Overview

overview

7

Static

static

3

Silent Cli...64.exe

windows10-2004-x64

7

Silent Cli...64.exe

windows11-21h2-x64

7

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows10-2004-x64

4

LICENSES.c...m.html

windows11-21h2-x64

4

Silent Client.exe

windows10-2004-x64

7

Silent Client.exe

windows11-21h2-x64

7

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows10-2004-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows10-2004-x64

1

libGLESv2.dll

windows11-21h2-x64

1

resources/...er.dll

windows10-2004-x64

1

resources/...er.dll

windows11-21h2-x64

1

resources/...on.svg

windows10-2004-x64

3

resources/...on.svg

windows11-21h2-x64

4

resources/...go.svg

windows10-2004-x64

3

resources/...go.svg

windows11-21h2-x64

4

resources/...go.svg

windows10-2004-x64

3

resources/...go.svg

windows11-21h2-x64

4

resources/...r.html

windows10-2004-x64

4

resources/...r.html

windows11-21h2-x64

4

resources/...ter.js

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 10:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Silent Client Setup 4.4.1 x64.exe
  • Size 70.5MB
  • Sample260604-my145acy7x
  • SHA256 913f064f92f714774ba4e54d3039c38e59d5f57e875253f1110057a3d0499cc5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 34 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 28 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 52 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Silent Client Setup 4.4.1 x64.exe
    "C:\Users\Admin\AppData\Local\Temp\Silent Client Setup 4.4.1 x64.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Silent Client.exe" | %SYSTEMROOT%\System32\find.exe "Silent Client.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4116
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Silent Client.exe"
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2840
      • C:\Windows\SysWOW64\find.exe
        C:\Windows\System32\find.exe "Silent Client.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4884
  • C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
    "C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5756
      • C:\Windows\system32\chcp.com
        chcp
        3⤵
          PID:5752
      • C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
        "C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\silentclient" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1460 --field-trial-handle=1684,i,3616582545754444978,16383736135274192599,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1816
      • C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
        "C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\silentclient" --mojo-platform-channel-handle=1856 --field-trial-handle=1684,i,3616582545754444978,16383736135274192599,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2844
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
        2⤵
          PID:5056
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5928
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2812
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3240
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5072
          • C:\Windows\system32\findstr.exe
            findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
            3⤵
              PID:4520
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:968
            • C:\Windows\system32\reg.exe
              reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
              3⤵
              • Checks processor information in registry
              PID:1716
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4788
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2920
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3900
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:4228
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:5608
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:1744
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:4620
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:3104
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:3660
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:1132
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:5872
          • C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
            "C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\silentclient" --app-path="C:\Users\Admin\AppData\Local\Programs\silentclient\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2920 --field-trial-handle=1684,i,3616582545754444978,16383736135274192599,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2224
          • C:\Users\Admin\AppData\Local\silentclient-updater\pending\Silent Client Setup 4.4.2 x64.exe
            "C:\Users\Admin\AppData\Local\silentclient-updater\pending\Silent Client Setup 4.4.2 x64.exe" --updated --force-run
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2828
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Silent Client.exe" | %SYSTEMROOT%\System32\find.exe "Silent Client.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4624
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Silent Client.exe"
                4⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5496
              • C:\Windows\SysWOW64\find.exe
                C:\Windows\System32\find.exe "Silent Client.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3552
            • C:\Users\Admin\AppData\Local\Temp\nsb453E.tmp\old-uninstaller.exe
              "C:\Users\Admin\AppData\Local\Temp\nsb453E.tmp\old-uninstaller.exe" /S /KEEP_APP_DATA /currentuser --keep-shortcuts --updated _?=C:\Users\Admin\AppData\Local\Programs\silentclient
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5628
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Silent Client.exe" | %SYSTEMROOT%\System32\find.exe "Silent Client.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:6056
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Silent Client.exe"
                  5⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4732
                • C:\Windows\SysWOW64\find.exe
                  C:\Windows\System32\find.exe "Silent Client.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3608
        • C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
          "C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe" --updated
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:6100
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "chcp"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2572
            • C:\Windows\system32\chcp.com
              chcp
              3⤵
                PID:6080
            • C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
              "C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\silentclient" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1692,i,10809661029250504428,1774734766675596816,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:5824
            • C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
              "C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\silentclient" --mojo-platform-channel-handle=1712 --field-trial-handle=1692,i,10809661029250504428,1774734766675596816,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1224
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
              2⤵
                PID:5928
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5280
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4100
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:1272
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:6064
                • C:\Windows\system32\findstr.exe
                  findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
                  3⤵
                    PID:4404
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2540
                  • C:\Windows\system32\reg.exe
                    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
                    3⤵
                    • Checks processor information in registry
                    PID:5044
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5744
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5572
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1540
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5292
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4432
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5792
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4988
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5456
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1776
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4064
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4560
                • C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
                  "C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\silentclient" --app-path="C:\Users\Admin\AppData\Local\Programs\silentclient\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2876 --field-trial-handle=1692,i,10809661029250504428,1774734766675596816,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:5776
                • C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
                  "C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\silentclient" --app-path="C:\Users\Admin\AppData\Local\Programs\silentclient\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3324 --field-trial-handle=1692,i,10809661029250504428,1774734766675596816,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1588

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    powershell.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                    • Size 3KB
                    • SHA256 18d5722b4bdd546da121b4c8756096755cab8cb7c40126d93644910d9292f343
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    ModuleAnalysisCache
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                    • Size 62KB
                    • SHA256 7fbd4c8b35f476f9c2b0a62e1cba03c91330423a3a48078e0e65d3f22e4813ac
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 1KB
                    • SHA256 57f2345cb4543ea051ecec0d7f6bb69ca777e42555d49cf9fecf1712c4216e36
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 1KB
                    • SHA256 36675facb5c7d362666e3a230a63753b20767d6d1b6419e33eef82dba847fb9e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 1KB
                    • SHA256 4247b91b02e2f5ccb300cfccf6a2cd56962f984c7692ac6b7e059f25900c502c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 1KB
                    • SHA256 8a852d7c0b1f449d337a8035c62f51fad16316755f72b33c091b42886d3b1857
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 1KB
                    • SHA256 c524545f6cc03f2fa22a8e2cbdc00e1db741b922336fef4cd6cfd9abbc62bcad
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 1KB
                    • SHA256 70a5cbf8fda7d7d9a09fc249cc29de06dae6ba65aecfbeec55af4da07aee1c16
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 1KB
                    • SHA256 049c581c899aefa63d452bf0472cfa079be00c81fe85133815c77c336700b59a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 1KB
                    • SHA256 3a2ab31422dbf7d94cc4c35b2cb7ad3f4587aa978174f80fc55b9db5fb926c1f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 1KB
                    • SHA256 553dd8a70380a3b1a9560da56afd78c1e9e1ec90fae2f532a1835479749b0985
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Uninstall Silent Client.exe
                    • Path C:\Users\Admin\AppData\Local\Programs\silentclient\Uninstall Silent Client.exe
                    • Size 134KB
                    • SHA256 a740bf0ba109ff5da913aeb4a3736437402bfc1c0be1b23b7cd690f41ef4a693
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    chrome_100_percent.pak
                    • Path C:\Users\Admin\AppData\Local\Programs\silentclient\chrome_100_percent.pak
                    • Size 126KB
                    • SHA256 2caa1da9b6a6e87bdb673977fee5dd771591a1b6ed5d3c5f14b024130a5d1a59
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    id.pak
                    • Path C:\Users\Admin\AppData\Local\Programs\silentclient\locales\id.pak
                    • Size 350KB
                    • SHA256 7fd715914e3b0cf2048d4429f3236e0660d5bd5e61623c8fef9b8e474c2ac313
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    __PSScriptPolicyTest_da5o2ts5.myr.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_da5o2ts5.myr.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    app.asar
                    • Path C:\Users\Admin\AppData\Local\Temp\nsb453E.tmp\7z-out\resources\app.asar
                    • Size 7.8MB
                    • SHA256 01555dbe7dbc9cdd74af11de24cf8882cce8c2e02ac40f613a6751e30eec1f48
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    register-protocol-handler.node
                    • Path C:\Users\Admin\AppData\Local\Temp\nsb453E.tmp\7z-out\resources\app.asar.unpacked\node_modules\register-scheme\build\Release\register-protocol-handler.node
                    • Size 144KB
                    • SHA256 1fac6ae00576f9e5b0b777b0865cca390640cbfb5187911956b62d97ae01ab9d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    LICENSE.electron.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\LICENSE.electron.txt
                    • Size 1KB
                    • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    LICENSES.chromium.html
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\LICENSES.chromium.html
                    • Size 6.5MB
                    • SHA256 0bfa9a636e722107b6192ff35c365d963a54e1de8a09c8157680e8d0fbbfba1c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    chrome_200_percent.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\chrome_200_percent.pak
                    • Size 175KB
                    • SHA256 07bee34e189fe9a8789aed78ea59ad41414b6e611e7d74da62f8e6ca36af01ce
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    d3dcompiler_47.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\d3dcompiler_47.dll
                    • Size 4.7MB
                    • SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ffmpeg.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\ffmpeg.dll
                    • Size 2.7MB
                    • SHA256 f11576bf7ffbc3669d1a5364378f35a1ed0811b7831528b6c4c55b0cdc7dc014
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    icudtl.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\icudtl.dat
                    • Size 10.1MB
                    • SHA256 7c8c7b05d70145120b45ccb64bf75bee3c63ff213e3e64d092d500a96afb8050
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libEGL.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\libEGL.dll
                    • Size 468KB
                    • SHA256 d2107ba0f4e28e35b22837c3982e53784d15348795b399ad6292d0f727986577
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libGLESv2.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\libGLESv2.dll
                    • Size 7.2MB
                    • SHA256 50c4dc73d69b6c0189eab56d27470ee15f99bbbc12bfd87ebe9963a7f9ba404e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    af.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\af.pak
                    • Size 353KB
                    • SHA256 0ad547bb1dc57907adeb02e1be3017cce78f6e60b8b39395fe0e8b62285797a1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    am.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\am.pak
                    • Size 569KB
                    • SHA256 fa1e44215bd5acc7342c431a3b1fddb6e8b6b02220b4599167f7d77a29f54450
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ar.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\ar.pak
                    • Size 624KB
                    • SHA256 a62b848a002474a8ea37891e148cbaf4af09bdba7dafebdc0770c9a9651f7e3b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    bg.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\bg.pak
                    • Size 652KB
                    • SHA256 898621731ac3471a41f8b3a7bf52e7f776e8928652b37154bc7c1299f1fd92e1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    bn.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\bn.pak
                    • Size 838KB
                    • SHA256 1ea245646a4b4386606f03c8a3916a3607e2adbbc88f000976be36db410a1e39
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ca.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\ca.pak
                    • Size 400KB
                    • SHA256 56efff228ee3e112357d6121b2256a2c3acd718769c89413de82c9d4305459c6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    cs.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\cs.pak
                    • Size 409KB
                    • SHA256 de92f14480770401e39e22dcf3dd36de5ad3ed22e44584c31c37cd99e71c4a43
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    da.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\da.pak
                    • Size 371KB
                    • SHA256 d8da7ab28992c8299484bc116641e19b448c20adf6a8b187383e2dba5cd29a0b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    de.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\de.pak
                    • Size 397KB
                    • SHA256 7cc213e2c9a2d2e2e463083dd030b86da6bba545d5cee4c04df8f80f9a01a641
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    el.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\el.pak
                    • Size 712KB
                    • SHA256 21d1d273124648a435674c7877a98110d997cf6992469c431fe502bbcc02641f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    en-GB.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\en-GB.pak
                    • Size 324KB
                    • SHA256 e11e8db78ae12f8d735632ba9fd078ec66c83529cb1fd86a31ab401f6f833c16
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    en-US.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\en-US.pak
                    • Size 326KB
                    • SHA256 1d20e626444759c2b72aa6e998f14a032408d2b32f957c12ec3abd52831338fb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    es-419.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\es-419.pak
                    • Size 395KB
                    • SHA256 7f85673cf80d1e80acfc94fb7568a8c63de79a13a1bb6b9d825b7e9f338ef17c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    es.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\es.pak
                    • Size 394KB
                    • SHA256 7fa148369c64bc59c2832d617357879b095357fe970bab9e0042175c9ba7cb03
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    et.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\et.pak
                    • Size 356KB
                    • SHA256 d69489a723b304e305cb1767e6c8da5d5d1d237e50f6ddc76e941dcb01684944
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fa.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\fa.pak
                    • Size 577KB
                    • SHA256 b9ee861e1bdecffe6a197067905279ea77c180844a793f882c42f2b70541e25e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fi.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\fi.pak
                    • Size 365KB
                    • SHA256 2d337924139ffe77804d2742eda8e58d4e548e65349f827840368e43d567810b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fil.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\fil.pak
                    • Size 410KB
                    • SHA256 db4a63fa0d5b2baba71d4ba0923caed540099db6b1d024a0d48c3be10c9eed5a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\fr.pak
                    • Size 426KB
                    • SHA256 1923e0edf1ef6935a4a718e3e2fc9a0a541ea0b4f3b27553802308f9fd4fc807
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gu.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\gu.pak
                    • Size 813KB
                    • SHA256 e40ee4f24839f9e20b48d057bf3216bc58542c2e27cb40b9d2f3f8a1ea5bfbb4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    he.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\he.pak
                    • Size 507KB
                    • SHA256 15951767dafa7bdbedac803d842686820de9c6df478416f34c476209b19d2d8c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    hi.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\hi.pak
                    • Size 848KB
                    • SHA256 b1c7fb6909c8a416b513d6de21eea0b5a6b13c7f0a94cabd0d9154b5834a5e8b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    hr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\hr.pak
                    • Size 397KB
                    • SHA256 4df972b7f6d81aa7bdc39e2441310a37f746ae5015146b4e434a878d1244375b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    hu.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\hu.pak
                    • Size 427KB
                    • SHA256 b59f932df822ab1a87e8aab4bbb7c549db15899f259f4c50ae28f8d8c7ce1e72
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    it.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\it.pak
                    • Size 388KB
                    • SHA256 10e65f42ce01ba19ebf4b074e8b2456213234482eadf443dfad6105faf6cde4c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ja.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\ja.pak
                    • Size 472KB
                    • SHA256 d8fab5714dafecb89b3e5fce4c4d75d2b72893e685e148e9b60f7c096e5b3337
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    kn.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\kn.pak
                    • Size 938KB
                    • SHA256 7a34483e6272f9b8881f0f5a725b477540166561c75b9e7ab627815d4be1a8a4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ko.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\ko.pak
                    • Size 398KB
                    • SHA256 1a5884bd6665b2f404b7328de013522ee7c41130e57a53038fc991ec38290d21
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    lt.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\lt.pak
                    • Size 429KB
                    • SHA256 8a5d6e29833374e0f74fd7070c1b20856cb6b42ed30d18a5f17e6c2e4a8d783e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    lv.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\lv.pak
                    • Size 427KB
                    • SHA256 a1a9d84fd3af571a57be8b1a9189d40b836808998e00ec9bd15557b83d0e3086
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ml.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\ml.pak
                    • Size 974KB
                    • SHA256 66005bc01175a4f6560d1e9768dbc72b46a4198f8e435250c8ebc232d2dac108
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    mr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\mr.pak
                    • Size 797KB
                    • SHA256 23058c0f71d9e40f927775d980524d866f70322e0ef215aa5748c239707451e7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ms.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\ms.pak
                    • Size 365KB
                    • SHA256 c6471aee5f34f31477d57f593b09cb1de87f5fd0f9b5e63d8bab4986cf10d939
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\nb.pak
                    • Size 358KB
                    • SHA256 4f44789a2c38edc396a31aba5cc09d20fb84cd1e06f70c49f0664289c33cd261
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nl.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\nl.pak
                    • Size 370KB
                    • SHA256 be254bcda4dbe167cb2e57402a4a0a814d591807c675302d2ce286013b40799b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pl.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\pl.pak
                    • Size 412KB
                    • SHA256 2593c8b59849fbc690cbd513f06685ea3292cd0187fcf6b9069cbf3c9b0e8a85
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pt-BR.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\pt-BR.pak
                    • Size 389KB
                    • SHA256 6632bd12f04a5385012b5cdebe8c0dad4a06750dc91c974264d8fe60e8b6951d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pt-PT.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\pt-PT.pak
                    • Size 390KB
                    • SHA256 ee1e014550b85e3d18fb5128984a713d9f6de2258001b50ddd18391e7307b4a1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ro.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\ro.pak
                    • Size 403KB
                    • SHA256 2b7906f33bfbe8e9968bcd65366e2e996cdf2f3e1a1fc56ad54baf261c66954c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ru.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\ru.pak
                    • Size 657KB
                    • SHA256 9fcda0d1fab7fff7e2f27980de8d94ff31e14287f58bd5d35929de5dd9cbcdca
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sk.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\sk.pak
                    • Size 416KB
                    • SHA256 b0d38869275d9d295e42b0b90d0177e0ca56a393874e4bb454439b8ce25d686f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sl.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\sl.pak
                    • Size 401KB
                    • SHA256 340e0babe5fddbfda601c747127251cf111dd7d79d0d6a5ec4e8443b835027de
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\sr.pak
                    • Size 616KB
                    • SHA256 ab96a18177af90495e2e3c96292638a775aa75c1d210ca6a6c18fbc284cd815b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sv.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\sv.pak
                    • Size 361KB
                    • SHA256 d15b46bc9b5e31449b11251df19cd2ba4920c759bd6d4fa8ca93fd3361fdd968
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sw.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\sw.pak
                    • Size 379KB
                    • SHA256 41dfb772ae4c6f9e879bf7b4fa776b2877a2f8740fa747031b3d6f57f34d81dd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ta.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\ta.pak
                    • Size 964KB
                    • SHA256 052bcdb64a80e504bb6552b97881526795b64e0ab7ee5fc031f3edf87160dee9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    te.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\te.pak
                    • Size 894KB
                    • SHA256 d39716633228a5872630522306f89af8585f8092779892087c3f1230d21a489e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    th.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\th.pak
                    • Size 753KB
                    • SHA256 e32e37ca0ab30f1816fe6df37e3168e1022f1d3737c94f5472ab6600d97a45f6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\tr.pak
                    • Size 385KB
                    • SHA256 14a131ba318274cf10de533a19776db288f08a294cf7e564b7769fd41c7f2582
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    uk.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\uk.pak
                    • Size 657KB
                    • SHA256 bd02966f6c6258b66eae7ff014710925e53fe26e8254d7db4e9147266025cc3a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ur.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\ur.pak
                    • Size 571KB
                    • SHA256 3941364d0278e2c4d686faa4a135d16a457b4bc98c5a08e62aa12f3adc09aa7f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vi.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\vi.pak
                    • Size 455KB
                    • SHA256 ddabb225b671b989789e9c2ccd1b5a8f22141a7d9364d4e6ee9b8648305e7897
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    zh-CN.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\zh-CN.pak
                    • Size 332KB
                    • SHA256 6655fd9dcdfaf2abf814ffb6c524d67495aed4d923a69924c65abeab30bc74fb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    zh-TW.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\locales\zh-TW.pak
                    • Size 330KB
                    • SHA256 adf8df051b55507e5a79fa47ae88c7f38707d02dfac0cc4a3a7e8e17b58c6479
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    resources.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources.pak
                    • Size 5.2MB
                    • SHA256 9cfd5d29cde3de2f042e5e1da629743a7c95c1211e1b0b001e4eebc0f0741e06
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    app-update.yml
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\app-update.yml
                    • Size 192B
                    • SHA256 39476ab5a6b404a77323c51a29a819ed39c074299cef3a77d887fb066e825068
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    app.asar
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\app.asar
                    • Size 7.8MB
                    • SHA256 fb84bb8207336b19aeafacd0dea978bb7c70f759b8480c91358e0b2eeda8cdde
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    register-protocol-handler.node
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\app.asar.unpacked\node_modules\register-scheme\build\Release\register-protocol-handler.node
                    • Size 144KB
                    • SHA256 0ecad90320c129c5e6d57cf4a142a9148d1dda534bff9a47b527d2781aec73a7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    assets.d.ts
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\assets.d.ts
                    • Size 623B
                    • SHA256 d1688c0a786e3d9c4dd1a71178fcd06230eb5eba9cd64421015b98c170cdeec6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    entitlements.mac.plist
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\entitlements.mac.plist
                    • Size 333B
                    • SHA256 f4b2891dc2b1239191cecf7cd5b9a36ea4edaec33c1cc091e09380d669e8fb63
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OnestBlack1602-hint.ttf
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\fonts\OnestBlack1602-hint.ttf
                    • Size 103KB
                    • SHA256 dfd3ce6bc744aee8584e4ab0262d302f77b19348f184f25b9a9d1b93c5329461
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OnestBold1602-hint.ttf
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\fonts\OnestBold1602-hint.ttf
                    • Size 98KB
                    • SHA256 dff9e349eb2b481c1cfc6300d92b87ace5c33ab319e1688aee23abd46931e9a2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OnestExtraBold1602-hint.ttf
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\fonts\OnestExtraBold1602-hint.ttf
                    • Size 99KB
                    • SHA256 b7314a87a4e349c5e9deea36642d4bde3f65dd98b3c45a833ff59663a2ced6a9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OnestLight1602-hint.ttf
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\fonts\OnestLight1602-hint.ttf
                    • Size 89KB
                    • SHA256 6f923d5f61241267ddde5076681b2ee8b090b0d75c815cd03c40dc03f6624219
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OnestMedium1602-hint.ttf
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\fonts\OnestMedium1602-hint.ttf
                    • Size 90KB
                    • SHA256 e18235709cddfdcf23d595b041380782d9290e46b53f260cb89db892324f9942
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OnestRegular1602-hint.ttf
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\fonts\OnestRegular1602-hint.ttf
                    • Size 90KB
                    • SHA256 c45db982760f32f3c677ac713241655f90c79d9aabaa6f6e7203d4dafbd6b107
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    icon.icns
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\icon.icns
                    • Size 38KB
                    • SHA256 7f872c0e4937d68ac5b4e7d7bcdc4dd5f61b086809f79d0eda42e1dc28269e7c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    icon.ico
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\icon.ico
                    • Size 12KB
                    • SHA256 dcf4af42caa05510a352ede0f7d2f08800e614404c57ed9aabdba5e9aa967115
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    icon.png
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\icon.png
                    • Size 64KB
                    • SHA256 5561f47264d75bb5baec4c637443cadee597f0b56411303b903aab1c6af87e3f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    icon.svg
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\icon.svg
                    • Size 86KB
                    • SHA256 ad1d859b9f2f5b7dcecd6b199a96b6bb164655b33b9545506f1479c94899fcfd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    1024x1024.png
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\icons\1024x1024.png
                    • Size 28KB
                    • SHA256 689394c64c9697ccf53f2de5c78d78bc21a03fcdc9ff4844ad06678497159664
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    128x128.png
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\icons\128x128.png
                    • Size 2KB
                    • SHA256 ecb595f5845b0a26d703d2eb9ac4b16f10d6fe8ec5dacd1bf24ab127e15cfba2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    16x16.png
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\icons\16x16.png
                    • Size 390B
                    • SHA256 42f67288b7f8757f5eff43706bc0ead90b0c73216357c88bae9fb1b624746772
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    24x24.png
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\icons\24x24.png
                    • Size 521B
                    • SHA256 0587281d410b08fbf14b0595f4c0eaa84bf2d4958350a59293af158657b44f10
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    256x256.png
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\icons\256x256.png
                    • Size 5KB
                    • SHA256 2870bc0abca5c7d19bd8103ba55e4240c8f7418127618ef75850ede6ba90b301
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    32x32.png
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\icons\32x32.png
                    • Size 753B
                    • SHA256 7c453c72e254d000515e8e5119679a4e124e578102161d721bfe9d1348984574
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    48x48.png
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\icons\48x48.png
                    • Size 1KB
                    • SHA256 e6065bce926146f1c1b63c240603734a59bb82cb56cc5f81fb45307c02b8c712
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    512x512.png
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\icons\512x512.png
                    • Size 12KB
                    • SHA256 c8073952a1ab25006f26ddb6c4250dd178cde09666c1dd02718b876c636f4b0e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    64x64.png
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\icons\64x64.png
                    • Size 1KB
                    • SHA256 8445cebb07e09a980f67b3dcc3b32c9579ddd9673ebd9e79dc10502a9258455c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    96x96.png
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\icons\96x96.png
                    • Size 2KB
                    • SHA256 07c4ab920443f4acb774dba6127adcb6b25bd33eee4ec4f7941ce38da8c9d490
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    custom_skin.png
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\images\custom_skin.png
                    • Size 1KB
                    • SHA256 a5236c1849fe26f9ccd4969a2accafdec67aa3035ff9280b4a8a1be77b2077ad
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    dedik.png
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\images\dedik.png
                    • Size 20KB
                    • SHA256 3d3e4429241504afc04d412d4a919eb07644e7f59be79705bc50d13ad41bad2d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    full_logo.svg
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\images\full_logo.svg
                    • Size 7KB
                    • SHA256 57492f2cab5858e746ff51282ffe5b9e9636c0313114e9051d3898a46dc2dd3a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    steve.png
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\images\steve.png
                    • Size 972B
                    • SHA256 f2a2e68081cea3fa401f2fd8d589f2264d79c68a6fb239316da7ebb453efda5b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    en-US.json
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\translations\en-US.json
                    • Size 14KB
                    • SHA256 e194c159f3c27dbc4653e3bb28cbb4f9206111f0afe2bf54110e18c0429e5cbc
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    en-US_old.json
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\translations\en-US_old.json
                    • Size 4KB
                    • SHA256 3b00fd8b9052447d57f8160b0c5f1e0757f38cca080c2ff4944cd18e7274279c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ru.json
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\translations\ru.json
                    • Size 21KB
                    • SHA256 43cdb7711ecd7005723d359e74a1922c4d2bfc058ee0d0c6c8a1040245df0de0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ru.json~
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\translations\ru.json~
                    • Size 21KB
                    • SHA256 f054df9c4afe6be9a656af9fc0b87d1a022aa6fecf4cbbf124421834616eaa25
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ru_old.json
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\translations\ru_old.json
                    • Size 6KB
                    • SHA256 7ed522a119c14a5984006f8a7908312071b377fef53523e2eaa71ad52f9fcf06
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    updater.css
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\updater\updater.css
                    • Size 755B
                    • SHA256 de42fbd39f2d91b518a77c721cdbeb4608e3db5c6d617d82a310ce871755020b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    updater.css~
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\updater\updater.css~
                    • Size 756B
                    • SHA256 b79d9d25863f905cceef777e41b787c26ce4560f4f283749f1f08c101eb24171
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    updater.html
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\updater\updater.html
                    • Size 423B
                    • SHA256 6ab2c4f63e9c6fb6b29315b9a0909f0977d935e61027603dc4773f1f673848ab
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    updater.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\assets\updater\updater.js
                    • Size 606B
                    • SHA256 8f27a967789167ec390e233e30dfb140cc0db66260fa786e725b074402a4621d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    elevate.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\resources\elevate.exe
                    • Size 105KB
                    • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    snapshot_blob.bin
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\snapshot_blob.bin
                    • Size 158KB
                    • SHA256 4de0f720c416776423add7ada621da95d0d188d574f08e36e822ad10d85c3ece
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    v8_context_snapshot.bin
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\v8_context_snapshot.bin
                    • Size 465KB
                    • SHA256 43b58ca4057cf75063d3b4a8e67aa9780d9a81d3a21f13c64b498be8b3ba6e0c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vk_swiftshader.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\vk_swiftshader.dll
                    • Size 5.0MB
                    • SHA256 6150a413ebe00f92f38737bdccf493d19921ef6329fcd48e53de9dbde4780810
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vk_swiftshader_icd.json
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\vk_swiftshader_icd.json
                    • Size 106B
                    • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    vulkan-1.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\7z-out\vulkan-1.dll
                    • Size 899KB
                    • SHA256 f681844896c084d2140ac210a974d8db099138fe75edb4df80e233d4b287196a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SpiderBanner.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\SpiderBanner.dll
                    • Size 9KB
                    • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    StdUtils.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\StdUtils.dll
                    • Size 100KB
                    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    System.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\System.dll
                    • Size 12KB
                    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WinShell.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\WinShell.dll
                    • Size 3KB
                    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    nsExec.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\nsExec.dll
                    • Size 6KB
                    • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nsis7z.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nshB0AE.tmp\nsis7z.dll
                    • Size 424KB
                    • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    default.dic
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                    • Size 2B
                    • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                    • MD5 SHA1 SHA512
                    Submit Download

                    data_0
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\DawnCache\data_0
                    • Size 8KB
                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_1
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\DawnCache\data_1
                    • Size 264KB
                    • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_2
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\DawnCache\data_2
                    • Size 8KB
                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_3
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\DawnCache\data_3
                    • Size 8KB
                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Network Persistent State
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\Network\Network Persistent State
                    • Size 654B
                    • SHA256 a9cb11d707ab9958db773ae8ce8ee2ec1ee60a583aa155d94fed47a6d991ade0
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Network Persistent State
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\Network\Network Persistent State
                    • Size 1KB
                    • SHA256 3d42c0c74fae85eaa0c402851cd54455de3ea1e83d5acd77a369141af4c21329
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Network Persistent State~RFe594462.TMP
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\Network\Network Persistent State~RFe594462.TMP
                    • Size 59B
                    • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    TransportSecurity
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\Network\TransportSecurity
                    • Size 188B
                    • SHA256 2dac56d615b721473a4fe95bbee9f20115b622ea83b371ce5896637703c008db
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    TransportSecurity
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\Network\TransportSecurity
                    • Size 356B
                    • SHA256 11a950f8d82c48b8e62459418ee9b969d4519144d3ebe886a5daebef49681729
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    TransportSecurity
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\Network\TransportSecurity
                    • Size 188B
                    • SHA256 cea0eea17fddc905833f0155f2f23238e76d2626343dbb4759c473a1ac82e734
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    TransportSecurity~RFe594462.TMP
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\Network\TransportSecurity~RFe594462.TMP
                    • Size 188B
                    • SHA256 b0f04c05ca1e003c58d5b31439135392bb1bb247ddfa822446d2bd37f91f9fb4
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Preferences
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\Preferences
                    • Size 57B
                    • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    CURRENT
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\Session Storage\CURRENT
                    • Size 16B
                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                    • MD5 SHA1 SHA512
                    Submit Download

                    MANIFEST-000001
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\Session Storage\MANIFEST-000001
                    • Size 41B
                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                    • MD5 SHA1 SHA512
                    Submit Download

                    accounts.dat
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\accounts.dat
                    • Size 62B
                    • SHA256 e296a241248985748a3b85be0e494fec4e76a84100566dc68077bdbdfda72865
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    config.json
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\config.json
                    • Size 414B
                    • SHA256 683d7f73fe5b8ddb30fc8598bd83bb11bd200db87455f3d14b3b6353708497b7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    config.json
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\config.json
                    • Size 402B
                    • SHA256 f908fcf329ed39ac33f38e9635d18753a606991fa29b39da2fa060cbd9e08b14
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    config.json.tmp-0570625293fc6168
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\config.json.tmp-0570625293fc6168
                    • Size 460B
                    • SHA256 395883a7dd704d1904e2256a639a993112f0420077fa7eaffc82b14177b0c114
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    electron-log-preload.js
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\electron-log-preload.js
                    • Size 963B
                    • SHA256 68c0b2d645ece18ec0c3f5432716372c379a63b7b1ddb2d6372a8f0a5bbc8611
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    THIRD_PARTY_README
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\THIRD_PARTY_README
                    • Size 175KB
                    • SHA256 39433253b603b9dcd9829e4df6c5194c7308c3026d2aeebf5e8b41a9ab872649
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Xusage.txt
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\bin\server\Xusage.txt
                    • Size 1KB
                    • SHA256 37cf4e6cdc4357cebb0ec8108d5cb0ad42611f675b926c819ae03b74ce990a08
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    jdk.zip
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\jdk.zip
                    • Size 35.3MB
                    • SHA256 832f13e69a4d20a1a0c81b7c0745d7a0e13282f19e45c198cc077cc865ada25b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    jvm.cfg
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\amd64\jvm.cfg
                    • Size 1KB
                    • SHA256 23f728cc2bf14e62d454190ea0139f159031b5bd9c3f141ca9237c4c5c96ec1d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    CIEXYZ.pf
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\cmm\CIEXYZ.pf
                    • Size 784B
                    • SHA256 98cf012f6122c833b1ff4fbbe37f43a808d769d9b10ba43f3411728e7bb58bea
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    GRAY.pf
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\cmm\GRAY.pf
                    • Size 556B
                    • SHA256 d3fd8cb41b7ef8c5ea53bfecb1ad6d4762197c8eab04444545e083dff6f86fa9
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    LINEAR_RGB.pf
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\cmm\LINEAR_RGB.pf
                    • Size 488B
                    • SHA256 790da58ccc79d03658283652716ec9896ed31e0392d818e60f6832815ee79f4c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    PYCC.pf
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\cmm\PYCC.pf
                    • Size 228KB
                    • SHA256 0031aa2b8b4d490369a2a601ae0d95505df0cb86c0504f080c02ed87e84b3ddc
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sRGB.pf
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\cmm\sRGB.pf
                    • Size 6KB
                    • SHA256 87e382b9336e6a0417a4d860173109ab319a029cf2972e19833a3327c65bd7e4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    content-types.properties
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\content-types.properties
                    • Size 5KB
                    • SHA256 46f47b3883c7244a819ae1161113fe9d2375f881b75c9b3012d7a6b3497e030a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    flavormap.properties
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\flavormap.properties
                    • Size 3KB
                    • SHA256 c2748e07b59398cc40cacccd47fc98a70c562f84067e9272383b45a8df72a692
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    hijrah-config-umalqura.properties
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\hijrah-config-umalqura.properties
                    • Size 14KB
                    • SHA256 3456982de9eba535337852f02852e26e4ed197ebd9d8356977e6da4ed9075538
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    cursors.properties
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\images\cursors\cursors.properties
                    • Size 1KB
                    • SHA256 7b8b63f78e2f732bd58bf8f16144c4802c513a52970c18dc0bdb789dd04078e4
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    win32_CopyDrop32x32.gif
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\images\cursors\win32_CopyDrop32x32.gif
                    • Size 165B
                    • SHA256 13c783acd580df27207dabccb10b3f0c14674560a23943ac7233df7f72d4e49d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    win32_LinkDrop32x32.gif
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\images\cursors\win32_LinkDrop32x32.gif
                    • Size 168B
                    • SHA256 485cbe5c5144cfcd13cc6d701cdab96e4a6f8660cbc70a0a58f1b7916be64198
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    win32_MoveDrop32x32.gif
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\images\cursors\win32_MoveDrop32x32.gif
                    • Size 147B
                    • SHA256 12cfce05229dba939ce13375d65ca7d303ce87851ae15539c02f11d1dc824338
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    jvm.hprof.txt
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\jvm.hprof.txt
                    • Size 4KB
                    • SHA256 b055bf25b07e5ac70e99b897fb8152f288769065b5b84387362bb9cc2e6c9d38
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    logging.properties
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\logging.properties
                    • Size 2KB
                    • SHA256 ce1688fe641099954572ea856953035b5188e2ca228705001368250337b9b232
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    jmxremote.access
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\management\jmxremote.access
                    • Size 3KB
                    • SHA256 439158eb513525feda19e0e4153ccf36a08fe6a39c0c6ceeb9fcee86899dd33c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    jmxremote.password.template
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\management\jmxremote.password.template
                    • Size 2KB
                    • SHA256 3d83e336c9a24d09a16063ea1355885e07f7a176a37543463596b5db8d82f8fa
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    snmp.acl.template
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\management\snmp.acl.template
                    • Size 3KB
                    • SHA256 f1dc97da5a5d220ed5d5b71110ce8200b16cac50622b33790bb03e329c751ced
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    psfont.properties.ja
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\psfont.properties.ja
                    • Size 3KB
                    • SHA256 5a4bd51b969bf187ff86d94f4a71fdfbfa602762975fa3c73d264b4575f7c78f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    psfontj2d.properties
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\psfontj2d.properties
                    • Size 11KB
                    • SHA256 780c565d5af3ee6f68b887b75c041cdf46a0592f67012f12eeb691283e92630a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    java.security
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\security\java.security
                    • Size 22KB
                    • SHA256 32163a63b9db77b7a5c8f3454c9802bf17b945bea879c535f721ff509ccda4f2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sound.properties
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\sound.properties
                    • Size 1KB
                    • SHA256 299c2360b6155eb28990ec49cd21753f97e43442fe8fab03e04f3e213df43a66
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    tzmappings
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk-alpha\lib\tzmappings
                    • Size 8KB
                    • SHA256 d936ee24810b747c54192b4b5a279f21179fe3ceb42d113d025a368ebb7cb5a7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ._bin
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk\__MACOSX\._bin
                    • Size 176B
                    • SHA256 3e0c83f0e4b95c2480ecaab0c23dc2e24b2f269a2e5873f81b5c85f95e88cf2a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    jdk.zip
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk\jdk.zip
                    • Size 38.3MB
                    • SHA256 ad03a2025e0601721705e123cb0985328516169b606218281be4fe6b727cd22f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    win32_MoveNoDrop32x32.gif
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk\lib\images\cursors\win32_MoveNoDrop32x32.gif
                    • Size 153B
                    • SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    US_export_policy.jar
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\jdk\lib\security\policy\limited\US_export_policy.jar
                    • Size 622B
                    • SHA256 7f8ff1d8a62f0d00a19b8a734b313e01a57bc6a8e1e87a8d7d20ab73a29b8aa6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    main.log
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\logs\main.log
                    • Size 5KB
                    • SHA256 e52c7c30428993d8d530cab7223542e1b5889df5068cdd534415bcce0916a013
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    main.log
                    • Path C:\Users\Admin\AppData\Roaming\silentclient\logs\main.log
                    • Size 4KB
                    • SHA256 4c2317b1467aefdad80f7b4c5a4868b30a471b732121a57b27531796640413f7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/2812-1029-0x0000023F9EB00000-0x0000023F9EB46000-memory.dmp
                    Download

                    memory/2812-1036-0x0000023F9EAD0000-0x0000023F9EAEC000-memory.dmp
                    Download

                    memory/2812-1037-0x0000023F9F050000-0x0000023F9F103000-memory.dmp
                    Download

                    memory/2812-1038-0x0000023F9EAB0000-0x0000023F9EABA000-memory.dmp
                    Download

                    memory/2812-1040-0x0000023F9EB80000-0x0000023F9EBA4000-memory.dmp
                    Download

                    memory/2812-1039-0x0000023F9EB80000-0x0000023F9EBAA000-memory.dmp
                    Download

                    memory/5928-1016-0x000001F63AA40000-0x000001F63AA62000-memory.dmp
                    Download