979ed00fea181c786f608967377d6d83ac82e6368275994a4182ec79d97b3122

Analysis

max time kernel
153s
max time network
187s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
595.97-notebook-win10-win11-64bit-international-dch-whql.exe
Size 913.0MB
Sample260712-vpcdeadz8n
SHA256 979ed00fea181c786f608967377d6d83ac82e6368275994a4182ec79d97b3122
MD5 4567a06b8de89429ca9c7dda8dbf7041
SHA1 6ff31b10101d12eb3f5743f9982b5e139d9d56b6
SHA512 f702f5da99a1a3127b246c7d2e722d4e68c9b87f5fdd0a68908e5b83aed722708e815314684c7746dfa7448fda139d6d82eeda42877a4dc2aca86daf4a49f21b
SSDEEP 25165824:CVuDFpVe29FNJvEj/7KxIxZt63z5MA24L67:CVN29bJSyILo3zv24L67
TLSH
T18DA93322661CFD77D9424172A2385F2A64D8E8F42F5409E79484BB3D87FD240272BBED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0416.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\box_checked_enabled.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\box_unchecked_disabled.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\EULA.txt	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\040a.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\btn_secondary_135.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\info.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\radio_btn_selected.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\CoreTemp.{ECF906D2-5C9D-40E5-8E36-41FE84BC1662}\setup.exe	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\041d.ui.forms	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0409.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\uninstall_bg_rtl.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\progress.htm	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\040c.ui.forms	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0416.ui.forms	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\041f.ui.forms	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0419.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\btn_primary_pressed_135.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\NvApp\PrivacyPolicy\PrivacyPolicy_en-US.htm	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0804.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\btn_disable_180.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\040a.ui.forms	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\041b.ui.forms	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0411.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\041d.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\warning.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0411.ui.forms	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0000.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\box_checked_disabled.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\presentations_bg_rtl.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\setup.cfg	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0407.ui.forms	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0424.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\040e.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\uninstall_bg.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\theme.cfg	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\040d.ui.forms	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0419.ui.forms	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\040b.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\041b.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0422.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\btn_secondary_90.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\circled_checkmark.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\presentations.cfg	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\btn_disable_90.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\btn_secondary_focus_135.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0409.ui.forms	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0404.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\040d.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\080a.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\btn_disable_135.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\install_bg_rtl.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0422.ui.forms	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0424.ui.forms	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0401.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\041e.ui.strings	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\box_partialcheckboxed_enabled.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\btn_primary_180.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\btn_primary_pressed_180.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\error.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\splash_rtl.png	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\installer.{3209D607-C07A-4DD9-B734-301205C21A87}\0816.ui.forms	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\CoreTemp.{ECF906D2-5C9D-40E5-8E36-41FE84BC1662}\NvInstallerUtil.dll	setup.exe
File created	C:\Program Files\NVIDIA Corporation\Installer2\CoreTemp.{ECF906D2-5C9D-40E5-8E36-41FE84BC1662}\NVI2UI.dll	setup.exe

Executes dropped EXE 1 IoCs

pid	Process
3256	setup.exe

Loads dropped DLL 12 IoCs

pid	Process
3256	setup.exe
3256	setup.exe
3256	setup.exe
3256	setup.exe
3256	setup.exe
3256	setup.exe
3256	setup.exe
3256	setup.exe
3256	setup.exe
3256	setup.exe
3256	setup.exe
3256	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	595.97-notebook-win10-win11-64bit-international-dch-whql.exe

Checks SCSI registry key(s) 3 TTPs 16 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	setup.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 6b00000001000000200000006dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb1770f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f00000001000000360000003034060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030706082b060105050703016200000001000000200000006dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb1770b000000010000001e00000045006e00740072007500730074002000280032003000340038002900000014000000010000001400000055e481d11180bed889b908a331f9a1240916b9701d0000000100000010000000e871723e266f38af5d49cda2a502669c7e000000010000000800000000001a7f62aedb01030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343119000000010000001000000091fad483f14848a8a69b18b805cdbb3a20000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 5c00000001000000040000000008000019000000010000001000000091fad483f14848a8a69b18b805cdbb3a030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d34317e000000010000000800000000001a7f62aedb011d0000000100000010000000e871723e266f38af5d49cda2a502669c14000000010000001400000055e481d11180bed889b908a331f9a1240916b9700b000000010000001e00000045006e0074007200750073007400200028003200300034003800290000006200000001000000200000006dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb1777f00000001000000360000003034060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030706082b06010505070301530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d86b00000001000000200000006dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb17720000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551	setup.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3256	setup.exe
Token: SeDebugPrivilege	3256	setup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3352	595.97-notebook-win10-win11-64bit-international-dch-whql.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 3256	3352	595.97-notebook-win10-win11-64bit-international-dch-whql.exe	87

C:\Users\Admin\AppData\Local\Temp\595.97-notebook-win10-win11-64bit-international-dch-whql.exe
"C:\Users\Admin\AppData\Local\Temp\595.97-notebook-win10-win11-64bit-international-dch-whql.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\setup.exe
  "C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\setup.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  PID:3256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nvadvi.inf

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\Display.Driver\nvadvi.inf
Size 418KB
SHA256 104a733e35d90c63eddef83fad8f905dcd61f986106af44438589ebc94b17783
MD5 d75225d06bf4fab5155dc654a75034fa
SHA1 6b80a4bf22f152e3cb7a63b536d375982833e1a4
SHA512 1adbb545cc44582fa06f9302c3913e1bfd273af8f9b6298c775e268ab8677bfc45f69b9356b6a6b0c964d7c8ae86594e798a2bc72329192add229edd245d8990
SSDEEP 1536:j7Ua5/0Nax+/kVCFex2FgVaqluBsyv9YfnDzvEXRewG7OyIEkcJdwL8x8pMdiu/q:Uy4MaEkcJdwL8x8pMdiu39TVK
TLSH
T17B943262672A71F5E44157C4F329B6830EADD04209F8296FB3B50567888EC5F02E9FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvlti.inf

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\Display.Driver\nvlti.inf
Size 11.6MB
SHA256 2b2ee6e86f86211c244919ea4146da8019e7a45ee98db68354157693ab66f1a3
MD5 2592135164329c0c08083fa8095bd04e
SHA1 a7645c415323ca7885b9ddbe03d445a81b1ef050
SHA512 03a24bcf5746727eb63d443f85e4527d888daf9bc9222c9c82e3723ee959d2e4e76f55b4aff08a35cb35b61a836dd8071ef604f8415082d8d84ed4370a5b8856
SSDEEP 6144:Pbmj+NkEvJEIjC0b0G0S4ah4+JiL/oXhuoZ:+4jC0b0G0NWZ
TLSH
T154C6D1A3632965E5E4411AD4F325BB831EADD0421DF8285FF3B10957888FC1B42EDFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EULA.txt

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\EULA.txt
Size 44KB
SHA256 a400609a6eab3b649a8b511c4bd629f7e56cd15f2a196d17aa8a3e80b7681b8c
MD5 4aa268af94e20e4a6106b117ae4cb87f
SHA1 5c42202ba8a391e4e2c1f3394079879474fc74b7
SHA512 5c360dccf13896886dcc121938d30bf062297738b36bdbe3155bcabc324df6c7e14998bc87146cc717ebde5ed7df3495a693e3666e5ddaa107134f64919dd3dd
SSDEEP 768:Zw2H/QrNV+JFa5hk2orynW1U/xc6EQrDV4DZYkEorb:CmVr/x3
TLSH
T17723A5BBB34923360AC601E23B4A99D6F33FD03D36AB5440609D815D2726E39537BBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0000.ui.forms
Size 61KB
SHA256 486e2a01fdc2ba767c20a6295425696ec6374043e2dc167619fdc601db625e02
MD5 5205c58d4db4ab0b74d99c8e82230e57
SHA1 98e4b5b4c17aafa9dc459fc5a8d0ba519481e7e5
SHA512 1dddb3f0b85b83de6f4b97a791221ffe66a0311de26b1babd184a017df92a72bc24acae41ff542a73496eb4c3dd97f994aed76e02cb58d777d3591e552390ae0
SSDEEP 384:qvaw5hUay8JcuNkctpoEcQNmcvZnMmGX0aP5fbU8oUjoJUmoJ5UCoJ5+UgoJ5+tx:3sE
TLSH
T124533000B035BF355759892BBFF49A86545FEC34C24C29AB95DE3D73A6D2C7020B329A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0000.ui.strings
Size 1KB
SHA256 e792f8a6666c05d723d9c19325aa3429e35df36a72cc4c229dc2cef0876de79d
MD5 88b402cd5cf6c9145b6c9aba0de7fc20
SHA1 71fa5024b381cf06c60874e41b7d42c263441f3d
SHA512 579e7227c721d19ec5e52ee37bd7fad0cacd96e8f898bb6cf26063c4fedadf8c78781b11285e8e1d25263277b3b069b5df182158123655b74de4216d69e97ee8
TLSH
T196218A842A62AF953F150EB035A6BC9C100D6970B72817FC98F9B37B5577A092932303
MD5 SHA1 SHA512 TLSH

Submit Download

0401.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0401.ui.forms
Size 4KB
SHA256 e9290211bf2ea54d65afd1933fd307a2390ae0c5b17a29f945f9f1b4252a16cb
MD5 5d712ae753185eff57c343bfb65dad46
SHA1 cee3c0025cb260d2406afbd14bafd455b42c69b0
SHA512 b006df4262d1d067e44c87e69823cab7f9d762a23154deb61d5fbcb2df4ba333e15a0e754b7ab20102b8a65b8fb5f4179503e1363a2426c6567e9d0407daa450
SSDEEP 96:ikLxsnpC2zjQebm/FNPplp6E/QJP3PJrr7x5PjHzJXfhPLPfXTV:5xo
TLSH
T11E917D5600228F23379587A9ADA7DC45D2754A74031E6A1310FF7BB3B26F36F26E3206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0401.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0401.ui.strings
Size 11KB
SHA256 fe3b9278b732676885761accc86e4e2580f6bec3ae84f94f48f1b1bcaf554b62
MD5 3a3dd71c7ad4facd6d9572138373be06
SHA1 5800c9cc625a5edda4ab42088074589b8a2e53cf
SHA512 9e00e4d1aa2aa5a2d67772751e0c72d3caf71ec120233c4594507ed4a0266f7c424534cca03fa7f2d9470d75e45cb6eaa0a8a87b47fc708b3ab34a4e3b976cc3
SSDEEP 192:BUdGIa/UkgANfoQvkImKHU1mnivQdQAFG/COPOD:BUdGIEUkgANfoxImgU1Iiv4QAFG/e
TLSH
T1293268A07915FF601F495F26C5F13C48A47E5C32B369B5FAE8CF322AA3A39019435232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0404.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0404.ui.forms
Size 4KB
SHA256 124e2f0a14d156e2563b91df958322d4c37ab4f15bf02ce40457b3a3fe17eb98
MD5 093299dcf0c4dfe44c6a99f390c0c7c7
SHA1 9beca907a684386c17472bba8aa6ccb0d2b5e253
SHA512 b729d88f1969c28d347f372be8af635d126a6abf5ea1393c159bd64a4decb7ee0af559470c1362633a7dda1a5adea556ca48fab05bf4e68fbb08ff71b99097de
SSDEEP 48:cOCxsNz01uH+H4CoCLdA6C+LdQi2jMpA1IhHaLLAr:+xsNIyxS
TLSH
T1F1A1819500228F23379657A9BDB7DC40D6754E74031E6A1310EF7FE2A25F16F26E320A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0404.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0404.ui.strings
Size 9KB
SHA256 e5f90f9038ab45558fc0a4b2a45a4d31b78b5f8858918420f14c0bd183c99903
MD5 c6adbf21a787827d494af738cc3069ba
SHA1 ae948f13e034d1327529f8c6b960c6697e202e7f
SHA512 8c78f9e2d780d448c12ef76aa2b364dabea6af060fddbe779cbc373ea8daf1cdee9a972febfe5e6dd32f7c4052251cd9e4ccab41958125ca4c477a98392e4de4
SSDEEP 192:cBvV/cKx9pJopn7HRfRQNQt+ZSmjczo8fOIOD:cBtrpJopn7HRro4mGZk
TLSH
T15112A535B995FF645F122F225AB63C11106E2831766830FEE5CD36AFA373D281A71462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0405.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0405.ui.forms
Size 4KB
SHA256 f857b2b8210f343b95bd56a37d60e7223a599fef8578beb184e08c03b7bd0bd4
MD5 e72f42a6dfc3b3d17473b5ddc3d3dda5
SHA1 90a0d939a8c8a667c1ae281313bd0410086cb28d
SHA512 3c2b3d3bd90a841ba1db18d9190948248b2524bde6552636462c732789ffb1675767e9fe2c7e34744195967cec39e2980e17ad273a55b2c234c961248919b326
SSDEEP 48:cMxlqGcfWvWAqQi2RlzHf5fzfvfvftf7I0qFaAf3fDfdaSfYz0Law:Rx4GBRzBbHHlIJPLtYc
TLSH
T188A1F41540225E23335583E9FEE3CCA5D6B94A74431D590310EFBBB3B29E56E36E3286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0405.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0405.ui.strings
Size 10KB
SHA256 d59225807e7d79d7c3832aa8022c2e2bd0b3fe1e73948b04030850e95d683d13
MD5 f1e96e59fb134ef720ca23df4639a3db
SHA1 c9d1bba270a1a227d9426356c5710bf9e4ef398e
SHA512 161d6d518d56215a825716a1e07c5566ee9159465e4d6fec1147df0a2349c89d65a882ff9bdd6a56ca2d4d605e7d0938c2608398029dafaf02efc2630f06f417
SSDEEP 192:qEgdghblO17iwE+TuHAm2lOxI9sjlAawi3fayhQJgES35vFGO5Y5T9Lgc47ceOnm:q7+hblO1cWugm2yI9HawivtQiESZ9Y5S
TLSH
T110225334B946FF206F551F662AB63C00196E0E71722970FAD9DE36AFE3B79050872152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0406.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0406.ui.forms
Size 4KB
SHA256 4b3344d0e5b644c8d0d0565a3ca244c3efb17b4137b7650d3c6ddd705e705c8d
MD5 979cb5fd5604db74ddb0d98077df990f
SHA1 51fbe0eea30ff1d0c2fa10621518a451a74bcb8c
SHA512 f8a0f349dfc4e1774c2b53e443b840aa8ab53fe1a3e67c22ce257aa66d65f22361de4042824f303f7e1dddbbd6a0e0047e873981fd8245652c976ee91ae43038
SSDEEP 48:cQxMqGj4RIR4CeCLjASCALjQi2xMHHIPqF6f+1aXLsl:NxJGYg8w
TLSH
T18391B05600229E27379547A9BEB7DC44D2754A78031E591310FF7BB2B26F26F26E3306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0406.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0406.ui.strings
Size 9KB
SHA256 e7dff28c6bc123c77a53ee1aa40e34ed99ecc7c0d0debcc819e4f5c57692429c
MD5 0bfa1022301c3e755408a7974cfc59bb
SHA1 4b2032128e627d7b2afca7205ad7b161d28adba0
SHA512 1198bc1097c1f965ca428a818831fc7146bd368068e449bb4df6b15ff0ef00c1d1342e89f887028e952b0c1deb0e2559715b0ff3a312bf8aac84d399d9610cd3
SSDEEP 192:QlXVx1rvNvdVQY6Lz+fa4nDFv/b0kFN3vAP/9PGvArmlSeFAvypVF3OGOD:c9xdVQY6qtpv/RrA3YAsSitc
TLSH
T170223324B926FF206F451F6B9AB62C01252E9871723930FED8DE727FE3A3D044976112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0407.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0407.ui.forms
Size 6KB
SHA256 ca2a6c92149352ee20e6c9feb9c27a86defd763a1e09eb9a663b1de8b173c422
MD5 eb630dc46a127e3b71ac0f81276be0c5
SHA1 3b5a0c4b1a02bf2132f5a4d21064a2da370ca05c
SHA512 d9dff384717103c6b3e15e139cb08e393df703880fdcd0f5702278013fffd7c55efcd438aa7c802cc15fdc05abfde5c802f5a6718f3c562e26f714d03abecbfa
SSDEEP 48:coxXqGtEfAJgZg4CPCLiA+C3LiQi2AM4jzRqsqyqyqSq0qMIaqFvqDzrJYqDrJYh:txaGKP8IpnnHx5wH7D737R7ZZERUE
TLSH
T18ED1291490226F22365943A9FEE7DC94D6B64A70835D180211EF3FB3729A87E39E314B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0407.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0407.ui.strings
Size 10KB
SHA256 fbc6837bd8fc10a802e251f3ac87b3b74c678ea90b18ae7a29ac33e5fa549e40
MD5 473b73f494b1bf6f7441171848090de0
SHA1 82c8deec20d61b162c8701651c6e45fac6a9fcfa
SHA512 14344f4425bea38384f06f99f6ece57afc5e3173a7abbf0da27d793477d8659c0ad48cfdf375c181f77d72fc18b598bc0b0884e70d5c954ebf6d0b4aabac8ead
SSDEEP 192:gzDzZB9fWEOGQNkBfJdtifLxcYgnj7cnDy29Dh2aFhUOGOD:GCGQNklJdUJlDN
TLSH
T1BD32BA24B965FF246F462F671AB12C01352EA971732930FE95DEB17FE3A3D150839122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0408.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0408.ui.forms
Size 6KB
SHA256 8c7203ae72affc0ade9919d0e35856f9f7eeaa6405b5a918154ddc2549af619b
MD5 7e307f22e26da23d80650f4aa02b0b18
SHA1 eadf598ccb74a59c58233fa93013146bfd48f407
SHA512 b25d116841206214fa62a034a2f8a0c19fae4ef3f1633e984febb68f349a3767e304027928766a0ebb9da8d281a7f4fd481987d69c4cde19cf7c24b838f9ad3f
SSDEEP 96:hxpxviVffJ5RtZoieU/uAAgm+nYkoOreJwzkh:hxpxviVffJz6f
TLSH
T1CBE15A115026AF223264439EFFF3AC90D56B8E70935D150265EF3FB362DA87D35A3286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0408.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0408.ui.strings
Size 14KB
SHA256 0e5e4acfa52a835af607ff01d780b990c36a1ccbf722590a060d231afe951ca5
MD5 6c9dbe4948e9ceeeec17c640ab6180e1
SHA1 2145d84977779c4aaba4ea0540d73c67f7c4c87f
SHA512 1a7ce62fcd3e9f5992519702471ddef63171cb9ffb9a6862022d2ee819b7d7d321499b5848d2e893da2ac2c6c6797f48737c078ad0bb551b5c3fddbb244b777a
SSDEEP 384:a6wT7uHwazXjgvRGbjsxtn1Kjw8pwXwKwfkkQA8yjHT:OvFy+gsLjAKckkNjz
TLSH
T1C46246AEF895BF684D015F5348F47828274F4C387328E1EDA1ADA73AFAFA450543190B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0409.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0409.ui.forms
Size 4KB
SHA256 6c9ed114e1965e35c7bfaf446927de7ba36ed8c7c8c5bed0413bef66ddcc2c96
MD5 5d66b8ddd971c9bfa352017747c9a307
SHA1 f0dcd33d45de2dc0902e11bae4a7fca3afb19bb4
SHA512 02448929bbf4c5be8b02168f5773cabf2128b1b1a236d2c822b0143524e84df8b863f5d4a6580cd324d55e96efe1d4acddb211d05ee1334d5447532c91567e0e
SSDEEP 48:csxFYbyry4CFCLQAuCxLQQi2eM+sICkaHLyE:pxF3B
TLSH
T1A191715600224E23379507AAADB7DC44EA754A74031E9A1310FF7FA3A25F26F76E3206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0409.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0409.ui.strings
Size 9KB
SHA256 25f3dc9ac9fdad7b1aa0bb02a82614880e40d5c4baed36f4091eb7dd89c01eea
MD5 89a278b9acf49e74d77501f9343c2a16
SHA1 59bdafe0bcfe355af4b90571c4a27da5e1f4cdf3
SHA512 64d4622c174308b70d8bbdbf468b9cc5393b373afda3591e753e93d06e1d39c1cc2178f9f0a5178d8c85aaaf65257f6dc6d005473244064ddeba142c784de8ae
SSDEEP 192:hCiETMdZYYNBiSQCSsahR8wBdmLL3OfBOD:hCifBfQCzc4h
TLSH
T19F125328BA55FF246F421F676AB22C11251E5870733831FED4EE72AFE3B39084576162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040a.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\040a.ui.forms
Size 5KB
SHA256 cd9bbb99b5297e0eb206c46c3a49906cdc20dcbdb03f3ef4759a73016ae52d1e
MD5 e3b162ccf4980ed314d76914eab0b152
SHA1 adc8342dc84135f1807a22f5b4e6de61dc1872ee
SHA512 d3601a24ae10f2050e39ee10a1457547e3bf8dd5cbf9360f6b5dbbe624c0d6d94f2e2ad2656e550405386ef039ceb54d5038b635dbf7aefa4b990db1f4a33b95
SSDEEP 96:SULx2rCiVffJIJxhMzguLWv1Nf5V5q0vgZfNsZ77rhm4zXjZHPxfbfPHDl:SULx2rCiVffJBzguLWv1l5V5q0vgZfNm
TLSH
T17FB1135640229E33379907ADBEB79C40D2794A70031D595211EF7BB3B39ED6E26E320A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040a.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\040a.ui.strings
Size 10KB
SHA256 6c60af596eda9e4a9917064fd82394f13451140a0c8d0381f6b775a76eafe47a
MD5 ea5c3c15e46592938c87edd1b89af3f1
SHA1 fca673eda4482e57c5f0a5f19f7dcd0b3d9e2917
SHA512 7395895b6c81b7fd67e62905b25b9e152c88b1dca03b0529bd0a17c49d68214ec18a35281d34efcc937bacb0b44ff95c7d4fc7e16ef45623327cd393af7a58f6
SSDEEP 96:qumjfCmD7DTXpbW5EuivbhMrJHIXEafpnbgKjOWILGYZXZ7IcO2OOD:FmzCwXpbW5svbSFoXEIb9KVZJ7IcOtOD
TLSH
T1A7228820B949FF106F521F6A5AB2AC12655E4C30722860FBE5DE717FE3F7D488832562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040b.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\040b.ui.forms
Size 5KB
SHA256 71c4ea69fd7e0fc130b8dad26bc46aa63ad465a3faae99ad2a280d50f668505d
MD5 400acc3967c50f2d904ce98095bce251
SHA1 411b8a9bab5d161bbedfad69c35d6ed109718177
SHA512 2a89dddcee340b07a478c508bee153223f367e7ecdc69d4462f2c0bc20c4580c5cfb5ebaebb26de3af6de9b7b3bcf202cdc04605de738dcb7f479fc5465a5e4d
SSDEEP 48:cYxlBnrC7mJzffJOLn6fe8FsF4CyCLfASCELfQi29MMM9zv66fJIVqnIY7nIYPnK:NxrrCiVffJS+3KT3PLp73g
TLSH
T1ADC1785510225E27379507A8BEF7EC40E2764A70431D291314EF7BB3B39F9AE29E3246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040b.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\040b.ui.strings
Size 10KB
SHA256 fcc44ffb741037322d1b704fa7b8acbe4295d3e34fc9d32c9425b7045735f9b5
MD5 01d49485e89b0e551dcc4c7fc183911a
SHA1 a0810dbe76e75269a1766128f76af20e852955c9
SHA512 0fd67b932f2f00a7612e30e3583d2b6266d75652fa18a7479cc7ce2d558dd964fbc58d74487539ba9eb108ab311a93356a8c08da57ec298e4066310eb30927ea
SSDEEP 192:hhnrV//tZzaqcy9ZRq0G8QnAjaQUFmEDARpkakYgwswvcrBOdrOD:FFcy9ZRGtAjLRFgH
TLSH
T111228375BA85FF602E952F264EB17C11185E9D70722824FED6DE32BFE3B78441872026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040c.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\040c.ui.forms
Size 6KB
SHA256 30acca5d175cb03d3acf39482eba243012870d072ac634226fbdcb8dfc5d1dc0
MD5 192b2471d4913ef18d648890a98207d3
SHA1 3836e7833745ee2b5fea372b73132303eae54e62
SHA512 5f6e631d00d4fd1f0613be323879ca1bd79e468f03baf3b1460c33dd4a19ca2a1e97d0d10f1476486b3f2c4e0093d2f02b4507b51cb8b73b0e19e07d754176d3
SSDEEP 96:9xMrCiVffJOaGp1Ic1TTz9lELR/RbRVR5M4YP:9xMrCiVffJDvVxzEP
TLSH
T1DFE17B1550227F32364543A9FEF7DC90D5A64A70939D280212EF7FB362DA8BE35E3186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040c.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\040c.ui.strings
Size 10KB
SHA256 169fc1b35c7249769bc13647748148a91d344b1afade3f79a8ace721e69e6a08
MD5 56593212d59e4036027c498ae5472eed
SHA1 c7a4012b07919c073247c71e57a816e2400bf8e9
SHA512 0ed2f34ca015d959ba8f3a894fbe158878c3fa783a081baf4a87279c8f3a7c874dfcab6a1b7f9d854e3d4064ee0ae4fca1b92d78ab357700008690bf6adf25a6
SSDEEP 192:TMYp4j5z9WkoTmElkzLMjXXE2fs8gdOlOD:gNrWkImtic1
TLSH
T1B0326724B964FF206E422F6B5A722C01642E9D71723971FEC8DE326FE3E7C194576122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040d.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\040d.ui.forms
Size 4KB
SHA256 4c6e5568e57ee199f924ca008cc9708d657db81f36eba379115e311fbf42d6a5
MD5 a2ebb9e8f6bf8db4f47bd69578283532
SHA1 c8784a4a2f21ee001dd0ca11cdd1dcb6a1995ea5
SHA512 8625718c0ef01cfb4d78adef0d9dbf2f30e1d1f1a95945061dd4a868080908dca255108bb350c06793504a7fcbae18ffde4525d86b673397269911a4e77cfb14
SSDEEP 48:cMxaqGpe3O34C4CLtA6COLtQi2TMZZIJqFbXarLAb:pxPGmst
TLSH
T1DA91B15580224E23379507A9BEB7CC40D2754B74831E5A1350FF7BB2A26F36F2AE3206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040d.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\040d.ui.strings
Size 11KB
SHA256 95896a0c544bb3e6d93ed07b7540ac272b7096e16e9648c3881eebd2ce7c8ff9
MD5 656dd1517ddd4bcd8f18759125655f34
SHA1 124b7a69836f2507a449b156ce01a1f22a183ae7
SHA512 a0c4081fbe92edaa0ad58404198d52a2b2cd0ef25cc2022b8e445a3ca3a04518ca2c200b475af9ae39965d58690c5e469d88d949ff9fb9234d7b2d943cd1c3f5
SSDEEP 96:qhXR563YqA0g6DRbms3i16DXA2UB5jb510oUWywtiHOCELB2scM5pWOPOD:eh56ycRdojN10dwtiH5E1/cMvWOPOD
TLSH
T10732E5A0BAD5BF101E355F939EB1A8142F7E4D71362631FAC6C8327EEE774959832021
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040e.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\040e.ui.forms
Size 4KB
SHA256 6f4cee9e3f1674f260f63294ab208731a4b889cb09ac39b1e3e4a59e081a88cb
MD5 df1bacadadf868d442275f8242b0ec50
SHA1 84b4a86058b26acb5016f6bf6cebf43c302c3125
SHA512 6b6262079598366f69e9a798a7daa62e88292532c3e33ec476baaaf64e13fa5193200dc368839701383a68e598cdb59a7bc35f76b1b15dd3e15e2341252df0aa
SSDEEP 48:csxJDHPG/G4CJCLMAeClLMQi2qMKVzjInIaPL6g:RxJW2Y
TLSH
T12791805600224F233B9547B9BDB7DC44D6754A74031E5A1314FF7BA2A29F26F26E3206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040e.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\040e.ui.strings
Size 10KB
SHA256 f9c6c5fe2388eea9f1a8d559eb000e447f6b6e85184667977d1059175bf6b5c1
MD5 ac6aa55975f82e27f88295db0f34fcaa
SHA1 e39c5e341fe73122e9a058f05b5ad4ee27262f7d
SHA512 c1944951cb51abce2988406bab96ce0277fe09d8212036d71eb102abbfe946aecf491165d1b4006283cbdf951cba40dbb49d34c77f2463d512054278220ad68f
SSDEEP 192:YF5Fr7WI96XLuJMcREASlRqQdEPacjl6PntOnOD:YdHALuJZOASTErjlqnT
TLSH
T183228335BA11FF20AE051FA369B12C44255E0C75727935FF99CE717FE3A7A18083206A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0410.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0410.ui.forms
Size 4KB
SHA256 8b2ff531ea2fc1d6b7e1cc2e581aa8b7cf853cf530eaace7ccef0b72dc984905
MD5 66950381f1074279e0b380e26a8d7e82
SHA1 49f6879f0b2f32a6f96fdf647775920e27bae45b
SHA512 0ece5268e0acca7456ae4dae7038583bea4275073bae08bc5813e36ac981e5f624e0bb47845d995a1751890825c8389b633d89b520d27eda125e744a99fee1d9
SSDEEP 48:ccx9qGqDdwtw4CXCLuA+CfLuQi2sMsuI+qFfqDGaXLeW:hxQGjiEB
TLSH
T1CFA1F56580265E23379507ADAEB7CC4092754A74039E581350EF7BF3F25B9AF26E3206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0410.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0410.ui.strings
Size 10KB
SHA256 e45edf325ee1c3ce50a3d33f0ca19bc96b12acd830986d8ef1ecbb6c5f66b80e
MD5 d2300669bf51958c682683d1f0007425
SHA1 1742ecd7090cc8cb0d3c6d1ee5c165ad0a398db0
SHA512 5a625bd2e5daeb098bef8992359753ff1acd83c0a63d7cb24676a5c0659be990faaf8dc7b2a77b6e8d3f0957f7b1571b664665448ecff35040d85b4dfcb8bfce
SSDEEP 192:pkXXKbe1pcFRCa/5MEPXkbjCGjS1sKSP7pROeOD:+XabD2DO1sRDpS
TLSH
T1D1226530B855FF106E121F6A4AB27C05662E5CB4B62930EA98DE327FF3F7D445479122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0411.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0411.ui.forms
Size 4KB
SHA256 ef7664639572775846e47febd60a3c1201d760481ba5fd0b2f109ba99a8e3eeb
MD5 27ba96a57205f66ab8a14ef0dfc6a3ee
SHA1 12425931ca6dfd2172ecb60be482a62e83c2470d
SHA512 3333f69238e631779d41d87ede7a8468ed065dc4848aee8d0ab631cfcfe29768f1abcb782c10c1f4d0c76027d9eeb85c38c9ed3011138219a1c2b6f121021fc4
SSDEEP 96:pjLxxiCzI4k/l8tQ+NgieaDQ/CgW7CMMcqygk40CIw4vsgwIUw:FxvI6dL
TLSH
T1E8A1C26500228F23379587A9ADB7DC4196758A74031E681310EF7BF3B29B66F26E3246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0411.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0411.ui.strings
Size 11KB
SHA256 a8428152f19611674fe50e88b8a49b934398d4d3ab4ae5f5ead1600037d96056
MD5 e9f4eb8621127eabff232a43925ffa3b
SHA1 a59740da0c67d6faa6fd1509fecf50744137b262
SHA512 1409034cdfd12eeaef6cfd1191f7f16e055ed7b18b5f156977e478ccb35da501160e9f4a2472172cc62e5ce9d7127c6c5ce0fde681526c141fa5474fe2b9fd93
SSDEEP 192:X4AiVXWhVPYijpUgAS7US9CjNZOtZ0OfOD:XBLhVg
TLSH
T14032103CFA85BF216E510F7208B97991250E5C71FA6A20FA80EEF12AB772C8DC535571
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0412.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0412.ui.forms
Size 4KB
SHA256 7c810bc732b26ad716885a39b3dfb0c141eb1e138794cbf7a53c0b83ced3c58b
MD5 9203d53af49c1aa345a14222eeb192a1
SHA1 721084cf893d5ff413f2d0a9678c7bf08fff234b
SHA512 91e354184e304e5729ab9d76ea58ad05ddaa3f327ca791fea3f5359ee9bd92c5efabf3533cdefb788bf5511692694a270a9256845570ae06c0dd86573598d907
SSDEEP 48:csx46fx4jmzm4ChCL4AmCdL4Qi2WM6lnzXIJ6fQK8aLLys:ZxRxjG1H
TLSH
T1F991A26500224E23379547ADAEB7CC4496B55A74031E595310EF7FF2B25B26F37E3206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0412.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0412.ui.strings
Size 10KB
SHA256 ba25804f5bd60fa4134f7eca2c936c46eb7ad0fc6396a63eebdcf02dc9eaf9ed
MD5 46cb9038f9561a6a2cc16b0d3781a920
SHA1 2ec0714133c7501bfe4c466e8e227efbfe3e19aa
SHA512 c480dc84e509667fb9258851cac0690bf9647de4dfcbec3f5831153044afbb6b315326923c676c0346367f9188f743712c165f2eb2a82ff32d38cd69f8b07267
SSDEEP 96:qegIQSI/ehlvf6ap8h0yBderw1/Ux2+4JiDmxux3fJ7Fynv8lbuhmMBP4UNOaP6Q:1QAOdfW4cDmxgP/bFnAxaAsUoudVOtOD
TLSH
T11B229AB1BA92BF501E061F121EF27C11124E8D75B32620FED8CD79AFE7B78950836562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0413.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0413.ui.forms
Size 5KB
SHA256 85d5559c88b0a45c05b5e2160c8dd95fcb2519ef6d81090d4de946606ccb5cc5
MD5 0d1a67a0cfeda06e790064d798f9d671
SHA1 7f863e315e8702ba2a8ea0e3fad36fb2b3c34e78
SHA512 3f5b264a380ebc1b99b5411cac3bebe21fcf8155933c48af2e82c26d61915047a68d50137c8306815c50138779d5806897e2ff141dd81f77832069241e8a61a8
SSDEEP 48:coxQg9noxoq/qGgFiXyX4CwCLJAaCmLJQi2PMNhAq9hI9qF7cI4HwI4H8I4HEay+:VxvRoLCGhI3KWy0GBP
TLSH
T1CEC1466510225F2733954BA9AEF7DC8096B68A70531D281310DF3BB3B29B57E25E3286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0413.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0413.ui.strings
Size 10KB
SHA256 f0346e542b28391555f0bd5c48126114c1f8b249207d4fd18b709372e4acb6d4
MD5 d66bfa6d26c339e8959a93bd8ca8a9ac
SHA1 53065452539e8bcd929f26fe5beae009f85473ba
SHA512 b7f98d38e00c1762244ba31e1a7fea503b34cf50554fb070afa56aa87a798cfe3b97dc77eaaa23844927052662faff1e4f62e97d5036091044b6ab0cf86818ce
SSDEEP 192:LWJAlsqPh7MS5LRv/KUNAC/R0mu6pJOWOD:qAlsqJDLR3K/Cp0musS
TLSH
T1CD228424B965FF346F411F6B99B62C01661EA875723C20FED9CEB17FE2B3A040879152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0414.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0414.ui.forms
Size 4KB
SHA256 ca81db4886e63a0f01547a232b237c9eea628514d3b239f87f5ddfa7028cd6ae
MD5 b27f06069e5ea5384f6e68f9bd4a971c
SHA1 42a762137222d6f61d2d7089cd289087352f5a69
SHA512 806d9cecea24637f6acced210039ebf41a46f66230b1826ce2bafb56b3af07787e5a7db726d2a27e938118549e136fc5d6c0c9b2b2988739720928a69bd8cc15
SSDEEP 48:c0xbqGC5kJk4CrCLyA+CTLyQi2wM4WqFRI9z3IqqFzqDiaPLe6:xxGG5EEygp
TLSH
T195A1D16500225F23379557ADAEB7DC4092754E74431E681310EF7FB3B2AB56F26E320A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0414.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0414.ui.strings
Size 9KB
SHA256 ca4807372dba86d60bd360d0c018e1f4b3b3e0900706424d6e2522555921c7df
MD5 5a4dc4e674b97c743be314ad33ebd959
SHA1 d3f0804524895f7aa6d9c23a934acc8902be99b7
SHA512 0e37980292ceb8a7801e2ab006a64a004032bbdda35cf1262040aced75866352b613863238c72f7c1062ea077a64341a20723d931162043dd25704787314bc59
SSDEEP 192:FOAJWPkQbvR3HifFH+7OCmuKt/iZWIwSOLOD:/JckQbvBkHnduKEZWhK
TLSH
T109225224BE56FF216F411F6A5AB62C05261EA835B33C21FE89DE717FE7B38440839112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0415.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0415.ui.forms
Size 6KB
SHA256 ad0b3c709c61ee524af67d681f7ce34571b013d0011ca697bd9bde7cb11da4bd
MD5 a316fb7c2288944da58c15f3ff7d59e9
SHA1 9c5621ce1c1b0fc36a7636be184deece5433549d
SHA512 d769567b9272625490063f53001de0dd01c937b70ef25c929465955a49d620cfecdbf3886bcc60af90f4ed3c9b7648222218177ae214c1aecea58c34b111967b
SSDEEP 96:NxCgrCiVffJCwGk1iavNw5y1g1K1W1W1U1MwqwBI4uI46I4MI4E12IP:Nx3rCiVffJjIkWqQHP
TLSH
T1D1E1892410226F23334483A9BEF7DC8195668E70831D284611DF7FB3B6CA97E35E3186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0415.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0415.ui.strings
Size 10KB
SHA256 591ba5cbbc06e2fb9f759d688bea68b44d74b6a5f88345ad41b93ce5445f7a6d
MD5 6d7311bed26334a236f64d351ea902e6
SHA1 535f16b2799b1ba393006f1668e0613db11f107c
SHA512 60fefa0268de550b17352545aa50c55d32731610c4522484510a81dab4b6b0cd6499e0906c76dedf54c4b2da4010cb07ea7bd4d0a71d46bb5dbce4ba53ed94bf
SSDEEP 192:2ufh3lDlydWkYWqY5+jIKYpLZhBNYM7LQw0WHc6vM6yOqQOD:hZcWkYKsjILhBNhLQw0WJvZi
TLSH
T141228624B955FF546F251FAA59F23C04291E4C34B23821FEA5DF317FE3A7A080876162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0416.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0416.ui.forms
Size 5KB
SHA256 0113a2f955692a7bb3b24457c565fadafad36ca54c9036f06556fe05103b603c
MD5 d648075856a2a94cc9cbae0531ce275c
SHA1 bd01fdbaa48f1d3daef1b68092c505021a55dc77
SHA512 0639a80abc5837cfc614434ae7c7d1e97162a824eaea69e53285e4cdbaca8df9839318846a7becfcb93687f100ef56860d373cf708869f06b99b77b6a1374727
SSDEEP 48:c0xynrC7mJzffJOJfJqGEPqfq4ClCLMAmCRLMQi2qMr3Se9zIVz3IEqF+Ia+qBLY:5xirCiVffJc0GXx40MvC
TLSH
T1ADC1562500226F23379507ADAEB7DC4092798A7C471D785310EF7BB3B29B56E26E3346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0416.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0416.ui.strings
Size 10KB
SHA256 b7911bf183b9d4832a25eebd7d5b0dfcb0ae361137ffe2e7d6317815bf4bf37a
MD5 b16a60138edfa6b5a0dbbdb274ce734f
SHA1 20b9ecdfea89d205b3c8aa289de7dfb0091ae01b
SHA512 58fc52f2fdfe307e54d6f9cdbf94851831f24946001f51304924a7c91cc2269eaa9723a4b1b8976d7c9896edbf84be11cb6dc9c8db934ad72b14af20928954f8
SSDEEP 192:Jcu450LAaFKasEo2jQpF5UFL76FRUO3OD:uuF5FKEotg6js
TLSH
T104225424B956FF201F151F672AB26E01251E4D30B62964FED9EE32BBE3F78444836522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0419.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0419.ui.forms
Size 5KB
SHA256 424a8396f2ec1cfb12f2349d4d29f7061111245c2208112870a1ed5645d3cab8
MD5 38226366b2479eeb5a1d13f34612918c
SHA1 35ef7d29ad0ae6f03906f9ae4138f1a7516f6ff8
SHA512 fd2adb1886e648968cd699d6b4a456d23842fecd1b52df66e820ad97a0eeaa80b9da76e96031cf0c13d47946495390ed6c4a99208dd8a21ac1f67643eed692fa
SSDEEP 48:cQxFn7mJzffJOLqGILEZUZ4C+CLHAyCgLHQi2VM/CtILqFCqDSImMZImMNImMpay:1xJiVffJNGDvNJ+Uwuzz
TLSH
T1AEC18A6510325F23379507AAAEF7DC80A2664A70431DA81318DF3FB7B29B46F35E3246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0419.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0419.ui.strings
Size 12KB
SHA256 520c2ca7ab0161cc38ef9ad9cd4298090f5f1da811ce45908f681e1c81c1e814
MD5 30d6f3ddcd2cf54fb3c19ffa7611f2e3
SHA1 f262d63521e351f105cc47309ea5d52e6eef56fa
SHA512 8818154cb859aaa877deb3a1e57dc0a6172ab681d66dd1732b69b172a814a1b9062d44c34716d58db6a086e699bb7387de192898e47894cad310bdd68b3be104
SSDEEP 96:qcqqeL3blCRuTUBsd8LWUukvZfQXEfI/gaYcxORwXx1ggfHYdsYgGYNnVWTSOKOD:pqVUBsiCUukRolg9YxOmHAkNn6SOKOD
TLSH
T18F5246207949BE950E017F77DD607D05389E08BD373A62FA44E93A7FBAF6814463A112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

041b.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\041b.ui.forms
Size 4KB
SHA256 470f78716aeee5c8e01e2c2fd59968f7cb8d0bbdc5715011beda3734ed23c4e2
MD5 d240b7fbc3d2df1c6dc8a79f904e0e2b
SHA1 e18195857686a80010b57c9ad0bc1db080036358
SHA512 69f2d3547ed7257946f010523647fc6f34b609326eddb5e671bb8946f5edfe8267af1595b855b2c30b2c34b5505cfe22990c6fa4b0e09b3b8b668aa20c4f4a49
SSDEEP 48:cMxg6fxIz2j24CxCLoAGCtLoQi2mMqkIZ6fQ6MaP6fo6fsLZ6f9a6fy:ZxpxzbEB3Zy
TLSH
T1B5A1F26500225E27335547ADEEB7EC4496794A70031E585310EF7BF3B29B16F2AE3246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

041b.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\041b.ui.strings
Size 10KB
SHA256 9296ea61a082bd479e296c0225e68be4f3539939f9265fd6c69288b2e23d560b
MD5 65f3cfee0e1130fbef905e2a15e0f52c
SHA1 51126ac4318f684658d08f4cc8b22ca2295fcf88
SHA512 9ef1b687501003f86e1455016e4ecb1534903a49971077aa9e1e8c1eb4fb95bed263ea778fbc5f38f516b04c60408be5d272fdf76ed3057e7305f6755fcc20ef
SSDEEP 192:GBVQPWbcxQsXBEidgFhuS4nEeFukGOHOD:GBVkHvdgvuS4Ee8kq
TLSH
T18E228826B942FF199F561FA659B23D00A61E0D70732961FE95CE32AFE3B3D090835252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

041d.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\041d.ui.forms
Size 4KB
SHA256 8ba46efa6a843edfc1bf10ad537f72caa05c38c05a045989083c328d5418482a
MD5 824101607fde78b6d678d469826edbc6
SHA1 43a00c3d97a024f30947c9f18571498534443182
SHA512 038f21003c794ebbcdbbf3b36630c86c9d255bfd3a38f66f598eafc9c1fbde43b39fc8a51e50d3e5c070b3fc316717493c22f582974d112250af75a576103aa3
SSDEEP 48:c0xLYyJ0504C7CLiAeCjLiQi2AMP3IKIa3jcDSaPLeK:Rx8pUJ
TLSH
T1AEA1F56580225E23379547ADAEF7CC40D2754A74039E581350EF7BF3B26B26F2AE3206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

041d.ui.strings

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\041d.ui.strings
Size 9KB
SHA256 32fbdce03c562b56adb7133611f344d32f2f82ddfc5a95bd2efeab0deed61419
MD5 a3e168d999f5053c84d89dfa88d1b832
SHA1 a7116da4a51ecef6d0cbb39f2377666c59d61d42
SHA512 108d31eb37712100f15b569c4e9aa1b698d807ed29603e275fb631196dd1adc046f2f5e3b3de09d34d0c126e93d37df299354fa142a7b9320c32db1ea5191f25
SSDEEP 192:TxGUIpvOveEn7nW9Le+wVOmnSiKFFrKuKh77Ovm6Z/1uawFCVvmxTiHF06COuOD:weV7n+C+wVOdFgpC//1SopDrf
TLSH
T14B224635BA21FF206F161F6B5AB12C01256EAC71722970FE95DE717FE3A3C480976122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

041e.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\041e.ui.forms
Size 5KB
SHA256 4c548a4d7145824182c175cc0edf25185b26ec915e4b1af47f9f421af23b3fdf
MD5 15d2f91e63a20a0efb1332cef8fc5234
SHA1 77d1d568656e9751a43232ba27f5a7b04e9490ae
SHA512 996840ba42864e986e1dda3743270c8b87cf9567d2a74e6e016bc0541ccdc53cb79fba423c123a84ef656b22c98e72511822547f9e00c5c4dd626f240489d70d
SSDEEP 96:NxS6RoP1x0IIGwIi1w161m1m1E181pIfeIfKIf8IfLIE:NxS6RoPsIITIiGoMs66vIWICI0IjIE
TLSH
T103C1257550225F233B5543AAAEF7CC4096B58A70831D684310DF3FBBB29A57E25E3286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

041f.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\041f.ui.forms
Size 5KB
SHA256 6420fe869527e44dc7e1b6eb8b6d94b26d1544bcfffd7728b701645b6881430b
MD5 64bbf5bba61af7fc491f4ddd975b8cab
SHA1 8e0f678bda075bf3ff3bdd2255da2f8c3a98a718
SHA512 2fcce65f5c3964e5bb8bac1ba741c9bdd7354351955ee25197f0e9450ca6423588e43ac1db04aa0087306b1764b58290c85f9ecc311011bf0a18d6071290753d
SSDEEP 48:c0xlfx0f6P64C1CL8AGChL8Qi26M2QqFRg9zXI0fcVSRS1SEaLS9La+z+KV:5x9xHKUBkQESAB
TLSH
T14DB1356500335E233B5903A9AEF7CC4892B54A70431D680B10EF7BF3B29B56F66E3246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0422.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0422.ui.forms
Size 5KB
SHA256 6adf510fd6bbe5a3b00598e03fb53629da8727e4edc0f57c8182d4d27af51872
MD5 61f1f7f05906dbaecf2f1df56e6f0c5c
SHA1 0ec66aa374bb0c8311299128d318adf3b40abae7
SHA512 4e4d8cf25b37b29cb6641c69bf7b9c37d67ce602e9caa64f69ce798248e9cb5e2593bc820a402d3848d55b236d9fe3334beac74e361d20399369425220fe6469
SSDEEP 48:ccxgJ6MtG6mj2j4CICLRA6CeLRQi2nM9o6MRn9CIM6M84nQ5nQdnQTaOnQjLM6Md:RxgGhOkwm/R
TLSH
T1B9B1461120225E33339643ADAFFBDC4892B69A74531D650701DF7AB6A29B57F32E3206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0424.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0424.ui.forms
Size 5KB
SHA256 db42b00b6a3f61d3fae5c7a5615e137420dbca71fd524ee0b1020cc28e07d179
MD5 a9552fee16916bcd449f137fbdb9b876
SHA1 e7dd8ac415fd12a0c4740b380fcf29728c9d9282
SHA512 60f50d1d0166af1c68c739ee8cc1fd859d87efbe202ae9e1402a28f86461b7a1cfceaf8c3d201f1ba35c71ee71aae5ec04ce90ceeec06332582a542929ef98e0
SSDEEP 48:cAxsfxq36yk5054CCCLbACCULbQi2ZM59zXGMI3f/WI4HyI4H2I4HEaEI4HeLQZ7:dxQxPiiBugEuX7
TLSH
T114B1275520225F23335653A9AEFBDC4096BA4E70435D280711DF3FB7B29B56E31E324A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0816.ui.forms

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\0816.ui.forms
Size 5KB
SHA256 5a64b454dcb1d0d1115986d8163bf6cbc869eee253a36cba74f7a11cb2ef54b4
MD5 59a7117c4a430d1e115ff20be16d4807
SHA1 748f74e3ca762b9ba4472d1d67f874a0e4933a59
SHA512 18bedd5e1531d0f30ef0acef4c1e8fe9199236f14088a819cdaf567fa5ac58e2bd044ee920bb11721d29de7690bf9946a5a59fd776cb0fa0d4a1230688eb4ee9
SSDEEP 48:c8x+nrC7mJzffJOdfdqGF3eHZrW7W4CRCLwA2CtLwQi2+Mj3Fe9zkUqFRI9zfIQt:JxurCiVffJQwGT7w4EIk
TLSH
T186C1452500326E23379507BD6EB79C409279CA7C471D286218DF7BB3B29756E22F3306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NVI2.DLL

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\NVI2.DLL
Size 6.5MB
SHA256 143f29b7637693591181a633789691f4faa3800e1c70c5a47cb54d3d12ab3c64
MD5 ca1decfb8660d9dc53dc09e725ab7283
SHA1 8a9029eed0593ec68e4f84f382cb0f4f66172420
SHA512 cb5e0c6fbfd3704410fc6603acafc5954d44314e2147e5b97a266067dccf66aba4f28846f1ad6eb6918e6408b0b573ef90e14fb6ead6b3243e6c532a08b15361
SSDEEP 98304:AZPVxYMzQcSMpqqEIp0Lbkzz1Q3pG9H5ARa3tq8khcku4FRAdy4K2d/+:m4MccSM4qEIp0Lbkzz1Q3U9M9D8+
TLSH
T18F665B322749CA2BD56F06F16DBCEB9B905CB9710F3480C3A3949D6E24754C31A3AE67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

presentations.cfg

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\presentations.cfg
Size 1KB
SHA256 224d338dd5d6920d6c9656aea73c98ed214941a2d71fd153a7b44f888e5fb6c1
MD5 e96d2c33dcba5bfead4085c785cb6e70
SHA1 e4e1122ec78b6a15f21f7714672184017c06e515
SHA512 0f569f7b2b1648dc611237571e0b32622d4907aef57fea81185321f943e73b31f93c1b546cc47d262dd7bd68bfd0d56f8a9d766e8e04623cb5f681f7c107e957
TLSH
T19A213FA4FCD47F714E098E775872546C326EDC20793A10B769FA313FB28250A7D35662
MD5 SHA1 SHA512 TLSH

Submit Download

presentations.dll

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\presentations.dll
Size 977KB
SHA256 4856a9d77eea3c4fdfd2166dd6c94a37a78c17df6ba7c0cd884d5f0bc545b624
MD5 cb72421c9db2452359a16208e2caf4a7
SHA1 c6e60c64f50a4e3a7e00b4d3e4bb99f165053058
SHA512 b25a3b6ca4b1b864b68de8907e2bf4288b2ea48798b339e86ad55ce9a9ac8e357c24231e041caa7a6d40f27a4520baa5b1e8b8feb4aafc4b79498273fb57c73b
SSDEEP 12288:xtkmwCV9czh+zmR75IS0TJnsPeZQuZ+F/4i1xnIa2n9WI6LIwj8i/:rRN0wTJ7u/F/4i1V72C0wj8i
TLSH
T15B257E203E89C537DA7E02B19C3D9A6F107DA9750FB044CBE3DC5A6E6A788C34632957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

progress.htm

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\progress.htm
Size 15KB
SHA256 f392f634d05139de62d5a99fa9bf0b77c242e5132fdae6d4980fea802806cbac
MD5 86ae0235546b916e0d9fea4d04e39abe
SHA1 466522d8fe683911898b426a607789389dee69be
SHA512 527bc5df986a23af5af6f0cac0dc0fd4258101eb62d590eb22f678feb800fd03ac04758c0c5e3d2d6e9d8d3450689e9f40e776c163b6fd5200d5f7bfc5cf8a42
SSDEEP 192:kM4UgWfC26g6exWKz8UC4kXU8HcVLzZmW80Kz0nP:z/H88VLzZuzgP
TLSH
T1CC72FA4DBCA05055D9337378AB2F4218F67612232A978E457FEC82447FB25158EA2FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

theme.cfg

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NVI2\theme.cfg
Size 8KB
SHA256 a262931f801819be54f713c5e39528511605d7b3c03fa9e7b9f28dc7e47b66d3
MD5 90325df24417648f8aab6266950528b8
SHA1 805fecaf425c83cd833ca5c5286623b3fe8923ea
SHA512 93b0c67a8c21f32b435b4bec8e060353ed6bc558d991334845582c8ba25f5703f6d86e8296800a22774104a29f1713ea0161e3fad98e6d66052b10ae25a0ad7e
SSDEEP 192:GlWESFt1pBkizu4IlYQ2wXAk6gaUn+JI6ktUWUCMmju+RsGEhj:GlzItPBkizuzYQ2Z
TLSH
T1781238913026BF111FD94AB36DFA7C04551EACB4767C6DF2C0CD33F6A2A2A590672706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriverUpdateRecommendation.json

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NvApp\CEF\config\DriverUpdateRecommendation.json
Size 87B
SHA256 b5b12e4b06e3f99b9cd8b1b64fca5b6faf2e35293885198785ec5e22ff7871ac
MD5 8d488b694933b802eb2e100f11714ac5
SHA1 0744fc44fd796a734dadc7ee385115afd4959f16
SHA512 413b3467dc84d069094bfcf11fae7df9617025b3c508dd49901ab01851be4e90182949dd3f73ca35b5b8bcfb4a45226044b6c18726b678e0888edbf7c54d5075
TLSH
T1CFB00194A8B258CA78DC1ADA406D2A8F6DC64417ABA419A4202B1997463EB690226D62
MD5 SHA1 SHA512 TLSH

Submit Download

FunctionalConsent_en-US.txt

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NvApp\FunctionalConsent_en-US.txt
Size 696B
SHA256 ce130056f99a0ae7c572c83197ede96a688b0bfa4f04531db12a023caeb6d8cb
MD5 1d61fb490dc284eda3135b966a9cd046
SHA1 72c8973a11c5a7835716b4449e06f246e765e7a1
SHA512 0647f30c692d69bd951200bb2556e312f1bf898ebca26213d7e48127f49734776bb1e4f51df16d4e3a0c0d95ba44f321ea61346f7208f1f40773a5db937b5bcc
TLSH
T1E301F49FB70904CA169311BAEAD559D17963DA4C227E1C782875400C13803A5E36F7C4
MD5 SHA1 SHA512 TLSH

Submit Download

PrivacyPolicy_en-US.htm

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NvApp\PrivacyPolicy\PrivacyPolicy_en-US.htm
Size 164KB
SHA256 707aa636d174b7d4056baabc134b073d0b792ac1bec447559e3c323afdc68429
MD5 c5828bae57eceb2b67d4e02baad1b553
SHA1 baf245981722964d2cd560e9e95b5b56e636f490
SHA512 22ce68b01a7287b0d77ce329c3727c4ec46b8fa3d0805c3e785b5034bdeff2af3c4efeaf1afc3725ff7c952d39fc5c633e4552942003636f6ea47c6dc1d693e8
SSDEEP 3072:i4J+03jL5TCOauTwDhFdnCVQNLa98HrtfL:I0zEOQR+iLa98Hrx
TLSH
T1B1F32CE5F2C13112527720F8A2BB9A07F6B9D05BB20D48A0B59C85D63F74E59A233F5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EULA_DD_NvApp_en-US.html

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NvApp\Unified_EULA\EULA_DD_NvApp_en-US.html
Size 73KB
SHA256 2b24f6513f3a4fc2b35b00406519b061370dae9f5a19026de5ab3987c81270fc
MD5 236ec10b2ff530a447f36c025e68f413
SHA1 9cf056a6a10554f9b618e13c7c81aa2715ffbcc1
SHA512 8f8aa16ab1fcb9c711b9618ef50d4f9fbdc98f8fad0f2f776f236caf65eceab333db46832e3f05c8c693b2056fca00e35e48531eb87f4a04e82962f89371e5d1
SSDEEP 1536:DsxXg2eQ8NgPHbC7XuSZOyQ7NSz+NLNmNTJNNe/+/8se+YoW4WcBFmbu9EMzaLev:l2Mv
TLSH
T1B373D722A3501123519200EDB60B4BE8F29AD459F757F571B0BF61BA7F5A4B0272E3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Marquee_Hero_Image_Gradient.svg

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NvApp\www\assets\img\Marquee_Hero_Image_Gradient.svg
Size 68KB
SHA256 ccf2b77b27e7f5a297f14e2643131686a1f48bc52c1127baa447f3527408466c
MD5 3f03b5fa3d228e924ff4ac0a034c0669
SHA1 ecc1f84198f79323e2d91fd4fe1842468074eefb
SHA512 c34c0db11b355e1bb82f4c766a074f0fd010849817c440a2194292c764a0f21648c288f1c89b25c9ad6230259f4d071c09c27d1bf98de0dd0a6b2f92866b310c
SSDEEP 1536:WfuTw+NwB+Nm/j9CzX7oqACfMWUlfAjHnZ8zQdnHvU:hTwm18IzX7/nZnHvU
TLSH
T18863CE33038F6A9BBB235C92C42077200EB5B9E79764E6C97DD558A286BF340CC18D79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Marquee_Hero_Image_Gradient_RTL.svg

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NvApp\www\assets\img\Marquee_Hero_Image_Gradient_RTL.svg
Size 68KB
SHA256 2c83cfbe96ec803325d6a0ebd62f23ecf44cedf6ecf70e405ecf4152a3f6d1cb
MD5 27da811419713779cc4465014484bdb5
SHA1 019f8834f8ac75cd0b8c161c18c1bc6ba671e5d9
SHA512 cb9b4cd6d19c39ff178a2044d00fdad9989218cf13ae7624a83ad082900dfeafd7d45e4e9ea79dd0e39c42afac4b1c8a738a131f4b3f7d6c6922b023abb53121
SSDEEP 1536:mfuTw+NwB+Nm/j9CzX7oqACfMWUlfAjHnZ8zQdnHv/:RTwm18IzX7/nZnHv/
TLSH
T1CC63CE33038F6A9BBB235C92C42077200EB5B9E79764E6C97DD558A286BF340CC18D79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile_marquee_hero_mask_ltr.webp

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NvApp\www\assets\img\mobile_marquee_hero_mask_ltr.webp
Size 43KB
SHA256 69cc5690bdcb4a8cd8e05a44f429899f7a36b098e80e4315d83049f7e17acafe
MD5 1fc534c4904958ac5cebd68166f86f6f
SHA1 d3b9b610948e2b47734fa3789c675657c5fa5320
SHA512 a330b6c320d042fee165dd05ae51f938ee2ac7aa41c3e504345b0600405d307c85fa277d7131e4c308541e63d97d44f2acc2ddc8c9f1c5affb3474f1cce82702
SSDEEP 768:sYy0VoQEM+fSAE4+MgE9MSaGDkNA00SgkM72mKWg6803V9Criyb5jDXw9fzqfC:sQBEM+qjPXSa8k+NMcvZ8qGj5AfzkC
TLSH
T15013F1FACF8742F6D503C5BB03B0E706D923C29E53EC8984696D37B65E2A7452D8E045
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile_marquee_hero_mask_rtl.webp

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\NvApp\www\assets\img\mobile_marquee_hero_mask_rtl.webp
Size 42KB
SHA256 1428f5b98ee6f731d7c915d3eb3a47408a0bd32bb921d7c15e100cc690c3f4e8
MD5 b7fe274b0bba13d81ffa004bc449cc22
SHA1 3532ae94a13835f888cc8755aa87619bcc8284fc
SHA512 42f24271c9fe3f39214e252bbe3b3528560f301522dc9dd96fefed6918e8e5776fc4d248218cddb528c620156505da68844d798a15883b396f025b5e48c62d4a
SSDEEP 768:LYy+k1TNh+g48lZT8iG4FCf7WUuw5MjTywaM1Cly0Ri/vyAk/A7P9au9xdP:Lqk1ns8lZT8h4FQuwejTyNCL0Ri1k/hm
TLSH
T13213F1FB84D9FA43CED393BC3AF46E6DA1527A66B36597841AC1A231245D48B3C5C00E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.CFG

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\setup.CFG
Size 72KB
SHA256 11d675347b38c1bebb497430d4d6844a2334b06c52ac5d528f0b5e72152766f5
MD5 fccac8803d043a1fd518caaf8aec814d
SHA1 97e85d2e16d372d208290e1527be82bada200ba5
SHA512 fe967d9adece630caf2a58bbf0cae33913b15e4e2e152ec008a6bb8a24815fb2adaeb87ddd9cba35e4bf1259e0378ad6e9b78fca746034e7a3ab3bc3fd05feed
SSDEEP 1536:WVzQKg1ZB1WPpUX0nLtEkIS7l024FwgFlq2fnkABxj5x6Dam:wwaHu2IqU9c
TLSH
T180732D25719CBF280F840FA3AEB43C41A45FEC75633D22EAA1DD30BBB2E78685576151
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Windows\Temp\768b2471-7f7c-4832-8959-800034de9bbd\setup.exe
Size 646KB
SHA256 7da8c03d78d16aafa95563f7d6c3bf28e9a36f248bd401f1bd53335bfa7237d9
MD5 7a3252fa6e8e7846727947a98b78c7f6
SHA1 348e6af3a9c03a6c298867ab604b24bde37d5d9a
SHA512 7f8fff41ac9c835e73155f628d6e0760ad36c28d941121dbb169c113edb8e73131c164b09b34e38953c9c1d5e6e8baf76f086710c28318938d504fefbc4777c4
SSDEEP 12288:55Q89Y7dlafkxsOuWrOkM52OKX4s/MKFyXqyhyKyVkKB0HajaOQxN:lesOuWakNQVVavj4qaOQz
TLSH
T111E48C213AE5C43AF5B357306EBEDAAA182DBE600F3484DB7BD4491D19706C25A71B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads