Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2024, 12:57

General

  • Target
    EpsilonSetup.exe
  • Size 66.5MB
  • Sample240119-p6yebaedel
  • SHA256 e862a4c024eb9c3df7442591bbf0700a3bb2b498fa80bc99296e9fb33defd120
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 14 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EpsilonSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\EpsilonSetup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4288
    • C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
      C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1020
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5048
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3460
      • C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1360 --field-trial-handle=1740,i,16035820452560619444,318758076150280230,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1940
      • C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --mojo-platform-channel-handle=1972 --field-trial-handle=1740,i,16035820452560619444,318758076150280230,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2056
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4004
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5028
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3652
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4964
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
          PID:2376
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          3⤵
            PID:4920
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "tasklist"
            3⤵
              PID:3320
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "tasklist"
              3⤵
                PID:4924
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1152
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                3⤵
                  PID:3260
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                  3⤵
                    PID:4672
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                    3⤵
                      PID:1992
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                      3⤵
                        PID:4608
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                        3⤵
                          PID:1228
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                          3⤵
                            PID:4496
                          • C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
                            "C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1740,i,16035820452560619444,318758076150280230,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious behavior: EnumeratesProcesses
                            PID:664
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        1⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2708
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        1⤵
                        • Enumerates processes with tasklist
                        PID:1152
                        • C:\Windows\system32\tasklist.exe
                          tasklist
                          2⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2296
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        1⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2616
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        1⤵
                        • Enumerates processes with tasklist
                        PID:2628
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        1⤵
                        • Enumerates processes with tasklist
                        PID:2436
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        1⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4320
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        1⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5036
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        1⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1516
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        1⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2060
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        1⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4904
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        1⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1596
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        1⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4372
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        1⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1608
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2628
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2436
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        1⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:864

                      Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            D3DCompiler_47.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\D3DCompiler_47.dll
                            • Size 60KB
                            • SHA256 5bf7243d9d7d8d17d757b8e9acd72aca48f00674702dea90aea33a0be9d7b1c2
                            • MD5 SHA1 SHA512 SSDEEP

                            EpsilonSetup.exe

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
                            • Size 99KB
                            • SHA256 9d815ffad5b13899024031ef927f189a9a9cfea1656d66553335f4a3f76be6a6
                            • MD5 SHA1 SHA512 SSDEEP

                            EpsilonSetup.exe

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
                            • Size 92KB
                            • SHA256 bdf516251fbfcedeeca1eb4f5e52baa39411311d89c9b59d5e1741c57bccd45d
                            • MD5 SHA1 SHA512 SSDEEP

                            EpsilonSetup.exe

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
                            • Size 106KB
                            • SHA256 5f9b13950c306a1cc117a0cf1b01c073557a5091f7e6b0eeac59f8b0ef957750
                            • MD5 SHA1 SHA512 SSDEEP

                            EpsilonSetup.exe

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
                            • Size 73KB
                            • SHA256 9b2a59806f4e7158df80ace21a8fdee42a174cd445ef5af4b387a8460fc27645
                            • MD5 SHA1 SHA512 SSDEEP

                            EpsilonSetup.exe

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\EpsilonSetup.exe
                            • Size 698KB
                            • SHA256 9bf4ee591ec8083776d2097dfcf22e17c8f4f1c8d84c445535839f2d2197249f
                            • MD5 SHA1 SHA512 SSDEEP

                            chrome_100_percent.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\chrome_100_percent.pak
                            • Size 124KB
                            • SHA256 4a8c3d2d078d715056f6f10e0aadeae38fd01d43c3729982400bdfecd63636cf
                            • MD5 SHA1 SHA512 SSDEEP

                            chrome_100_percent.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\chrome_100_percent.pak
                            • Size 53KB
                            • SHA256 1b509335be867be269b69d0657ce04296cf6d225f1324136b6e747a2fe980e1b
                            • MD5 SHA1 SHA512 SSDEEP

                            chrome_200_percent.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\chrome_200_percent.pak
                            • Size 19KB
                            • SHA256 9cf05fd99f594ae33eb02d3c73df5386913bde1f48394cfdde4e5e7bca26468c
                            • MD5 SHA1 SHA512 SSDEEP

                            d3dcompiler_47.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\d3dcompiler_47.dll
                            • Size 51KB
                            • SHA256 b7f0011e9e85b085bef5b1f3abedaa8393aa8dd3ffc9011ed9d7f5ae1f43a008
                            • MD5 SHA1 SHA512 SSDEEP

                            ffmpeg.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\ffmpeg.dll
                            • Size 170KB
                            • SHA256 49cf20bdb4b818a2fdc8459502ba1cc3b0b95a8ad7bd6475f56fe1855a4b287b
                            • MD5 SHA1 SHA512 SSDEEP

                            ffmpeg.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\ffmpeg.dll
                            • Size 77KB
                            • SHA256 8ee031ccc55086298c25e0dee4e7d577f5f91fb1f9898c3aef4cb02d9ab0aae8
                            • MD5 SHA1 SHA512 SSDEEP

                            ffmpeg.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\ffmpeg.dll
                            • Size 74KB
                            • SHA256 97508db8b7444f50c54dd631be6aa405e75624e8be4094206cf9e5298294b3e9
                            • MD5 SHA1 SHA512 SSDEEP

                            ffmpeg.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\ffmpeg.dll
                            • Size 957KB
                            • SHA256 a1f214af27944c19ac35dad16cecbb1636fdee62e81de5a1fc4e87d7bf77cf53
                            • MD5 SHA1 SHA512 SSDEEP

                            icudtl.dat

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\icudtl.dat
                            • Size 52KB
                            • SHA256 770bc249c0925b9f3873a41773108a24f1f39e36780832bf3b61bb0a22f9bec1
                            • MD5 SHA1 SHA512 SSDEEP

                            libEGL.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\libEGL.dll
                            • Size 27KB
                            • SHA256 9be3e1c6c671c21090f4abf5d1f34ed3bab14e269de4d14bd27912a7e01e317f
                            • MD5 SHA1 SHA512 SSDEEP

                            libGLESv2.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\libGLESv2.dll
                            • Size 58KB
                            • SHA256 0153dec889a208d9bb8352843175ee852780fdd156d23ed2ff37fda0e3d6aa9e
                            • MD5 SHA1 SHA512 SSDEEP

                            libegl.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\libegl.dll
                            • Size 57KB
                            • SHA256 8c778018065d02d06c592413fc134b92a51710643d548d8fde69093be7c2bc44
                            • MD5 SHA1 SHA512 SSDEEP

                            libglesv2.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\libglesv2.dll
                            • Size 50KB
                            • SHA256 aa76e1ecdaaaf0d66ba70e42e34d132e9e6862f2031616a4118b3c7769a13bbd
                            • MD5 SHA1 SHA512 SSDEEP

                            en-US.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\locales\en-US.pak
                            • Size 147KB
                            • SHA256 337cbee504e3f574f3cac7e2287d623c66d6f6b0bb41fa758768db5fc6f6b68d
                            • MD5 SHA1 SHA512 SSDEEP

                            resources.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\resources.pak
                            • Size 52KB
                            • SHA256 a7c27f8f63bba6ac35436b89ef44005175018fee4eca967068cb5826a9c40c62
                            • MD5 SHA1 SHA512 SSDEEP

                            app.asar

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\resources\app.asar
                            • Size 33KB
                            • SHA256 199ef6200efb6ebd3609680730f4e162c09433ba796bc6d7c629ffe0975ba5f4
                            • MD5 SHA1 SHA512 SSDEEP

                            vk_swiftshader.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\vk_swiftshader.dll
                            • Size 59KB
                            • SHA256 e5a316d04f697dd0c2714d6371c1cde724b470e04fc26be106aa84f5a1e983a5
                            • MD5 SHA1 SHA512 SSDEEP

                            vk_swiftshader.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\2b9OOYVN3f0JF9Sv4q3g63RYTar\vk_swiftshader.dll
                            • Size 817KB
                            • SHA256 ce4c33d387b80dbfc722ca265a757db1d43d8fef60ef67bf7d8a1bdd1a4c0dc8
                            • MD5 SHA1 SHA512 SSDEEP

                            34e02432-36b4-4582-bc56-cb003088592c.tmp.node

                            • Path C:\Users\Admin\AppData\Local\Temp\34e02432-36b4-4582-bc56-cb003088592c.tmp.node
                            • Size 49KB
                            • SHA256 9ccc4da8de62ea38b52ad84439139eae5928ce1d19ee2c7017df860a5d967764
                            • MD5 SHA1 SHA512 SSDEEP

                            4443fd36-f5b1-45b7-bf65-e38cc6dac694.tmp.node

                            • Path C:\Users\Admin\AppData\Local\Temp\4443fd36-f5b1-45b7-bf65-e38cc6dac694.tmp.node
                            • Size 76KB
                            • SHA256 88527f180d6ae75a3023d0357ef066e5323f18b6e1c6ca5437a25d6aff28f147
                            • MD5 SHA1 SHA512 SSDEEP

                            EpsilonSetup.exe

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\EpsilonSetup.exe
                            • Size 133KB
                            • SHA256 4458dbcc1fe9d8fdbf695c7e624972e8efa5598d069db9568f1c2b472f1f90dd
                            • MD5 SHA1 SHA512 SSDEEP

                            LICENSE.electron.txt

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\LICENSE.electron.txt
                            • Size 1KB
                            • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                            • MD5 SHA1 SHA512

                            LICENSES.chromium.html

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\LICENSES.chromium.html
                            • Size 237KB
                            • SHA256 057cc1011992931090082cef7ed953be78d09f28b453f57e4f5793173b351f22
                            • MD5 SHA1 SHA512 SSDEEP

                            chrome_200_percent.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\chrome_200_percent.pak
                            • Size 116KB
                            • SHA256 9255a96493bdbe7d291db2b4780ff82b14ad35c7ce5df9cbc2c18b7061ba1ed3
                            • MD5 SHA1 SHA512 SSDEEP

                            d3dcompiler_47.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\d3dcompiler_47.dll
                            • Size 45KB
                            • SHA256 cbb6cea541bc50177f9d32686cc03a1ca17477a20e830fe21e93fdcce8045e30
                            • MD5 SHA1 SHA512 SSDEEP

                            ffmpeg.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\ffmpeg.dll
                            • Size 174KB
                            • SHA256 07633b79d9dca6e5d98a9c33d25608e3f5acb78fa5675c1c7657583e03dd05e0
                            • MD5 SHA1 SHA512 SSDEEP

                            icudtl.dat

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\icudtl.dat
                            • Size 166KB
                            • SHA256 97ad24c9285da70e73812c82f717724605f2fdf36ac412f55d2528a4d5e2c0c0
                            • MD5 SHA1 SHA512 SSDEEP

                            libEGL.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\libEGL.dll
                            • Size 171KB
                            • SHA256 b1a8d4aaa9d83da28136798940765040502a1dbe660ab117995f6a58d90e7d4a
                            • MD5 SHA1 SHA512 SSDEEP

                            libGLESv2.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\libGLESv2.dll
                            • Size 209KB
                            • SHA256 a4f4c698b8aed9b06ff33955ed0d17d5f1e8ce58dbecbc80a01d339400df5cfd
                            • MD5 SHA1 SHA512 SSDEEP

                            af.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\af.pak
                            • Size 263KB
                            • SHA256 29cd4a5c80e29765e2585ff3907730168e21e4f0a6c410f13ec3175b64191bbb
                            • MD5 SHA1 SHA512 SSDEEP

                            am.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\am.pak
                            • Size 117KB
                            • SHA256 fb9ffacdc46b746d6ba5a37b98f72c2635a45760cf95e25f1bc4ba13c6c9fdfe
                            • MD5 SHA1 SHA512 SSDEEP

                            ar.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\ar.pak
                            • Size 92KB
                            • SHA256 5c58b948eda40b54a1f902cf9247bfa54266eaff9c349f2f3812a85387764898
                            • MD5 SHA1 SHA512 SSDEEP

                            bg.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\bg.pak
                            • Size 246KB
                            • SHA256 2bc83e23bfe2517fd2cda30a40baca07d15a6ff9cfc875451cdfab4d0d2435f6
                            • MD5 SHA1 SHA512 SSDEEP

                            bn.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\bn.pak
                            • Size 130KB
                            • SHA256 ffd832a6815f76fa859a88119116d8f64223f5cc1d55a06528162cbf347269e8
                            • MD5 SHA1 SHA512 SSDEEP

                            ca.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\ca.pak
                            • Size 160KB
                            • SHA256 ff587555518286b04fba4ba848f2bf444484a7828b72efa6783985c0c6de2aa7
                            • MD5 SHA1 SHA512 SSDEEP

                            cs.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\cs.pak
                            • Size 148KB
                            • SHA256 b82c24a01a2739f1a0268fc611f05200525db422e8337a6154658d54fac74bb5
                            • MD5 SHA1 SHA512 SSDEEP

                            da.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\da.pak
                            • Size 96KB
                            • SHA256 d8b452171ccfb3785f8ca424ad19b3f26555311e82638a4b64ea34466d2ba186
                            • MD5 SHA1 SHA512 SSDEEP

                            de.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\de.pak
                            • Size 172KB
                            • SHA256 de9aaf47e2514fe53ec61fe0a12166a7dfebcc8cfb0d6c97c31c1dbf296bef0b
                            • MD5 SHA1 SHA512 SSDEEP

                            el.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\el.pak
                            • Size 6KB
                            • SHA256 e15db046ef1e5dcfc959e7abafe6d7208efeeafe8624ffb35ec483736388dd46
                            • MD5 SHA1 SHA512 SSDEEP

                            en-GB.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\en-GB.pak
                            • Size 177KB
                            • SHA256 3146b7a5be0eddc47e72d7004806e0dc776eb355072e155da9618fd08713c858
                            • MD5 SHA1 SHA512 SSDEEP

                            en-US.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\en-US.pak
                            • Size 172KB
                            • SHA256 469835285afa5457ffc1480289c3dfeb4b5ca826045a1aef000dc7b2faa4c115
                            • MD5 SHA1 SHA512 SSDEEP

                            es-419.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\es-419.pak
                            • Size 133KB
                            • SHA256 af69aadaf60694936817136ffe53848a8ebb1c224d5f795dc69a8dbd5b2d0adb
                            • MD5 SHA1 SHA512 SSDEEP

                            es.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\es.pak
                            • Size 163KB
                            • SHA256 6eb0a178e7d650351f4645eb6b59e389ff79034b14f58de19bc373219ca45921
                            • MD5 SHA1 SHA512 SSDEEP

                            et.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\et.pak
                            • Size 176KB
                            • SHA256 5f75e5338cdb8be81916542d019a23ba309ba01360572f0b36451f9349f5e56f
                            • MD5 SHA1 SHA512 SSDEEP

                            fa.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\fa.pak
                            • Size 124KB
                            • SHA256 cbf07bcd0c53300ad66017af108fb82bbf9d19c63a32cc1ed072407643d4cafe
                            • MD5 SHA1 SHA512 SSDEEP

                            fi.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\fi.pak
                            • Size 211KB
                            • SHA256 575c998899cbe63cf722bb745de7a33bb73a1bedccefb253115cd1a6259ab775
                            • MD5 SHA1 SHA512 SSDEEP

                            fil.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\fil.pak
                            • Size 100KB
                            • SHA256 1a141df598425cd2e9afba3dbffe12bae8dc29190d45b7c57b51c1abb7e21782
                            • MD5 SHA1 SHA512 SSDEEP

                            fr.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\fr.pak
                            • Size 47KB
                            • SHA256 752fc900f0edf0ead959777ae09d4e2c00bd9938639cead1b7dc43d168866f1a
                            • MD5 SHA1 SHA512 SSDEEP

                            gu.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\gu.pak
                            • Size 61KB
                            • SHA256 442e70018d977d3f27d89420775cb84d09c0b70e6b2281f6de06e3aeb5e52578
                            • MD5 SHA1 SHA512 SSDEEP

                            he.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\he.pak
                            • Size 93KB
                            • SHA256 4e4161fb4f6ddc9f6bd1fd6a55166230546e0706a5a816acada43cb0180406da
                            • MD5 SHA1 SHA512 SSDEEP

                            hi.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\hi.pak
                            • Size 94KB
                            • SHA256 e914900718fd9986af224e31ea4e92b73c6c692eb499d99a1d35e4d687af7f04
                            • MD5 SHA1 SHA512 SSDEEP

                            hr.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\hr.pak
                            • Size 53KB
                            • SHA256 6efc1b24e2b25756f04e3f05303b6564ece092e31431574460f3e6cc94cfde53
                            • MD5 SHA1 SHA512 SSDEEP

                            hu.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\hu.pak
                            • Size 103KB
                            • SHA256 10d8f6e485d21bf125c9f13ae2dbedbedd444a2de7ace0ac3ebf048f453f028b
                            • MD5 SHA1 SHA512 SSDEEP

                            id.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\id.pak
                            • Size 102KB
                            • SHA256 22df4a7ef509f09a744d953daf2f93aaa2896ec9d54018685f9af3b269ee2e25
                            • MD5 SHA1 SHA512 SSDEEP

                            it.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\it.pak
                            • Size 207KB
                            • SHA256 d2bf5f0e68d8636d9edb9421c67828a72779e843c8f1d179e2af8139ff9793b1
                            • MD5 SHA1 SHA512 SSDEEP

                            ja.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\ja.pak
                            • Size 104KB
                            • SHA256 0bbecf54b684c980b135f73d9c0d04a093506d1eb43e55a53b15aef7881dba61
                            • MD5 SHA1 SHA512 SSDEEP

                            kn.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\kn.pak
                            • Size 48KB
                            • SHA256 c5d1aa8719eb6531e1309fb17b950a4ed74a059871fb9ed00e435a42af483f0f
                            • MD5 SHA1 SHA512 SSDEEP

                            ko.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\ko.pak
                            • Size 119KB
                            • SHA256 b222c905a96583c20107a9a930fe2afe33fd06306f39a29cb91d205b63510c7c
                            • MD5 SHA1 SHA512 SSDEEP

                            lt.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\lt.pak
                            • Size 92KB
                            • SHA256 0eab3a1b78124e68516c201c521fa15c958d43e30fd2ac46a5bf3b6bd4a5cf3f
                            • MD5 SHA1 SHA512 SSDEEP

                            lv.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\lv.pak
                            • Size 88KB
                            • SHA256 73e7a43feb0efa3ba11365b608bf7b3dfb5af429cd5f0287de86054e9e1c3fac
                            • MD5 SHA1 SHA512 SSDEEP

                            ml.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\ml.pak
                            • Size 118KB
                            • SHA256 954c9db1a1d23e8654a05a7dc6cc104d9c35b1ca73149a77823e8f03fc5e6745
                            • MD5 SHA1 SHA512 SSDEEP

                            mr.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\mr.pak
                            • Size 33KB
                            • SHA256 e3ba83bf47f815ccde1e9aeb571df19798b6d548797a85577bb2799c5e2bfbeb
                            • MD5 SHA1 SHA512 SSDEEP

                            ms.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\ms.pak
                            • Size 60KB
                            • SHA256 0a721b14582d716af4e99252ed84ec29554f4e6859082702f1b60ac7b04b2022
                            • MD5 SHA1 SHA512 SSDEEP

                            nb.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\nb.pak
                            • Size 152KB
                            • SHA256 cacb8d4a5920c529243f4b97dd44a7a0f8269a3364dbae6bc9920cce48ff6c03
                            • MD5 SHA1 SHA512 SSDEEP

                            nl.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\nl.pak
                            • Size 85KB
                            • SHA256 377c8dfeb7780a59da989db1516b5a2173ed3d35188cbf80421fc5c8aed32ff4
                            • MD5 SHA1 SHA512 SSDEEP

                            pl.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\pl.pak
                            • Size 95KB
                            • SHA256 8ee951d8ddb8faaf039ec4d7a6dadefd0ed28da419aabb0c6257aafe74e6e0d1
                            • MD5 SHA1 SHA512 SSDEEP

                            pt-BR.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\pt-BR.pak
                            • Size 121KB
                            • SHA256 ab19dc3971dd78c29194a65788b4163e28ce17721e2d9e868447de6d55b35648
                            • MD5 SHA1 SHA512 SSDEEP

                            pt-PT.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\pt-PT.pak
                            • Size 150KB
                            • SHA256 1b3d80f53402429cf71c4b9badffb39f4e623c211b091c9d81d707050dd0badc
                            • MD5 SHA1 SHA512 SSDEEP

                            ro.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\ro.pak
                            • Size 97KB
                            • SHA256 5c224d6f6aba0ee355aa46acad08d7f374bf73c9129ea8aac3b382c1e9c8744a
                            • MD5 SHA1 SHA512 SSDEEP

                            ru.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\ru.pak
                            • Size 105KB
                            • SHA256 917ad4ef88adc308426e6a782fd0833b8d94f0e54316263b44e2cb9cd219c38c
                            • MD5 SHA1 SHA512 SSDEEP

                            sk.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\sk.pak
                            • Size 92KB
                            • SHA256 13e34a1d500dba518cab93ab0c150a652643b876b1d533fbba62931db1e299a1
                            • MD5 SHA1 SHA512 SSDEEP

                            sl.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\sl.pak
                            • Size 44KB
                            • SHA256 dc174bdb4b53d3a60555ab1a04840f3b5c781f6f8f362e472946f028c3c27e32
                            • MD5 SHA1 SHA512 SSDEEP

                            sr.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\sr.pak
                            • Size 30KB
                            • SHA256 a90c2b704744c60d17942d56bb2376851e060c8a3c5f3a088cfc0bdfe0797e20
                            • MD5 SHA1 SHA512 SSDEEP

                            sv.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\sv.pak
                            • Size 1KB
                            • SHA256 88e1c851da9b1f62f784f3bbcaf83c76b3ce027b62dbb0a9cfca1dcb697e30cd
                            • MD5 SHA1 SHA512

                            sw.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\sw.pak
                            • Size 72KB
                            • SHA256 8d9aa7f41c0ae03aa0eb2dc856c6f9351e9cc8131aaae35e9219ed75a38a4d2e
                            • MD5 SHA1 SHA512 SSDEEP

                            ta.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\ta.pak
                            • Size 10KB
                            • SHA256 1a4dcaa964a8afa5aac659aceb8d8d916537261d61d933f4cb6d607e8f3c31f4
                            • MD5 SHA1 SHA512 SSDEEP

                            te.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\te.pak
                            • Size 28KB
                            • SHA256 93608e26f422fb2520fd32baceba86cad531c11efcd13dbb1ce615cf07268792
                            • MD5 SHA1 SHA512 SSDEEP

                            th.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\th.pak
                            • Size 16KB
                            • SHA256 2cc43c0f0e07cd87bfad5bf81e7b26baea4ec024a6506861f82b84bd666f2659
                            • MD5 SHA1 SHA512 SSDEEP

                            tr.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\tr.pak
                            • Size 5KB
                            • SHA256 ffeab6fdf4de416eb9d14c0023da5867f8f266eb4a2acfce96091e7d626bc54e
                            • MD5 SHA1 SHA512 SSDEEP

                            uk.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\uk.pak
                            • Size 42KB
                            • SHA256 4e2d1bed7794ce1f9ba78cafb16e72bb95336885e81db025e1126631266348e4
                            • MD5 SHA1 SHA512 SSDEEP

                            ur.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\ur.pak
                            • Size 25KB
                            • SHA256 ac215a09d91f0a408ea8040b9144f35b99c2a2e3323aec6c6dd792fcfe55e775
                            • MD5 SHA1 SHA512 SSDEEP

                            vi.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\vi.pak
                            • Size 20KB
                            • SHA256 85fae5036a2a1161f8be8ea23b9e9f2d1f6decec3e81b687e9ad1f8cb0a7eb25
                            • MD5 SHA1 SHA512 SSDEEP

                            zh-CN.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\zh-CN.pak
                            • Size 85KB
                            • SHA256 14ae15d29561131f123de5ea19367ede82b98f03711d98a8823931aa958e9253
                            • MD5 SHA1 SHA512 SSDEEP

                            zh-TW.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\locales\zh-TW.pak
                            • Size 97KB
                            • SHA256 c78d6405362ef2614ac3c291dc98c579535d012f5da894dba780f568f33f9ee3
                            • MD5 SHA1 SHA512 SSDEEP

                            resources.pak

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\resources.pak
                            • Size 36KB
                            • SHA256 247e0a300d8d4b9b16022274223f9f7784e1d2ee5fbf08bfaec8cc38ac7380c9
                            • MD5 SHA1 SHA512 SSDEEP

                            app.asar

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\resources\app.asar
                            • Size 5KB
                            • SHA256 34170c81f2db61bbebd84edcf209beb76d20d9d0ff6b7037e87e9238be979f2c
                            • MD5 SHA1 SHA512 SSDEEP

                            elevate.exe

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\resources\elevate.exe
                            • Size 30KB
                            • SHA256 97c2070d3a4cfed478815314ab326f0e0b18581c56dfb4c0269cd6e84ebcab2b
                            • MD5 SHA1 SHA512 SSDEEP

                            snapshot_blob.bin

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\snapshot_blob.bin
                            • Size 220KB
                            • SHA256 4d4bf2f048e8c57d386fd8b2cc45300fc4fa394defc02d350b4e51d4dbff02e3
                            • MD5 SHA1 SHA512 SSDEEP

                            v8_context_snapshot.bin

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\v8_context_snapshot.bin
                            • Size 132KB
                            • SHA256 4c59aab9203905a6a33bba699f2e35b31eec366ab1fe3c39eb79d6eeb43d5202
                            • MD5 SHA1 SHA512 SSDEEP

                            vk_swiftshader.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\vk_swiftshader.dll
                            • Size 137KB
                            • SHA256 4d290b9633342822cd184d9db2df38d062038b3923825a0df2ef8cdeda510110
                            • MD5 SHA1 SHA512 SSDEEP

                            vk_swiftshader_icd.json

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\vk_swiftshader_icd.json
                            • Size 106B
                            • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                            • MD5 SHA1 SHA512

                            vulkan-1.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\7z-out\vulkan-1.dll
                            • Size 98KB
                            • SHA256 b13f3f6567bf1882d60905f94761d2892358cec9beca5c8e279d8eef0bdbadc9
                            • MD5 SHA1 SHA512 SSDEEP

                            StdUtils.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\StdUtils.dll
                            • Size 13KB
                            • SHA256 363cca514a968658656bec257381d55f43c6998f5ae168a1e0f53cb1c81011cf
                            • MD5 SHA1 SHA512 SSDEEP

                            System.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\System.dll
                            • Size 12KB
                            • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                            • MD5 SHA1 SHA512 SSDEEP

                            nsis7z.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsp475A.tmp\nsis7z.dll
                            • Size 333KB
                            • SHA256 21226cf3d46af8d9e896734a7f8613f327a73d87649289ea7b4dbcdd4bd5ea64
                            • MD5 SHA1 SHA512 SSDEEP

                            memory/664-614-0x0000017FC4310000-0x0000017FC4311000-memory.dmp

                            memory/664-613-0x0000017FC4310000-0x0000017FC4311000-memory.dmp

                            memory/664-612-0x0000017FC4310000-0x0000017FC4311000-memory.dmp

                            memory/664-624-0x0000017FC4310000-0x0000017FC4311000-memory.dmp

                            memory/664-623-0x0000017FC4310000-0x0000017FC4311000-memory.dmp

                            memory/664-622-0x0000017FC4310000-0x0000017FC4311000-memory.dmp

                            memory/664-621-0x0000017FC4310000-0x0000017FC4311000-memory.dmp

                            memory/664-620-0x0000017FC4310000-0x0000017FC4311000-memory.dmp

                            memory/664-619-0x0000017FC4310000-0x0000017FC4311000-memory.dmp

                            memory/664-618-0x0000017FC4310000-0x0000017FC4311000-memory.dmp

                            memory/1940-598-0x000001C30F6C0000-0x000001C30F861000-memory.dmp

                            memory/1940-550-0x00007FFE444F0000-0x00007FFE444F1000-memory.dmp