Overview

overview

7

Static

static

3

OTP_Bot_Setup.exe

windows10-2004-x64

7

OTP_Bot_Setup.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows10-2004-x64

4

LICENSES.c...m.html

windows11-21h2-x64

4

d3dcompiler_47.dll

windows10-2004-x64

1

dxcompiler.dll

windows10-2004-x64

1

dxil.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/app.js

windows10-2004-x64

3

resources/app.js

windows11-21h2-x64

3

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-21h2-x64

3

updater.exe

windows10-2004-x64

7

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows10-2004-x64

1

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    76s
  • max time network
    86s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/04/2026, 17:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OTP_Bot_Setup.exe
  • Size 83.4MB
  • Sample260428-vyn4kact61
  • SHA256 05c235bc36b8003026f6bf4803d3c4b680819cc5d31eceb997942298ecb35ee6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 28 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OTP_Bot_Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\OTP_Bot_Setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5520
    • C:\Users\Admin\AppData\Local\Temp\3CynYmjcBScaikfYXAtVnGROqkI\updater.exe
      C:\Users\Admin\AppData\Local\Temp\3CynYmjcBScaikfYXAtVnGROqkI\updater.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4924
      • C:\Users\Admin\AppData\Local\Temp\3CynYmjcBScaikfYXAtVnGROqkI\updater.exe
        "C:\Users\Admin\AppData\Local\Temp\3CynYmjcBScaikfYXAtVnGROqkI\updater.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1868,i,1215144990702332581,654577150072883672,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1864 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3488
      • C:\Users\Admin\AppData\Local\Temp\3CynYmjcBScaikfYXAtVnGROqkI\updater.exe
        "C:\Users\Admin\AppData\Local\Temp\3CynYmjcBScaikfYXAtVnGROqkI\updater.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --field-trial-handle=1868,i,1215144990702332581,654577150072883672,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1944 /prefetch:3
        3⤵
        • Executes dropped EXE
        PID:2400
      • C:\Users\Admin\AppData\Local\Temp\python3\pythonw.exe
        C:\Users\Admin\AppData\Local\Temp\python3\pythonw.exe C:\Users\Admin\AppData\Local\Temp\python3\exec.py
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks for VirtualBox DLLs, possible anti-VM trick
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3036
        • C:\Windows\system32\cmd.exe
          cmd.exe /C "echo %REALTEKAUDIO%"
          4⤵
            PID:6120

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          app.asar
          • Path C:\Users\Admin\AppData\Local\Temp\3CynYmjcBScaikfYXAtVnGROqkI\resources\app.asar
          • Size 143KB
          • SHA256 39007b6e58e93ea27b9c51b66f9adac0ce6f6f2b4a462bb871c608eb7bcd8326
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LICENSE.electron.txt
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\LICENSE.electron.txt
          • Size 1KB
          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSES.chromium.html
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\LICENSES.chromium.html
          • Size 14.4MB
          • SHA256 c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_100_percent.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\chrome_100_percent.pak
          • Size 112KB
          • SHA256 45d14a4278b1e152b363197401a5604aa5a3cee6512a6b52df978038fa521a0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_200_percent.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\chrome_200_percent.pak
          • Size 182KB
          • SHA256 aafc61b89748d17fcbc9fecd9844a77be2c584529a81714c98e0c4d453ea9496
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          d3dcompiler_47.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\d3dcompiler_47.dll
          • Size 4.5MB
          • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dxcompiler.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\dxcompiler.dll
          • Size 24.9MB
          • SHA256 6f02237496ce3d04459539c530521e6ae2aa05dc6e3f669769898e604b8d5dd7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dxil.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\dxil.dll
          • Size 1.4MB
          • SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ffmpeg.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\ffmpeg.dll
          • Size 2.9MB
          • SHA256 e8ef0c488acde7242b318b7babf6e45297a57ec968abd700f989d6269bf36831
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icudtl.dat
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\icudtl.dat
          • Size 10.0MB
          • SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libEGL.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\libEGL.dll
          • Size 492KB
          • SHA256 cc90ee15962abb35fcc409b854de08b2e640b5aa44c9211be3eafca43917074b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libGLESv2.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\libGLESv2.dll
          • Size 8.0MB
          • SHA256 273e0c34c3511fa793eb8c7a30623218c530c01668640d890a70d8c77a5a9466
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          af.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\af.pak
          • Size 568KB
          • SHA256 ca253121434ef430661c30672e1097e6d238e42821585b700776b56977c05d97
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          am.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\am.pak
          • Size 921KB
          • SHA256 c348b68d8a552f5b7c074d424ecb54ab19aac93e17b61295b36ac10315da5ced
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ar.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\ar.pak
          • Size 1016KB
          • SHA256 6b050deccd06de33dfc9abe68dd2e256b0838be7bd91f926c03f4edfc6b32cf6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bg.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\bg.pak
          • Size 1.0MB
          • SHA256 f2a46c4ee04330ef49f6acc62c26ed7ec57dfe124aa386e08c5b582832c4000e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bn.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\bn.pak
          • Size 1.3MB
          • SHA256 b4ada9665be5c9d9fe4254bff291978dfb50c2b22a7149faf9b9c3f470f0d32f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ca.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\ca.pak
          • Size 640KB
          • SHA256 46a7488ffcb9d7d8b2d9b93ba035ec46fc950dc936a03617ab2606294851c650
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cs.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\cs.pak
          • Size 663KB
          • SHA256 609f32e921928b33de0f007e7db6f0ff12f411fbbcb85b0596e4f674bcc6d399
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          da.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\da.pak
          • Size 598KB
          • SHA256 3f33e371a8be4ec3946a6cd484d73260abad36c29560773158f03028be444a8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          de.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\de.pak
          • Size 640KB
          • SHA256 06b1bba011530d78f5cd5d38c54f1e96d49dfb97d582112761002d8e99eddff8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          el.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\el.pak
          • Size 1.1MB
          • SHA256 dc27d24e9afd24124abca6dca1a362462851267902fe6493ff3165a1c5aab69f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-GB.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\en-GB.pak
          • Size 518KB
          • SHA256 ee6fc979d1fff0c1a4d6bca929691733665c5df7e7a43cc54f1165ea14cffa67
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-US.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\en-US.pak
          • Size 524KB
          • SHA256 bfa782c9efae2c9cd2c0214dae1bbb3c259d4d4c38d920b06677b9c4cf4f813d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          es-419.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\es-419.pak
          • Size 631KB
          • SHA256 fcff3af49b63faf72e07c36240887420a0041f27645bad58c5462c29b471988c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          es.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\es.pak
          • Size 628KB
          • SHA256 0668fe4b1abb52581cbd0068cb9ee71023dc844e2f830e531a6302de24933bbf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          et.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\et.pak
          • Size 573KB
          • SHA256 e5eddafe1f10905caea4610499067943fb329287fa09fa7cf3ee8bc71670b177
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fa.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\fa.pak
          • Size 946KB
          • SHA256 495d6d9570cd7a4d8099968b6f315b80d13719d822cedf6d7c3dc00ae85efb56
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fi.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\fi.pak
          • Size 584KB
          • SHA256 c04f5e2b7f30e8e350feefd6cc45f266dbeacf11837cc774c977bf76e9b403a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fil.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\fil.pak
          • Size 662KB
          • SHA256 48884f90e800b0b0803ddaa0bbebbea1292bf8e1bb5ee8f035a79371bef7ac2b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\fr.pak
          • Size 682KB
          • SHA256 9ff765a541603297f1c1ad2ddc53d282e30f185b2eda4ea981c84d2127bfd31d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          gu.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\gu.pak
          • Size 1.3MB
          • SHA256 11e4ab3cfa421ea0d4d0971b038a6e7a254094fa6dfe9b8f65fd1572f36bcabb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          he.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\he.pak
          • Size 829KB
          • SHA256 3bf33db3a0232d8e7306450254a452b0f731bb6ed2bdd76979d8fafd65416900
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hi.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\hi.pak
          • Size 1.4MB
          • SHA256 bb19f47ad91101332c37cb7820a527342b705a6e1863f54edb66c032e993061b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hr.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\hr.pak
          • Size 639KB
          • SHA256 fe9ef06fbd137dd08a78661ac242a716e9efba4a2ecb0e8ddaf15b65c524f956
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hu.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\hu.pak
          • Size 684KB
          • SHA256 501569c5e74285231b41d067e0ea28972ef0ab7b269886485cf1b42cd78cbd1d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          id.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\id.pak
          • Size 565KB
          • SHA256 09d4dd7cbe4eb1b7730a80a3a3cd0606139f4b9647b0a04b49314638680b0a31
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          it.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\it.pak
          • Size 619KB
          • SHA256 fb06883d2e2986f407c2fda6fb9a582d7b3a3d32f8864cb5d6655018f908c20f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ja.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\ja.pak
          • Size 754KB
          • SHA256 0369673208ec4758abfed3094e5be0331877fe66af0c1beef6f9d8e7883b769c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          kn.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\kn.pak
          • Size 1.5MB
          • SHA256 76938de8f9377f9dff4672d7f43e233e42bc2053b17e2764115b18f8de47bfa7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ko.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\ko.pak
          • Size 640KB
          • SHA256 b8ecd18ce8601686ef64129c77f5307d0c60656d27eede7a23b4f3947647b302
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          lt.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\lt.pak
          • Size 694KB
          • SHA256 6d648211ff3a6801e049c9a3931afaf3007857b2872e55ae11e19849180d19da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          lv.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\lv.pak
          • Size 692KB
          • SHA256 b16771adf895df173370d3f3e7411545d01d5ffa0bea4f5061a2a1ded9dcefe7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ml.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\ml.pak
          • Size 1.5MB
          • SHA256 2bc35d18af85b3c7004a6e1e02591f5db4430a2f334f5c4be3c0a0e04837d9ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mr.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\mr.pak
          • Size 1.3MB
          • SHA256 5dee369e9366bfcc4fc95aec6c58b915933efd72c718d56802e35e8af5a880a0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ms.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\ms.pak
          • Size 595KB
          • SHA256 5af99080b311e15a19f9988779a1cdd939a7fb9b98bf093fca324eeb58b39602
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nb.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\nb.pak
          • Size 572KB
          • SHA256 11e798ef612a1d22b90450c547998bf0b23ccc4ca5265f27f1924c8b09f22937
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nl.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\nl.pak
          • Size 594KB
          • SHA256 bf2a7d52d8c061b5f5543e7c4e20b4eac96e65e02a967752af873c3ec30034b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pl.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\pl.pak
          • Size 663KB
          • SHA256 d22e7666c9c66df8a5bee3b8040a0f9dafe15e9cf908b6712eb5a26812218a93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pt-BR.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\pt-BR.pak
          • Size 621KB
          • SHA256 d5370596d47bad2a2c930688e7f67970381e63b3ae37384b77fd0b631eec3725
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pt-PT.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\pt-PT.pak
          • Size 625KB
          • SHA256 b727b377a6ccf25952189c59ef175c213dd1e29e896b6b5fdfacd024c711ac93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ro.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\ro.pak
          • Size 648KB
          • SHA256 205ea8cc0b368426f06c533b636a2845e66e3f7932aa6a680645e79de15edff3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ru.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\ru.pak
          • Size 1.0MB
          • SHA256 447e788b9d36e6219ba1319a0831d4ea1c1e5e90c7db88bd7a6e6845d2a27d44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sk.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\sk.pak
          • Size 675KB
          • SHA256 abdebceb4dd71f603cea0e9362943ddc4eb4e65fa0ad417f0958121fc5b2660b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sl.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\sl.pak
          • Size 646KB
          • SHA256 52426fb8fc82d1ed28797ccb62b7fe14f123cddf011f5d5875b076cdb0c33695
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sr.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\sr.pak
          • Size 993KB
          • SHA256 e67b36698412b94a6d3a63ffc398f74f005471fb1bdbd195e53330cfc8bbb62d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sv.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\sv.pak
          • Size 578KB
          • SHA256 3e94e4e0d0ce0c4d0a630540f43c83fe0d898c935f370a0baecf902cd4d04f12
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sw.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\sw.pak
          • Size 610KB
          • SHA256 e3bf553f18a0008dc5ac86e001a0ffb190f885260a7bf06feaf34822f0dde36a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ta.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\ta.pak
          • Size 1.5MB
          • SHA256 b04bec20fed826231af9ba7329cd04227e861e758eb9884ee485d33ae24810ff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          te.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\te.pak
          • Size 1.4MB
          • SHA256 62b6f656b301bb7b678f809f9eaa2ff64e020211cb1930aebd16cc1222ce2a53
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          th.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\th.pak
          • Size 1.2MB
          • SHA256 92919a8a65e9c344dc10a512ad238d4b3c4f6ab30b05e9515712fd7a2450d0b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tr.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\tr.pak
          • Size 621KB
          • SHA256 cb445b78fc9c1500a5acaec7eb49e1b36eab8797b82a0257c0e0cdbaf643d6e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          uk.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\uk.pak
          • Size 1.1MB
          • SHA256 b5534d58e5624f94f48ed010251d5cf3d0cb5063acca310c4c8c6ee61e50e7a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ur.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\ur.pak
          • Size 933KB
          • SHA256 c0d81e0446bae6d62b496f5268222ad53fe5e6f7325c19bdb7685974967beb3b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vi.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\vi.pak
          • Size 737KB
          • SHA256 5f11a5911d63793462087c2950ff86cd1ea2af68b11d306c0dc35f59266b157c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zh-CN.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\zh-CN.pak
          • Size 529KB
          • SHA256 9b968ef2fb8f21ed334d37fa2136495666107abda481665ed68381faf7b26e2b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zh-TW.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\locales\zh-TW.pak
          • Size 523KB
          • SHA256 f4bc5203f5954709aa33e9efcac2c3d197ea8b192280d1e30f01b12a416f9312
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          resources.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\resources.pak
          • Size 6.0MB
          • SHA256 7e2f5fb099e9a625298f6d094c4b1ef2d59c295e223fccc9ac52af1fdf789b8f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          main.jsc
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\resources\app.asar.unpacked\compiled\main.jsc
          • Size 4KB
          • SHA256 8023ca1183294063542c79b022ae1873ce77299a911601d0148eb6a8b884a23a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevate.exe
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\resources\elevate.exe
          • Size 105KB
          • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          snapshot_blob.bin
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\snapshot_blob.bin
          • Size 394KB
          • SHA256 8c838a849558a994c524476bf6bc2fab1a36f826f957b9f729261e66f70dcf45
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          v8_context_snapshot.bin
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\v8_context_snapshot.bin
          • Size 758KB
          • SHA256 fe4724f2a788e8902fe4a0419468bf06e556dbbd419cbd38e95a39c7c0acc2d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vk_swiftshader.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\vk_swiftshader.dll
          • Size 5.4MB
          • SHA256 1df00e64394fa563016ec1885271e4665d5813da5f9d1ce910d71d9a090e5d81
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vk_swiftshader_icd.json
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\vk_swiftshader_icd.json
          • Size 106B
          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vulkan-1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\7z-out\vulkan-1.dll
          • Size 922KB
          • SHA256 e6663e25b7380f110166e194eff87257bb25a2a7455037e9e0f33bebeabd1d6e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StdUtils.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\StdUtils.dll
          • Size 100KB
          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\System.dll
          • Size 12KB
          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsis7z.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd4D70.tmp\nsis7z.dll
          • Size 424KB
          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\python3\VCRUNTIME140.dll
          • Size 117KB
          • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\python3\_ctypes.pyd
          • Size 138KB
          • SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\python3\_hashlib.pyd
          • Size 67KB
          • SHA256 052f824d5e3a046aa401efef86307c0c7746a0d8ff85c855d4225d6fe565bb07
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          exec.py
          • Path C:\Users\Admin\AppData\Local\Temp\python3\exec.py
          • Size 9KB
          • SHA256 6ff4c76b33d43b6b7cc6714db30eb10ee4c2b79430f7b4accba04ab49b62be76
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\python3\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\python3\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __init__.py
          • Path C:\Users\Admin\AppData\Local\Temp\python3\pyarmor_runtime_000000\__init__.py
          • Size 103B
          • SHA256 30cc9c4e9a1c8e1f9a3217f4628f220507652ba01194f0a0e3c23b56c551299d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __init__.cpython-314.pyc
          • Path C:\Users\Admin\AppData\Local\Temp\python3\pyarmor_runtime_000000\__pycache__\__init__.cpython-314.pyc
          • Size 250B
          • SHA256 731b0b8231b57cd1c64c72d3aad67fadde837ec9a5bc9d05b425e290059b4458
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          pyarmor_runtime.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\python3\pyarmor_runtime_000000\pyarmor_runtime.pyd
          • Size 627KB
          • SHA256 365e76feb796d8ab8fa491f59ca92e7bd9556785ffa26501bcebdbb518ca8947
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\python3\python3.dll
          • Size 72KB
          • SHA256 27972cedfa8ca9f6835a2cbbff95336b15773a05b10067e3b084409095341068
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python314._pth
          • Path C:\Users\Admin\AppData\Local\Temp\python3\python314._pth
          • Size 80B
          • SHA256 2ed7ccda80e9e28ab5877902a9a325586c8a7b7b3e6731d944565bee082e216c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          python314.dll
          • Path C:\Users\Admin\AppData\Local\Temp\python3\python314.dll
          • Size 6.4MB
          • SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python314.zip
          • Path C:\Users\Admin\AppData\Local\Temp\python3\python314.zip
          • Size 3.9MB
          • SHA256 f9b891b0aae0d0aa0c3120183a8141a21c3909a35cfea66cbdbc5cb7082d5a95
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __init__.py
          • Path C:\Users\Admin\AppData\Local\Temp\python3\pythonmemorymodule\__init__.py
          • Size 31KB
          • SHA256 08d89f2caafcdebb3319aba29b03dc50e58864ca505a5a1929b9896977814702
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __init__.cpython-314.pyc
          • Path C:\Users\Admin\AppData\Local\Temp\python3\pythonmemorymodule\__pycache__\__init__.cpython-314.pyc
          • Size 47KB
          • SHA256 9c083963c64eb956853f213d655b9295d6ed1cce92f7cbece8ab18c688dd34c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pefile.cpython-314.pyc
          • Path C:\Users\Admin\AppData\Local\Temp\python3\pythonmemorymodule\__pycache__\pefile.cpython-314.pyc
          • Size 263KB
          • SHA256 eb3a1649395aa046592c83c784d5fd9ecdd386d77553f1c211d69111f2a26c9a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __init__.py
          • Path C:\Users\Admin\AppData\Local\Temp\python3\pythonmemorymodule\ordlookup\__init__.py
          • Size 784B
          • SHA256 a95df6e43bea93d1d81a517605792348053c36202a1a4f7083a6dc180ec33026
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __init__.cpython-314.pyc
          • Path C:\Users\Admin\AppData\Local\Temp\python3\pythonmemorymodule\ordlookup\__pycache__\__init__.cpython-314.pyc
          • Size 1KB
          • SHA256 12daecd019e9beb290fde8869f872e7317a3c5f61499245fc651b9f6c0b0571d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          oleaut32.cpython-314.pyc
          • Path C:\Users\Admin\AppData\Local\Temp\python3\pythonmemorymodule\ordlookup\__pycache__\oleaut32.cpython-314.pyc
          • Size 17KB
          • SHA256 2594dd90ed60e1429ad8641d894058140ea4f1c256c27092c658e197050c43d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ws2_32.cpython-314.pyc
          • Path C:\Users\Admin\AppData\Local\Temp\python3\pythonmemorymodule\ordlookup\__pycache__\ws2_32.cpython-314.pyc
          • Size 4KB
          • SHA256 db5cfa9a9887e58bea3e998684425259bce1d984abc4246b3924583afbd9cd81
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          oleaut32.py
          • Path C:\Users\Admin\AppData\Local\Temp\python3\pythonmemorymodule\ordlookup\oleaut32.py
          • Size 10KB
          • SHA256 8346cd7072d1b87fe75bbe71a996ed6593564eb39505b74457c5bbbf1cf43ae7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ws2_32.py
          • Path C:\Users\Admin\AppData\Local\Temp\python3\pythonmemorymodule\ordlookup\ws2_32.py
          • Size 3KB
          • SHA256 832f959ebb7ac959b337cb1ba8b40449a370167676a238782ec880ab9203aee0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          pefile.py
          • Path C:\Users\Admin\AppData\Local\Temp\python3\pythonmemorymodule\pefile.py
          • Size 269KB
          • SHA256 7015676dabff7769c4dce8d69e2a2610f804a95e0a02c36df98276b4c0e289fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pythonw.exe
          • Path C:\Users\Admin\AppData\Local\Temp\python3\pythonw.exe
          • Size 102KB
          • SHA256 d278b258a6d565aa014a4cab0731134facdec77e9b25d97d0c235922353464b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3036-2000-0x0000000063300000-0x00000000633AB000-memory.dmp
          Download

          memory/3036-2001-0x0000000140000000-0x0000000141EA1000-memory.dmp
          Download

          memory/3036-2008-0x0000000140000000-0x0000000141EA1000-memory.dmp
          Download

          memory/3036-2007-0x0000000140000000-0x0000000141EA1000-memory.dmp
          Download

          memory/3036-2009-0x0000000140000000-0x0000000141EA1000-memory.dmp
          Download

          memory/3036-2011-0x0000000140000000-0x0000000141EA1000-memory.dmp
          Download

          memory/3036-2027-0x0000000140000000-0x0000000141EA1000-memory.dmp
          Download

          memory/5520-1997-0x0000000000A60000-0x0000000000B1F000-memory.dmp
          Download

          memory/5520-528-0x0000000000A60000-0x0000000000B1F000-memory.dmp
          Download

          memory/5520-2015-0x0000000000A60000-0x0000000000B1F000-memory.dmp
          Download