Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/04/2026, 04:30

General

  • Target
    ZigWallet.exe
  • Size 71.1MB
  • Sample260426-e5bh2sfw7p
  • SHA256 af20a74cc8eb90b8dba9a8dd4f730630f1f476daeaf5776e2cf48e66919fff5d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ZigWallet.exe
    "C:\Users\Admin\AppData\Local\Temp\ZigWallet.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4416
    • C:\Users\Admin\AppData\Local\Temp\3C5mVmEMSd0sqRWp0xJDayxPiXj\Microsoft.exe
      C:\Users\Admin\AppData\Local\Temp\3C5mVmEMSd0sqRWp0xJDayxPiXj\Microsoft.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Users\Admin\AppData\Local\Temp\3C5mVmEMSd0sqRWp0xJDayxPiXj\Microsoft.exe
        C:\Users\Admin\AppData\Local\Temp\3C5mVmEMSd0sqRWp0xJDayxPiXj\Microsoft.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5780

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\3C5mVmEMSd0sqRWp0xJDayxPiXj\chrome_100_percent.pak
        • Size 148KB
        • SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Temp\3C5mVmEMSd0sqRWp0xJDayxPiXj\locales\ta.pak
        • Size 1.4MB
        • SHA256 8c3e1b39555fd7852eefdbf8e0d32843605e5b5c3b6770d573a89dbec7cdeb85
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\LICENSES.chromium.html
        • Size 8.7MB
        • SHA256 0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\chrome_200_percent.pak
        • Size 223KB
        • SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.7MB
        • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\ffmpeg.dll
        • Size 2.8MB
        • SHA256 015c30885776c9fe35242bc7ed612c1a3caaf737c4d3116a443e2c473cd87270
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\icudtl.dat
        • Size 10.0MB
        • SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\libEGL.dll
        • Size 481KB
        • SHA256 071160c865fac5bc6c232a10b1906cda0c4315fcf8c5349541cc709e9bcf386c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\libGLESv2.dll
        • Size 8.0MB
        • SHA256 c57cf0d74eddd6324a437d3e210949ae39b15c6f058b0828f3cde07c11b6c52c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\af.pak
        • Size 520KB
        • SHA256 c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\am.pak
        • Size 840KB
        • SHA256 8f46ccb4459b50fe06c4f825dd42c4d458dcc05df9631fdfb9d5a0926038246e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\ar.pak
        • Size 921KB
        • SHA256 e8d59cb109f5f6a923281c619ba1eacbe795c88a3da30c3fcb960a54230627bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\bg.pak
        • Size 959KB
        • SHA256 f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\bn.pak
        • Size 1.2MB
        • SHA256 c48b7423d5638b09860ed1ed4a0741890dc4b3f7c9e682e94867eb8441d196ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\ca.pak
        • Size 584KB
        • SHA256 06809011053b482b4830517039057c65021783129cc90b20857141d4f37ce9bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\cs.pak
        • Size 602KB
        • SHA256 690f31abc263f7c479531b267909777dcb20c680b3cf7801b287860d2415af3f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\da.pak
        • Size 545KB
        • SHA256 e71730c1bfb469f327212f7488c7674e66a59f857a4bdbb8c7736765215e5ffb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\de.pak
        • Size 582KB
        • SHA256 be0d49be3b021c0a4d917ad437d8ed817d676c40bca4fc08f2f9a8b2cbe67fc3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\el.pak
        • Size 1.0MB
        • SHA256 7e54f3c19a0343435685738d41cbedcba6b1df30f6cc837f0b5c27e0a91e2d84
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\en-GB.pak
        • Size 474KB
        • SHA256 33132446072ddfd058a395afeec901d7fae18505bb48e271ca870a4435d9e338
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\en-US.pak
        • Size 478KB
        • SHA256 75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\es-419.pak
        • Size 575KB
        • SHA256 0ee595ac6814586b46101e854d01ce6b1076092b07aa2564d6c8adb5d7a082e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\es.pak
        • Size 575KB
        • SHA256 31f98fca9ab6837569315fd1baac8fab16c592b03e47d7e1dfe4c16bb3ac2567
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\et.pak
        • Size 523KB
        • SHA256 9954e80792a5cac7b0a7ae2899b0adaa620af2f3ed2a273ee65b10b22ffa4bbc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\fa.pak
        • Size 855KB
        • SHA256 b2d24b4311edd8e0cad01308b6667c8be2fb04ca624666cf0a841e907312b551
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\fi.pak
        • Size 534KB
        • SHA256 8d62395944362d437fc1bd7810d8fd037afcc2f94f56bfaee4368350c189c106
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\fil.pak
        • Size 604KB
        • SHA256 1a6d121fb42a1b2941f2bc3c11c25e2a7c1e96ed845d08cd5f2370b9d399a0be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\fr.pak
        • Size 622KB
        • SHA256 4abf6ce2de7f20ffaeed953b97d364f08324bbc9819d2ae02a4aaadcf9b88cff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\gu.pak
        • Size 1.2MB
        • SHA256 d0ee25a5a7dee8337b9dd12e65a5910e75c09aed36eb3ade0907de6e14a6d760
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\he.pak
        • Size 751KB
        • SHA256 f9e4f3e50d86f0c6fd271caa160675e224adb56a292bf21283733e2066a09995
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\hi.pak
        • Size 1.3MB
        • SHA256 f73ccac3debba20fb225209805ff2383609853111f931e6b82095c1eb56a6ce4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\hr.pak
        • Size 581KB
        • SHA256 3ca8e7eb09aa20845684beefa2351afd4c6ca95bc09ba8bd7a0b629fe8a40565
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\hu.pak
        • Size 625KB
        • SHA256 ec81ac981af0e962654ad4f65030064a6369dc2316cb1b10bb24b473808ad1e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\id.pak
        • Size 516KB
        • SHA256 84a9b61e27edda9b2998e8c57e5e81bc0c0d47d6988bd3b03959487d2fff4921
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\it.pak
        • Size 567KB
        • SHA256 73cd1e113eba841c26e67ea9431b885f7c51fe85d61862b1a766e185accb3e20
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\ja.pak
        • Size 691KB
        • SHA256 1dd20f7bd91426229bfb131b575e8154b21e623e3db0162aec26dc67e568584a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\kn.pak
        • Size 1.4MB
        • SHA256 87ee47c4cec984a995a53ce2ef212539b7adee4a9011775b8699a29164e53c5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\ko.pak
        • Size 585KB
        • SHA256 1af8aeac229711e127844a71cabcafb29fc752d3d8401f42cd120fce3084744b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\lt.pak
        • Size 629KB
        • SHA256 b31b65e81db7f1f3daffac67b6436039ead2545f02c428e60ab755aa2630285f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\lv.pak
        • Size 628KB
        • SHA256 614e634224d32e39e9a79679d915ce402a6d0106bee37d39930884f9f6e3e01c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\ml.pak
        • Size 1.4MB
        • SHA256 f003a5671d619e6ed42370e70d943ee276012246dfe99310366bc3a70484307a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\mr.pak
        • Size 1.2MB
        • SHA256 0e65a4f22a6a52369f948526d5a3ee3c9bbc99ae23e0b2c414b376ba23c2d411
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\ms.pak
        • Size 541KB
        • SHA256 ce4b0390f707e3ec3bcbefc11cb7b6b914af50d89b950e16704dfb6d13f0fca2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\nb.pak
        • Size 525KB
        • SHA256 697882ac2da78894e449cb1f75da43e7115c2481bbd2fee3bdaa425e82fc232c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\nl.pak
        • Size 543KB
        • SHA256 68d981bd2119d714fbc4ba22ea2d2a0b3d9e127da7060d3bd02bd1fb5e895a43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\pl.pak
        • Size 604KB
        • SHA256 2ab697892ed2186bde0cfa3ed27857f850a73b195529f5a4f5a9658de188ef6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\pt-BR.pak
        • Size 568KB
        • SHA256 5a496e969e72eebbd4d4757923c8c47f15ca3aff2a5f9cd3147ff9fdf7f9baa3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\pt-PT.pak
        • Size 571KB
        • SHA256 9ebafb943bf20c66f8d9ca533633fdc63519e8ad38d78a3dd28b4457c38ba79d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\ro.pak
        • Size 592KB
        • SHA256 cb60090b451122165bb41abc238318474c4e86a545eef28ae2790c310c7d0050
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\ru.pak
        • Size 972KB
        • SHA256 53ced8c091b6745d06d6fe06ea3e9b6824256cd279a45c6ade419ba1c9d547ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\sk.pak
        • Size 611KB
        • SHA256 2f09ff1b8f02f735511f1ac1ecae5a3e88cd7fe16c58cee38beea5aba7fb83c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\sl.pak
        • Size 587KB
        • SHA256 70457f29ed3790557ef4c9792620c499a9e6134e004c5034586fadef5a833f6b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\sr.pak
        • Size 903KB
        • SHA256 7f3c729230ef2ed709c17bcdff781ec4aa5921334ccedda148df0027544094dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\sv.pak
        • Size 528KB
        • SHA256 7fd305f5ec9ac220d6ba7eefe49686ee02a574146ad023c99ea5c364780e79ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\sw.pak
        • Size 557KB
        • SHA256 434879a83079fba562af9dac928ad2fcc1033e0a6a5a1f4822d36e710decdd2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\te.pak
        • Size 1.3MB
        • SHA256 513a1db6caa7f4e454ddc0cba87494f5adb754f437019696a991d228ebbbe945
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\th.pak
        • Size 1.1MB
        • SHA256 6605217a533a0d0a9060dbd94ab3027762b21cb29c3bf1d2247ca4459d288bb9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\tr.pak
        • Size 567KB
        • SHA256 f2ca71fed0f1c1d8f081adf740e5a04927890ff35dccde1fb2253479b927f93f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\uk.pak
        • Size 973KB
        • SHA256 843c206ad3fdd6a34d083ae3f969ef58bf3c087dcba31af6126ffe46b2726511
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\ur.pak
        • Size 850KB
        • SHA256 1929f3c85e550ccca9985cef47be30b690a701cbca70345baa0c2aaee99809f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\vi.pak
        • Size 673KB
        • SHA256 590c7c9bcceb61c96b24bcfbacc2b77b02a643e028c838abbdac7327a53d63b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\zh-CN.pak
        • Size 484KB
        • SHA256 a9d2faa4ed07828e9939854a1ae09f3b42eac956abaa75af66c37dd923b191c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\locales\zh-TW.pak
        • Size 479KB
        • SHA256 965a32f56caabad66615659a0d79e0a4eb7a60c6e5cd8dc784fd7a1f95e80a0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\resources.pak
        • Size 5.5MB
        • SHA256 e52ff4895aa4e1dc82462cdeeb0bcb1d89fc481bf82e8c604d0d0bd383ac3ec8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app.asar

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\resources\app.asar
        • Size 2.5MB
        • SHA256 cf527bf4fa562b56d1716002c313865519ae1068beb23014a861f0b781c072ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\snapshot_blob.bin
        • Size 309KB
        • SHA256 769785eda3922bd210ee776fa46e97e30217755ca1dbb928230542bda2786857
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\v8_context_snapshot.bin
        • Size 671KB
        • SHA256 30f46b08a76755b48e569afff2657cd14734508a0d48dd053462d8c95604bc52
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\vk_swiftshader.dll
        • Size 5.3MB
        • SHA256 9ffb78591fdf2d24f8e7290dc95b98bd16eb59192d9ecec9d656c46164c27e22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\7z-out\vulkan-1.dll
        • Size 874KB
        • SHA256 7f6739a3a7f91e817dc5c6f25ec1e04cc453fa2e2c3ae676b198cde76e1fcf01
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/4416-535-0x0000000000A20000-0x0000000000CA1000-memory.dmp

        memory/4416-687-0x0000000000A20000-0x0000000000CA1000-memory.dmp