x00007FFC377C0000-0x00007FFC377C1000-memory.dmp