Analysis

  • max time kernel
    24s
  • max time network
    44s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/07/2026, 04:29

General

  • Target
    Arcbound-Setup-1.1.8.exe
  • Size 90.1MB
  • Sample260708-e4js2aay6v
  • SHA256 77ac97fb44f3b3716c35d83afe8dd7c6dab26371c0868cdd16d6d977fa315558
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Arcbound-Setup-1.1.8.exe
    "C:\Users\Admin\AppData\Local\Temp\Arcbound-Setup-1.1.8.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5812
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1508
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\arcbound-launcher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1112
  • C:\Users\Admin\AppData\Local\Programs\arcbound-launcher\Arcbound.exe
    "C:\Users\Admin\AppData\Local\Programs\arcbound-launcher\Arcbound.exe"
    1⤵
      PID:1572

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log

          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 c03c91dd74498cc33a32d616fb3050ad954ed4f57e671e2e9651aedb7b128ff3
          • MD5 SHA1 SHA512 TLSH

          StartupProfileData-NonInteractive

          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 16KB
          • SHA256 03c1fda9d161743bad287a18cf174024747a653285adc803015c6a4d87420c90
          • MD5 SHA1 SHA512 SSDEEP TLSH

          StartupProfileData-NonInteractive

          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 16KB
          • SHA256 04503c583c7adc1ffe619b0980d9346da576babc6a769dd7b6d7c82092a45036
          • MD5 SHA1 SHA512 SSDEEP TLSH

          resources.pak

          • Path C:\Users\Admin\AppData\Local\Programs\arcbound-launcher\resources.pak
          • Size 1.8MB
          • SHA256 3fc4f42218b075e011b0e45d421b721b37e4839535602ec3f69bcf2d9f31817c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          __PSScriptPolicyTest_b4c3h41g.s2k.ps1

          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b4c3h41g.s2k.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH

          LICENSE.electron.txt

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\LICENSE.electron.txt
          • Size 1KB
          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
          • MD5 SHA1 SHA512 TLSH

          LICENSES.chromium.html

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\LICENSES.chromium.html
          • Size 18.6MB
          • SHA256 62e3b53be6bbbb2e7747b7a55c8b4f4a3cf38b95e0fff594737b3bfdac8cf373
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_100_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\chrome_100_percent.pak
          • Size 113KB
          • SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_200_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\chrome_200_percent.pak
          • Size 183KB
          • SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          d3dcompiler_47.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\d3dcompiler_47.dll
          • Size 4.5MB
          • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          dxcompiler.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\dxcompiler.dll
          • Size 24.5MB
          • SHA256 7a743a2af5b4cb59cec8c38e7fb544b87fb6547f215491634a577a03a4e83bd8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          dxil.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\dxil.dll
          • Size 1.4MB
          • SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ffmpeg.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\ffmpeg.dll
          • Size 3.0MB
          • SHA256 e7aec5ca86d80540ea30c5acdf0a13acb34d1d9dd0f9e78b36fb21776b711a1e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icudtl.dat

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\icudtl.dat
          • Size 10.3MB
          • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libEGL.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\libEGL.dll
          • Size 510KB
          • SHA256 6edaea2de8f6bca40dc4cbb60a55be5ae93c2454a66474c3706953b5d1d73e26
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libGLESv2.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\libGLESv2.dll
          • Size 7.6MB
          • SHA256 49c2a50a3a43c10e258eee0d58e81be9d207ebeae206d603314f1ebc36d7567f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          af.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\af.pak
          • Size 595KB
          • SHA256 973c21a2ccc0375a016b1ba0028cc3fb2cfa4e9ab82a52217fdff342ba43fbe5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          am.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\am.pak
          • Size 966KB
          • SHA256 ab591598cac20048c2b7a2d73eb4d1ca9054f9dda153eb51855935e969c7f54d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\ar.pak
          • Size 1.0MB
          • SHA256 dacb642f184b6aa20d062eae55b49101c507d7378d60e53a014a2631c0bb20bd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bg.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\bg.pak
          • Size 1.1MB
          • SHA256 e854a940ef467662ee733bcf5c5aac0f5aef8d006200af173b4f840ab9f6d3ff
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\bn.pak
          • Size 1.4MB
          • SHA256 2465ef35bd984ed78c1a0ffff00713facada7ca0d419104716eafb149187d9f8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ca.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\ca.pak
          • Size 670KB
          • SHA256 7f9a90bc5821548acd42546604c18d525b3b00f87094739ab95b5683d08aa79c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cs.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\cs.pak
          • Size 696KB
          • SHA256 94c119305964dd203e4335ef1676f373d56fad9e27ae6e11987d790b2b3f5a41
          • MD5 SHA1 SHA512 SSDEEP TLSH

          da.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\da.pak
          • Size 626KB
          • SHA256 f097260d271900ebb3a6a68e42e49005d3441026904462c3b306c87e21f2d640
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\de.pak
          • Size 671KB
          • SHA256 1eec5b0a6d7a2888127c1a490d40497e2913460b96c4334815e278bc882802e9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          el.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\el.pak
          • Size 1.2MB
          • SHA256 f9715c939e27d6da75c89866aac6de5fe9f25baef524d85db2fd812750cc43b1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-GB.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\en-GB.pak
          • Size 542KB
          • SHA256 acefd35ede3e9dde3c91880bba726546cfb8e543712b7c7167b53867a0f155e7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-US.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\en-US.pak
          • Size 548KB
          • SHA256 a02518efe75c630a1b5419af5ffdb1b16636b939139bccd7710e37f36ad9d55c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es-419.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\es-419.pak
          • Size 661KB
          • SHA256 818f06880dc921662f0685d8f79d85f76ab7b5490deb7497208f307ba9c6d42e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\es.pak
          • Size 658KB
          • SHA256 5228d6bbac5909cf285aceeac65c042462c6da99b957f03f5c4070763bcba583
          • MD5 SHA1 SHA512 SSDEEP TLSH

          et.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\et.pak
          • Size 601KB
          • SHA256 c7364bca48cec7994e40a3169d465d6af04a66becbadccff24c9fa74d9410cbb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fa.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\fa.pak
          • Size 995KB
          • SHA256 d840449c2aa71835bfaa739156c5ad00c4d0709557e129e4c87ae8ca38c4d960
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\fi.pak
          • Size 612KB
          • SHA256 6b09e983a58aca1a3b4bdfe35f4c8d37a568feda3ed680e14b24395ba04d880c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fil.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\fil.pak
          • Size 694KB
          • SHA256 c5335e3b4468ebafd55fdbe77553a3838bfb6a1fd5a5ed0396598a0e96e7792d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\fr.pak
          • Size 716KB
          • SHA256 06acba3cbd3f4e7cca4fa2103c5d71e8f6de3a7530717b0c72b454bd670be503
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\gu.pak
          • Size 1.4MB
          • SHA256 897b9ed176073cd0e8a39004158a2ad9877bc69f79cf260e029937fc9c556f95
          • MD5 SHA1 SHA512 SSDEEP TLSH

          he.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\he.pak
          • Size 871KB
          • SHA256 b777e7ede2e0ba88186a1a6dcacbcc918e7983c2027922f92994f937a1f0327e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\hi.pak
          • Size 1.5MB
          • SHA256 966845384bd7213dd03e87a80655cdcb2bb02d180e778fa0583e86edcdba73cc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\hr.pak
          • Size 670KB
          • SHA256 30d7259b46052fa6735cab8a6d4cba682df021e68998a4b3723248a5b806eacd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\hu.pak
          • Size 717KB
          • SHA256 3bf2106670f2a461ec3454d790bf94010079e4e683d24aabd4a19e8d89e333c9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\id.pak
          • Size 592KB
          • SHA256 4d003b8e85f4daea7c28c4f6854d46a62b32abe9973e6df764e2882b4472ea64
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\it.pak
          • Size 648KB
          • SHA256 3e241f9341c9593ecbe3a2a74a5249e8d737962741b51fe60143e3529470d716
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\ja.pak
          • Size 791KB
          • SHA256 03427863b47fcde8164855a13d01f09cfcf27bf9ea59d6abf74f2f7b255fb1ef
          • MD5 SHA1 SHA512 SSDEEP TLSH

          kn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\kn.pak
          • Size 1.6MB
          • SHA256 1dc837117f2b3dc69fc36c1c199addc999d5fb5a131072680796accd25e33b8c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\ko.pak
          • Size 671KB
          • SHA256 e43762e4f3b00819c2c5570ed292a6d42e53bbb00220c3f76a6aa0d502a76060
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lt.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\lt.pak
          • Size 729KB
          • SHA256 1cf37f7eafa0612186eebb76406767518f9b5dba12872bc3170b9a309c5050cd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\lv.pak
          • Size 726KB
          • SHA256 01913d9951959803c419816189ba5517568b1f36f70c539549713c4579105be9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ml.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\ml.pak
          • Size 1.6MB
          • SHA256 98c8ecff32021c532167cbd7e60b714c6dd8e240a3527af141da9d3916ea7d4f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\mr.pak
          • Size 1.3MB
          • SHA256 962928ac0c648b426dbd5dc930528900935acca4b336be6cf3fd911e99ef400f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ms.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\ms.pak
          • Size 624KB
          • SHA256 7b5ecc027a33e3123596cacfe6d4a8b33c8185c6d90d65aceb686aaaa234c5c0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nb.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\nb.pak
          • Size 598KB
          • SHA256 c4bfbb6dfa8c2f38caa27f77b58a5a373792284032d998f48469b2d8f050b084
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\nl.pak
          • Size 623KB
          • SHA256 1f9f8fdf67a93b571823fcdbf4f6c1132663a92bf199fcd8b3554a1404138182
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\pl.pak
          • Size 696KB
          • SHA256 1c328e8286098d6758aae4562ad0465094bf38477035475ea3b7ce9729c59518
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-BR.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\pt-BR.pak
          • Size 652KB
          • SHA256 76af448316964d70f5ca6ea2d3d10dfdda055521d981c0342c8eb2df1aace27d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-PT.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\pt-PT.pak
          • Size 656KB
          • SHA256 8ecd368ebcf0c4cbd3decb1709c1e6cda9ebd75dc4c3d0869b86dcf959c15565
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ro.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\ro.pak
          • Size 681KB
          • SHA256 bb8cb9b4b9708cba17c6a1b00d448c500ecb1658019fd2451868603c68251e92
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ru.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\ru.pak
          • Size 1.1MB
          • SHA256 4f7ef4e041932011eabc4d2dc8f8544106f57ee62c023e6b6a9a3a3ac23a7cc2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\sk.pak
          • Size 708KB
          • SHA256 9494cb93b7dd65cef73072d315c7c031005a3783594fdf43fe96d9e531f5cda7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\sl.pak
          • Size 678KB
          • SHA256 b50824ca2479dc29b404a8e2c252a9a791f444ba10b839d09b684b52cbb7b4b4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\sr.pak
          • Size 1.0MB
          • SHA256 02224e36d8d12e79c22e573425b5e7b2505e1f68d8be4cebada710a9c0ebdb00
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\sv.pak
          • Size 605KB
          • SHA256 ba098c7e48f588677686e8c4353432ef185ed4d659bd43d0b1bc76029b36aa30
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sw.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\sw.pak
          • Size 640KB
          • SHA256 c806d266dacc573c6f2a852bbba1cf1980063f08a803e6a0f5783c1418b4c16d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ta.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\ta.pak
          • Size 1.6MB
          • SHA256 cc82344df7ec4fefc02fc36f5d1af7286b27f4c267477bffbb0ac4f4fefab901
          • MD5 SHA1 SHA512 SSDEEP TLSH

          te.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\te.pak
          • Size 1.5MB
          • SHA256 f354b638c25843ec70a625d98066d1e291d6567830a327a308262f7872739f43
          • MD5 SHA1 SHA512 SSDEEP TLSH

          th.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\th.pak
          • Size 1.3MB
          • SHA256 72495fa1c87e6009499c3c478eb8ff1dc295e4fa8e1e97c915c4334cd48df45f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\tr.pak
          • Size 651KB
          • SHA256 d42ef3d1bfd531ef93d1e30e34d0c9a9fad37d08aa26fb61930d67ef31e5a471
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\uk.pak
          • Size 1.1MB
          • SHA256 2b3e02603e4d06b513b59db0d262971c8ec9e7f85233c6862f52e72bbc4e0afc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ur.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\ur.pak
          • Size 981KB
          • SHA256 0f5565df4484d9c0ed2f3033156e876aa8ff25406fb5a628ba12dc2588d5f7b9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\vi.pak
          • Size 774KB
          • SHA256 b5ae891cb2c1b98e01b7b819946849b7f1530b2991584b74045766f566ab739a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-CN.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\zh-CN.pak
          • Size 554KB
          • SHA256 d9ba93569044c34fdc3aea0a0be892e0b6eab8a71e3008bc854924bd5efcd19a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-TW.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\locales\zh-TW.pak
          • Size 547KB
          • SHA256 217b6776de0fc342d2ba3259aef9c5a6d9747f20942791be4e5fa16cb412b970
          • MD5 SHA1 SHA512 SSDEEP TLSH

          resources.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\resources.pak
          • Size 6.4MB
          • SHA256 741b7aebbec65ed7af754530e77b45ea4274e8f7c012c4396de789563a1183a5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          app-update.yml

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\resources\app-update.yml
          • Size 157B
          • SHA256 7664ce2ac1fe3ef97e168eecaa35feca2eeccda110ae2456cd7874c8e724547b
          • MD5 SHA1 SHA512 TLSH

          app.asar

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\resources\app.asar
          • Size 7.8MB
          • SHA256 bd45d5d392545e5c66f60b359b889e3197df1196c4359804f62d288c92fdaf4e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          elevate.exe

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\resources\elevate.exe
          • Size 120KB
          • SHA256 80dce18149c0564e057fd576bb521e6cc15dab998c92d8938db4be1465cc3631
          • MD5 SHA1 SHA512 SSDEEP TLSH

          snapshot_blob.bin

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\snapshot_blob.bin
          • Size 333KB
          • SHA256 ed719d078977be84118c45420df70a0cc46dd32ae326559c9e6d9a909aeda099
          • MD5 SHA1 SHA512 SSDEEP TLSH

          v8_context_snapshot.bin

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\v8_context_snapshot.bin
          • Size 698KB
          • SHA256 c321440b5b893fabf4cb983c46c325e6b1959536b7c98a3f1f0200df8ad61a33
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\vk_swiftshader.dll
          • Size 5.4MB
          • SHA256 d50b5ed41356b540e1f1d3525837effd4045220cb4efbfc2b913fd7d7edd0999
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader_icd.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\vk_swiftshader_icd.json
          • Size 106B
          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
          • MD5 SHA1 SHA512 TLSH

          vulkan-1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\7z-out\vulkan-1.dll
          • Size 932KB
          • SHA256 35b0d20574fd7f4c8b959e4789cd75950a37cc6106119f89210d086e7f15b47e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          SpiderBanner.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\SpiderBanner.dll
          • Size 9KB
          • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
          • MD5 SHA1 SHA512 SSDEEP TLSH

          StdUtils.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\StdUtils.dll
          • Size 100KB
          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          System.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\System.dll
          • Size 12KB
          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          WinShell.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\WinShell.dll
          • Size 3KB
          • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
          • MD5 SHA1 SHA512 TLSH

          nsExec.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\nsExec.dll
          • Size 6KB
          • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsis7z.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsh55FC.tmp\nsis7z.dll
          • Size 424KB
          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
          • MD5 SHA1 SHA512 SSDEEP TLSH

          memory/1112-95-0x000000006F5C0000-0x000000006F60C000-memory.dmp

          memory/1112-103-0x000000006FD40000-0x0000000070094000-memory.dmp

          memory/1508-63-0x0000000005200000-0x0000000005210000-memory.dmp

          memory/1508-62-0x0000000005200000-0x0000000005210000-memory.dmp

          memory/1508-82-0x0000000007A90000-0x0000000007AA1000-memory.dmp

          memory/1508-81-0x0000000007B20000-0x0000000007BB6000-memory.dmp

          memory/1508-73-0x000000006F5C0000-0x000000006F60C000-memory.dmp

          memory/1508-71-0x0000000005EC0000-0x0000000006214000-memory.dmp

          memory/5812-48-0x0000000005190000-0x00000000051A0000-memory.dmp

          memory/5812-49-0x00000000074E0000-0x0000000007583000-memory.dmp

          memory/5812-21-0x0000000005190000-0x00000000051A0000-memory.dmp

          memory/5812-20-0x0000000002ED0000-0x0000000002F06000-memory.dmp

          memory/5812-19-0x0000000005190000-0x00000000051A0000-memory.dmp

          memory/5812-36-0x000000007F220000-0x000000007F230000-memory.dmp

          memory/5812-38-0x000000006F5C0000-0x000000006F60C000-memory.dmp

          memory/5812-37-0x00000000074A0000-0x00000000074D2000-memory.dmp

          memory/5812-47-0x0000000005190000-0x00000000051A0000-memory.dmp

          memory/5812-25-0x0000000005E80000-0x0000000005EE6000-memory.dmp

          memory/5812-46-0x0000000006A50000-0x0000000006A6E000-memory.dmp

          memory/5812-22-0x00000000057D0000-0x0000000005DF8000-memory.dmp

          memory/5812-50-0x0000000007E50000-0x00000000084CA000-memory.dmp

          memory/5812-51-0x0000000007800000-0x000000000781A000-memory.dmp

          memory/5812-52-0x0000000007870000-0x000000000787A000-memory.dmp

          memory/5812-53-0x00000000079F0000-0x0000000007A1A000-memory.dmp

          memory/5812-54-0x0000000007A20000-0x0000000007A44000-memory.dmp

          memory/5812-55-0x000000006FD00000-0x0000000070054000-memory.dmp

          memory/5812-23-0x00000000055F0000-0x0000000005612000-memory.dmp

          memory/5812-24-0x0000000005E00000-0x0000000005E66000-memory.dmp

          memory/5812-35-0x0000000006A70000-0x0000000006ABC000-memory.dmp

          memory/5812-34-0x00000000064C0000-0x00000000064DE000-memory.dmp

          memory/5812-33-0x0000000005EF0000-0x0000000006244000-memory.dmp