Overview

overview

8

Static

static

3

AzraielLox....2.exe

windows10-2004-x64

7

AzraielLox....2.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-ltsc_2024-x64

4

$PLUGINSDIR/app-64.7z

windows10-2004-x64

1

$PLUGINSDIR/app-64.7z

windows11-ltsc_2024-x64

1

LICENSE.electron.txt

windows10-2004-x64

1

LICENSE.electron.txt

windows11-ltsc_2024-x64

1

chrome_100...nt.pak

windows10-2004-x64

3

chrome_100...nt.pak

windows11-ltsc_2024-x64

4

chrome_200...nt.pak

windows10-2004-x64

3

chrome_200...nt.pak

windows11-ltsc_2024-x64

3

icudtl.dat

windows10-2004-x64

3

icudtl.dat

windows11-ltsc_2024-x64

3

locales/af.pak

windows10-2004-x64

3

locales/af.pak

windows11-ltsc_2024-x64

3

locales/am.pak

windows10-2004-x64

3

locales/am.pak

windows11-ltsc_2024-x64

3

locales/ar.pak

windows10-2004-x64

3

locales/ar.pak

windows11-ltsc_2024-x64

3

locales/bg.pak

windows10-2004-x64

3

locales/bg.pak

windows11-ltsc_2024-x64

3

locales/bn.pak

windows10-2004-x64

3

locales/bn.pak

windows11-ltsc_2024-x64

3

locales/ca.pak

windows10-2004-x64

3

locales/ca.pak

windows11-ltsc_2024-x64

4

Resubmissions

24/06/2026, 23:02

260624-21dh6sgs318

24/06/2026, 22:25

260624-2b89jsf16l8

Analysis

  • user interaction
    yes
  • max time kernel
    601s
  • max time network
    485s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/06/2026, 22:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AzraielLox-Premium-Setup-1.0.2.exe
  • Size 106.9MB
  • Sample260624-2b89jsf16l
  • SHA256 9fef1d1c7e7a78dd5212ec8947a2d290acece807decc3c8db23183b52c559afa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 39 IoCs
  • Loads dropped DLL 58 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Windows directory 6 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\AzraielLox-Premium-Setup-1.0.2.exe
    "C:\Users\Admin\AppData\Local\Temp\AzraielLox-Premium-Setup-1.0.2.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1464
  • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
    "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
      "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3520
    • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
      "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --field-trial-handle=2468,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:11
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1984
    • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
      "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2628,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1880
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "certutil -addstore -f "Root" "C:\Users\Admin\AppData\Roaming\azraiellox-premium\certs\rootCA.crt""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5740
      • C:\Windows\system32\certutil.exe
        certutil -addstore -f "Root" "C:\Users\Admin\AppData\Roaming\azraiellox-premium\certs\rootCA.crt"
        3⤵
          PID:1004
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "schtasks /Query /TN "AzraielLoxPcChildAppElevated""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4460
        • C:\Windows\system32\schtasks.exe
          schtasks /Query /TN "AzraielLoxPcChildAppElevated"
          3⤵
            PID:4804
        • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
          "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3640,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3836
        • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
          "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2992,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5568
        • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
          "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --field-trial-handle=3548,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:12
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1676
        • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
          "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3956,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4732
        • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
          "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4100,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5952
        • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
          "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3768,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:10
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:3416
        • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
          "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1100,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2692
        • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
          "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1872,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4152
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\az_apps_2724_1782340710508_hcw4dj.ps1""
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2368
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\az_apps_2724_1782340710508_hcw4dj.ps1"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4908
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u01dskwb\u01dskwb.cmdline"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3376
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2A53.tmp" "c:\Users\Admin\AppData\Local\Temp\u01dskwb\CSCCFBA63348428443F805841DAF8F17760.TMP"
                5⤵
                  PID:5532
          • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
            "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3464,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=944 /prefetch:1
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3992
          • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
            "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4264,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:1
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:568
          • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
            "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4376,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3980
          • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
            "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1744,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2840
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command 'Add-Type -AssemblyName System.Windows.Forms; Start-Sleep -Milliseconds 200; [System.Windows.Forms.SendKeys]::SendWait(''don''''t leave'')'"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2512
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -WindowStyle Hidden -Command 'Add-Type -AssemblyName System.Windows.Forms; Start-Sleep -Milliseconds 200; [System.Windows.Forms.SendKeys]::SendWait(''don''''t leave'')'
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5996
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -Command "(New-Object -ComObject Shell.Application).MinimizeAll()""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5704
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "(New-Object -ComObject Shell.Application).MinimizeAll()"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5972
          • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
            "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4400,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4468
          • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
            "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4292,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1068
          • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
            "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4608,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4024
          • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
            "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4372,i,10379338476329287197,5829718460738139350,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4840
        • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
          "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2416
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "schtasks /Query /TN "AzraielLoxPcChildAppElevated""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1920
            • C:\Windows\System32\schtasks.exe
              schtasks /Query /TN "AzraielLoxPcChildAppElevated"
              3⤵
                PID:6032
            • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
              "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1800,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4828
            • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
              "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --field-trial-handle=2912,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:11
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4144
            • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
              "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2956,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:1
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2428
            • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
              "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4400
            • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
              "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --field-trial-handle=3200,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:12
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2120
            • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
              "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3360,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1528
            • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
              "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3568,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:5168
            • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
              "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3516,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2348
            • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
              "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2988,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:10
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              PID:5116
            • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
              "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2776,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:1
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:5944
            • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
              "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3672,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:1
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:5544
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\az_apps_2416_1782340713026_r5g623.ps1""
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1940
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\az_apps_2416_1782340713026_r5g623.ps1"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3280
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z4yomnic\z4yomnic.cmdline"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5804
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2998.tmp" "c:\Users\Admin\AppData\Local\Temp\z4yomnic\CSC32EDAEEC73D459DA3742316ACA28A36.TMP"
                    5⤵
                      PID:3668
              • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
                "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3624,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:1
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:3820
              • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
                "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1136,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:4016
              • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
                "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3676,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1496 /prefetch:1
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1068
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command 'Add-Type -AssemblyName System.Windows.Forms; Start-Sleep -Milliseconds 200; [System.Windows.Forms.SendKeys]::SendWait(''hello'')'"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4636
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -WindowStyle Hidden -Command 'Add-Type -AssemblyName System.Windows.Forms; Start-Sleep -Milliseconds 200; [System.Windows.Forms.SendKeys]::SendWait(''hello'')'
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3992
              • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
                "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3792,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:5624
              • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
                "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3680,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=976 /prefetch:1
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2700
              • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
                "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3736,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1488
              • C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe
                "C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\AzraielLox Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\azraiellox-premium" --app-user-model-id="electron.app.AzraielLox Premium" --app-path="C:\Users\Admin\AppData\Local\Programs\azraiellox-premium\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3744,i,10631805453562943010,12266292197835707708,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:3840
            • C:\Windows\System32\oobe\UserOOBEBroker.exe
              C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
              1⤵
              • Drops file in Windows directory
              PID:3864
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
              C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
              1⤵
              • System Location Discovery: System Language Discovery
              PID:3264

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  1
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Defense Evasion

                  Modify Registry

                  1
                  T1112

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  1
                  T1552

                  Credentials In Files

                  1
                  T1552.001

                  Discovery

                  Browser Information Discovery

                  1
                  T1217

                  Query Registry

                  2
                  T1012

                  System Information Discovery

                  1
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Lateral Movement

                  Collection

                  Data from Local System

                  1
                  T1005

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  __PSScriptPolicyTest_ur2ohr1z.s2a.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ur2ohr1z.s2a.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  f8aa7d46-a747-428d-980e-d0f14a88582e.tmp.ico
                  • Path C:\Users\Admin\AppData\Local\Temp\f8aa7d46-a747-428d-980e-d0f14a88582e.tmp.ico
                  • Size 264KB
                  • SHA256 92cea0a0ab48e2aa72217b13a4407d920689ab6e914670f69d24d08a9f6bbe46
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  LICENSE.electron.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\LICENSE.electron.txt
                  • Size 1KB
                  • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  LICENSES.chromium.html
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\LICENSES.chromium.html
                  • Size 9.0MB
                  • SHA256 dc2878d9bf6ef5fca45737536272a7a1877e0c6f89cb9578cb0f956781102986
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_100_percent.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\chrome_100_percent.pak
                  • Size 148KB
                  • SHA256 7dd5485def22a53c0635efdf8ae900f147ec8c8a22b9ed71c24668075dd605d3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_200_percent.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\chrome_200_percent.pak
                  • Size 223KB
                  • SHA256 2408969599d3953aae2fb36008e4d0711e30d0bc86fb4d03f8b0577d43c649fa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  d3dcompiler_47.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\d3dcompiler_47.dll
                  • Size 4.7MB
                  • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ffmpeg.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\ffmpeg.dll
                  • Size 2.6MB
                  • SHA256 113ccc8e701157d0d59283baa5dc1fd3b0eae2571fd825084d7a4d58697a5ec2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icudtl.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\icudtl.dat
                  • Size 10.0MB
                  • SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libEGL.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\libEGL.dll
                  • Size 470KB
                  • SHA256 01b8a8c2875ecb9979de339500ce0e0b7ecc3c5387053ce27bea51e6a09e2d72
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libGLESv2.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\libGLESv2.dll
                  • Size 7.7MB
                  • SHA256 fb6ea924fbb9417e4695ce414cdcbc299f13451dbedd2d9adb55479bf1cbf57f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  af.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\af.pak
                  • Size 494KB
                  • SHA256 e2470090a09ca500679e68bb5e3b1acc35a5873fea4f93af25a23c82122f2c13
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  am.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\am.pak
                  • Size 800KB
                  • SHA256 4e15946e86a578eeff41feda808bb291d81e240fbdfc96cbe2efe692ad35eef5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ar.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\ar.pak
                  • Size 874KB
                  • SHA256 5cc02570e5f61cbca791309985df3a29584e41583b3344f1d9fb6b04ce423e6f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bg.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\bg.pak
                  • Size 913KB
                  • SHA256 97ef7984074775282b68dca5d5a469efdb2b22474ee6669fdfb5197d3f1b3768
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bn.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\bn.pak
                  • Size 1.1MB
                  • SHA256 1aba82aee8c985e5e370e7cf2b35c9ec20cbe5174db5fcb54ec7d19ec5d79587
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ca.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\ca.pak
                  • Size 556KB
                  • SHA256 b3d5dfae25427596b1f14a8e13d6bcb58532c82554229c2367779ff5c42b28bb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cs.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\cs.pak
                  • Size 572KB
                  • SHA256 7d7b701ce510b2e4a18e957e500086db590aad8bf5acd37f82263a676f0b556c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  da.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\da.pak
                  • Size 518KB
                  • SHA256 3430c0f1946901dfa24190ca3989f72171ec564bc7c523853e6a1f531b61b5ee
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  de.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\de.pak
                  • Size 553KB
                  • SHA256 662496eff49febbe49f0a03cf2c51acaa743cb2237de3c41014556e16f3d8e2b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  el.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\el.pak
                  • Size 1001KB
                  • SHA256 162e51bc7d682e223e498f4ff8c81f019d136d857bd25a1c982d4a1084a8c840
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  en-GB.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\en-GB.pak
                  • Size 450KB
                  • SHA256 7df934906a61c0ae7a952f9ed058f4a06cd3989663a7d9f50afc3c9f830135bb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  en-US.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\en-US.pak
                  • Size 454KB
                  • SHA256 41123d72bd8e289e85bd35227aabb4cc61fe1de02b5cd7a7834e5ec200bc2078
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  es-419.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\es-419.pak
                  • Size 547KB
                  • SHA256 ec922f8ca16b7e7642fc73369ba7b75ec950cafb1dcadc6c88426c034382d483
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  es.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\es.pak
                  • Size 547KB
                  • SHA256 0385e6776de5a0d8a3b30b7bad44308ac4cb04e2bcebd573d3c7938b68036573
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  et.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\et.pak
                  • Size 497KB
                  • SHA256 ba4ec85d2306a1f1f178a017fef4d340b77b33e10bbee07bd359a8e0ff8ea461
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fa.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\fa.pak
                  • Size 813KB
                  • SHA256 f1a7351bf0d8cad475d2761b9edf970c3098836e38aa98106a5e04a41002b7c8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fi.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\fi.pak
                  • Size 508KB
                  • SHA256 11b0b9b0f74d01f16db7aa49be9dceeb55fde9da56f17419c4bca159cdcae274
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fil.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\fil.pak
                  • Size 573KB
                  • SHA256 d7fdc7fd08dcc421bc8aaae3fdc72599c60a3b96f05989a3e46736f0de06e745
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\fr.pak
                  • Size 591KB
                  • SHA256 1f6cc56e04bcbd6b6ecbe500bcb0a5702551ec80d79e624642d0c7d9758d4424
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gu.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\gu.pak
                  • Size 1.1MB
                  • SHA256 087e99953eef9b5fd736e3dbd98d702fdb01dc614593a4c575cb619159688118
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  he.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\he.pak
                  • Size 713KB
                  • SHA256 20b1c80f8b2bd5130a1fb372814fb9c9ceac15305da3da0cb29923960a94a934
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  hi.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\hi.pak
                  • Size 1.2MB
                  • SHA256 9c6d8d93278a6e375405142df9829adefbcc8ae9797a4f589591b9784b2b71c8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  hr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\hr.pak
                  • Size 551KB
                  • SHA256 afed35643df24709c8c5cc9b8158b3d9a2266fbfeed132e98ff254ced4086c5f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  hu.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\hu.pak
                  • Size 595KB
                  • SHA256 b4e6a1135de8bdc42c04f4db4eb1ce48256f18eb46a5146a21010b6165a90e7a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  id.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\id.pak
                  • Size 490KB
                  • SHA256 a21f9474a19fe2d7f26c59f5ba8d6e72801a8a057b7dbcb8b3f96471043d9059
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  it.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\it.pak
                  • Size 539KB
                  • SHA256 33652aae78a486dc3ce4e5affd1b7f72e1248f6f9f3e62188afe3b5d73bd148e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ja.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\ja.pak
                  • Size 659KB
                  • SHA256 c5692ca739c31569ae2431fd58f1028e6c8c01af278b76656ee0bb65b79e9985
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  kn.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\kn.pak
                  • Size 1.3MB
                  • SHA256 a6ecf1dfe4d99f6ba0926c696b5b23b77d234fa8fd03da9825b074ecc640d508
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ko.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\ko.pak
                  • Size 557KB
                  • SHA256 3fa72d61a997c36f9c093f769f4bba60b290d1fbcb71d5544f85e8e1efe51d07
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  lt.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\lt.pak
                  • Size 597KB
                  • SHA256 a1257d10e673311747363e6929832e70f36668b1fc0d6a5ddd550fe88007aa58
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  lv.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\lv.pak
                  • Size 596KB
                  • SHA256 33fdf706f6d3f06b485c5115a7c73a571296dac41c582fc9d0dbb371d86e8653
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ml.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\ml.pak
                  • Size 1.3MB
                  • SHA256 87384db1ddcac012b0b40ec89daf47ebbbcf1497705f023a6983fb2470e4abd6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  mr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\mr.pak
                  • Size 1.1MB
                  • SHA256 039f4e0176c38867fef57482825d043fa63bf1356c85eab0fc665f118db125e4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ms.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\ms.pak
                  • Size 514KB
                  • SHA256 2f0c83b5b3bff8f624d78e0670a31c509e7f1d5330f72aaede471b2e97c956e2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\nb.pak
                  • Size 499KB
                  • SHA256 887a0278971d6ba61e2f24c62029a3087a46c4962c4357412c28ede12ed6da15
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nl.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\nl.pak
                  • Size 516KB
                  • SHA256 619c61701b3a142733d23ad8c7117bc013867a842d3d1d572faa56895ad8257e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pl.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\pl.pak
                  • Size 574KB
                  • SHA256 f2a7dcb69a433c2a898866c555b82c26e3515c089f500e7748b9b11ec3047786
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pt-BR.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\pt-BR.pak
                  • Size 540KB
                  • SHA256 5ff219be32f9178fee40e8966ac5deff2be1f2ff259a66cb9cdce81c2e90a7e8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pt-PT.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\pt-PT.pak
                  • Size 543KB
                  • SHA256 02ea290fac25b414a1d4ed78cdc159cf6c73fe5350824c2f36f032e426a23364
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ro.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\ro.pak
                  • Size 562KB
                  • SHA256 655c175903a791d0ff56264a487c53f7bd09ed037cf04cfa6e79eb8be5b677e9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ru.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\ru.pak
                  • Size 924KB
                  • SHA256 4babe5f20caafca33867ee263aa9dd55ed271704a062e4372fdd133eb359a558
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sk.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\sk.pak
                  • Size 580KB
                  • SHA256 89f984a67cea3997c704005fbfbacd3f6f5652248626945c2ab1c3bcf24e6623
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sl.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\sl.pak
                  • Size 556KB
                  • SHA256 458b15bf249c1e6fe9843725c42443274ef6e09dcb15f5288c916c0561aefc47
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\sr.pak
                  • Size 859KB
                  • SHA256 4cea4c83b5e887463dadbf470a9953b8175149f31fd07b83406a6fc59acfde41
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sv.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\sv.pak
                  • Size 501KB
                  • SHA256 105460cb717104d82f99cf8c5e2c51ff252211a605bd1c98bf75981f100d619e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sw.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\sw.pak
                  • Size 529KB
                  • SHA256 f0fccf2e3ad332846736d816e254028569f5f84918573872442987a8bc9bba58
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ta.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\ta.pak
                  • Size 1.3MB
                  • SHA256 1cebac8d758298ed2763e62b9bdfb17351831e691ff3e1ba85252c9a66d66242
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  te.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\te.pak
                  • Size 1.2MB
                  • SHA256 8264244c6de861817f5b19cef282844a18ed8cb7d4e059451489652749fe931e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  th.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\th.pak
                  • Size 1.0MB
                  • SHA256 647ad394e92e7610bd0f6c4e08d28748408fcd5a816a35e4622ea7f71cfa7a9d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\tr.pak
                  • Size 539KB
                  • SHA256 f58ed19be62706fb4fd797a6bfd3af5c6ad4b39aef994a577cd28968fcac0291
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  uk.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\uk.pak
                  • Size 923KB
                  • SHA256 13e40208e2c9f4f4b83dcf422610dc82314a8f99ba50acdbd286c508f92eb232
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ur.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\ur.pak
                  • Size 808KB
                  • SHA256 60310f9a3457fae0395b447a30646211ef4160ba84bd7c36d291af4c8ec2b79a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vi.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\vi.pak
                  • Size 639KB
                  • SHA256 fb9463d5655e73fa69cace9800d95f8cd077ee9284fef3bfe162d2bfe220c257
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  zh-CN.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\zh-CN.pak
                  • Size 460KB
                  • SHA256 f0c0ba53c954325b3bbefb333ba23f7fb40a7a4e506043e9f7886089f611943b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  zh-TW.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\locales\zh-TW.pak
                  • Size 455KB
                  • SHA256 d4033cb3264c7c4cd2636ea2a202421650c449e5bfb10f29949e4c44e91ca93b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\resources.pak
                  • Size 5.3MB
                  • SHA256 a5908171bfbb738ac015e7c9903c838d93359ed12c3b7d86545514dc1f0e9d62
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevate.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\resources\elevate.exe
                  • Size 105KB
                  • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  snapshot_blob.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\snapshot_blob.bin
                  • Size 302KB
                  • SHA256 22a46de643045805a3e588f9a18ebaa377f9fba3dee46b2d60f3ae300a09cc4e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  v8_context_snapshot.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\v8_context_snapshot.bin
                  • Size 646KB
                  • SHA256 a8bd22478c4f85afa836c89d3a7f52c606b17872fbbefce268b499bedede10ae
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\vk_swiftshader.dll
                  • Size 5.2MB
                  • SHA256 7005598f9bb8559101458ddaac77e3a23f9876c0a1aaf7136a11f2d1d5173448
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader_icd.json
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\vk_swiftshader_icd.json
                  • Size 106B
                  • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  vulkan-1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\7z-out\vulkan-1.dll
                  • Size 938KB
                  • SHA256 45adc3dac19684ed3af159ae3914fbbf2426a879e5a4c1e678e3c9b451fab01a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SpiderBanner.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\SpiderBanner.dll
                  • Size 9KB
                  • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  StdUtils.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\StdUtils.dll
                  • Size 100KB
                  • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\System.dll
                  • Size 12KB
                  • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WinShell.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\WinShell.dll
                  • Size 3KB
                  • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  nsExec.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\nsExec.dll
                  • Size 6KB
                  • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nsis7z.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsnFCFA.tmp\nsis7z.dll
                  • Size 424KB
                  • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  default.exc
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                  • Size 2B
                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                  • MD5 SHA1 SHA512
                  Submit Download

                  05e138d2-6adb-480c-9ad5-042fdbd4d943.tmp
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\05e138d2-6adb-480c-9ad5-042fdbd4d943.tmp
                  • Size 86B
                  • SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Cache\Cache_Data\data_0
                  • Size 44KB
                  • SHA256 23859c5f970b11cc7b1e8676576c74ddc8b93bc10194a34098a8cb3fb6d32c81
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Cache\Cache_Data\data_1
                  • Size 264KB
                  • SHA256 544415569bb241b9b022f2601eba5bfc373f9bf48a3c5a2be3387c0d12214b49
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Cache\Cache_Data\data_3
                  • Size 4.0MB
                  • SHA256 56f638460987887b1838c1f33b0ed3421a0bf9665322c187580cf7d21785cfac
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  f_000001
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Cache\Cache_Data\f_000001
                  • Size 39KB
                  • SHA256 2399a44eba77e72f5864f50fb0cbd937d797760fbc58f52044f8f64b8961c232
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  f_000002
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Cache\Cache_Data\f_000002
                  • Size 22KB
                  • SHA256 27b993ef7849006885bebea19956f12c64a839f1b2d0c06f37af5d5bef0545a2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  f_000003
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Cache\Cache_Data\f_000003
                  • Size 109KB
                  • SHA256 3cdd3d186e554353aaea8e0b691e3558fb254c477bd33a5f3dbc6fde1f65f808
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  index
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Cache\Cache_Data\index
                  • Size 256KB
                  • SHA256 25e5f25ace4bf41cb64540804a9293ef9baad898f7d5374449d10cf53e603377
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  index
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Code Cache\js\index
                  • Size 24B
                  • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                  • MD5 SHA1 SHA512
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Code Cache\js\index-dir\the-real-index
                  • Size 48B
                  • SHA256 6b3bef18d41cbec3cae61546064e2d4c67b4f17789b937e44762c915e4c84974
                  • MD5 SHA1 SHA512
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Code Cache\wasm\index-dir\the-real-index
                  • Size 48B
                  • SHA256 22cd622e4c55bc49566023eaaadb63e71a7a920aabe51044cd3d9703f8c3f7ac
                  • MD5 SHA1 SHA512
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\GPUCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\GPUCache\data_1
                  • Size 264KB
                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\GPUCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\GPUCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Local State
                  • Size 434B
                  • SHA256 9bc22cd36c3027f9730f29f06e0d8270b691c5f29d22f258af5127ad0963380c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  5a75fd31-b3eb-4e2d-a7be-ddf714fadc35.tmp
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Network\5a75fd31-b3eb-4e2d-a7be-ddf714fadc35.tmp
                  • Size 59B
                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Cookies
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Network\Cookies
                  • Size 20KB
                  • SHA256 15a22ebbc358370ad3476ba0a0c44f87f548f01d59720d17ff580c534a35e058
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Network\Network Persistent State
                  • Size 495B
                  • SHA256 3d4b8be607ed9ba3ba0b694e022c1d29ad6013223dd0543fc588d9dc96c697dc
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Network\Network Persistent State
                  • Size 495B
                  • SHA256 449afeab7bfe75474fde9a5dee5202d421388de75c2b7b34a1a9d61dda798410
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TransportSecurity
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Network\TransportSecurity
                  • Size 188B
                  • SHA256 2992267045a86eeb4076932dc16041e3ee5784499d6c55851d1f753d8472b30a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Trust Tokens
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Network\Trust Tokens
                  • Size 36KB
                  • SHA256 9e73b896c702a73bc8cc8b2d8f9b8ffa303581802ebb26f95c34793a4cd12fca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Session Storage\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Shared Dictionary\cache\index-dir\the-real-index
                  • Size 48B
                  • SHA256 5406be21f4376d8a7d99c8125582787f8d0185affd7d3127257cc01254f2cdfd
                  • MD5 SHA1 SHA512
                  Submit Download

                  db
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\Shared Dictionary\db
                  • Size 44KB
                  • SHA256 e1ea1994a9c238120944c0009b25c9b75c3b8acb5cc137a78cd4a8450c809130
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  QuotaManager
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\WebStorage\QuotaManager
                  • Size 40KB
                  • SHA256 22e27af96279c27efbb1b5017294ea00beb387ea424641fd523678cbfd3995b1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  rootCA.crt
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\certs\rootCA.crt
                  • Size 1KB
                  • SHA256 5a4f3b8a5144586d7a6d24e17aef8b96668326fa6f8b45f0c146978c11e6ef7b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  rootCA.key
                  • Path C:\Users\Admin\AppData\Roaming\azraiellox-premium\certs\rootCA.key
                  • Size 1KB
                  • SHA256 7a223dc77b2a0b2c518a348b400e674c52c41ecf22aa1178298deca98b86af85
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/3280-798-0x00000201E9920000-0x00000201E9E48000-memory.dmp
                  Download

                  memory/3280-797-0x00000201E9220000-0x00000201E93E2000-memory.dmp
                  Download

                  memory/3280-795-0x00000201E8C50000-0x00000201E8C58000-memory.dmp
                  Download

                  memory/3416-744-0x000001CCB1580000-0x000001CCB1581000-memory.dmp
                  Download

                  memory/3416-745-0x000001CCB1580000-0x000001CCB1581000-memory.dmp
                  Download

                  memory/3416-743-0x000001CCB1580000-0x000001CCB1581000-memory.dmp
                  Download

                  memory/3416-742-0x000001CCB1580000-0x000001CCB1581000-memory.dmp
                  Download

                  memory/3416-741-0x000001CCB1580000-0x000001CCB1581000-memory.dmp
                  Download

                  memory/3416-746-0x000001CCB1580000-0x000001CCB1581000-memory.dmp
                  Download

                  memory/3416-734-0x000001CCB1580000-0x000001CCB1581000-memory.dmp
                  Download

                  memory/3416-732-0x000001CCB1580000-0x000001CCB1581000-memory.dmp
                  Download

                  memory/4732-678-0x00007FFC3DD50000-0x00007FFC3DD51000-memory.dmp
                  Download

                  memory/4732-679-0x00007FFC3EA40000-0x00007FFC3EA41000-memory.dmp
                  Download

                  memory/4908-773-0x000001F7BD440000-0x000001F7BD462000-memory.dmp
                  Download

                  memory/4908-796-0x000001F7BD470000-0x000001F7BD478000-memory.dmp
                  Download