Analysis

  • max time kernel
    18s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2024, 12:57

General

  • Target
    EpsilonSetup.exe
  • Size 66.5MB
  • Sample240119-p6yebaedel
  • SHA256 e862a4c024eb9c3df7442591bbf0700a3bb2b498fa80bc99296e9fb33defd120
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Irata

    Irata is an Iranian remote access trojan Android malware first seen in August 2022.

  • Irata payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EpsilonSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\EpsilonSetup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
      C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:940
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2028
      • C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=980 --field-trial-handle=1176,i,9430890413776923076,6566069307631285605,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1412
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
          PID:724
        • C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
          "C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1152 --field-trial-handle=1176,i,9430890413776923076,6566069307631285605,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
          3⤵
            PID:1160
          • C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
            "C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --mojo-platform-channel-handle=1436 --field-trial-handle=1176,i,9430890413776923076,6566069307631285605,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
            3⤵
              PID:1116
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "tasklist"
              3⤵
                PID:1676
                • C:\Windows\system32\tasklist.exe
                  tasklist
                  4⤵
                  • Enumerates processes with tasklist
                  PID:1516
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                3⤵
                  PID:1624
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    4⤵
                    • Enumerates processes with tasklist
                    PID:1556
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                  3⤵
                    PID:2436
                    • C:\Windows\system32\tasklist.exe
                      tasklist
                      4⤵
                      • Enumerates processes with tasklist
                      PID:2800
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                    3⤵
                      PID:2120
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        4⤵
                        • Enumerates processes with tasklist
                        PID:2408
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                      3⤵
                        PID:2748
                        • C:\Windows\system32\tasklist.exe
                          tasklist
                          4⤵
                          • Enumerates processes with tasklist
                          PID:2572
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                        3⤵
                          PID:3056
                          • C:\Windows\system32\tasklist.exe
                            tasklist
                            4⤵
                            • Enumerates processes with tasklist
                            PID:1256
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                          3⤵
                            PID:1292
                            • C:\Windows\system32\tasklist.exe
                              tasklist
                              4⤵
                              • Enumerates processes with tasklist
                              PID:2840
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                            3⤵
                              PID:2936
                              • C:\Windows\system32\tasklist.exe
                                tasklist
                                4⤵
                                • Enumerates processes with tasklist
                                PID:2316
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                              3⤵
                                PID:1528
                                • C:\Windows\system32\tasklist.exe
                                  tasklist
                                  4⤵
                                  • Enumerates processes with tasklist
                                  PID:396
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                3⤵
                                  PID:1812
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist
                                    4⤵
                                    • Enumerates processes with tasklist
                                    PID:2160
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                  3⤵
                                    PID:2448
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist
                                      4⤵
                                      • Enumerates processes with tasklist
                                      PID:1588
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                    3⤵
                                      PID:580
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist
                                        4⤵
                                        • Enumerates processes with tasklist
                                        PID:2248
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                      3⤵
                                        PID:2400
                                        • C:\Windows\system32\tasklist.exe
                                          tasklist
                                          4⤵
                                          • Enumerates processes with tasklist
                                          PID:2468
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                        3⤵
                                          PID:2144
                                          • C:\Windows\system32\tasklist.exe
                                            tasklist
                                            4⤵
                                            • Enumerates processes with tasklist
                                            PID:816
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist
                                      1⤵
                                      • Enumerates processes with tasklist
                                      PID:1912

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          D3DCompiler_47.dll

                                          • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\D3DCompiler_47.dll
                                          • Size 2.9MB
                                          • SHA256 00b1bd9b75445ecc1bd7899d0052be3fa7b0a933ab76a3e09332f4a9b6802f50
                                          • MD5 SHA1 SHA512 SSDEEP

                                          EpsilonSetup.exe

                                          • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
                                          • Size 384KB
                                          • SHA256 4141786e5b593ce98f9fc727ba65fb636b28fc8da3bcadb0328aad394fe114aa
                                          • MD5 SHA1 SHA512 SSDEEP

                                          EpsilonSetup.exe

                                          • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
                                          • Size 1.5MB
                                          • SHA256 0cc3f47ef5a9983489bac007fe6792a0bad9e8aab8a492d613615f350b608a21
                                          • MD5 SHA1 SHA512 SSDEEP

                                          EpsilonSetup.exe

                                          • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
                                          • Size 3.2MB
                                          • SHA256 16a0fa3c2af0412b9a52f6f7fba6bd8ebf55b86e02930f184e780854cae604c5
                                          • MD5 SHA1 SHA512 SSDEEP

                                          EpsilonSetup.exe

                                          • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
                                          • Size 2.0MB
                                          • SHA256 6bf9f26e7348ba94b3dadaf493b2bab76991290a873e7fc61b87c145745c1112
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ffmpeg.dll

                                          • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\ffmpeg.dll
                                          • Size 320KB
                                          • SHA256 378882a8b778062a34d9c0fa55e961b463aab1e5277c8d9a9e0b51d0af83da4a
                                          • MD5 SHA1 SHA512 SSDEEP

                                          icudtl.dat

                                          • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\icudtl.dat
                                          • Size 384KB
                                          • SHA256 a865111ca09f3e8e77cb4e25d9efbfddfa84c59bdfa2070829286838985125dc
                                          • MD5 SHA1 SHA512 SSDEEP

                                          libglesv2.dll

                                          • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\libglesv2.dll
                                          • Size 1.9MB
                                          • SHA256 6bf54bfee6a289c50b6fa1780e04ee59c4de32ed9f513644c8a7933519611704
                                          • MD5 SHA1 SHA512 SSDEEP

                                          en-US.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\locales\en-US.pak
                                          • Size 302KB
                                          • SHA256 a99bd31907bbdc12bdfbff7b9da6ddd850c273f3a6ece64ee8d1d9b6ef0c501c
                                          • MD5 SHA1 SHA512 SSDEEP

                                          resources.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\resources.pak
                                          • Size 2.8MB
                                          • SHA256 0a2bcf5663ac2acf5c9e5b9b449bfcd700e01f1fe1a48c6d8a72ce71da273ca5
                                          • MD5 SHA1 SHA512 SSDEEP

                                          app.asar

                                          • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\resources\app.asar
                                          • Size 42KB
                                          • SHA256 af3ca140e97e0f3cbf8332e193456e8b403d0d945611c05fab70ff4bb292414a
                                          • MD5 SHA1 SHA512 SSDEEP

                                          v8_context_snapshot.bin

                                          • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\v8_context_snapshot.bin
                                          • Size 320KB
                                          • SHA256 395c92d1fe271d08f94d26a4eb85dc91cfa5a12c2026079d0aac48dd1090a94d
                                          • MD5 SHA1 SHA512 SSDEEP

                                          EpsilonSetup.exe

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\EpsilonSetup.exe
                                          • Size 1.9MB
                                          • SHA256 ed368eb317db4e4c190278039cc0a26733bdf531024f12a02592bcb1ecb0c6ea
                                          • MD5 SHA1 SHA512 SSDEEP

                                          LICENSE.electron.txt

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\LICENSE.electron.txt
                                          • Size 1KB
                                          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                                          • MD5 SHA1 SHA512

                                          LICENSES.chromium.html

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\LICENSES.chromium.html
                                          • Size 3.7MB
                                          • SHA256 d0c68c953f124ed640c4eb8a14934bb34b53fa1397345686e77cbfaefc2b3a99
                                          • MD5 SHA1 SHA512 SSDEEP

                                          chrome_100_percent.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\chrome_100_percent.pak
                                          • Size 126KB
                                          • SHA256 bca4401b578a6ac0fe793e8519fed82b5444972b7d6c176ec0369ed13beaad7b
                                          • MD5 SHA1 SHA512 SSDEEP

                                          chrome_200_percent.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\chrome_200_percent.pak
                                          • Size 175KB
                                          • SHA256 b2c25fb30fee5f04ccdb8bf3c937a667502d266e428425feeb5af964f6167d48
                                          • MD5 SHA1 SHA512 SSDEEP

                                          d3dcompiler_47.dll

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\d3dcompiler_47.dll
                                          • Size 4.7MB
                                          • SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ffmpeg.dll

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\ffmpeg.dll
                                          • Size 2.6MB
                                          • SHA256 24a896a9b63d116c2da72928cbbffff4934bf0ce1ec3e99d53493cd776e3a07b
                                          • MD5 SHA1 SHA512 SSDEEP

                                          icudtl.dat

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\icudtl.dat
                                          • Size 4.8MB
                                          • SHA256 15bc301ab62f67e4874855bac3f496ef2d9f059b299783a02055169f3a81e9af
                                          • MD5 SHA1 SHA512 SSDEEP

                                          libEGL.dll

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\libEGL.dll
                                          • Size 464KB
                                          • SHA256 c813ee6b4e4f81f32f4fed86497cd751fdb4c19b0b718c61aed06f0760f511db
                                          • MD5 SHA1 SHA512 SSDEEP

                                          libGLESv2.dll

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\libGLESv2.dll
                                          • Size 3.5MB
                                          • SHA256 655530b1a8b92426c2ceeb61f615d06632ff4f2ad034c7363de9358e32f6af27
                                          • MD5 SHA1 SHA512 SSDEEP

                                          af.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\af.pak
                                          • Size 327KB
                                          • SHA256 b1987cdcbb8d76598422aa1739a246ed6690dc1b211f950fcbf2f040491ed7a8
                                          • MD5 SHA1 SHA512 SSDEEP

                                          am.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\am.pak
                                          • Size 76KB
                                          • SHA256 87d4e811a52f5aee5beb3418512f79e6b0b6d36ca602360af39aff55d43e307e
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ar.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\ar.pak
                                          • Size 574KB
                                          • SHA256 bfa2a3c3ebb3c6afbca42cb70b4da8f997068d511cf40ee8a952a893b8f9d7cd
                                          • MD5 SHA1 SHA512 SSDEEP

                                          bg.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\bg.pak
                                          • Size 608KB
                                          • SHA256 6c10b64d31e0dc2c4befc6703ac17343ca473b4350cfb3c6e01833f505b69590
                                          • MD5 SHA1 SHA512 SSDEEP

                                          bn.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\bn.pak
                                          • Size 780KB
                                          • SHA256 297d52b252df0912490ddf26fa58706895e70c2a0f3f09d0dc756706720095ef
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ca.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\ca.pak
                                          • Size 91KB
                                          • SHA256 5e0d1b75d353fa6c4adbbea1befbfc793673b5f46501791128ccd6f129b610dc
                                          • MD5 SHA1 SHA512 SSDEEP

                                          cs.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\cs.pak
                                          • Size 377KB
                                          • SHA256 08e40f5efc616cdc0588fb4b1a706d997c69d17ddaf97eb91a4aabafaa11cee6
                                          • MD5 SHA1 SHA512 SSDEEP

                                          da.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\da.pak
                                          • Size 342KB
                                          • SHA256 13c9583127d9d723801c946039e60f72dbbde898dd23fb9f675b9e299d0ce72a
                                          • MD5 SHA1 SHA512 SSDEEP

                                          de.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\de.pak
                                          • Size 367KB
                                          • SHA256 8bd127d689be65e45bb8d2a2ff66698200da97835809c6b56ec9e2929b70618a
                                          • MD5 SHA1 SHA512 SSDEEP

                                          el.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\el.pak
                                          • Size 664KB
                                          • SHA256 bc07e403272a4d65305fe24a827404d7b931d01cda547f8c07a840d19e591430
                                          • MD5 SHA1 SHA512 SSDEEP

                                          en-GB.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\en-GB.pak
                                          • Size 299KB
                                          • SHA256 e1e357c853eed83fb6c4133f8f4df377a8eda4fe6f0e55395f21c5ab6e38faa8
                                          • MD5 SHA1 SHA512 SSDEEP

                                          en-US.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\en-US.pak
                                          • Size 24KB
                                          • SHA256 bd25e0f67e1a92c129cc02bfb322679cfff7e7664deb54ea0fe9b0b63afad568
                                          • MD5 SHA1 SHA512 SSDEEP

                                          es-419.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\es-419.pak
                                          • Size 366KB
                                          • SHA256 943fa8774ade38d57349a5d27869097a782bc06bd34c40864a85ba829457d127
                                          • MD5 SHA1 SHA512 SSDEEP

                                          es.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\es.pak
                                          • Size 367KB
                                          • SHA256 11ef2c0229c1fe1c10be08e3d5f36c973bc3c272f37b40e05c534a118757461b
                                          • MD5 SHA1 SHA512 SSDEEP

                                          et.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\et.pak
                                          • Size 330KB
                                          • SHA256 3599e7138a24a31839da877cc9718b9c0c9522437ea93a6222a119080f108d14
                                          • MD5 SHA1 SHA512 SSDEEP

                                          fa.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\fa.pak
                                          • Size 535KB
                                          • SHA256 bb28ad47e95aefaa2d8d7b6a7f449f9707cfadbcd4c21bad8bd8a6578108d2cd
                                          • MD5 SHA1 SHA512 SSDEEP

                                          fi.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\fi.pak
                                          • Size 338KB
                                          • SHA256 df8cefa4831fc2fdf817dd6d49a6373edee4f51f23cf990c690e72ce348f69bb
                                          • MD5 SHA1 SHA512 SSDEEP

                                          fil.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\fil.pak
                                          • Size 39KB
                                          • SHA256 e5734b928191663e66254cb46e6eeb1f2aae9b3e36cbc69db855044c691ba73a
                                          • MD5 SHA1 SHA512 SSDEEP

                                          fr.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\fr.pak
                                          • Size 395KB
                                          • SHA256 7af39af49846fba6d6b8ee18b2a212f1323ebc1cff1af0053194d01d8d5433f6
                                          • MD5 SHA1 SHA512 SSDEEP

                                          gu.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\gu.pak
                                          • Size 755KB
                                          • SHA256 047da4dfadcfc6bec8f4dc7d250b1757caf31a23bcfa2ea3e1f3b1cdbe9a3995
                                          • MD5 SHA1 SHA512 SSDEEP

                                          he.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\he.pak
                                          • Size 468KB
                                          • SHA256 6649a844f222cfcec01e75d3de3cb3658f1347ea3851d31b8124597b87e7b57d
                                          • MD5 SHA1 SHA512 SSDEEP

                                          hi.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\hi.pak
                                          • Size 787KB
                                          • SHA256 eda355e3785313e3d982c1d3652266dce1b6e08832056fe58854b825e0712ca5
                                          • MD5 SHA1 SHA512 SSDEEP

                                          hr.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\hr.pak
                                          • Size 365KB
                                          • SHA256 bada5828fc0d80c842d1409b54e8da516ae737ca30d86658b3fad5c8ace4722e
                                          • MD5 SHA1 SHA512 SSDEEP

                                          hu.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\hu.pak
                                          • Size 395KB
                                          • SHA256 688312f38488c7256370b1517b84963a3ff886b31692cc504fe169db241a43f0
                                          • MD5 SHA1 SHA512 SSDEEP

                                          id.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\id.pak
                                          • Size 25KB
                                          • SHA256 4394cd07a737f089cfb4dedbdda5c7eec6c9e873fa35a73611c5dc0eb87c18b9
                                          • MD5 SHA1 SHA512 SSDEEP

                                          it.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\it.pak
                                          • Size 360KB
                                          • SHA256 13dd077e5e8c8b04ac0854e4466ee074df67c74cd29cc48a0c2c9f96f768fad5
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ja.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\ja.pak
                                          • Size 440KB
                                          • SHA256 2c5457b0fa6fe41b7b524aa726dae4dd69e7072864f73f211c731810d00b9323
                                          • MD5 SHA1 SHA512 SSDEEP

                                          kn.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\kn.pak
                                          • Size 85KB
                                          • SHA256 365e118ca3f65dcf5183bfa6e3750e31f1261e169f99c047cb707b957e74d3c8
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ko.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\ko.pak
                                          • Size 19KB
                                          • SHA256 d395d131e89470ea7593f273694c94168be313844926b6348ac09599ab98d962
                                          • MD5 SHA1 SHA512 SSDEEP

                                          lt.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\lt.pak
                                          • Size 53KB
                                          • SHA256 990c4e5662dda25d01b55cdda6f6ba230ae6bf6c98387da9370f6a7163993d2d
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ml.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\ml.pak
                                          • Size 57KB
                                          • SHA256 20733f249a27b1bbb4c3a1bf7e6e411f74fe8f53ce75ca841ceb361c55de49a7
                                          • MD5 SHA1 SHA512 SSDEEP

                                          mr.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\mr.pak
                                          • Size 45KB
                                          • SHA256 79152829d38bdd060c68255d6b55f8ec60466f63ed105e5bbf28b06bd86e856f
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ms.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\ms.pak
                                          • Size 1KB
                                          • SHA256 1b9d305d0d5d796d4665045c27c3a5b6ca58153d6db27ae4cae5b68f95eed1d5
                                          • MD5 SHA1 SHA512

                                          nb.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\nb.pak
                                          • Size 11KB
                                          • SHA256 3bf4db25a5ebbb2f5c62b7b9e00d8afd6a57263d2c154893887e72eb63a722dd
                                          • MD5 SHA1 SHA512 SSDEEP

                                          nl.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\nl.pak
                                          • Size 1KB
                                          • SHA256 e145e33a70d972cc5e43477409888ee6b9f333a8ec5edfa27da37ddda753cc21
                                          • MD5 SHA1 SHA512

                                          pl.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\pl.pak
                                          • Size 381KB
                                          • SHA256 65b6dd63aaba1692f36774413d372f6c6c66088d7ec4009a2dbee1648ca133f1
                                          • MD5 SHA1 SHA512 SSDEEP

                                          pt-BR.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\pt-BR.pak
                                          • Size 360KB
                                          • SHA256 7b171f2a6d46295147a8d10e475048bac4346c6a5162b32a0336334baccad520
                                          • MD5 SHA1 SHA512 SSDEEP

                                          pt-PT.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\pt-PT.pak
                                          • Size 128KB
                                          • SHA256 eea143cf978759145779874c7ab1b9485ca72092ec3769b37703c453aa648501
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ro.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\ro.pak
                                          • Size 372KB
                                          • SHA256 c50f824e63806e5782b693f7d474c48684b9e5174e93463a9bc2876c94990879
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ru.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\ru.pak
                                          • Size 606KB
                                          • SHA256 44f0cbb2d5414b6dfca6abb40a435200670e2a71607b158fcbaba67fd6b3ba08
                                          • MD5 SHA1 SHA512 SSDEEP

                                          sk.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\sk.pak
                                          • Size 192KB
                                          • SHA256 e85ed8528589a6361ed3af1068c4b368b50e721ffa0bddd39aae243cf50d2092
                                          • MD5 SHA1 SHA512 SSDEEP

                                          sl.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\sl.pak
                                          • Size 369KB
                                          • SHA256 d0415bfa061b36a6eb93fa2c78563448da8b63c91e0523086c7eb2714933ab99
                                          • MD5 SHA1 SHA512 SSDEEP

                                          sr.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\sr.pak
                                          • Size 572KB
                                          • SHA256 d459c1a781ddc344de76558211983dd07d47e3ca6cacffb518043bd78dc48fbe
                                          • MD5 SHA1 SHA512 SSDEEP

                                          sv.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\sv.pak
                                          • Size 334KB
                                          • SHA256 3f0acf6f6319636c3e72cdc392b7b80ab0cfd8ae1a5a8e319624e4b46bcd3c42
                                          • MD5 SHA1 SHA512 SSDEEP

                                          sw.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\sw.pak
                                          • Size 351KB
                                          • SHA256 dea6947693fceb6457801d912ea7c716add3c0cfb4c34782a9cfa4c4e06b9402
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ta.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\ta.pak
                                          • Size 899KB
                                          • SHA256 e0421b4cf2736bb465ec02cd85c2df09809f86479cb7624195373f25edbcedd3
                                          • MD5 SHA1 SHA512 SSDEEP

                                          te.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\te.pak
                                          • Size 836KB
                                          • SHA256 f53e06181c9fa0f6028906a7388fd4e8f000ffb7277330634462433d34572395
                                          • MD5 SHA1 SHA512 SSDEEP

                                          th.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\th.pak
                                          • Size 704KB
                                          • SHA256 4fe2b7b6886e3ce068be0b7a0a71d45756eb797eda1e7d4fad52ab8a370e8336
                                          • MD5 SHA1 SHA512 SSDEEP

                                          tr.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\tr.pak
                                          • Size 357KB
                                          • SHA256 5df18798a35b502a18fb4f82e9b03b7ca100903ecd5d192ab2a3f0bc7646c366
                                          • MD5 SHA1 SHA512 SSDEEP

                                          uk.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\uk.pak
                                          • Size 605KB
                                          • SHA256 3fb15957c77f3635aa7cfca796b045a1ee1f1abfc0c12c163cfb537364f3c80a
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ur.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\ur.pak
                                          • Size 532KB
                                          • SHA256 06a0c18d978b54dd163c7f77b7ee0f2ecf3607c5dc14032326f21b4a1f304d81
                                          • MD5 SHA1 SHA512 SSDEEP

                                          vi.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\vi.pak
                                          • Size 424KB
                                          • SHA256 f1602637e7f3e0a908d7a9a3f630b8dd38bfd26704cc64ef432d2c88a1ee7017
                                          • MD5 SHA1 SHA512 SSDEEP

                                          zh-CN.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\zh-CN.pak
                                          • Size 128KB
                                          • SHA256 5e096156dfc6a821d891d88b4516bd5b4d49ecb89100f5e23d3d48026d1579bc
                                          • MD5 SHA1 SHA512 SSDEEP

                                          zh-TW.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\locales\zh-TW.pak
                                          • Size 128KB
                                          • SHA256 14549b9b3639f535f169810e3793abce3da9186102b4b6ea3c9fe1f260bb250a
                                          • MD5 SHA1 SHA512 SSDEEP

                                          resources.pak

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\resources.pak
                                          • Size 5.0MB
                                          • SHA256 60c2c73c1313101be6fbfe1d7f7d06259de490219fd79cdb798bd0e0385c7564
                                          • MD5 SHA1 SHA512 SSDEEP

                                          app.asar

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\resources\app.asar
                                          • Size 128KB
                                          • SHA256 97780241a5886f67fbc49086e0a0e61391770616e39701eeec3ac2c5996572c3
                                          • MD5 SHA1 SHA512 SSDEEP

                                          elevate.exe

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\resources\elevate.exe
                                          • Size 102KB
                                          • SHA256 05a229b995a82b9cc14fb7b8d07f1b00471f29935f67fc04746f849c91390111
                                          • MD5 SHA1 SHA512 SSDEEP

                                          snapshot_blob.bin

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\snapshot_blob.bin
                                          • Size 410KB
                                          • SHA256 ece191beef3b53272a925c1f5e8c02a0dc78b00559799d27a0665fc480380b3c
                                          • MD5 SHA1 SHA512 SSDEEP

                                          v8_context_snapshot.bin

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\v8_context_snapshot.bin
                                          • Size 704KB
                                          • SHA256 41e7015e720e6da27774cbaa1b42cd22aaa28d324192478fc578828d173b2484
                                          • MD5 SHA1 SHA512 SSDEEP

                                          vk_swiftshader.dll

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\vk_swiftshader.dll
                                          • Size 704KB
                                          • SHA256 fb844a13db5e4c459c3dc946caecd6b5fc23ced7d826e617bd21ca9f8fb2fc0a
                                          • MD5 SHA1 SHA512 SSDEEP

                                          vk_swiftshader_icd.json

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\vk_swiftshader_icd.json
                                          • Size 106B
                                          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                                          • MD5 SHA1 SHA512

                                          vulkan-1.dll

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\7z-out\vulkan-1.dll
                                          • Size 704KB
                                          • SHA256 90516815509ebe12fb2683d980052d563d53db69c5d30180b16155c5867a901e
                                          • MD5 SHA1 SHA512 SSDEEP

                                          StdUtils.dll

                                          • Path C:\Users\Admin\AppData\Local\Temp\nsy712B.tmp\StdUtils.dll
                                          • Size 100KB
                                          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                                          • MD5 SHA1 SHA512 SSDEEP

                                          EpsilonSetup.exe

                                          • Path \Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
                                          • Size 448KB
                                          • SHA256 789a6b4bf96276bcc994714563e000e28517bb6e8c94a0a5fad19e1e02065412
                                          • MD5 SHA1 SHA512 SSDEEP

                                          EpsilonSetup.exe

                                          • Path \Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
                                          • Size 1.2MB
                                          • SHA256 a9c4fddb765743b599b9a7429f2826e347254e61b43d1e58965b6c8f6d9cce18
                                          • MD5 SHA1 SHA512 SSDEEP

                                          EpsilonSetup.exe

                                          • Path \Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
                                          • Size 2.6MB
                                          • SHA256 c07ccf341d0d366bf4d48d21eb8bb8095721b7604f76bd49330b4761382ac179
                                          • MD5 SHA1 SHA512 SSDEEP

                                          EpsilonSetup.exe

                                          • Path \Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
                                          • Size 2.8MB
                                          • SHA256 4acc4e1297d54b44e0d65c11e5081be3f9ee30130a4c618d2f0243eee1fffce4
                                          • MD5 SHA1 SHA512 SSDEEP

                                          d3dcompiler_47.dll

                                          • Path \Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\d3dcompiler_47.dll
                                          • Size 2.7MB
                                          • SHA256 5ff2e3c1f12c7c55cac91c1566e50700cf0d55dc995a79b4d0fcefedc8d78b45
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ffmpeg.dll

                                          • Path \Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\ffmpeg.dll
                                          • Size 384KB
                                          • SHA256 e3d74db174303222d656d107204f2cebd8eeb93938881f0bbc134e4fd20a06b9
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ffmpeg.dll

                                          • Path \Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\ffmpeg.dll
                                          • Size 927KB
                                          • SHA256 31c5c9ffc3816d0024cf553478c67367f4b80ad2eaa140905c5c1c34c54f5c58
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ffmpeg.dll

                                          • Path \Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\ffmpeg.dll
                                          • Size 1.9MB
                                          • SHA256 102d52e920d9b49d845e9a6a710c0554892fbf08071cdf06e5db05e3975ee80c
                                          • MD5 SHA1 SHA512 SSDEEP

                                          libGLESv2.dll

                                          • Path \Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\libGLESv2.dll
                                          • Size 2.2MB
                                          • SHA256 4edb2b2463bb383f07d4441e592496969c5234d1319df3dd175d9c6e3254be61
                                          • MD5 SHA1 SHA512 SSDEEP

                                          ce48244d-4d5a-4ef7-8694-47fa77a6bc9b.tmp.node

                                          • Path \Users\Admin\AppData\Local\Temp\ce48244d-4d5a-4ef7-8694-47fa77a6bc9b.tmp.node
                                          • Size 135KB
                                          • SHA256 e59e21b84b2a6200c3789157d5f14407ea4dfe880bb2113666d10e98ceb3ee8f
                                          • MD5 SHA1 SHA512 SSDEEP

                                          f34caff2-5ae2-4bef-ace6-f0cf28ccb27b.tmp.node

                                          • Path \Users\Admin\AppData\Local\Temp\f34caff2-5ae2-4bef-ace6-f0cf28ccb27b.tmp.node
                                          • Size 1.8MB
                                          • SHA256 ec41fc2fee2abcbf0559965501f54aae47cff24a87204fd3a85d86c7d53d53c7
                                          • MD5 SHA1 SHA512 SSDEEP

                                          System.dll

                                          • Path \Users\Admin\AppData\Local\Temp\nsy712B.tmp\System.dll
                                          • Size 12KB
                                          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                                          • MD5 SHA1 SHA512 SSDEEP

                                          nsis7z.dll

                                          • Path \Users\Admin\AppData\Local\Temp\nsy712B.tmp\nsis7z.dll
                                          • Size 424KB
                                          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                                          • MD5 SHA1 SHA512 SSDEEP

                                          memory/1412-583-0x00000000773A0000-0x00000000773A1000-memory.dmp

                                          memory/1412-552-0x0000000000060000-0x0000000000061000-memory.dmp