Overview

overview

7

Static

static

3

SMPVerse.exe

windows10-2004-x64

7

SMPVerse.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows10-2004-x64

4

LICENSES.c...m.html

windows11-21h2-x64

4

Windows Sy...ce.exe

windows10-2004-x64

7

d3dcompiler_47.dll

windows10-2004-x64

1

dxcompiler.dll

windows10-2004-x64

1

dxil.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-21h2-x64

3

resources/...pi.dll

windows10-2004-x64

1

resources/...pi.dll

windows11-21h2-x64

1

resources/...de.dll

windows10-2004-x64

1

resources/...de.dll

windows11-21h2-x64

1

resources/...e3.dll

windows10-2004-x64

1

resources/...e3.dll

windows11-21h2-x64

1

resources/...de.dll

windows10-2004-x64

1

resources/...de.dll

windows11-21h2-x64

1

resources/...act.js

windows10-2004-x64

3

resources/...act.js

windows11-21h2-x64

3

sqlite-aut...llback

ubuntu-18.04-amd64

1

sqlite-aut...llback

debian-9-armhf

1

sqlite-aut...llback

debian-9-mips

1

sqlite-aut...llback

debian-9-mipsel

1

sqlite-aut...le.bat

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/05/2026, 12:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SMPVerse.exe
  • Size 91.8MB
  • Sample260522-pegx9ac15v
  • SHA256 052fb8eca00bad93b8d1fbf7dcc7f51441da48d2bdb807b031ac837da58314c8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Run Powershell to get system information.

    execution
  • Enumerates processes with tasklist 1 TTPs 5 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SMPVerse.exe
    "C:\Users\Admin\AppData\Local\Temp\SMPVerse.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3900
    • C:\Users\Admin\AppData\Local\Temp\3C2pGs4dKS9UGUy6eJT3a7cYmOY\Windows System Management Provider Service.exe
      "C:\Users\Admin\AppData\Local\Temp\3C2pGs4dKS9UGUy6eJT3a7cYmOY\Windows System Management Provider Service.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3636
        • C:\Windows\system32\net.exe
          net session
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4432
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            5⤵
              PID:3240
        • C:\Users\Admin\AppData\Local\Temp\3C2pGs4dKS9UGUy6eJT3a7cYmOY\Windows System Management Provider Service.exe
          "C:\Users\Admin\AppData\Local\Temp\3C2pGs4dKS9UGUy6eJT3a7cYmOY\Windows System Management Provider Service.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\system-resource-provider" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1716,i,4373801425390053614,8550867986942394891,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1712 /prefetch:2
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3804
        • C:\Users\Admin\AppData\Local\Temp\3C2pGs4dKS9UGUy6eJT3a7cYmOY\Windows System Management Provider Service.exe
          "C:\Users\Admin\AppData\Local\Temp\3C2pGs4dKS9UGUy6eJT3a7cYmOY\Windows System Management Provider Service.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\system-resource-provider" --field-trial-handle=1716,i,4373801425390053614,8550867986942394891,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1908 /prefetch:11
          3⤵
          • Executes dropped EXE
          PID:2620
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { $os = Get-CimInstance -ClassName Win32_OperatingSystem; $os.Caption + ' ' + $os.Version } catch { $os = Get-WmiObject -Class Win32_OperatingSystem; $os.Caption + ' ' + $os.Version }""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2072
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "try { $os = Get-CimInstance -ClassName Win32_OperatingSystem; $os.Caption + ' ' + $os.Version } catch { $os = Get-WmiObject -Class Win32_OperatingSystem; $os.Caption + ' ' + $os.Version }"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2392
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { $cpu = Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1; $cpu.Name + ' (' + $cpu.NumberOfCores + ' cores, ' + [math]::Round($cpu.MaxClockSpeed/1000, 1) + ' GHz)' } catch { $cpu = Get-WmiObject -Class Win32_Processor | Select-Object -First 1; $cpu.Name }""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:652
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "try { $cpu = Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1; $cpu.Name + ' (' + $cpu.NumberOfCores + ' cores, ' + [math]::Round($cpu.MaxClockSpeed/1000, 1) + ' GHz)' } catch { $cpu = Get-WmiObject -Class Win32_Processor | Select-Object -First 1; $cpu.Name }"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1724
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { $gpu = Get-CimInstance -ClassName Win32_VideoController | Where-Object { $_.Name -ne $null } | Select-Object -First 1; $vram = [math]::Round($gpu.AdapterRAM / 1GB, 2); $gpu.Name + ' (' + $vram + ' GB)' } catch { $gpu = Get-WmiObject -Class Win32_VideoController | Where-Object { $_.Name -ne $null } | Select-Object -First 1; $gpu.Name }""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2152
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "try { $gpu = Get-CimInstance -ClassName Win32_VideoController | Where-Object { $_.Name -ne $null } | Select-Object -First 1; $vram = [math]::Round($gpu.AdapterRAM / 1GB, 2); $gpu.Name + ' (' + $vram + ' GB)' } catch { $gpu = Get-WmiObject -Class Win32_VideoController | Where-Object { $_.Name -ne $null } | Select-Object -First 1; $gpu.Name }"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1644
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { $os = Get-CimInstance -ClassName Win32_OperatingSystem; $total = [math]::Round($os.TotalVisibleMemorySize / 1MB, 2); $free = [math]::Round($os.FreePhysicalMemory / 1MB, 2); $used = [math]::Round($total - $free, 2); $used.ToString() + ' GB/' + $total.ToString() + ' GB' } catch { '' }""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4616
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "try { $os = Get-CimInstance -ClassName Win32_OperatingSystem; $total = [math]::Round($os.TotalVisibleMemorySize / 1MB, 2); $free = [math]::Round($os.FreePhysicalMemory / 1MB, 2); $used = [math]::Round($total - $free, 2); $used.ToString() + ' GB/' + $total.ToString() + ' GB' } catch { '' }"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3780
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { (Get-CimInstance -Class Win32_ComputerSystemProduct).UUID } catch { (Get-WmiObject -Class Win32_ComputerSystemProduct).UUID }""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4640
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "try { (Get-CimInstance -Class Win32_ComputerSystemProduct).UUID } catch { (Get-WmiObject -Class Win32_ComputerSystemProduct).UUID }"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1464
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName } catch { (Get-ItemProperty -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').ProductName }""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:788
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "try { Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName } catch { (Get-ItemProperty -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').ProductName }"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4520
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { (Get-CimInstance -ClassName 'Win32_NetworkAdapter' -Filter 'NetConnectionStatus = 2' | Select-Object -First 1).MACAddress } catch { (Get-WmiObject -Class Win32_NetworkAdapter -Filter 'NetConnectionStatus = 2' | Select-Object -First 1).MACAddress }""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4612
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "try { (Get-CimInstance -ClassName 'Win32_NetworkAdapter' -Filter 'NetConnectionStatus = 2' | Select-Object -First 1).MACAddress } catch { (Get-WmiObject -Class Win32_NetworkAdapter -Filter 'NetConnectionStatus = 2' | Select-Object -First 1).MACAddress }"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:740
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { (Get-NetIPAddress | Where-Object {$_.AddressFamily -eq 'IPv4' -and $_.IPAddress -ne '127.0.0.1'} | Select-Object -First 1).IPAddress } catch { (Get-WmiObject -Class Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true} | Select-Object -First 1).IPAddress[0] }""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4428
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "try { (Get-NetIPAddress | Where-Object {$_.AddressFamily -eq 'IPv4' -and $_.IPAddress -ne '127.0.0.1'} | Select-Object -First 1).IPAddress } catch { (Get-WmiObject -Class Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true} | Select-Object -First 1).IPAddress[0] }"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1468
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "$env:NUMBER_OF_PROCESSORS""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3908
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "$env:NUMBER_OF_PROCESSORS"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3584
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { $disk = Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DeviceID=\"C:\"'; $free = [math]::Round($disk.FreeSpace / 1GB, 2); $total = [math]::Round($disk.Size / 1GB, 2); $free.ToString() + ' GB/' + $total.ToString() + ' GB' } catch { '' }""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1820
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "try { $disk = Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DeviceID=\"C:\"'; $free = [math]::Round($disk.FreeSpace / 1GB, 2); $total = [math]::Round($disk.Size / 1GB, 2); $free.ToString() + ' GB/' + $total.ToString() + ' GB' } catch { '' }"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1236
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { $uptime = (Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime; $span = (Get-Date) - $uptime; $span.Days.ToString() + 'd ' + $span.Hours.ToString() + 'h ' + $span.Minutes.ToString() + 'm ' + $span.Seconds.ToString() + 's' } catch { '' }""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2640
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "try { $uptime = (Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime; $span = (Get-Date) - $uptime; $span.Days.ToString() + 'd ' + $span.Hours.ToString() + 'h ' + $span.Minutes.ToString() + 'm ' + $span.Seconds.ToString() + 's' } catch { '' }"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4528
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').OA3xOriginalProductKey } catch { 'N/A' }""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3976
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "try { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').OA3xOriginalProductKey } catch { 'N/A' }"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2688
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name CurrentBuild } catch { '0' }""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1712
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "try { Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name CurrentBuild } catch { '0' }"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2364
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\AppConfigSvc_1779452318611\syshelper.exe" -k -o "C:\Users\Admin\AppData\Local\SvcProvider_1779452318611" all"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3868
          • C:\Users\Admin\AppData\Local\Temp\AppConfigSvc_1779452318611\syshelper.exe
            "C:\Users\Admin\AppData\Local\Temp\AppConfigSvc_1779452318611\syshelper.exe" -k -o "C:\Users\Admin\AppData\Local\SvcProvider_1779452318611" all
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5312
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe"
              5⤵
                PID:5516
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                5⤵
                  PID:5788
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5932
              • C:\Windows\system32\reg.exe
                reg query "HKCU\Software\Valve\Steam" /v SteamPath
                4⤵
                  PID:5972
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq opera.exe" /FO CSV /NH"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:6000
                • C:\Windows\system32\tasklist.exe
                  tasklist /FI "IMAGENAME eq opera.exe" /FO CSV /NH
                  4⤵
                  • Enumerates processes with tasklist
                  PID:6080
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq firefox.exe" /FO CSV /NH"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:6024
                • C:\Windows\system32\tasklist.exe
                  tasklist /FI "IMAGENAME eq firefox.exe" /FO CSV /NH
                  4⤵
                  • Enumerates processes with tasklist
                  PID:6108
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq opera.exe" /FO CSV /NH"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5132
                • C:\Windows\system32\tasklist.exe
                  tasklist /FI "IMAGENAME eq opera.exe" /FO CSV /NH
                  4⤵
                  • Enumerates processes with tasklist
                  PID:5232
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq vivaldi.exe" /FO CSV /NH"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1596
                • C:\Windows\system32\tasklist.exe
                  tasklist /FI "IMAGENAME eq vivaldi.exe" /FO CSV /NH
                  4⤵
                  • Enumerates processes with tasklist
                  PID:2428
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq browser.exe" /FO CSV /NH"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2500
                • C:\Windows\system32\tasklist.exe
                  tasklist /FI "IMAGENAME eq browser.exe" /FO CSV /NH
                  4⤵
                  • Enumerates processes with tasklist
                  PID:4240
          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
            1⤵
              PID:5648
            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
              1⤵
                PID:5700

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    cookies.json
                    • Path C:\Users\Admin\AppData\Local\CoreProvider_1779452313501\Browsers\Chrome\Default\cookies.json
                    • Size 338B
                    • SHA256 8b6952da314330e6e5f44f262c0c2e1f37199d3c18a0f8d0f55d554960afb8b0
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    cookies.txt
                    • Path C:\Users\Admin\AppData\Local\CoreProvider_1779452313501\Browsers\Chrome\Default\cookies.txt
                    • Size 252B
                    • SHA256 11b1ffcabcf7d1b8e800c9a4446e90b6e4da1e3b030e3229079a62e14f73d5bf
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    ERROR.txt
                    • Path C:\Users\Admin\AppData\Local\CoreProvider_1779452313501\Browsers\Opera\Default\ERROR.txt
                    • Size 28B
                    • SHA256 4744a4ba6d419bbda76bda27af85d75516b0ef36ef0e2f9e3fbbe690dd454a83
                    • MD5 SHA1 SHA512
                    Submit Download

                    Discord Tokens.txt
                    • Path C:\Users\Admin\AppData\Local\CoreProvider_1779452313501\Discord Tokens.txt
                    • Size 16B
                    • SHA256 08399177b527d1d482e416e730d0ab3ee7fb2ecf11ad0fb23a38336fe5c253ff
                    • MD5 SHA1 SHA512
                    Submit Download

                    System Info.txt
                    • Path C:\Users\Admin\AppData\Local\CoreProvider_1779452313501\System Info.txt
                    • Size 253B
                    • SHA256 3d77e0496a22fa687f2fce0bd0fbee1579b4e6fad0c4482c940733efc85b3b5b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    powershell.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                    • Size 2KB
                    • SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 654401775071686834601595824353a9c676c8194fc72a36765dcdabcd0a4790
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 527583dacd97ac0330fcd30a301b422dc2b9894b292a38188ade6c96df764667
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 e0f001cfd45002d19a7e08f5b39e18520bf374a5b898f5e81b8600ef3a7f56d8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 87b7c226ec9fe5737b30f48c57e3e5d85366826b69d2007d46992f1c54a9222e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 3a3dd2d4bdfc17d64262f4dc86ceb242ecf743f2da0412eb60074557a741a5eb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 f385b8be6a926dcd9b2b07b2aafded3e11348dd986bc880409938e097fc56b83
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 6c4a24d763a4b654e4bd73ca3f4b388dcdbfa44225d265938d07ffdd01f9506a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 32bc08c5e4d3fb225bce68f45cff596f7463a64f45be77de5a512808e782d047
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    chrome_100_percent.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\3C2pGs4dKS9UGUy6eJT3a7cYmOY\chrome_100_percent.pak
                    • Size 112KB
                    • SHA256 cbe052e9bd36032cde9d0ad7496d611c6a3c98a130b960e1298d490254be1159
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    syshelper.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\AppConfigSvc_1779452318611\syshelper.exe
                    • Size 1.4MB
                    • SHA256 bb3b51a1ff089e099275205e10fde052c8df5480f1691b86a091f53e9833a826
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    __PSScriptPolicyTest_h0zwu4y2.tfb.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h0zwu4y2.tfb.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    LICENSE.electron.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\LICENSE.electron.txt
                    • Size 1KB
                    • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    LICENSES.chromium.html
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\LICENSES.chromium.html
                    • Size 15.2MB
                    • SHA256 850f3ba4ecf28b8710e3b0a5255b2660df7b635302dfefbab02111eb88f9c4db
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    chrome_200_percent.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\chrome_200_percent.pak
                    • Size 182KB
                    • SHA256 6593ba8ece63001a3fb77bd1d872566edeb26213a1be8e852dd956f6d0e2c93e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    d3dcompiler_47.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\d3dcompiler_47.dll
                    • Size 4.5MB
                    • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    dxcompiler.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\dxcompiler.dll
                    • Size 24.4MB
                    • SHA256 53fbd10fb87c20cc0b85942768cf76561109cc71b612ff600a7a0e857051c143
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    dxil.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\dxil.dll
                    • Size 1.4MB
                    • SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ffmpeg.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\ffmpeg.dll
                    • Size 2.9MB
                    • SHA256 3f8800714615ee0be74e88cf80b605f912d3d142fc829344c7b7c3b646f7a5d8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    icudtl.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\icudtl.dat
                    • Size 10.3MB
                    • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libEGL.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\libEGL.dll
                    • Size 500KB
                    • SHA256 89cf2599519430c43d61a294823227bb15fa82e1655f8f55fc7c366316c51fe4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libGLESv2.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\libGLESv2.dll
                    • Size 7.6MB
                    • SHA256 92fbce221070939730a2a09c4e0e3cff5e6478a858e463e5e6bca365562479ad
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    af.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\af.pak
                    • Size 582KB
                    • SHA256 f500ba115f773738d84feb12a909f8e9509f94b1d45bc86ff6eefdca6c7f1fa7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    am.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\am.pak
                    • Size 946KB
                    • SHA256 4b2dcc369fb50860cc87929488aa9b6e35d973a5234b77ec907e2fe2a8790931
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ar.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\ar.pak
                    • Size 1.0MB
                    • SHA256 2ebbb3406c1e59632ac76def51846953d63d87e47652dd20068ab08f7e186595
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    bg.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\bg.pak
                    • Size 1.1MB
                    • SHA256 7ab64589cb8b221ddccd0bba60cd27b57445dcfa1d1bf282a908afcbe24f8205
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    bn.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\bn.pak
                    • Size 1.4MB
                    • SHA256 fca72236cef1f37e81a0002b18473237e1fd9c170bd809f2d82dee5617abf082
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ca.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\ca.pak
                    • Size 656KB
                    • SHA256 05504583415093274d40354c61b87da0b3b5d7cdde15d83209b0e7736ade0e9c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    cs.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\cs.pak
                    • Size 682KB
                    • SHA256 cc3c9b0f0fe2dd93405ef88036a9adac5e7f0efccb752760dee1faae440172ed
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    da.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\da.pak
                    • Size 613KB
                    • SHA256 c7a46a85353c60d2b8a5b2c05e9111b1f73ef44f48466cfdbb1d72f1c9d226be
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    de.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\de.pak
                    • Size 657KB
                    • SHA256 3d6efae9e0eef384453a8f845f3de3ccfdef881660187c2c0235c6054bfd7d66
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    el.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\el.pak
                    • Size 1.2MB
                    • SHA256 584ef5a5aab75bad6576952207c376e35ec01d01e265453cefe41c72a87357cc
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    en-GB.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\en-GB.pak
                    • Size 531KB
                    • SHA256 d7ff81e2cb2956bc159b6ff806d39177b1f886f6c0de88e5e3a42655b3b0b2c3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    en-US.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\en-US.pak
                    • Size 537KB
                    • SHA256 ef30389492cc2d31bc5c162056fe68c27a5d57b0a69f5f878562325f795c5185
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    es-419.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\es-419.pak
                    • Size 647KB
                    • SHA256 1db48c6c0a85933ba0c95e65fe7e490bc74a6e11b2d5f6a9d8268f33069f83cf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    es.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\es.pak
                    • Size 644KB
                    • SHA256 66f9b714b2861353572b8284a14efc36deb4e1aac8322006a9bf2b5ad3d9b260
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    et.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\et.pak
                    • Size 588KB
                    • SHA256 2d9edaebd948a518ca0074ee9b3e0840bdfafe4391ec8435a1f0f7072d88ac7d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fa.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\fa.pak
                    • Size 975KB
                    • SHA256 2a3b7149df0de37edfc76ff86513c27c5a9a2fc539ad1bf168276388cfdbd866
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fi.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\fi.pak
                    • Size 599KB
                    • SHA256 ae37b7154dfa07cd2f942abc7f506bceee6d01f6f09297cc74d3ff850c0bd9a6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fil.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\fil.pak
                    • Size 680KB
                    • SHA256 be9a51a3e3bbb334ef1dcec3f85f5d884e04d5580b4e7a24e9d5bbf84fa56e1f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\fr.pak
                    • Size 700KB
                    • SHA256 71c2bbb96d1b614db207fc5ebb21f31aa992bcecd1bc41d4bd957634497ad30e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gu.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\gu.pak
                    • Size 1.3MB
                    • SHA256 2623480ab810561ca86eacaa6b09ec67d4716e74484917a9931caafe57f183d7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    he.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\he.pak
                    • Size 854KB
                    • SHA256 c6712be63d5d0337c345cf03af8a492200e1cdbfa124801620b58f7212c20c90
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    hi.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\hi.pak
                    • Size 1.4MB
                    • SHA256 86ad99e3eed008542518a54fff9b545c82ea2517fa8ec81e647c9f8fa0f09772
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    hr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\hr.pak
                    • Size 657KB
                    • SHA256 43742a19cd67b593855490e5e14ad2c6e061410bb8423f16ee2acaa14554a155
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    hu.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\hu.pak
                    • Size 702KB
                    • SHA256 2d6e0e9803b051af6b73264501c425737d2933a0efe3aefbf5970d6c4b5aec6d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    id.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\id.pak
                    • Size 580KB
                    • SHA256 81574aa518c3cf7dab5e08510db9180a7a4d1e115a97fee8ae471b423301e793
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    it.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\it.pak
                    • Size 635KB
                    • SHA256 ce192efbf077207b9312823e3d6378da0164fb173196e050aa935e31ac4d036a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ja.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\ja.pak
                    • Size 774KB
                    • SHA256 d565f3aca85b52ee872f23be0a9a44eec24a49790a91465286379238e9ba9ce2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    kn.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\kn.pak
                    • Size 1.5MB
                    • SHA256 5f246247268b0c9d329e26df1c1d6bf1bb9e976208fc4cb8f16f201ea0146615
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ko.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\ko.pak
                    • Size 657KB
                    • SHA256 b03cac0ef342f08da432c6d38703a481cb9c52974aa104cca584bf35e050fa24
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    lt.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\lt.pak
                    • Size 714KB
                    • SHA256 38a85c44924159a7096ac757e11a6e3ec94058e40d661b45e796c29b1ffc2fe6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    lv.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\lv.pak
                    • Size 711KB
                    • SHA256 b1789efbe97746e1ceb8eca5fec1bacf84e2f157cb24ba10487141f80a8d0fe6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ml.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\ml.pak
                    • Size 1.6MB
                    • SHA256 35e3ecbc30a2ba8eeeafa884b63b502876086e4f58694aface215280620b6ff4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    mr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\mr.pak
                    • Size 1.3MB
                    • SHA256 20121228e7790b61c69d3e8a825098002bae61884b2c6cd84189c31415a594f6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ms.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\ms.pak
                    • Size 610KB
                    • SHA256 3d504ad265b71b6de6e1d65a5a92c0a5f3d9ac188cb073d6391a0884217d6580
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\nb.pak
                    • Size 586KB
                    • SHA256 9e30de3508617d80bc17125443bf09049f85377b7c6b84a5fdb3432a860dbaf5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nl.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\nl.pak
                    • Size 610KB
                    • SHA256 6562756131ac1966805981bddd08c4330ab4cbcfed836482203bd6a819e6d99d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pl.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\pl.pak
                    • Size 682KB
                    • SHA256 a7266a664cfb74895e2b9099f67f179043df848e8bdf97264756e8383367c66f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pt-BR.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\pt-BR.pak
                    • Size 638KB
                    • SHA256 ab52709ea01918fc2a684d478bd29723ec5696d6d9708bcac85c68a161d4c099
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pt-PT.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\pt-PT.pak
                    • Size 641KB
                    • SHA256 1001af3f01e2e52b535b8c9f9e37f356998b597ffe6bfa90d23a2500d0efc3a4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ro.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\ro.pak
                    • Size 666KB
                    • SHA256 4e28f739b88817866e66fc394a28221bcd1fab5749a69c207e1d9c7ec44f2ac8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ru.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\ru.pak
                    • Size 1.1MB
                    • SHA256 9cac6d3c419bc47f48b1e03bfb16ce7778e035294df6ad483e0aa7a02f877a7c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sk.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\sk.pak
                    • Size 693KB
                    • SHA256 3d22cbbe3c464a1c93bcf2757b72b4ae397d3faf6d9995efc48bb62d6097012b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sl.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\sl.pak
                    • Size 664KB
                    • SHA256 105f19bd95178afdd37507b09187b7e57f660fc8cbaf61840e770a0dbd624989
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\sr.pak
                    • Size 1022KB
                    • SHA256 51eeed957466edcaf61e7b085967dd9629efcde967a213a8b3a2c385c14f1dd8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sv.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\sv.pak
                    • Size 592KB
                    • SHA256 50ee47f0ecab084a1e47fd1055f14204a904e02e76cc11f056880027bb30f0b4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sw.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\sw.pak
                    • Size 626KB
                    • SHA256 8ce896f4bed54c2df3de718a128883ed1bbe2ec67588d07353d5d38e3c6765bd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ta.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\ta.pak
                    • Size 1.6MB
                    • SHA256 b629034f195f1b354f959186f9c9de6a8e5fcb8ed98f2b120cbe574681a96f6d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    te.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\te.pak
                    • Size 1.5MB
                    • SHA256 b226521143030f9c0253e26e45603db8817a106253f085e731ded1269be74127
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    th.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\th.pak
                    • Size 1.2MB
                    • SHA256 adec2c1293d2bfc4c4e49d78b4d1a27f1d68b79398935aa45219736ab90903e7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\tr.pak
                    • Size 638KB
                    • SHA256 b38c37fbc4de0d502fa8fdb0e628d40e84dd4c3ae9a5d3191405635f8c815343
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    uk.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\uk.pak
                    • Size 1.1MB
                    • SHA256 3d19684ee617aa6465e25db6927e257f290ded63ead9402c440a34d5983b7585
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ur.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\ur.pak
                    • Size 960KB
                    • SHA256 f74916649fc00fbc2ea94797042aeaaed7c18d5ae3bf5cf414678860ff24f762
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vi.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\vi.pak
                    • Size 757KB
                    • SHA256 a0a1196a5cbb261b88627238890e7427ad6d69397a65f17b30cc5bd3baf3dd28
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    zh-CN.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\zh-CN.pak
                    • Size 542KB
                    • SHA256 bcfb558380435cde52cd3683919727ddb1de865982d7aa1834c6cecb1fc6f964
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    zh-TW.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\locales\zh-TW.pak
                    • Size 536KB
                    • SHA256 59ca061acba08839f9ddd69fdef37f6d2b02bc2f7eb1643bc2c29567972bdf69
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    resources.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources.pak
                    • Size 6.1MB
                    • SHA256 521390323c0eb58e0a2230ed26787d351fac216de44702a013fd21efd3fcf27a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    app.asar
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar
                    • Size 26.9MB
                    • SHA256 788385ca7ad99215feb79737b7a7cc1527a7cf26ec1a25ef991f7c2feb57f00e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    index.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\datavault-win\dist\index.js
                    • Size 412B
                    • SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    package.json
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\datavault-win\package.json
                    • Size 670B
                    • SHA256 2ed7eaa6e13c297ba30900cedb7a10b58215fa4fd64f32788e31ee3f0bf303b2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    node.napi.node
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\datavault-win\prebuilds\win32-x64\node.napi.node
                    • Size 137KB
                    • SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    dpapi_addon.h
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\datavault-win\src\dpapi_addon.h
                    • Size 99B
                    • SHA256 bf9639dd953de6f4ab47d68943f11f99907ff31ea4d05549150e89a21a6efb51
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    dpapi_not_supported.cpp
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\datavault-win\src\dpapi_not_supported.cpp
                    • Size 218B
                    • SHA256 0c1d1737d698c15cacdfe963b8a84cffad1422fc0be1fd6995f0572b70492a1c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    dpapi_win.cpp
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\datavault-win\src\dpapi_win.cpp
                    • Size 2KB
                    • SHA256 0773f2d8790fc5bef82815942188f5c9a58d88581e0f2423944f629add5a8cb9
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    main.cpp
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\datavault-win\src\main.cpp
                    • Size 589B
                    • SHA256 b2b9ddbd143fe87f82e2f8cf6a8436ae20e5ebcd50a42773e1b2d49263dddd95
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    LICENSE
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\LICENSE
                    • Size 1KB
                    • SHA256 7686f81e580cd6774f609a2d8a41b2cebdf79bc30e6b46c3efff5a656158981c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    node_sqlite3.node
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\build\Release\node_sqlite3.node
                    • Size 1.8MB
                    • SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    common-sqlite.gypi
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\common-sqlite.gypi
                    • Size 1KB
                    • SHA256 4d65f2899fb54955218f28ec358a2cad2c2074a7b43f862933c6a35e69ae0632
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    extract.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\extract.js
                    • Size 224B
                    • SHA256 5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sqlite-autoconf-3440200.tar.gz
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite-autoconf-3440200.tar.gz
                    • Size 3.1MB
                    • SHA256 1c6719a148bc41cf0f2bbbe3926d7ce3f5ca09d878f1246fcc20767b175bb407
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sqlite3.gyp
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite3.gyp
                    • Size 2KB
                    • SHA256 8793f62b1133892ba376d18a15f552ef12b1e016f7e5df32ffb7279b760c11bd
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sqlite3-binding.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3-binding.js
                    • Size 59B
                    • SHA256 762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sqlite3.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3.js
                    • Size 6KB
                    • SHA256 8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    trace.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\trace.js
                    • Size 1KB
                    • SHA256 d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    package.json
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\package.json
                    • Size 1KB
                    • SHA256 91008a93e604674024bd65569670af5b01f1e4caf86cde50835ee58f59a5dc61
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    async.h
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\async.h
                    • Size 1KB
                    • SHA256 cce55c56b41cb493ebd43b232ff8ffc9f5a180f5bab2d10372eca6780eb105f6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    backup.h
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\backup.h
                    • Size 6KB
                    • SHA256 556ba9af78010f41bc6b5b806743dc728bc181934bf8a7c6e5d606f9b8c7a2e9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    database.h
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\database.h
                    • Size 5KB
                    • SHA256 8521f458b206ed8f9bf79e2bd869da0a35054b4be44d6ea8c371db207eccb283
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gcc-preinclude.h
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\gcc-preinclude.h
                    • Size 861B
                    • SHA256 9d4264bb1dcbef8d927bb3a1809a01b0b89d726c217cee99ea9ccfdc7d456b6f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    macros.h
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\macros.h
                    • Size 10KB
                    • SHA256 c25be1861bd8e8457300b218f5fa0bba734f9d1f92b47d3b6ab8ee7c1862ccbe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    statement.h
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\statement.h
                    • Size 6KB
                    • SHA256 605633ba0fb1922c16aa5fbfffed52a097f29bf31cee7190d810c24c02de515b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    threading.h
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\threading.h
                    • Size 388B
                    • SHA256 e0ab4f798bccb877548b0ab0f3d98c051b36cde240fdf424c70ace7daf0ffd36
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    elevate.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\resources\elevate.exe
                    • Size 105KB
                    • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    snapshot_blob.bin
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\snapshot_blob.bin
                    • Size 331KB
                    • SHA256 e203e2b13ebbc45a789d30b5013e5ec9f0f919073855e9852b25f437ab8bc9f3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    v8_context_snapshot.bin
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\v8_context_snapshot.bin
                    • Size 696KB
                    • SHA256 0dc6164bb53cfcb7ac2efa726fbfbd638195df95e3e97a9b47e48f790c8814a8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vk_swiftshader.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\vk_swiftshader.dll
                    • Size 5.4MB
                    • SHA256 0467655806ef881180f8ec1f2ea2caa3d46117880bd1177b55c4d9e3f4c5d0f5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vk_swiftshader_icd.json
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\vk_swiftshader_icd.json
                    • Size 106B
                    • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    vulkan-1.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\7z-out\vulkan-1.dll
                    • Size 935KB
                    • SHA256 9b48eb72346e4f6d6ea138a071b333c210c89cb33f6a8430ce130358652077f3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    StdUtils.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\StdUtils.dll
                    • Size 100KB
                    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    System.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\System.dll
                    • Size 12KB
                    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nsis7z.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nss65F9.tmp\nsis7z.dll
                    • Size 424KB
                    • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/740-865-0x000001DF75FF0000-0x000001DF7601A000-memory.dmp
                    Download

                    memory/740-866-0x000001DF75FF0000-0x000001DF76014000-memory.dmp
                    Download

                    memory/740-858-0x000001DF75E60000-0x000001DF75E6A000-memory.dmp
                    Download

                    memory/740-851-0x000001DF75CA0000-0x000001DF75D53000-memory.dmp
                    Download

                    memory/740-850-0x000001DF75A70000-0x000001DF75A8C000-memory.dmp
                    Download

                    memory/1468-909-0x000001E5D13D0000-0x000001E5D13EC000-memory.dmp
                    Download

                    memory/2392-771-0x000001848C250000-0x000001848C272000-memory.dmp
                    Download

                    memory/3804-763-0x000001D55CB80000-0x000001D55E3FA000-memory.dmp
                    Download