Overview

overview

8

Static

static

3

AssetFlow-...64.exe

windows10-2004-x64

7

AssetFlow-...64.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-ltsc_2024-x64

3

AssetFlow.exe

windows10-2004-x64

7

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

4

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

locales/mr.ps1

windows10-2004-x64

3

locales/mr.ps1

windows11-ltsc_2024-x64

3

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-ltsc_2024-x64

3

resources/...er.bat

windows10-2004-x64

1

resources/...er.bat

windows11-ltsc_2024-x64

1

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-ltsc_2024-x64

8

$R0/Uninst...ow.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 13:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AssetFlow-1.2.3-x64.exe
  • Size 83.1MB
  • Sample260629-qmp49set7s
  • SHA256 e0f0380d86199c8273402c0349373f0551c589f4a8e968a776d5eef802cef583
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 16 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AssetFlow-1.2.3-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\AssetFlow-1.2.3-x64.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq AssetFlow.exe" /FO csv | "C:\Windows\system32\find.exe" "AssetFlow.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq AssetFlow.exe" /FO csv
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5688
      • C:\Windows\SysWOW64\find.exe
        "C:\Windows\system32\find.exe" "AssetFlow.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3852
  • C:\Users\Admin\AppData\Local\Programs\AssetFlow\AssetFlow.exe
    "C:\Users\Admin\AppData\Local\Programs\AssetFlow\AssetFlow.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:720
    • C:\Users\Admin\AppData\Local\Programs\AssetFlow\AssetFlow.exe
      "C:\Users\Admin\AppData\Local\Programs\AssetFlow\AssetFlow.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\assetflow" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1724,i,3146867234309626872,2318067184820621973,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1832
    • C:\Users\Admin\AppData\Local\Programs\AssetFlow\AssetFlow.exe
      "C:\Users\Admin\AppData\Local\Programs\AssetFlow\AssetFlow.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\assetflow" --field-trial-handle=1724,i,3146867234309626872,2318067184820621973,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:11
      2⤵
      • Executes dropped EXE
      PID:4576
    • C:\Users\Admin\AppData\Local\Programs\AssetFlow\AssetFlow.exe
      "C:\Users\Admin\AppData\Local\Programs\AssetFlow\AssetFlow.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\assetflow" --app-path="C:\Users\Admin\AppData\Local\Programs\AssetFlow\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1724,i,3146867234309626872,2318067184820621973,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1356
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1920
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4496
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1244

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        168e5ab6-be0a-4532-84c4-1d9149e6413c.tmp.ico
        • Path C:\Users\Admin\AppData\Local\Temp\168e5ab6-be0a-4532-84c4-1d9149e6413c.tmp.ico
        • Size 200KB
        • SHA256 e0df859379c62bb9f9ab5610b1796861b08fff63eb954e7986dbf0c65ed5a5c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LICENSE.electron.txt
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LICENSES.chromium.html
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\LICENSES.chromium.html
        • Size 11.7MB
        • SHA256 5d67aba37acc9e0e0a88546d940ed23f29ea3441aac7dd06dcc08a1b1c93b0a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_100_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\chrome_100_percent.pak
        • Size 144KB
        • SHA256 6ce0ccf6a0cc4ea8be11262d168a344bc3ee78a4a6365d755ffb5570bc48d6d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_200_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\chrome_200_percent.pak
        • Size 215KB
        • SHA256 68e92cde2557d68eddcf8df21ce4d1ef7a85581fb28cd5ab93db20812217e073
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dcompiler_47.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.7MB
        • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffmpeg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\ffmpeg.dll
        • Size 2.9MB
        • SHA256 99fbd8bd11696e24479d22e29b490c7e96c7d9875ab4392ff12307ddfb5a9503
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\icudtl.dat
        • Size 10.0MB
        • SHA256 a9f6072e858ea29cb66501847856d403c862f23d03cac2656d1e0fa2865fdc7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libEGL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\libEGL.dll
        • Size 481KB
        • SHA256 e55fb10fb929b28446583ebc5afa89fc647bafc2eebf3b12e6a0adf91a7bb202
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libGLESv2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\libGLESv2.dll
        • Size 7.6MB
        • SHA256 2289eb00380b7f143d81df224d5bb412dec9b5eb6002b5213518e295ae8256b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        af.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\af.pak
        • Size 536KB
        • SHA256 842fa605183eb7cb2764af9ef34eade4a6dbf59ffa726b240a799ec4f829cacd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        am.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\am.pak
        • Size 868KB
        • SHA256 ecbadbf260e62099e6140327f0acb40d79ac010676d48f4fd557085f6668f43d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ar.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\ar.pak
        • Size 954KB
        • SHA256 eb80f7d9b8ef4895f4b122616ae97ec63a5123b37ae68d68ecb5f332095ec2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bg.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\bg.pak
        • Size 991KB
        • SHA256 12b755ee6a50f30b327980e59d086e9f178c6e1bccd0c2bf387696e2c538a5b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bn.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\bn.pak
        • Size 1.2MB
        • SHA256 43a0c8bf652288c7a1efaf19926d25275507fa03e9134cfe5e3a580e8e7cd203
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ca.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\ca.pak
        • Size 602KB
        • SHA256 5a03f4f7ba62998eabf8ccdbd55a49b06398bf5f7aa3eb3f0ae26cfe8a65c31f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cs.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\cs.pak
        • Size 622KB
        • SHA256 0a11d902fcf7f082ea6d602cba67d2befcc639de500c5fef56a7055a0b444a9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        da.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\da.pak
        • Size 562KB
        • SHA256 1145dc560e49c746fd7466f064b1dcd1ec25d22b4b38a13261174aad5505caf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        de.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\de.pak
        • Size 601KB
        • SHA256 3695fb21a7d356c5dbaf7f8393d3e53554e4c19c2979358c0e59411fac67a5e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        el.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\el.pak
        • Size 1.1MB
        • SHA256 55a09ed6d1bd58e73161450c828ac59cf86162a9cd18f83b246fb19ffa50e83c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-GB.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\en-GB.pak
        • Size 487KB
        • SHA256 dedf16f15baa50b05832c27d1f9d030c60bcefac7e4a8cdb30df20fda4e39a7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\en-US.pak
        • Size 492KB
        • SHA256 cc7d18d3a6606b645ede826de9417c961d6ebb815f7250bad3a930da89dcd3a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        es-419.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\es-419.pak
        • Size 593KB
        • SHA256 ab6f9a95d333e5bb14d5420e49c5636703d8fc965212cb748e2522505b6bec91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        es.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\es.pak
        • Size 592KB
        • SHA256 590238a02b3cc14b05aaf21d5285035b45ff55575dd533264461e5170583cead
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        et.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\et.pak
        • Size 539KB
        • SHA256 605996ff0c8a43f772dc64274ab309c4313ced4e8c936f82bcd797b54cb5c6e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fa.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\fa.pak
        • Size 885KB
        • SHA256 8dd8cb4a8fdcd5833f73ef7947649ec24ed0538b3d5f079d82cf441cf955d6b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\fi.pak
        • Size 550KB
        • SHA256 1517fe8463e2bfb502e01667d7f9ed0027369f5b976b1e0a38feefe82caa2c7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fil.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\fil.pak
        • Size 623KB
        • SHA256 b87306fed8f471279c134d460581ecc13d17b533c184be7c1241d6bcf74d32e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\fr.pak
        • Size 642KB
        • SHA256 2ae85ac2b90ebaabe034b979ffb53c50f3dbe2fa9bd7420d370839da5538cef7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gu.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\gu.pak
        • Size 1.2MB
        • SHA256 8da2aef78a775083f19573a14e0861a96a8990866920b3dd4b1aa4d43552159a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        he.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\he.pak
        • Size 777KB
        • SHA256 4948fa44871e8ed5a0ed2d553f4dd698548b60618b55619239045181a8ec519e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\hi.pak
        • Size 1.3MB
        • SHA256 8ddded9b2dea1787367869152f2b27f93556ec515f7da6f361a73ac61fdcb73a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\hr.pak
        • Size 599KB
        • SHA256 9a7a1dea1bd0bf594acbc356ddac9fb64d993fa96f5d3cc1f38f9486abc888bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hu.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\hu.pak
        • Size 645KB
        • SHA256 8e00a8562e32713abf7c99fb9543f65505f8f6d0509ad6b6b7607896f689e2e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        id.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\id.pak
        • Size 532KB
        • SHA256 6d46b40dea9ba42a9ca6dda6e7ff81a3dbcd86b61fb2d7a5fe946d06bdce5d30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        it.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\it.pak
        • Size 585KB
        • SHA256 e5fb1e10e15d55c42cdd937e133a9725739259157b1b3f134333cad7110e5978
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ja.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\ja.pak
        • Size 712KB
        • SHA256 91461c3b4a426688b16926d3279a44590cab75d65d797b6fd2567e0ec5cde60e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kn.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\kn.pak
        • Size 1.4MB
        • SHA256 81a6a8d7f817bb6fbccfdf8d73f1229cd3bf74aeec0a64373a853e8bff744e8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ko.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\ko.pak
        • Size 602KB
        • SHA256 67f8b13860dfc28eb3ee150750fab39c0b41e8638f06920f240f434ce08ec753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lt.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\lt.pak
        • Size 650KB
        • SHA256 bae83903640041b5f949398d7af1975d67070467c4925950c7a838edd73ed956
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lv.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\lv.pak
        • Size 648KB
        • SHA256 229b518ee95bc1960be7e72c8af33633fc8b9a32ee09900ae6d64b771c40d359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ml.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\ml.pak
        • Size 1.5MB
        • SHA256 a973e6ce2c5cbba8f41e54d9aecef31bdabb070bf06e470afce1c4ed263be671
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\mr.pak
        • Size 1.2MB
        • SHA256 0eae188c9a81bd3257a21dc28448b5e9e5c3f4f4de4dc8e178e7f13cab06d6f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ms.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\ms.pak
        • Size 558KB
        • SHA256 185a275d0fb6263471ca1844c8df7fe91d2e98b209379b4a7ec18981ae642c53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nb.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\nb.pak
        • Size 539KB
        • SHA256 bc11695694983516a9806eaef25e380a5d705c2c8e91324192a0983a50d1291e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\nl.pak
        • Size 560KB
        • SHA256 124b702f9f31eb34f307cae79074812873307f36c9a72f53696567a26ea13ba8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\pl.pak
        • Size 622KB
        • SHA256 55d1f22dcb6fdea4f641984a386b3497cf6d29fdb4c069d1e906efa4404d9550
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pt-BR.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\pt-BR.pak
        • Size 584KB
        • SHA256 8ab2fce26c0612520d152147637929c23a979ef059ef37757ac6988a9fdd26e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pt-PT.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\pt-PT.pak
        • Size 589KB
        • SHA256 56974d3f5c4c614fed58eae2b3889898a79b4cd6a13b3468c4f370e2c09470a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ro.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\ro.pak
        • Size 610KB
        • SHA256 309118023eacfe9aeb3405f2606a323982e75b1e33887e85be9235fc2ceeae5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ru.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\ru.pak
        • Size 1006KB
        • SHA256 e042ce451d72fc1e2fa10a66fbc0490a4d9fdbc34caad64d06307d787ff5ced0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sk.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\sk.pak
        • Size 633KB
        • SHA256 aed563cc711b2b65d4734eb6c21aca2fe5fe4411b47681b31af8996245adadf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\sl.pak
        • Size 606KB
        • SHA256 495125af6d3cdc85bb24ea4a211ea808208d19ce7af8dbea44e1e9317e91bd5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\sr.pak
        • Size 935KB
        • SHA256 9d98eefbf8d84ad054f58a286b4891d51ae8da99f82047a09886e4b661db13d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sv.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\sv.pak
        • Size 543KB
        • SHA256 e663b723c4dec60526182c70c943c9caa4976de09831ded69d59c9fe4114283e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sw.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\sw.pak
        • Size 574KB
        • SHA256 c83bb0238ca67b1137dd73e2ccdbfdbc3c2312d8c95aa2636940cc7dfac13cf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ta.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\ta.pak
        • Size 1.5MB
        • SHA256 b76188eff81ffd0a0d9ea7e547eff7bc05069baecd650e1c1e11aa707b40e99c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        te.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\te.pak
        • Size 1.3MB
        • SHA256 471e766e6647e4315c45b15f702dfb2a8253ce91044e141034ce37ca9e0ede68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        th.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\th.pak
        • Size 1.1MB
        • SHA256 010ec4d2cf97d45ed2a1934372fa389e49dc32567a97946162271af1c3a6e7e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\tr.pak
        • Size 584KB
        • SHA256 801df6a4a8d52b1ebb99da0ea788d933804643cca2bf8bbc46064eb6016e17b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uk.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\uk.pak
        • Size 1009KB
        • SHA256 aa204656b9efbad5069943054f70fc0a6fc1e9f660b4bc59bcfa90cde3c3b0fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ur.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\ur.pak
        • Size 879KB
        • SHA256 b26fa64bc9d26991d7c2f1d20934e3dbd467d64096053887cde9ce99d7d0456c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\vi.pak
        • Size 693KB
        • SHA256 06b752bff885c13260adf91b51d56d3ef5048ea0058f69bb24a1db3b45bfa969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zh-CN.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\zh-CN.pak
        • Size 498KB
        • SHA256 82717aa331b1ab869046cd691ddc9589882a34715a2522577313f0864acd083b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zh-TW.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\locales\zh-TW.pak
        • Size 492KB
        • SHA256 61709875e1ede0ecc2582a282896ef6398b0c2f4fec07cfabc68c696ba6dd35a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resources.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\resources.pak
        • Size 5.7MB
        • SHA256 4d22a8976b3e6d5bca66d59cc24f1d2db6df2163f12f9624bc07c5846adfbab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app-update.yml
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\resources\app-update.yml
        • Size 94B
        • SHA256 039fb815188665637b1a0dc431fe18cead39ca24d656ffcdd4a9079b80dcd245
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        app.asar
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\resources\app.asar
        • Size 5.7MB
        • SHA256 e587ad95141789b345de1ec4c9f8cbb1d2da6361cdb0b3bf70e8c56842be5726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevate.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AssetReuploader.server.lua
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\resources\plugin\AssetReuploader.server.lua
        • Size 16KB
        • SHA256 271b86dd3b3e25bddd5b57b3b8994b1e45d3b8a4b5eaf9f6cf4c60bb6b613ea3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snapshot_blob.bin
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\snapshot_blob.bin
        • Size 324KB
        • SHA256 69d9b2ecbc649fed6c41ca18e94f3a36b6770ff7038e9a0d07ae1ab824d9f7fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        v8_context_snapshot.bin
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\v8_context_snapshot.bin
        • Size 685KB
        • SHA256 462919f1b49c9e913042f9e9a738e9510884d5920a426a8a5f1b188e28c4da91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vk_swiftshader.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\vk_swiftshader.dll
        • Size 5.3MB
        • SHA256 bdf28efb95d1618e211aafafd2060df77ad53b98af8db685379f88aa852c0e00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vk_swiftshader_icd.json
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vulkan-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\7z-out\vulkan-1.dll
        • Size 882KB
        • SHA256 2f0ae7c191a962a49abe65c8c5c056262de5e2108e1f341b105844034153915f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StdUtils.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UAC.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\UAC.dll
        • Size 14KB
        • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WinShell.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\WinShell.dll
        • Size 3KB
        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsDialogs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\nsExec.dll
        • Size 6KB
        • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsis7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyCCB3.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default.exc
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512
        Submit Download

        AssetFlow.lnk
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AssetFlow.lnk
        • Size 2KB
        • SHA256 ef0dffdf991a95f9a7f9f77901974c91935dea58cdf8519076370235988633b6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Network Persistent State
        • Path C:\Users\Admin\AppData\Roaming\assetflow\Network\Network Persistent State
        • Size 828B
        • SHA256 ee2612b25fc96141e85e609eb51fc149cb91d98123a22d82ec3a8f032faf6ff2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Network Persistent State~RF66cc6.TMP
        • Path C:\Users\Admin\AppData\Roaming\assetflow\Network\Network Persistent State~RF66cc6.TMP
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Preferences
        • Path C:\Users\Admin\AppData\Roaming\assetflow\Preferences
        • Size 57B
        • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Preferences~RF58d82.TMP
        • Path C:\Users\Admin\AppData\Roaming\assetflow\Preferences~RF58d82.TMP
        • Size 86B
        • SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CURRENT
        • Path C:\Users\Admin\AppData\Roaming\assetflow\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        AssetFlow.lnk
        • Path C:\Users\Admin\Desktop\AssetFlow.lnk
        • Size 2KB
        • SHA256 74825123a47fbf097a59aacdf496fc6f4007021701d2586224dd31ae40e2fa3d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1244-646-0x0000017481FD0000-0x0000017481FF0000-memory.dmp
        Download

        memory/1244-681-0x0000017494790000-0x00000174947B0000-memory.dmp
        Download

        memory/1244-656-0x0000017484210000-0x0000017484230000-memory.dmp
        Download

        memory/1244-648-0x0000017494410000-0x0000017494510000-memory.dmp
        Download

        memory/1244-635-0x00000174801E0000-0x00000174802E0000-memory.dmp
        Download

        memory/1356-599-0x0000026B10DA0000-0x0000026B11496000-memory.dmp
        Download

        memory/1356-473-0x00007FFCD40C0000-0x00007FFCD40C1000-memory.dmp
        Download

        memory/1356-472-0x00007FFCD4540000-0x00007FFCD4541000-memory.dmp
        Download

        memory/1920-799-0x0000000008020000-0x0000000008084000-memory.dmp
        Download

        memory/1920-800-0x000000000DC50000-0x000000000DCA0000-memory.dmp
        Download