Overview

overview

8

Static

static

3

NightCord-...er.exe

windows10-2004-x64

7

NightCord-...er.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

8

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

4

Nightcord.exe

windows10-2004-x64

7

Nightcord.exe

windows11-ltsc_2024-x64

1

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

ffmpeg.dll

windows11-ltsc_2024-x64

8

libEGL.dll

windows10-2004-x64

1

libEGL.dll

windows11-ltsc_2024-x64

1

libGLESv2.dll

windows10-2004-x64

1

libGLESv2.dll

windows11-ltsc_2024-x64

8

resources/app.js

windows10-2004-x64

3

resources/app.js

windows11-ltsc_2024-x64

3

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-ltsc_2024-x64

3

swiftshade...GL.dll

windows10-2004-x64

1

swiftshade...GL.dll

windows11-ltsc_2024-x64

1

swiftshade...v2.dll

windows10-2004-x64

1

swiftshade...v2.dll

windows11-ltsc_2024-x64

1

vk_swiftshader.dll

windows10-2004-x64

1

vk_swiftshader.dll

windows11-ltsc_2024-x64

8

vulkan-1.dll

windows10-2004-x64

1

vulkan-1.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    89s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/06/2026, 21:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    NightCord-Installer.exe
  • Size 50.9MB
  • Sample260620-1kssgsay21
  • SHA256 be3beb5ec2c6e3a76d566a746867aef7a0d45c8342ffa5f19395fbabe8c951be
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\NightCord-Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\NightCord-Installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5356
    • C:\Users\Admin\AppData\Local\Temp\3FPVkqpAhm4XEM1RUCGWckKPeB3\Nightcord.exe
      C:\Users\Admin\AppData\Local\Temp\3FPVkqpAhm4XEM1RUCGWckKPeB3\Nightcord.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1732
      • C:\Users\Admin\AppData\Local\Temp\3FPVkqpAhm4XEM1RUCGWckKPeB3\Nightcord.exe
        "C:\Users\Admin\AppData\Local\Temp\3FPVkqpAhm4XEM1RUCGWckKPeB3\Nightcord.exe" --type=gpu-process --field-trial-handle=1552,8508413043389635716,4263808672071625903,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1560 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1720
      • C:\Users\Admin\AppData\Local\Temp\3FPVkqpAhm4XEM1RUCGWckKPeB3\Nightcord.exe
        "C:\Users\Admin\AppData\Local\Temp\3FPVkqpAhm4XEM1RUCGWckKPeB3\Nightcord.exe" --type=renderer --field-trial-handle=1552,8508413043389635716,4263808672071625903,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\3FPVkqpAhm4XEM1RUCGWckKPeB3\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2740
      • C:\Users\Admin\AppData\Local\Temp\3FPVkqpAhm4XEM1RUCGWckKPeB3\Nightcord.exe
        "C:\Users\Admin\AppData\Local\Temp\3FPVkqpAhm4XEM1RUCGWckKPeB3\Nightcord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1552,8508413043389635716,4263808672071625903,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:5964
      • C:\Users\Admin\AppData\Local\Temp\3FPVkqpAhm4XEM1RUCGWckKPeB3\Nightcord.exe
        "C:\Users\Admin\AppData\Local\Temp\3FPVkqpAhm4XEM1RUCGWckKPeB3\Nightcord.exe" --type=gpu-process --field-trial-handle=1552,8508413043389635716,4263808672071625903,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1444 /prefetch:2
        3⤵
          PID:2980
    • C:\Windows\System32\CompPkgSrv.exe
      C:\Windows\System32\CompPkgSrv.exe -Embedding
      1⤵
        PID:3028
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2492
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:4352
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4960
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5860

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 599B
            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            LICENSE.electron.txt
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\LICENSE.electron.txt
            • Size 1KB
            • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            LICENSES.chromium.html
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\LICENSES.chromium.html
            • Size 5.1MB
            • SHA256 fc2a256467fb4d4ff72be6c423e5961e98b418554deeec296aded0e757b9a585
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_100_percent.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\chrome_100_percent.pak
            • Size 138KB
            • SHA256 c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_200_percent.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\chrome_200_percent.pak
            • Size 202KB
            • SHA256 b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            d3dcompiler_47.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\d3dcompiler_47.dll
            • Size 4.3MB
            • SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ffmpeg.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\ffmpeg.dll
            • Size 2.6MB
            • SHA256 39293258d5a2418841edb5ccf9ab3ad23064fb95e1ddfa7a3c6295a24c272a08
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icudtl.dat
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\icudtl.dat
            • Size 9.9MB
            • SHA256 6e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libEGL.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\libEGL.dll
            • Size 429KB
            • SHA256 23046e7fe2bbf76ee2c5596b6beac723ad465fdbaa44266486102cdb292148a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libGLESv2.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\libGLESv2.dll
            • Size 7.6MB
            • SHA256 dd74029716da56a0e4b64bc5cea0c169e1c4b31143ff39213d3c544792e8f2b9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            am.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\am.pak
            • Size 150KB
            • SHA256 5f323c0bd185d5bd5f7ea737018f14fd6ea500ba5440bc74f5c09b635518eadc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ar.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\ar.pak
            • Size 153KB
            • SHA256 e7f9a474399c0ca0daf28c6153f6ec7ae87423e66c8ffe0849407471d20b6237
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bg.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\bg.pak
            • Size 166KB
            • SHA256 bd3a3aacc3cee9864404755eee9542e0f21efbebd4a71e5333d15783d4ce18c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bn.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\bn.pak
            • Size 216KB
            • SHA256 b4ed891e8b38452623348da12d325b52407446114cba664a8e25a26a7cfaf773
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ca.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\ca.pak
            • Size 105KB
            • SHA256 9a4e286a58bb9a58e9e30d982783663c9bce40730cb6dad4c37980038040919e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cs.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\cs.pak
            • Size 107KB
            • SHA256 c00829fc57c7e1e5419fe3202f114d394a590b8b32b1e55af42772c93755945d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            da.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\da.pak
            • Size 98KB
            • SHA256 6da77a20fd6fbb228b2de5f197225342da18cbc58d26ebf542cf20d23e00f033
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            de.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\de.pak
            • Size 105KB
            • SHA256 e964d841b9588b7412f1ff86f004e6b052f993bf2153e4dc4bee6c5536be1744
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            el.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\el.pak
            • Size 184KB
            • SHA256 b624633365c19e6e3cbe200b39889711994809796dbee7988883165d0cc1d6c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-GB.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\en-GB.pak
            • Size 87KB
            • SHA256 4a5e6439c6731a5273970c8c053b4a89018c57f1d9be81d85f24978233675442
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-US.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\en-US.pak
            • Size 88KB
            • SHA256 781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            es-419.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\es-419.pak
            • Size 103KB
            • SHA256 2e1cf9d3e3eebe607da44873cfe37b9a84615962e3450313c3947920d4de4fda
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            es.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\es.pak
            • Size 105KB
            • SHA256 b927984d25359f3d7a20d71aa4b16d2ec4c574461177825b5221865f416d1e71
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            et.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\et.pak
            • Size 94KB
            • SHA256 9cdefc472c67247e67da040b984e800cc8b903a1b39c742e6962ff5c423f391e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fa.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\fa.pak
            • Size 147KB
            • SHA256 7e8f7f42300178f001ea5f74c63db25d813b7c25989114dc7673c76fd92a72c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fi.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\fi.pak
            • Size 97KB
            • SHA256 4e538a14f1dbc872a85fdb4be1e19145553ecfa3b07ee7c810b690c52b889684
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fil.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\fil.pak
            • Size 107KB
            • SHA256 cb536b478feffd3b55ec53676cce84cefc9e000c1205273bafcdaf6ee6edd381
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\fr.pak
            • Size 113KB
            • SHA256 f3bfcd6a297a7634c24f2fbd3de96f02588b0603d4a7618bb7588f6c091beb2e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gu.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\gu.pak
            • Size 207KB
            • SHA256 1d4d407233a4c78d5a9a242b43b21aa89fb68a0632bc52b0a515d69491632e85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            he.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\he.pak
            • Size 129KB
            • SHA256 4a9862ee8e139ae74e6336e0207d484e1a1ae0f689b5f1cc06b6fea66d2090d9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hi.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\hi.pak
            • Size 213KB
            • SHA256 06424570167c9bdd7e13b115a632d6ab58de7a4fa14f8d094627bd12d85e9318
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\hr.pak
            • Size 102KB
            • SHA256 cc48d7deaf73103e22e3e5900503396e2a2c9e5bf1450a4df8ce94179b1e47a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hu.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\hu.pak
            • Size 110KB
            • SHA256 61ae4e65474cb4ecf5edb2ec9bb9ea2b7a47bbf769f81c8fee1282c13b209783
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            id.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\id.pak
            • Size 94KB
            • SHA256 e07be6b1a095f235a4babb2ad5e8018c8c1b2f7cd6feab170124d25898e764c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            it.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\it.pak
            • Size 103KB
            • SHA256 4e2089d3fd90977f9a3a88b2af7fa9ff3b9864969d2f4582431626ae1f37c158
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ja.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\ja.pak
            • Size 124KB
            • SHA256 275307a3a9708c0698565f10941c57d42e1d2f55709a025d37e588699b5a985e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            kn.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\kn.pak
            • Size 237KB
            • SHA256 1a3fa5261b58113ae1a5cf140abd93e812b4a866a19a4c54929fffee5f42b18b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ko.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\ko.pak
            • Size 104KB
            • SHA256 0a46cce08401a72e44178349a61cdbae5fd78ca4f071bff2bf5f2e8c877a25f8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            lt.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\lt.pak
            • Size 111KB
            • SHA256 225e5784a7a616f83d81e6f3fdc5510e975e9fbde741b673deece5ded1604a9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            lv.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\lv.pak
            • Size 111KB
            • SHA256 d58b6308b64a1cda4ee0b2b395672728ce7abb73c44961fc911386569caee60e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ml.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\ml.pak
            • Size 250KB
            • SHA256 e51d9a02ad11cb9825368da9a17af7294b7e6bf11079e2072e4bec028ecaf20f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\mr.pak
            • Size 204KB
            • SHA256 4293afacf1c4dce2423c368a45fec4b33aac7232e7b7c1919aa8a5a20fb026a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ms.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\ms.pak
            • Size 97KB
            • SHA256 83248a2aaefb87fc19454afa34bf5df99b95b98f823b534de0bae552c8260d93
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nb.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\nb.pak
            • Size 96KB
            • SHA256 21f3efe54a2a0ed9e2f618b2a50f89b44957bc7c779e7f88c1f10b310cea8bd5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nl.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\nl.pak
            • Size 99KB
            • SHA256 e94551ca94505f068ecd0619af676b7b3a869f6068af87f0f537cace8055ba4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pl.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\pl.pak
            • Size 108KB
            • SHA256 c57c2e534da554e42388815cd3e848630ed46e1e61e640a6f3d4fd7cbdfb2aed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pt-BR.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\pt-BR.pak
            • Size 102KB
            • SHA256 ed9adacad575344216ee986e9c04908a5093aa7a0ebfbf2549df4c668a35f356
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pt-PT.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\pt-PT.pak
            • Size 103KB
            • SHA256 da64b5178bb41be0684cb3ef1204becb457520fe4960c3252f5ccd6a9ee9e29a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ro.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\ro.pak
            • Size 106KB
            • SHA256 99730524e53ca07481f8cdbbdace228aed42abc19d2277d26c42f47653f3cf07
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ru.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\ru.pak
            • Size 166KB
            • SHA256 ec6654ffd877ec62d8afcf90469ecef5790e17c7306654cfe4b905de449b06d8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sk.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\sk.pak
            • Size 109KB
            • SHA256 d7baa6b1c0355e1ce9088c6eb508235c7a640ba70cc7ad84c9ac607026400495
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sl.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\sl.pak
            • Size 104KB
            • SHA256 48e9004441f8afb200601ec2843a03892076deb1706e1d3a7bbdbfcdd137ab57
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\sr.pak
            • Size 158KB
            • SHA256 68a04bae37629675c49d9aaeb68a1da974aac427b61151a18f3210499702202d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sv.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\sv.pak
            • Size 96KB
            • SHA256 c63e812fee929492974c9b5dfa14a7587258e6fabed355a105015b296246b068
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sw.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\sw.pak
            • Size 97KB
            • SHA256 8b07bfafa5c97be2da9b6146535b7848d88a44d43a45ab06dfae286d93fd64ce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ta.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\ta.pak
            • Size 245KB
            • SHA256 22eb9d73331e92c898b27546a9e775fa8df0fdada391734a9291b2a016662652
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            te.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\te.pak
            • Size 228KB
            • SHA256 2dd8a542ee0778ee39639380208c584d9eec8932d1307bd5563e1eab320fe0d8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            th.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\th.pak
            • Size 195KB
            • SHA256 cffd61f7954ca10038529d14fda6a4e34c8ea1a9f202ead0b0c2db93143ef485
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\tr.pak
            • Size 101KB
            • SHA256 b1b66bfec0aff21c64ec8ba3f19008501f196f80e7e41b2e8ae73114357df458
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            uk.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\uk.pak
            • Size 167KB
            • SHA256 fa035595c375522d09f9de5a545f5339fcd3ddb224fb19f1828a7958b7dff3e8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vi.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\vi.pak
            • Size 119KB
            • SHA256 044c48581c2395a8eb0f85b5905e1b4cce1fc1fef2196710cef06e197afdfa99
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zh-CN.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\zh-CN.pak
            • Size 88KB
            • SHA256 690dafdeb5be360e8b3a84c711d0d48b3cfc74c871b89a8f03f8058738ca9834
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zh-TW.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\locales\zh-TW.pak
            • Size 88KB
            • SHA256 8187e67cde3292c6f18ea0a40f8f8d3f2cd604e62feec9ec40c71b5d2bcdec9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            resources.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\resources.pak
            • Size 4.9MB
            • SHA256 a30b8269e588c6cc2cea5fd4685da3012fd10451edb59a283005116f8e033182
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            app.asar
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\resources\app.asar
            • Size 1.1MB
            • SHA256 f423491977ef40558c43ea8543f6c09d9ca8a5f5052a514585fb87177df65ceb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icon.icns
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\resources\assets\icon.icns
            • Size 46KB
            • SHA256 a4dc3ce7a64207d10d15c4c537599f47b4ec1f16b53dbf3a92466d050ed4fcc5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icon.ico
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\resources\assets\icon.ico
            • Size 49KB
            • SHA256 c079322ded8d8ebb655b2b93be10b18b2a7a5080dde945da6acf517caf3acf3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            background.png
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\resources\assets\images\background.png
            • Size 297B
            • SHA256 1d370406c3b0c6bfe109feb76229fd4a0fe1d4171ae2a77655a0fd3264558d2f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            canary.png
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\resources\assets\images\canary.png
            • Size 2KB
            • SHA256 dfd3446ba31a55a11b45e0196b4eb2800e0271749c99102660d0df59f2ad9b85
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            splash.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\resources\assets\images\splash.bmp
            • Size 564KB
            • SHA256 c14a86e456f5b9783ed3e2118c9e97de6306fbd2b40cf9cd0dfb821b945c3569
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            stable.png
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\resources\assets\images\stable.png
            • Size 1KB
            • SHA256 b5b0f8076b0ac106fcc8f172b5e81516b69387f4119ca54715bd00739861fa27
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            license.txt
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\resources\assets\license.txt
            • Size 3KB
            • SHA256 7a274954056aa1065eb96c64b014ecf9e2e535d78633204303feeb2f6e802c72
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            elevate.exe
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\resources\elevate.exe
            • Size 105KB
            • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snapshot_blob.bin
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\snapshot_blob.bin
            • Size 47KB
            • SHA256 e03a33c2feb3cd9fd04fb1aa086febd0a6fdf5c680f48b6c5c80ef75767863d9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libEGL.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\swiftshader\libEGL.dll
            • Size 448KB
            • SHA256 b1054e0dc2ab31a7cf3cd7f3dae07b1ec31acd42c157be13ce47ea870840f0cc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libGLESv2.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\swiftshader\libGLESv2.dll
            • Size 3.1MB
            • SHA256 2e10d308d0207835b07df3bb38bee88300aa57fcb214051e8654d29587257744
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            v8_context_snapshot.bin
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\v8_context_snapshot.bin
            • Size 161KB
            • SHA256 09686ad5bf03d95de7c251d204e60a8e3824bd6420bedddee80b2c6e5609fb26
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vk_swiftshader.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\vk_swiftshader.dll
            • Size 4.5MB
            • SHA256 cc947f08b87f4636213211b22328c32d1986d49abc96a619799091fa6a15c851
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vk_swiftshader_icd.json
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\vk_swiftshader_icd.json
            • Size 106B
            • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            vulkan-1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\7z-out\vulkan-1.dll
            • Size 707KB
            • SHA256 26460b9250e904a9db6e5e0893e746a84ffae21c02e083e3f33a913d7cc79111
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StdUtils.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\StdUtils.dll
            • Size 100KB
            • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\System.dll
            • Size 12KB
            • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsis7z.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsx3B7A.tmp\nsis7z.dll
            • Size 424KB
            • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            default.exc
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
            • Size 2B
            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
            • MD5 SHA1 SHA512
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Roaming\Nightcord Installer\Network Persistent State
            • Size 175B
            • SHA256 bd367325bb3c469e1aa6dcff50b6296b9b8d5bf5bed538f01f36c29b0603511a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State~RFe5a7706.TMP
            • Path C:\Users\Admin\AppData\Roaming\Nightcord Installer\Network Persistent State~RFe5a7706.TMP
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1720-432-0x00007FFB3D870000-0x00007FFB3D871000-memory.dmp
            Download

            memory/4960-516-0x0000026802E20000-0x0000026802F20000-memory.dmp
            Download

            memory/4960-534-0x0000026802B80000-0x0000026802BA0000-memory.dmp
            Download

            memory/4960-514-0x0000026802940000-0x0000026802960000-memory.dmp
            Download

            memory/4960-497-0x00000268001E0000-0x00000268002E0000-memory.dmp
            Download

            memory/4960-548-0x0000026804260000-0x0000026804280000-memory.dmp
            Download