Overview

overview

8

Static

static

3

Krush.exe

windows10-2004-x64

7

Krush.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

EAC.exe

windows10-2004-x64

7

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

4

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-ltsc_2024-x64

3

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows10-2004-x64

1

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    105s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 10:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Krush.exe
  • Size 78.1MB
  • Sample260708-mj7claet71
  • SHA256 cde44481848004511d41ceecf272da72a8d840b4efdbf4aedabb4d89f7140d21
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryexecutionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Krush.exe
    "C:\Users\Admin\AppData\Local\Temp\Krush.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4156
    • C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe
      C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5744
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session >nul 2>&1"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5404
        • C:\Windows\system32\net.exe
          net session
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3688
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            5⤵
              PID:2840
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "net session >nul 2>&1"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1580
          • C:\Windows\system32\net.exe
            net session
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1136
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 session
              5⤵
                PID:2872
          • C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe
            "C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe" --type=gpu-process --enable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\eac-bootstrapper" --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1740,i,877085564244615153,7763238089337430111,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5560
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "net session >nul 2>&1"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3384
            • C:\Windows\system32\net.exe
              net session
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:928
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 session
                5⤵
                  PID:3096
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled""
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3964
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled"
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4764
            • C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe
              "C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\eac-bootstrapper" --field-trial-handle=1740,i,877085564244615153,7763238089337430111,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
              3⤵
              • Executes dropped EXE
              PID:2900
            • C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe
              "C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\eac-bootstrapper" --app-path="C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1783506361170433 --launch-time-ticks=586649068 --field-trial-handle=1740,i,877085564244615153,7763238089337430111,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:1
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:6136
            • C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe
              "C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --enable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\eac-bootstrapper" --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1740,i,877085564244615153,7763238089337430111,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1232 /prefetch:10
              3⤵
                PID:2304
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4588
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:900
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:5216
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3352

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 599B
                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                LICENSE.electron.txt
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\LICENSE.electron.txt
                • Size 1KB
                • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                LICENSES.chromium.html
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\LICENSES.chromium.html
                • Size 14.5MB
                • SHA256 a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_100_percent.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\chrome_100_percent.pak
                • Size 163KB
                • SHA256 0d27d5591c72721ce399133e104114aa802caf3070814570ad205987a51a8ff7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_200_percent.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\chrome_200_percent.pak
                • Size 252KB
                • SHA256 fa1fce57396b3e21776659e50fb1c12fd4c010c9f56f161be6f4437207d21241
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                d3dcompiler_47.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\d3dcompiler_47.dll
                • Size 4.7MB
                • SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ffmpeg.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\ffmpeg.dll
                • Size 2.9MB
                • SHA256 0d21de0f4497f126b9aad67c57b045225185c70aad2308a25db01d6086e4d5a7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icudtl.dat
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\icudtl.dat
                • Size 10.0MB
                • SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libEGL.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\libEGL.dll
                • Size 492KB
                • SHA256 dfd53ccbfce55510f2afdb52703037452370eb5bdf33143829a8b06253015625
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libGLESv2.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\libGLESv2.dll
                • Size 7.7MB
                • SHA256 b348ceedd275843cbe344a29dd8550b18e5d433abff695cdf5658470c1e71c67
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                af.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\af.pak
                • Size 562KB
                • SHA256 7efae5393f523d0b23dd355e5cb165a14a4a5eb9d102f8fd7e1592fde0d81590
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                am.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\am.pak
                • Size 911KB
                • SHA256 108ac040ce13b53af88bc45f3e5b13086c1d435839dfdbabb19d6877d9daad96
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ar.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\ar.pak
                • Size 1007KB
                • SHA256 69a43e3592c8cabfe8fdef53c963bca7ee137e093d20f12767df89862c0eccd8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                bg.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\bg.pak
                • Size 1.0MB
                • SHA256 f4e5ceabc00d8d66a100f78540d81762e67bcd7482df116ee2545507a45de25d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                bn.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\bn.pak
                • Size 1.3MB
                • SHA256 66e568b1fbb31391786dcd2af632866894fd6a23bef0b408a59587a144bd0353
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ca.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\ca.pak
                • Size 633KB
                • SHA256 bdcc6f6404dc686148977e41330461e89d5739afcf123f03557239d93b911e03
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cs.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\cs.pak
                • Size 654KB
                • SHA256 56b0e1723259bcf6abdda080ece8877f4b1586b49d3c13ef8908619e2a118972
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                da.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\da.pak
                • Size 591KB
                • SHA256 c7a554e9644dda72071d7af1dcf077b783b52af926e99b507d79a664df4acc33
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                de.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\de.pak
                • Size 633KB
                • SHA256 de5422f48522a52248ba835d4e7ef860a734b54d2ee41c9a87cd73e7e947c318
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                el.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\el.pak
                • Size 1.1MB
                • SHA256 aa9b5d10422054e87bcd6068be5a2b085b8fd3ecb1d998eabe282a72c6520570
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                en-GB.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\en-GB.pak
                • Size 513KB
                • SHA256 e2eef21ab7b088c122b6990f66dd22ce0c7e1191c64e9ac8424435c3a6749cbe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                en-US.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\en-US.pak
                • Size 518KB
                • SHA256 3cd05f6512ed5d09076253dcdfd4ccc5eedfab44e1703cf3e015597dd31220c1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                es-419.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\es-419.pak
                • Size 624KB
                • SHA256 3fb38e2a38ef336a407fe91813986522e89696bcf3d6f78c68d60c921f741db4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                es.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\es.pak
                • Size 622KB
                • SHA256 e381793151b6bb9e87e954d2ead53fac523dda92912d4d14ecf46885f86ce441
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                et.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\et.pak
                • Size 567KB
                • SHA256 19245d259d70ec459d210cc01eb6e6d05298073dead915e164aa7aedf3b873ca
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                fa.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\fa.pak
                • Size 933KB
                • SHA256 bab2b590f945b1d864c38ebcc7167b74ba325b0ac7f3d611cd1728a53a5fb99a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                fi.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\fi.pak
                • Size 578KB
                • SHA256 41137434ee1d2b1aa3603fc134e8cd52455731dfb3eec44bd7f3e36df57e4f15
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                fil.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\fil.pak
                • Size 655KB
                • SHA256 8a9e1a72a7d067654df9e4a761f5c06cfac267680e00c45d9d52a929b318b435
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                fr.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\fr.pak
                • Size 674KB
                • SHA256 477771211fdff1fc9c8e002476e2440c1c14ce4ce69976a0993c99f2f5b47505
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                gu.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\gu.pak
                • Size 1.3MB
                • SHA256 51635a11ad7349ae131927156c50f6935c38cb6628cd8d2f8a5fb6715f6140e8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                he.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\he.pak
                • Size 818KB
                • SHA256 0ecf199553289880d0fa590fcab56d2165e4e571de0b77970619a244cc0285f5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                hi.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\hi.pak
                • Size 1.4MB
                • SHA256 5197062239f1780dff514326ca5894c39e4e4e2b4bb2c6e73f619122db31630f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                hr.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\hr.pak
                • Size 631KB
                • SHA256 ea68d33fd264a2a3cb0c78f7b92ac79af7cc1ca27fc50427ca100fc468ae40ec
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                hu.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\hu.pak
                • Size 678KB
                • SHA256 91d754bd252cd411fcc3513e04513d5e4d8165f36eace12f88d84fd7e352e857
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                id.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\id.pak
                • Size 559KB
                • SHA256 e78831cb31a4d2ab77cbe47bcc5439be3bc7d66fba7799779d5ab3e1d004115f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                it.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\it.pak
                • Size 614KB
                • SHA256 c5feff891ed9a00cdd7e0349b187cc2d26248ae468f076a09099312e04b23c21
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ja.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\ja.pak
                • Size 747KB
                • SHA256 30ea0122899ef914ee799d92667af4ae54c18cdc6e5bb780719a3f6a5dfc6435
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kn.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\kn.pak
                • Size 1.5MB
                • SHA256 b00058366c4e2febd46df14debda4ef777ddfe2c004d08f528dd17eaf8d4c17e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ko.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\ko.pak
                • Size 634KB
                • SHA256 2f26d1e6f3f505d95c26dd0a4d61c2621d8109d871bdb30fdb4718b802f10d20
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                lt.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\lt.pak
                • Size 684KB
                • SHA256 473fb2217995c4c4bafc23a9d418b3cd393604248ed19d06588e719519122c2e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                lv.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\lv.pak
                • Size 683KB
                • SHA256 7b589f1bc446b15d315fcd81b446b47e15ec533043abe56b1d060ab4a727b56c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ml.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\ml.pak
                • Size 1.5MB
                • SHA256 9b874b08ffe56813efce14d03e840f948f6e0ac9fb5fdef1163098d0d7ddf91f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mr.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\mr.pak
                • Size 1.3MB
                • SHA256 ab04bcdd9287640b1ce017eec44b6701e44a2e050c51eb1c9859b6367759d848
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ms.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\ms.pak
                • Size 588KB
                • SHA256 7d408f4f45fcdb66efcaf7beae9cb07e0c42a26e237461500cfc4403cdc88690
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\nb.pak
                • Size 567KB
                • SHA256 b44a1be560c7138a4d2b6b08a93fa529192e54a2256dac2695c901019cc66bce
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nl.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\nl.pak
                • Size 588KB
                • SHA256 262bf074055e830d0e4d361ca24e74f0170cd55938236163d96c6b48929b6d26
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pl.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\pl.pak
                • Size 655KB
                • SHA256 4994a5ad97534bc91b73ad528abc1771628848005c950bbac279d5e2b3e03465
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pt-BR.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\pt-BR.pak
                • Size 615KB
                • SHA256 e90d7ca40487d8f5299c85f86b5f20f7188d94c3f0e8b5368495f9a73c29cd40
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pt-PT.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\pt-PT.pak
                • Size 619KB
                • SHA256 97b06698596cf084533ac7990ae73cd72b3b851927e0fc5747cd0cab4f681079
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ro.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\ro.pak
                • Size 641KB
                • SHA256 757990528d01554f5a1e476929ed3b4fd0bee20cbae07db442923cb477358d9d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ru.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\ru.pak
                • Size 1.0MB
                • SHA256 7aaf8f96500bc8eb8883e46a10b84ebdc17ffdf34fe3d972cb3d69b29ed04776
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sk.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\sk.pak
                • Size 666KB
                • SHA256 1101256328b7dce3d388abfafa44e27ca416136187f366809ada6fabe1def449
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sl.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\sl.pak
                • Size 638KB
                • SHA256 eef2f7c2f3aa5572456274004104d0c79911834f002fa1fdcd5063b60a3225a5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sr.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\sr.pak
                • Size 982KB
                • SHA256 9184460cb3dc15e5babf7d96c0816d4068e411a376dc7314e84c722761788538
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sv.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\sv.pak
                • Size 572KB
                • SHA256 bcc5a1a2405dd2cdb4adcdc0fd9236645de378ea179ea558b44908fdf708f93b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sw.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\sw.pak
                • Size 604KB
                • SHA256 dd7ec69741e67b471df0555096dcf3affe5a40f68753ccebae75d0cf11b07c60
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ta.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\ta.pak
                • Size 1.5MB
                • SHA256 70a31eee3dc00ae51d9ae04945ad3db12de70f44a1fa913d88d599506e27c6b8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                te.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\te.pak
                • Size 1.4MB
                • SHA256 1447c02054e3d9ea084311c86c010834b44d7b0863f515cc4b83ce43201787e6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                th.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\th.pak
                • Size 1.2MB
                • SHA256 426a8e74828089ffb36b6ed19462eb645e407ae0352906f7f08ee19a3a5eb97a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tr.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\tr.pak
                • Size 615KB
                • SHA256 62c8ace3604a27fab3455e5e86a74f4eaca0a80c1d25a6c24a9656d0e8c37ec5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                uk.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\uk.pak
                • Size 1.0MB
                • SHA256 e8c4c4c982f28789f7e710ff7e941b37179966cdc6b9a480f60b03bef866886b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ur.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\ur.pak
                • Size 923KB
                • SHA256 7e8c8a47ab450c0165602160712d0430fc751c5703de655c0d543558e54c63fd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vi.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\vi.pak
                • Size 729KB
                • SHA256 6f898771f587d9c7742e3f4779eaa23fc0db554803701b698965a672dcdd6e04
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                zh-CN.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\zh-CN.pak
                • Size 523KB
                • SHA256 622f645c6b0a9cb8df6fc92c7a8e52ab2f5118a3f1b324d1910942ce34d180b8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                zh-TW.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\locales\zh-TW.pak
                • Size 518KB
                • SHA256 da8923f485868aeb83f57a1b5991db7ae6474d2418e389d71512e3e5227367ee
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                resources.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\resources.pak
                • Size 5.9MB
                • SHA256 ca47fceab76d2220a66dd5c55a444bbdb1f2300b1bd3b180693509327442b292
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                app.asar
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\resources\app.asar
                • Size 8.0MB
                • SHA256 536ead6560750bea0d1a6d6d4943f25ee2a0a772718d19deb0ef18c2d0174917
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                app.manifest
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\resources\app.manifest
                • Size 988B
                • SHA256 3e45567a13e37ef4cbaf23c197b8a87c5c88401f41d70134bbaf22d188f3d34a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                elevate.exe
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\resources\elevate.exe
                • Size 105KB
                • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icon.ico
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\resources\icon.ico
                • Size 12KB
                • SHA256 e444d1dd39b41fbb7ea75daf034556926c04ce1ddb8225d5679063d983b3b25c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                snapshot_blob.bin
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\snapshot_blob.bin
                • Size 329KB
                • SHA256 9a10e7b6d4a4a19e9e825217b2eaab2e47df86fe85a70e74e6f660c89ddb0fb6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                v8_context_snapshot.bin
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\v8_context_snapshot.bin
                • Size 695KB
                • SHA256 546db668f31be13f2a70cb2282f8073a88ad51be77eef468e1ad7a9450738da6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vk_swiftshader.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\vk_swiftshader.dll
                • Size 5.3MB
                • SHA256 c753107d8827525306b83d3c35da988b0954caebc4ab806d4ca6f27b7a0d8bdf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vk_swiftshader_icd.json
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\vk_swiftshader_icd.json
                • Size 106B
                • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                vulkan-1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\7z-out\vulkan-1.dll
                • Size 917KB
                • SHA256 40e39b8cd62c3292f7c5ad6a2d863f6e3bd3d2c0b1b3a2a0e4d41a61d2a8f758
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StdUtils.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\StdUtils.dll
                • Size 100KB
                • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                System.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\System.dll
                • Size 12KB
                • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nsis7z.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsr2DBE.tmp\nsis7z.dll
                • Size 424KB
                • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                default.exc
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                • Size 2B
                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                • MD5 SHA1 SHA512
                Submit Download

                data_0
                • Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\GPUCache\data_0
                • Size 8KB
                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_1
                • Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\GPUCache\data_1
                • Size 264KB
                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_2
                • Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\GPUCache\data_2
                • Size 8KB
                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_3
                • Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\GPUCache\data_3
                • Size 8KB
                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/2304-707-0x000002162F810000-0x000002162F811000-memory.dmp
                Download

                memory/2304-708-0x000002162F810000-0x000002162F811000-memory.dmp
                Download

                memory/2304-705-0x000002162F810000-0x000002162F811000-memory.dmp
                Download

                memory/2304-709-0x000002162F810000-0x000002162F811000-memory.dmp
                Download

                memory/2304-706-0x000002162F810000-0x000002162F811000-memory.dmp
                Download

                memory/2304-704-0x000002162F810000-0x000002162F811000-memory.dmp
                Download

                memory/2304-700-0x000002162F810000-0x000002162F811000-memory.dmp
                Download

                memory/2304-698-0x000002162F810000-0x000002162F811000-memory.dmp
                Download

                memory/4764-408-0x000001C94AE90000-0x000001C94AEB2000-memory.dmp
                Download

                memory/4764-416-0x000001C94B520000-0x000001C94B610000-memory.dmp
                Download

                memory/4764-414-0x000001C94AF50000-0x000001C94AF5A000-memory.dmp
                Download

                memory/4764-413-0x000001C94B210000-0x000001C94B2C2000-memory.dmp
                Download

                memory/4764-412-0x000001C94AF30000-0x000001C94AF4E000-memory.dmp
                Download

                memory/5216-579-0x0000028E141E0000-0x0000028E14200000-memory.dmp
                Download

                memory/5216-565-0x0000028E01DB0000-0x0000028E01DD0000-memory.dmp
                Download

                memory/5216-547-0x0000028E01E70000-0x0000028E01F70000-memory.dmp
                Download

                memory/5216-545-0x0000028E01C90000-0x0000028E01CB0000-memory.dmp
                Download

                memory/5216-534-0x0000028E001E0000-0x0000028E002E0000-memory.dmp
                Download

                memory/5216-533-0x0000028E001E0000-0x0000028E002E0000-memory.dmp
                Download

                memory/6136-450-0x00007FFE25890000-0x00007FFE25891000-memory.dmp
                Download

                memory/6136-453-0x00007FFE23E70000-0x00007FFE23E71000-memory.dmp
                Download