Analysis

  • user interaction
    yes
  • max time kernel
    178s
  • max time network
    181s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 23:15

General

  • Target
    Nightingale-SAMPLE-DO-NOT-RUN.exe
  • Size 32.5MB
  • Sample260714-28hsvsfs8r
  • SHA256 1fde25d50e3c2a5570ba281f5fde318d74b0a5dc9b6954bcf8fb9cbc29d938b6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Drops file in Windows directory 14 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nightingale-SAMPLE-DO-NOT-RUN.exe
    "C:\Users\Admin\AppData\Local\Temp\Nightingale-SAMPLE-DO-NOT-RUN.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nightingale-SAMPLE-DO-NOT-RUN.exe --webview-exe-version=0.8.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2668.3856.7365282117459850685 /pfhostedapp:75bf2724b802a8df85f00250780467af74004d57
      2⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:4808
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView /prefetch:4 /pfhostedapp:75bf2724b802a8df85f00250780467af74004d57 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa77a95fd8,0x7ffa77a95fe4,0x7ffa77a95ff0
        3⤵
          PID:4656
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView" --webview-exe-name=Nightingale-SAMPLE-DO-NOT-RUN.exe --webview-exe-version=0.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1736,i,17068909927386004332,531728242618309656,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:75bf2724b802a8df85f00250780467af74004d57
          3⤵
            PID:4248
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView" --webview-exe-name=Nightingale-SAMPLE-DO-NOT-RUN.exe --webview-exe-version=0.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2180 --field-trial-handle=1736,i,17068909927386004332,531728242618309656,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:75bf2724b802a8df85f00250780467af74004d57
            3⤵
              PID:2168
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView" --webview-exe-name=Nightingale-SAMPLE-DO-NOT-RUN.exe --webview-exe-version=0.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2400 --field-trial-handle=1736,i,17068909927386004332,531728242618309656,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:75bf2724b802a8df85f00250780467af74004d57
              3⤵
                PID:3580
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView" --webview-exe-name=Nightingale-SAMPLE-DO-NOT-RUN.exe --webview-exe-version=0.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3496 --field-trial-handle=1736,i,17068909927386004332,531728242618309656,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:75bf2724b802a8df85f00250780467af74004d57 /prefetch:1
                3⤵
                  PID:1212
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView" --webview-exe-name=Nightingale-SAMPLE-DO-NOT-RUN.exe --webview-exe-version=0.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4748 --field-trial-handle=1736,i,17068909927386004332,531728242618309656,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:75bf2724b802a8df85f00250780467af74004d57
                  3⤵
                    PID:4148
                • C:\Windows\system32\tar.exe
                  "tar" -xf C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg.zip -C C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg
                  2⤵
                    PID:5900

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      config.json

                      • Path C:\Users\Admin\.nightingale\config.json
                      • Size 621B
                      • SHA256 5ccc26900c3c8093526a9df3e89473bbe2c4bbe574ca75961006b0be7eea6bbc
                      • MD5 SHA1 SHA512 TLSH

                      nightingale.log

                      • Path C:\Users\Admin\.nightingale\nightingale.log
                      • Size 231B
                      • SHA256 fe66e3fd6c417ded07d206ada8cb9c669f0d4792394ebfc664eaf10eedec74d9
                      • MD5 SHA1 SHA512 TLSH

                      LICENSE.txt

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\LICENSE.txt
                      • Size 34KB
                      • SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      bootstrap.min.css

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\bootstrap.min.css
                      • Size 106KB
                      • SHA256 3cedecf2b8064b4a56ba47bda04544e1b21d71c83a12e7b5709e7c7976ead70e
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      community.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\community.html
                      • Size 13KB
                      • SHA256 ed1a149ca1f5129e31b71f7bf6547a690bbefed1f94b24d3b6cf15b9b5e7cac6
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      default.css

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\default.css
                      • Size 2KB
                      • SHA256 504c4a0980e6ec809da02ce16b73151622a2fdfb4409098c7ce96c1cac9b3735
                      • MD5 SHA1 SHA512 TLSH

                      developer.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\developer.html
                      • Size 64KB
                      • SHA256 cc14a87cf4bb8d9e4509b4f9a7b2ade08015e8e93392dc72a0352a3daf0369ec
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      drawvg-reference.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\drawvg-reference.html
                      • Size 143KB
                      • SHA256 e63e3aa79935d162c5e29e8feac866ae899ae0073f45595b3a029b42a897db90
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      faq.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\faq.html
                      • Size 63KB
                      • SHA256 12e4eaa685c874b975e9ad774aabd588871088a877f531ba2f7aa628b1670c45
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      fate.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\fate.html
                      • Size 18KB
                      • SHA256 603ae75dc972d486d4901c222ec881d6bb903058311dfcc9cda9f6471c50e3aa
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffmpeg-all.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffmpeg-all.html
                      • Size 2.9MB
                      • SHA256 67ab1fb36aac3368f0622a7bb79b0eb654dec4438bb5d213718df309d712038d
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffmpeg-bitstream-filters.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffmpeg-bitstream-filters.html
                      • Size 61KB
                      • SHA256 6783e37c2cafaec9337ac5188d72d1722b539f5bff9c08a1542ae0ec32bfb545
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffmpeg-codecs.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffmpeg-codecs.html
                      • Size 340KB
                      • SHA256 1e0c1482d7c0df446173268563f515dca6ed6dedf62b114a834d04ecb8aecfa9
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffmpeg-devices.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffmpeg-devices.html
                      • Size 110KB
                      • SHA256 be6b5fbc2cd3658d65ca0ec2d1ff6243ecee80bdc71b4cbac9843ddd44dbb8c4
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffmpeg-filters.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffmpeg-filters.html
                      • Size 1.6MB
                      • SHA256 03f0f344718e919ed70e4d0a7e1d87781569c0bc5fa03bb52ecc32c01a627f76
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffmpeg-formats.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffmpeg-formats.html
                      • Size 330KB
                      • SHA256 82b36706871571cf809586c6d6164f4c604fdd4e68b5a511bfbef1e905dabffc
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffmpeg-protocols.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffmpeg-protocols.html
                      • Size 119KB
                      • SHA256 cad8660b00c0476d92471c658d922190655afa636b0da48a19086cc5046ca9a9
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffmpeg-resampler.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffmpeg-resampler.html
                      • Size 13KB
                      • SHA256 ef33b5c00313e980fd8bef875e48ad49534f8d4da3acd62c2cb121cf2f767986
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffmpeg-scaler.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffmpeg-scaler.html
                      • Size 12KB
                      • SHA256 77a322683a61362bf302e67fe62560f6c5a4ccb7ef944f5fb7e2e797685436ff
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffmpeg-utils.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffmpeg-utils.html
                      • Size 54KB
                      • SHA256 f0acb1ad146da71c65450b975f6e7e102eed03ee40eb9163e5d7b70df2e82146
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffmpeg.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffmpeg.html
                      • Size 214KB
                      • SHA256 dfb1cc19861eda62b09c8ecdd8d559cdbe5a47ce888ae384df98d9abe06888fd
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffplay-all.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffplay-all.html
                      • Size 2.3MB
                      • SHA256 bba80f96f8643b39f743ae466abcd1ae20a715f2518038b760f87594d1628603
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffplay.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffplay.html
                      • Size 41KB
                      • SHA256 c94ff755a36c9028aeeaf93f853df75450c23962a7bea43b6ae0177684195c37
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffprobe-all.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffprobe-all.html
                      • Size 2.3MB
                      • SHA256 0cd3868d7ea1a88aca340762e6ca5aa69661aad8c9a6ae14d104ebf4eb99e693
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      ffprobe.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\ffprobe.html
                      • Size 57KB
                      • SHA256 ca1dead6f3c6b93f6245ce6be3101ca2e176c69c768579a8d0d2383b57884763
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      general.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\general.html
                      • Size 126KB
                      • SHA256 0da20102efcc3435badffbe91d57672d3e41e459dc7122d583def2778be970dd
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      git-howto.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\git-howto.html
                      • Size 27KB
                      • SHA256 e44ed6484fa73f819c59494c68be232728319250bd86c6e32a760ddca620e108
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      libavcodec.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\libavcodec.html
                      • Size 3KB
                      • SHA256 faf8dd1ae157374e92a685970fa28f21e0df8a2dfb8c3ea99e58d6d956bee879
                      • MD5 SHA1 SHA512 TLSH

                      libavdevice.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\libavdevice.html
                      • Size 2KB
                      • SHA256 cea441629a753d099d8b1032f0814a87cfa113d830f8fcdebd047738cb5481ac
                      • MD5 SHA1 SHA512 TLSH

                      libavfilter.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\libavfilter.html
                      • Size 3KB
                      • SHA256 d02ec4ed1dddb7cb09f9c4e9f2bf38810b3050f6db5f839f398bd6561cab4322
                      • MD5 SHA1 SHA512 TLSH

                      libavformat.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\libavformat.html
                      • Size 3KB
                      • SHA256 49f9fdced269207bfd3a6bcb63738b3f1dcf2b3c7641eba509fd46f37c5cebcc
                      • MD5 SHA1 SHA512 TLSH

                      libavutil.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\libavutil.html
                      • Size 3KB
                      • SHA256 ba59342959874520f152b8df5eedde47295929a43e29646392e03c6fcdc2d8e9
                      • MD5 SHA1 SHA512 TLSH

                      libswresample.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\libswresample.html
                      • Size 3KB
                      • SHA256 f66d2d2e5f29ba56f47d2855d5cd8f276bf207241d024a5a06d0564b96d52bf5
                      • MD5 SHA1 SHA512 TLSH

                      libswscale.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\libswscale.html
                      • Size 3KB
                      • SHA256 41859c7b95dd3d1089e2189c2dc81b1da920557e66ec181a1f8fe04dcc829118
                      • MD5 SHA1 SHA512 TLSH

                      mailing-list-faq.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\mailing-list-faq.html
                      • Size 30KB
                      • SHA256 e6a26273f248a5ca7f4354fc8b19e4d0bceeefc3c7aa492db58072fdc9e6a944
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      nut.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\nut.html
                      • Size 10KB
                      • SHA256 97706cef7a10c32fa781aca5242443868c003858c84b41629e7c04d77b2b0d0c
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      platform.html

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\platform.html
                      • Size 21KB
                      • SHA256 8d6c71e3d28c52cddd7de85fcdbbdd87d22a02fa9905a6b3169ff9767033fd6d
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      style.min.css

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\doc\style.min.css
                      • Size 6KB
                      • SHA256 02496d7bdbd48d0f332dc94b62668906cbeabc3a8592253d5dfe2e5196522660
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      libvpx-1080p.ffpreset

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\presets\libvpx-1080p.ffpreset
                      • Size 227B
                      • SHA256 cf0dca9d029e0aa29c242e5a7ecfb202a55ae41c1acdf5e2e59bf281a0136251
                      • MD5 SHA1 SHA512 TLSH

                      libvpx-1080p50_60.ffpreset

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\presets\libvpx-1080p50_60.ffpreset
                      • Size 227B
                      • SHA256 4d32bed9032caf8bf4ef8e4bcac427f482c6191396ef6b11f075a264da3a8def
                      • MD5 SHA1 SHA512 TLSH

                      libvpx-360p.ffpreset

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\presets\libvpx-360p.ffpreset
                      • Size 219B
                      • SHA256 c2ccd70a941c9b7003e364d7cc0296e8f3dea78cc3a87ccdcaae7c39a1a05b79
                      • MD5 SHA1 SHA512 TLSH

                      libvpx-720p.ffpreset

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\presets\libvpx-720p.ffpreset
                      • Size 227B
                      • SHA256 5bcac409c81ec0e11091801d5d1322b5ec6a9bb8617d7dda022acfea0d498d52
                      • MD5 SHA1 SHA512 TLSH

                      libvpx-720p50_60.ffpreset

                      • Path C:\Users\Admin\.nightingale\vendor\_tmp_ffmpeg\ffmpeg-master-latest-win64-gpl\presets\libvpx-720p50_60.ffpreset
                      • Size 227B
                      • SHA256 b08a5ae448cb3cccd23faa6f42c8dbf61ead1a8381fce65636aa01a4a142cb8e
                      • MD5 SHA1 SHA512 TLSH

                      settings.dat

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Crashpad\settings.dat
                      • Size 280B
                      • SHA256 32e81b7b97b72833e20d549c601ac038e60b7c4caed5e0772433a7bfb0a0228b
                      • MD5 SHA1 SHA512

                      settings.dat

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Crashpad\settings.dat
                      • Size 280B
                      • SHA256 eda8fc3f6e29e46022ea57ffba76adfe04933c050f0b5639ed20eab5835e3f78
                      • MD5 SHA1 SHA512 TLSH

                      throttle_store.dat

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Crashpad\throttle_store.dat
                      • Size 20B
                      • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                      • MD5 SHA1 SHA512

                      947c25fd-312e-4919-9de6-8cb23af472c5.tmp

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Default\947c25fd-312e-4919-9de6-8cb23af472c5.tmp
                      • Size 6KB
                      • SHA256 939bafed2cde83cfe31506ff6862f355a70ab08c0003ee4dd933dbf5f5802b08
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      the-real-index

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                      • Size 72B
                      • SHA256 359755584b2f74b30f16228ddef2b28d4187c450438723c6c58f3f7f47f1ae75
                      • MD5 SHA1 SHA512 TLSH

                      the-real-index~RFe591ce5.TMP

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe591ce5.TMP
                      • Size 48B
                      • SHA256 275ca20a4758dfed48329d1f7c31e7a4194b78c590a14831a2f961c9dd762a04
                      • MD5 SHA1 SHA512

                      CURRENT

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Default\Extension Rules\CURRENT
                      • Size 16B
                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                      • MD5 SHA1 SHA512

                      Network Persistent State

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Default\Network\Network Persistent State
                      • Size 111B
                      • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                      • MD5 SHA1 SHA512 TLSH

                      Network Persistent State~RFe59f340.TMP

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Default\Network\Network Persistent State~RFe59f340.TMP
                      • Size 59B
                      • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                      • MD5 SHA1 SHA512 TLSH

                      SCT Auditing Pending Reports

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Default\Network\SCT Auditing Pending Reports
                      • Size 2B
                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                      • MD5 SHA1 SHA512

                      Preferences

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Default\Preferences
                      • Size 6KB
                      • SHA256 c084723c97a49cb01e796b752723deaa95ca74a5a6e5a1278e88782692d21904
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      MANIFEST-000001

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
                      • Size 41B
                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                      • MD5 SHA1 SHA512

                      data_0

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\GraphiteDawnCache\data_0
                      • Size 8KB
                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                      • MD5 SHA1 SHA512 SSDEEP

                      data_1

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\GraphiteDawnCache\data_1
                      • Size 264KB
                      • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                      • MD5 SHA1 SHA512 SSDEEP

                      data_2

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\GraphiteDawnCache\data_2
                      • Size 8KB
                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                      • MD5 SHA1 SHA512 SSDEEP

                      data_3

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\GraphiteDawnCache\data_3
                      • Size 8KB
                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                      • MD5 SHA1 SHA512 SSDEEP

                      Local State

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Local State
                      • Size 2KB
                      • SHA256 08118ef3b85b33cafa16de3c0a8c41bd110764219805db0b8b08d630e8f06056
                      • MD5 SHA1 SHA512 TLSH

                      Local State

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Local State
                      • Size 3KB
                      • SHA256 f7e667c9634b516728650a2ebcf4182d83d1d583bcdd24673d2da0f6ea5679d5
                      • MD5 SHA1 SHA512 TLSH

                      Local State

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Local State
                      • Size 15KB
                      • SHA256 c9e7d6ef24d853c1beab5abfcd9fb3e9f5f4f66bf0664ff946b4693e215cd9fb
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      Local State

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Local State
                      • Size 17KB
                      • SHA256 259f485d81a3f613de15a5b191bd728f92de54356044aa6bb82eadff7a73ff85
                      • MD5 SHA1 SHA512 SSDEEP TLSH

                      Local State~RFe58cbd7.TMP

                      • Path C:\Users\Admin\AppData\Local\com.rzru.client\EBWebView\Local State~RFe58cbd7.TMP
                      • Size 1KB
                      • SHA256 e93698b074f022b6c033ecde86bf3abd3c2e91370f82fe2ccec3e538de3980b8
                      • MD5 SHA1 SHA512 TLSH

                      memory/1212-124-0x00007FFA98D00000-0x00007FFA98D01000-memory.dmp

                      memory/4148-572-0x00007FFA98B10000-0x00007FFA98B11000-memory.dmp

                      memory/4148-571-0x00007FFA98900000-0x00007FFA98901000-memory.dmp

                      memory/4248-36-0x00007FFA98D00000-0x00007FFA98D01000-memory.dmp