Overview

overview

7

Static

static

3

XSpammer-W...er.exe

windows10-2004-x64

5

XSpammer-W...er.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/app-64.7z

windows10-2004-x64

1

$PLUGINSDIR/app-64.7z

windows11-ltsc_2024-x64

1

LICENSE.electron.txt

windows10-2004-x64

1

LICENSE.electron.txt

windows11-ltsc_2024-x64

1

chrome_100...nt.pak

windows10-2004-x64

3

chrome_100...nt.pak

windows11-ltsc_2024-x64

3

chrome_200...nt.pak

windows10-2004-x64

3

chrome_200...nt.pak

windows11-ltsc_2024-x64

3

icudtl.dat

windows10-2004-x64

3

icudtl.dat

windows11-ltsc_2024-x64

3

locales/af.pak

windows10-2004-x64

3

locales/af.pak

windows11-ltsc_2024-x64

3

locales/am.pak

windows10-2004-x64

3

locales/am.pak

windows11-ltsc_2024-x64

3

locales/ar.pak

windows10-2004-x64

3

locales/ar.pak

windows11-ltsc_2024-x64

3

locales/bg.pak

windows10-2004-x64

3

locales/bg.pak

windows11-ltsc_2024-x64

3

locales/bn.pak

windows10-2004-x64

3

locales/bn.pak

windows11-ltsc_2024-x64

3

locales/ca.pak

windows10-2004-x64

3

locales/ca.pak

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    151s
  • max time network
    119s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 00:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    XSpammer-Windows-Installer.exe
  • Size 71.5MB
  • Sample260714-bae17sdz2t
  • SHA256 2b34af774ce56ea57402014d840dd781da514c09e1312a7eac2012fbc61429ab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 18 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XSpammer-Windows-Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\XSpammer-Windows-Installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5868
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq XSpammer.exe" | %SYSTEMROOT%\System32\find.exe "XSpammer.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3904
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq XSpammer.exe"
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2804
      • C:\Windows\SysWOW64\find.exe
        C:\Windows\System32\find.exe "XSpammer.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:796
  • C:\Users\Admin\AppData\Local\Programs\xspammer\XSpammer.exe
    "C:\Users\Admin\AppData\Local\Programs\xspammer\XSpammer.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4192
    • C:\Users\Admin\AppData\Local\Programs\xspammer\XSpammer.exe
      "C:\Users\Admin\AppData\Local\Programs\xspammer\XSpammer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\xspammer" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1676,i,5079262280403906246,13810937540291838181,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3012
    • C:\Users\Admin\AppData\Local\Programs\xspammer\XSpammer.exe
      "C:\Users\Admin\AppData\Local\Programs\xspammer\XSpammer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\xspammer" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes=app --fetch-schemes=app --service-worker-schemes=app --streaming-schemes --mojo-platform-channel-handle=1868 --field-trial-handle=1676,i,5079262280403906246,13810937540291838181,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4596
    • C:\Users\Admin\AppData\Local\Programs\xspammer\XSpammer.exe
      "C:\Users\Admin\AppData\Local\Programs\xspammer\XSpammer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xspammer" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes=app --fetch-schemes=app --service-worker-schemes=app --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\xspammer\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2504 --field-trial-handle=1676,i,5079262280403906246,13810937540291838181,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:4708
    • C:\Users\Admin\AppData\Local\Programs\xspammer\XSpammer.exe
      "C:\Users\Admin\AppData\Local\Programs\xspammer\XSpammer.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\xspammer" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1676,i,5079262280403906246,13810937540291838181,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2352

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LICENSE.electron.txt
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LICENSES.chromium.html
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\LICENSES.chromium.html
        • Size 6.3MB
        • SHA256 c5a05048505c00af46c75fb5ca22057f09dce001eada3a756c3839d59011758f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_100_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\chrome_100_percent.pak
        • Size 126KB
        • SHA256 bca4401b578a6ac0fe793e8519fed82b5444972b7d6c176ec0369ed13beaad7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_200_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\chrome_200_percent.pak
        • Size 175KB
        • SHA256 b2c25fb30fee5f04ccdb8bf3c937a667502d266e428425feeb5af964f6167d48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dcompiler_47.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.7MB
        • SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffmpeg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\ffmpeg.dll
        • Size 2.6MB
        • SHA256 906b781978ee1524039abc6eafea3c66e7fa45748184e87fb4cf2931e774b6f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\icudtl.dat
        • Size 10.0MB
        • SHA256 8d8a74ca376338623170d59c455476218d5a667d5991a52556aa9c9a70ebc5e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libEGL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\libEGL.dll
        • Size 464KB
        • SHA256 71e4896016446bb46984a4cb11741a1fea9f2da40fcc2808847206147530fae4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libGLESv2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\libGLESv2.dll
        • Size 7.0MB
        • SHA256 7de7578c77d402fa646ea6d051ce6c31e1c133bd44e45ac013f1175d2ad7fffe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        af.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\af.pak
        • Size 327KB
        • SHA256 b1987cdcbb8d76598422aa1739a246ed6690dc1b211f950fcbf2f040491ed7a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        am.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\am.pak
        • Size 531KB
        • SHA256 ee363b88697a26d486c77bbf05f5f7f62d4b40c235e1d85e11448083070576f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ar.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\ar.pak
        • Size 574KB
        • SHA256 bfa2a3c3ebb3c6afbca42cb70b4da8f997068d511cf40ee8a952a893b8f9d7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bg.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\bg.pak
        • Size 608KB
        • SHA256 6c10b64d31e0dc2c4befc6703ac17343ca473b4350cfb3c6e01833f505b69590
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bn.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\bn.pak
        • Size 780KB
        • SHA256 297d52b252df0912490ddf26fa58706895e70c2a0f3f09d0dc756706720095ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ca.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\ca.pak
        • Size 371KB
        • SHA256 78bbee9bf6c95d239418037fd4660d081ebc0f369e727e613b6b652e380e6dd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cs.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\cs.pak
        • Size 377KB
        • SHA256 08e40f5efc616cdc0588fb4b1a706d997c69d17ddaf97eb91a4aabafaa11cee6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        da.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\da.pak
        • Size 342KB
        • SHA256 13c9583127d9d723801c946039e60f72dbbde898dd23fb9f675b9e299d0ce72a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        de.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\de.pak
        • Size 367KB
        • SHA256 8bd127d689be65e45bb8d2a2ff66698200da97835809c6b56ec9e2929b70618a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        el.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\el.pak
        • Size 664KB
        • SHA256 bc07e403272a4d65305fe24a827404d7b931d01cda547f8c07a840d19e591430
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-GB.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\en-GB.pak
        • Size 299KB
        • SHA256 e1e357c853eed83fb6c4133f8f4df377a8eda4fe6f0e55395f21c5ab6e38faa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\en-US.pak
        • Size 302KB
        • SHA256 a99bd31907bbdc12bdfbff7b9da6ddd850c273f3a6ece64ee8d1d9b6ef0c501c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        es-419.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\es-419.pak
        • Size 366KB
        • SHA256 943fa8774ade38d57349a5d27869097a782bc06bd34c40864a85ba829457d127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        es.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\es.pak
        • Size 367KB
        • SHA256 11ef2c0229c1fe1c10be08e3d5f36c973bc3c272f37b40e05c534a118757461b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        et.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\et.pak
        • Size 330KB
        • SHA256 3599e7138a24a31839da877cc9718b9c0c9522437ea93a6222a119080f108d14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fa.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\fa.pak
        • Size 535KB
        • SHA256 bb28ad47e95aefaa2d8d7b6a7f449f9707cfadbcd4c21bad8bd8a6578108d2cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\fi.pak
        • Size 338KB
        • SHA256 df8cefa4831fc2fdf817dd6d49a6373edee4f51f23cf990c690e72ce348f69bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fil.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\fil.pak
        • Size 379KB
        • SHA256 448bc8eae353c188ffaa4c2466956598ad807f0f0aae7f12e1bc59584e1aac2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\fr.pak
        • Size 395KB
        • SHA256 7af39af49846fba6d6b8ee18b2a212f1323ebc1cff1af0053194d01d8d5433f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gu.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\gu.pak
        • Size 755KB
        • SHA256 047da4dfadcfc6bec8f4dc7d250b1757caf31a23bcfa2ea3e1f3b1cdbe9a3995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        he.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\he.pak
        • Size 468KB
        • SHA256 6649a844f222cfcec01e75d3de3cb3658f1347ea3851d31b8124597b87e7b57d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\hi.pak
        • Size 787KB
        • SHA256 eda355e3785313e3d982c1d3652266dce1b6e08832056fe58854b825e0712ca5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\hr.pak
        • Size 365KB
        • SHA256 bada5828fc0d80c842d1409b54e8da516ae737ca30d86658b3fad5c8ace4722e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hu.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\hu.pak
        • Size 395KB
        • SHA256 688312f38488c7256370b1517b84963a3ff886b31692cc504fe169db241a43f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        id.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\id.pak
        • Size 324KB
        • SHA256 21368245d99265e760b1b57a3169feb72e6b5099c3f1855155d147b2f788eda4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        it.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\it.pak
        • Size 360KB
        • SHA256 13dd077e5e8c8b04ac0854e4466ee074df67c74cd29cc48a0c2c9f96f768fad5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ja.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\ja.pak
        • Size 440KB
        • SHA256 2c5457b0fa6fe41b7b524aa726dae4dd69e7072864f73f211c731810d00b9323
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kn.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\kn.pak
        • Size 872KB
        • SHA256 c315e791770cea204c7e49ef5b68fa46fe42864a33e77fa5a1d42f87ba85124f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ko.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\ko.pak
        • Size 369KB
        • SHA256 3ee7d79af9ec226bebfdd9d79907f1bc97d528d2009dbd0db23d74ad655e0256
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lt.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\lt.pak
        • Size 395KB
        • SHA256 e7c133a8dc438870f97112587f5f223f5fcae4f1510874b95b72cc281fa150fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lv.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\lv.pak
        • Size 393KB
        • SHA256 6e99a3ef823a651f5187c5c549a6885002a2f8523c014f989ec6d53d87e7aac7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ml.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\ml.pak
        • Size 915KB
        • SHA256 6295eb0b0d05d26b3fdaa19ad390ba30f267b7af7a60a214db558dcdbdb436c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\mr.pak
        • Size 743KB
        • SHA256 f63460da44e2f71c237b2555eda621c8c211c13ae68927c27ad121f03daa0599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ms.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\ms.pak
        • Size 339KB
        • SHA256 ad044cb5cc56f8cba19ea3319081c194661f072d6b1193509e3690769bbfc2d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nb.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\nb.pak
        • Size 332KB
        • SHA256 18512064afcc3fb5a0e1f36400e592ff34e8c6c9a7ed0bbe3432255c4759ad8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\nl.pak
        • Size 344KB
        • SHA256 bdb8fb52d8032a8f9cf5336698ca715b4beb4d567bf3657e12a47c36020ae256
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\pl.pak
        • Size 381KB
        • SHA256 65b6dd63aaba1692f36774413d372f6c6c66088d7ec4009a2dbee1648ca133f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pt-BR.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\pt-BR.pak
        • Size 360KB
        • SHA256 7b171f2a6d46295147a8d10e475048bac4346c6a5162b32a0336334baccad520
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pt-PT.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\pt-PT.pak
        • Size 363KB
        • SHA256 f374bd5c54596aacbc35f47bdd4c9ab4045bebdfa479ae386fd2fdd2d0041216
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ro.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\ro.pak
        • Size 372KB
        • SHA256 c50f824e63806e5782b693f7d474c48684b9e5174e93463a9bc2876c94990879
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ru.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\ru.pak
        • Size 606KB
        • SHA256 44f0cbb2d5414b6dfca6abb40a435200670e2a71607b158fcbaba67fd6b3ba08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sk.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\sk.pak
        • Size 383KB
        • SHA256 dbd82a2a08f8e9ba9581b2672bc49e0fa5c89f073b58f152225f9e2815228ddf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\sl.pak
        • Size 369KB
        • SHA256 d0415bfa061b36a6eb93fa2c78563448da8b63c91e0523086c7eb2714933ab99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\sr.pak
        • Size 572KB
        • SHA256 d459c1a781ddc344de76558211983dd07d47e3ca6cacffb518043bd78dc48fbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sv.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\sv.pak
        • Size 334KB
        • SHA256 3f0acf6f6319636c3e72cdc392b7b80ab0cfd8ae1a5a8e319624e4b46bcd3c42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sw.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\sw.pak
        • Size 351KB
        • SHA256 dea6947693fceb6457801d912ea7c716add3c0cfb4c34782a9cfa4c4e06b9402
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ta.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\ta.pak
        • Size 899KB
        • SHA256 e0421b4cf2736bb465ec02cd85c2df09809f86479cb7624195373f25edbcedd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        te.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\te.pak
        • Size 836KB
        • SHA256 f53e06181c9fa0f6028906a7388fd4e8f000ffb7277330634462433d34572395
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        th.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\th.pak
        • Size 704KB
        • SHA256 4fe2b7b6886e3ce068be0b7a0a71d45756eb797eda1e7d4fad52ab8a370e8336
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\tr.pak
        • Size 357KB
        • SHA256 5df18798a35b502a18fb4f82e9b03b7ca100903ecd5d192ab2a3f0bc7646c366
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uk.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\uk.pak
        • Size 605KB
        • SHA256 3fb15957c77f3635aa7cfca796b045a1ee1f1abfc0c12c163cfb537364f3c80a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ur.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\ur.pak
        • Size 532KB
        • SHA256 06a0c18d978b54dd163c7f77b7ee0f2ecf3607c5dc14032326f21b4a1f304d81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\vi.pak
        • Size 424KB
        • SHA256 f1602637e7f3e0a908d7a9a3f630b8dd38bfd26704cc64ef432d2c88a1ee7017
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zh-CN.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\zh-CN.pak
        • Size 308KB
        • SHA256 97fe793b325d0c27669f62235bd157c51a3e1aeaffba30e7fe028c9d64939c5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zh-TW.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\locales\zh-TW.pak
        • Size 305KB
        • SHA256 280ba35171dfb6a54efb13fc4ddedc13a0283a9a6eebff4c15275767beb4ba77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resources.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\resources.pak
        • Size 5.2MB
        • SHA256 f7fdde9650504d8872a7aa2b68e1f5b3cedd100ded1e19e44c2b6282eb637813
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app.asar
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\resources\app.asar
        • Size 44.5MB
        • SHA256 50a52161cd220c98174231a8be7b9c215d4067398c03cc40575c4ac85aeccabc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevate.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snapshot_blob.bin
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\snapshot_blob.bin
        • Size 410KB
        • SHA256 ece191beef3b53272a925c1f5e8c02a0dc78b00559799d27a0665fc480380b3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        v8_context_snapshot.bin
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\v8_context_snapshot.bin
        • Size 710KB
        • SHA256 ea2ea0f97ac908fd127a423f505241ebf4acea0ba5d02635cae40f7cd9c2f464
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vk_swiftshader.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\vk_swiftshader.dll
        • Size 4.8MB
        • SHA256 56809fc84c83b7b651014df670631399546e6c335fbb69ece77681cbf0163866
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vk_swiftshader_icd.json
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vulkan-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\7z-out\vulkan-1.dll
        • Size 858KB
        • SHA256 7adaaeb870b6c3220527cfd971e75c22567d8f921a0737dc2574419b36cf8b4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SpiderBanner.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\SpiderBanner.dll
        • Size 9KB
        • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StdUtils.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WinShell.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\WinShell.dll
        • Size 3KB
        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\nsExec.dll
        • Size 6KB
        • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsis7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsh626A.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default.exc
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512
        Submit Download

        data_0
        • Path C:\Users\Admin\AppData\Roaming\xspammer\DawnCache\data_0
        • Size 8KB
        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_1
        • Path C:\Users\Admin\AppData\Roaming\xspammer\DawnCache\data_1
        • Size 264KB
        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_2
        • Path C:\Users\Admin\AppData\Roaming\xspammer\DawnCache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_3
        • Path C:\Users\Admin\AppData\Roaming\xspammer\DawnCache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Network Persistent State
        • Path C:\Users\Admin\AppData\Roaming\xspammer\Network\Network Persistent State
        • Size 296B
        • SHA256 0c8e6419df29157b2d7f9b3106ae515bac65f7149629282e6d04b5f186a99015
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Network Persistent State~RFe5ac303.TMP
        • Path C:\Users\Admin\AppData\Roaming\xspammer\Network\Network Persistent State~RFe5ac303.TMP
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2352-587-0x000001CC4D720000-0x000001CC4D721000-memory.dmp
        Download

        memory/2352-585-0x000001CC4D720000-0x000001CC4D721000-memory.dmp
        Download

        memory/2352-593-0x000001CC4D720000-0x000001CC4D721000-memory.dmp
        Download

        memory/2352-596-0x000001CC4D720000-0x000001CC4D721000-memory.dmp
        Download

        memory/2352-595-0x000001CC4D720000-0x000001CC4D721000-memory.dmp
        Download

        memory/2352-594-0x000001CC4D720000-0x000001CC4D721000-memory.dmp
        Download

        memory/2352-592-0x000001CC4D720000-0x000001CC4D721000-memory.dmp
        Download

        memory/2352-591-0x000001CC4D720000-0x000001CC4D721000-memory.dmp
        Download

        memory/3012-489-0x00007FF8D9B00000-0x00007FF8D9B01000-memory.dmp
        Download