Overview

overview

8

Static

static

3

Mythfall O...ut.dll

windows10-2004-x64

1

Mythfall O...ut.dll

windows11-ltsc_2024-x64

1

Mythfall O...ut.dll

windows10-2004-x64

1

Mythfall O...ut.dll

windows11-ltsc_2024-x64

1

Mythfall O...ed.dll

windows10-2004-x64

1

Mythfall O...ed.dll

windows11-ltsc_2024-x64

1

Mythfall O...io.dll

windows10-2004-x64

1

Mythfall O...io.dll

windows11-ltsc_2024-x64

1

Mythfall O...ey.exe

windows10-2004-x64

8

Mythfall O...ey.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

3

Odyssey.exe

windows10-2004-x64

8

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/...pi.dll

windows10-2004-x64

1

resources/...pi.dll

windows11-ltsc_2024-x64

1

resources/...pi.dll

windows10-2004-x64

1

resources/...pi.dll

windows11-ltsc_2024-x64

1

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-ltsc_2024-x64

3

resources/...pi.dll

windows10-2004-x64

1

resources/...pi.dll

windows11-ltsc_2024-x64

1

resources/...e3.dll

windows10-2004-x64

1

Resubmissions

20/07/2026, 23:28

260720-3f9xbagz3q

20/07/2026, 22:40

260720-2lt8dah16s8

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/07/2026, 22:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Mythfall Odyssey/Mythfall Odyssey.exe
  • Size 82.2MB
  • Sample260720-2lt8dah16s
  • SHA256 d5e781c3314d88cb8e38bc251e407d6c511407a9587d2395ff8efe8434d8bd20
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

    Using powershell.exe command.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 12 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mythfall Odyssey\Mythfall Odyssey.exe
    "C:\Users\Admin\AppData\Local\Temp\Mythfall Odyssey\Mythfall Odyssey.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4892
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Odyssey.exe" /FO csv | "C:\Windows\system32\find.exe" "Odyssey.exe"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2260
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Odyssey.exe" /FO csv
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4036
      • C:\Windows\SysWOW64\find.exe
        "C:\Windows\system32\find.exe" "Odyssey.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3692
  • C:\Users\Admin\AppData\Local\Programs\Odyssey\Odyssey.exe
    "C:\Users\Admin\AppData\Local\Programs\Odyssey\Odyssey.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4860
      • C:\Windows\system32\chcp.com
        chcp
        3⤵
          PID:1456
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM "watcher.exe""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2004
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM "watcher.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3044
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "WHERE smartctl 2>nul"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Windows\system32\where.exe
          WHERE smartctl
          3⤵
            PID:4204
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
          2⤵
          • Executes a command shell one-liner
          PID:552
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_DiskDrive | select Caption,Size,Status,PNPDeviceId,DeviceId,BytesPerSector,TotalCylinders,TotalHeads,TotalSectors,TotalTracks,TracksPerCylinder,SectorsPerTrack,FirmwareRevision,SerialNumber,InterfaceType | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3296
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-PhysicalDisk | select BusType,MediaType,FriendlyName,Model,SerialNumber,Size | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2320
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4684
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_baseboard | select Model,Manufacturer,Product,Version,SerialNumber,PartNumber,SKU | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1528
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_physicalmemoryarray | select MaxCapacityEx, MemoryDevices | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4672
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_bios | select Description,Version,Manufacturer,@{n=\"ReleaseDate\";e={$_.ReleaseDate.ToString(\"yyyy-MM-dd\")}},BuildNumber,SerialNumber,SMBIOSBIOSVersion | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3732
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PhysicalMemory | select DataWidth,TotalWidth,Capacity,BankLabel,MemoryType,SMBIOSMemoryType,ConfiguredClockSpeed,Speed,FormFactor,Manufacturer,PartNumber,SerialNumber,ConfiguredVoltage,MinVoltage,MaxVoltage,Tag | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3440
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4472
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3332
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3160
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1248
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2448
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3692
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4252
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4548
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4036
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2236
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "reg query \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\" /v DisplayVersion"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3312
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion
            3⤵
              PID:5704
          • C:\Users\Admin\AppData\Local\Programs\Odyssey\Odyssey.exe
            "C:\Users\Admin\AppData\Local\Programs\Odyssey\Odyssey.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Odyssey" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2496,i,16791783089834135025,18237043355873923391,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:2
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1356
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM "mitmdump.exe""
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1972
            • C:\Windows\system32\taskkill.exe
              taskkill /F /T /IM "mitmdump.exe"
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5680
          • C:\Users\Admin\AppData\Local\Programs\Odyssey\Odyssey.exe
            "C:\Users\Admin\AppData\Local\Programs\Odyssey\Odyssey.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Odyssey" --field-trial-handle=2496,i,16791783089834135025,18237043355873923391,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:3
            2⤵
            • Executes dropped EXE
            PID:3984

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              powershell.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              • Size 3KB
              • SHA256 021636a793f57f23b16356c5b84fdf0122fdcadfaba305e4df4654bfbfa442bd
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 90a149112f5bfb040fbac1e75da2a8860eb780eb0f6375b72c0b1581ab2782ac
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 5eabbde2ccb3b1abfec079901dcfdbadd519ff9153675ac7ba927d63e509cc8d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 64B
              • SHA256 7bb6837bc0ee6f27851276c287bb9c3b69f6686b6eac57fcfe3b2d6516a36f59
              • MD5 SHA1 SHA512
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 78365c15bd3b5369be8fb8d6d054146a5350a8f9a0661f2a5790141adae7b1c5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 72189a84883b8afa9d1e75c2ad86bb59ecd67c505b5f32f6e9bf97d1bc7341f4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 931c529a6bf2915d340dcb742a970296cdfee8684741a760f8a04512a7e12ad3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 1bb352a1d8ccbcf53f25c55b37611cd840a318b043d32910fe9a25692f5c29da
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 b6f10912e51be9374b20ecbad6505203f9427c949fc7407803f6a2f19dc90df0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 c10bb0040db5e32d55dfd76292c949447d31321f6b46bffa81e261864f2f648f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              chrome_100_percent.pak
              • Path C:\Users\Admin\AppData\Local\Programs\Odyssey\chrome_100_percent.pak
              • Size 144KB
              • SHA256 6ce0ccf6a0cc4ea8be11262d168a344bc3ee78a4a6365d755ffb5570bc48d6d5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __PSScriptPolicyTest_144sxrtt.rln.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_144sxrtt.rln.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              LICENSE.electron.txt
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\LICENSE.electron.txt
              • Size 1KB
              • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              LICENSES.chromium.html
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\LICENSES.chromium.html
              • Size 11.7MB
              • SHA256 5d67aba37acc9e0e0a88546d940ed23f29ea3441aac7dd06dcc08a1b1c93b0a9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_200_percent.pak
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\chrome_200_percent.pak
              • Size 215KB
              • SHA256 68e92cde2557d68eddcf8df21ce4d1ef7a85581fb28cd5ab93db20812217e073
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              d3dcompiler_47.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\d3dcompiler_47.dll
              • Size 4.7MB
              • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ffmpeg.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\ffmpeg.dll
              • Size 2.9MB
              • SHA256 99fbd8bd11696e24479d22e29b490c7e96c7d9875ab4392ff12307ddfb5a9503
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              icudtl.dat
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\icudtl.dat
              • Size 10.0MB
              • SHA256 a9f6072e858ea29cb66501847856d403c862f23d03cac2656d1e0fa2865fdc7b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libEGL.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\libEGL.dll
              • Size 481KB
              • SHA256 e55fb10fb929b28446583ebc5afa89fc647bafc2eebf3b12e6a0adf91a7bb202
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libGLESv2.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\libGLESv2.dll
              • Size 7.6MB
              • SHA256 2289eb00380b7f143d81df224d5bb412dec9b5eb6002b5213518e295ae8256b2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              en-US.pak
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\locales\en-US.pak
              • Size 492KB
              • SHA256 cc7d18d3a6606b645ede826de9417c961d6ebb815f7250bad3a930da89dcd3a3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              resources.pak
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources.pak
              • Size 5.7MB
              • SHA256 4d22a8976b3e6d5bca66d59cc24f1d2db6df2163f12f9624bc07c5846adfbab6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              HCCvnzHjj1Lxs6p9.bin
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\Screenshot\HCCvnzHjj1Lxs6p9.bin
              • Size 60B
              • SHA256 8d51cb36fed2c7e8d52e83876849db36e689e978ed4747d58290544b5f56341e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              HCCvnzHjj1Lxs6p9.enc
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\Screenshot\HCCvnzHjj1Lxs6p9.enc
              • Size 3.2MB
              • SHA256 86b4aab29f15d723e989d53329c49fc60836731d0349ce32ed7314c67bdfdb46
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              short.enc
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\Shortcut\short.enc
              • Size 391KB
              • SHA256 caf701d8c1faca8b31250d406fcdc38d37b563506258745c19a5895248c8f251
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              app.asar
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar
              • Size 14.4MB
              • SHA256 e272dce0a649ec370b706486ad2dcbab215f4e9fc0f08fb1a22abd5eff7f117a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dpapi.node
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\bin\win32-x64-133\dpapi.node
              • Size 126KB
              • SHA256 9da75b2e77ba1b383e9573484431c31993bd8a13c9456e7ad5fbefdebbf28e2f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              index.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\dist\index.js
              • Size 1KB
              • SHA256 3043aeba077d86d8b2e7fbbd6e1ecc3438c65ab184a2bda9fa0179976c5b0170
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              package.json
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\package.json
              • Size 936B
              • SHA256 be14494278f32ab162d3b3cf8f5d0bdbcf02c4bd8785428119a2e225e1cd482f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              @primno+dpapi.node
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-arm64\@primno+dpapi.node
              • Size 122KB
              • SHA256 6a5cc9c5b3e390fe08fea0de3a22248d5836cea0b26aa6a80d9447c45ec04b12
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              @primno+dpapi.node
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
              • Size 134KB
              • SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              better_sqlite3.node
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node
              • Size 1.8MB
              • SHA256 5d50e3d6f5e0ebecf18c1e0165546a614cf79e27bea835d766fd21c49b49357f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              copy.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\copy.js
              • Size 897B
              • SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              database.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
              • Size 4KB
              • SHA256 02ea23bdd23d7ac5de0675a2f32fc686e76d5c6a32bd3e3891f360e72e07f61f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              index.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
              • Size 110B
              • SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              aggregate.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
              • Size 1KB
              • SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              backup.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
              • Size 2KB
              • SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              function.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
              • Size 1KB
              • SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              inspect.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
              • Size 174B
              • SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              pragma.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
              • Size 536B
              • SHA256 8b1c54475bd4340b15e25c50d53d06308be65f8f919ecbe4aa9d285ca859ad5a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              serialize.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
              • Size 625B
              • SHA256 7a10ee5c2735384b7f0c361811bc6d017db29f62b203fd3c68a35f667e2c2605
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              table.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
              • Size 6KB
              • SHA256 97c42d9ded1aa96c7d916b5b92f96b4e59581d50eaf629cd2c7afb78ff26a9ea
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              transaction.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
              • Size 2KB
              • SHA256 bc8624a3ef689d8f78e5669020ad121e17acbc93b1d5ee5afe26860b1084c66c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              wrappers.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
              • Size 1KB
              • SHA256 a150a6271d23f4e5f8953b129f370ff096c7cdc4b812afbf080a6cf4ab741bcf
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              sqlite-error.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
              • Size 717B
              • SHA256 2582d61c27680dead168543f392eb102be621dfbef282a4ca4c7c21aa5e7c75d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              util.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
              • Size 331B
              • SHA256 92b2e39e2151b43a2252e10b6d6de876ecaf0008336a4fa1dfe1317b20f1916f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              package.json
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
              • Size 935B
              • SHA256 0bd7bf9474f0b8d92c3e5443146b51cf7a329fab464dda2b020b27569379ec91
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              robotjs.node
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\robotjs\bin\win32-x64-133\robotjs.node
              • Size 176KB
              • SHA256 2571133ff3126228dab243d0a2c3645a71a594f1214fc716d98479a80749d669
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              index.js
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\robotjs\index.js
              • Size 937B
              • SHA256 8bf3e9c7d85cfd50e58068b6f0cfc7a154d82deae8e53052f2eb7015f41dd0ff
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              package.json
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\app.asar.unpacked\node_modules\robotjs\package.json
              • Size 610B
              • SHA256 388dd9c273e7c6c787563ffc71e9f878d31edc63317abd6ac41aa4e4593ae222
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              elevate.exe
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\resources\elevate.exe
              • Size 105KB
              • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              snapshot_blob.bin
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\snapshot_blob.bin
              • Size 324KB
              • SHA256 69d9b2ecbc649fed6c41ca18e94f3a36b6770ff7038e9a0d07ae1ab824d9f7fb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              v8_context_snapshot.bin
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\v8_context_snapshot.bin
              • Size 685KB
              • SHA256 462919f1b49c9e913042f9e9a738e9510884d5920a426a8a5f1b188e28c4da91
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vk_swiftshader.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\vk_swiftshader.dll
              • Size 5.3MB
              • SHA256 bdf28efb95d1618e211aafafd2060df77ad53b98af8db685379f88aa852c0e00
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vk_swiftshader_icd.json
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\vk_swiftshader_icd.json
              • Size 106B
              • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              vulkan-1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\7z-out\vulkan-1.dll
              • Size 882KB
              • SHA256 2f0ae7c191a962a49abe65c8c5c056262de5e2108e1f341b105844034153915f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SpiderBanner.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\SpiderBanner.dll
              • Size 9KB
              • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StdUtils.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\StdUtils.dll
              • Size 100KB
              • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\System.dll
              • Size 12KB
              • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              nsExec.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\nsExec.dll
              • Size 6KB
              • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              nsis7z.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsq2E4F.tmp\nsis7z.dll
              • Size 424KB
              • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1248-640-0x0000023C7B6E0000-0x0000023C7B8FC000-memory.dmp
              Download

              memory/1528-607-0x000002ACF5490000-0x000002ACF56AC000-memory.dmp
              Download

              memory/2236-600-0x000002286FE70000-0x000002287008C000-memory.dmp
              Download

              memory/2320-638-0x000002DF47FB0000-0x000002DF481CC000-memory.dmp
              Download

              memory/2448-627-0x000001F6F8CB0000-0x000001F6F8ECC000-memory.dmp
              Download

              memory/3160-634-0x000001F2EB350000-0x000001F2EB56C000-memory.dmp
              Download

              memory/3296-616-0x00000141D8AD0000-0x00000141D8CEC000-memory.dmp
              Download

              memory/3312-613-0x00000216F0150000-0x00000216F036C000-memory.dmp
              Download

              memory/3332-604-0x000002B67EAD0000-0x000002B67ECEC000-memory.dmp
              Download

              memory/3440-639-0x00000219F0E90000-0x00000219F10AC000-memory.dmp
              Download

              memory/3440-474-0x00000219D7E60000-0x00000219D7E82000-memory.dmp
              Download

              memory/3692-641-0x00000264ABF30000-0x00000264AC14C000-memory.dmp
              Download

              memory/3732-631-0x00000282A3790000-0x00000282A39AC000-memory.dmp
              Download

              memory/4036-622-0x000001C957740000-0x000001C95795C000-memory.dmp
              Download

              memory/4252-642-0x000001B168E20000-0x000001B16903C000-memory.dmp
              Download

              memory/4472-596-0x00000255EB6A0000-0x00000255EB6CA000-memory.dmp
              Download

              memory/4472-597-0x00000255EB6A0000-0x00000255EB6C4000-memory.dmp
              Download

              memory/4472-637-0x00000255EB0D0000-0x00000255EB2EC000-memory.dmp
              Download

              memory/4548-619-0x000001779E470000-0x000001779E68C000-memory.dmp
              Download

              memory/4672-628-0x000001FCE0920000-0x000001FCE0B3C000-memory.dmp
              Download

              memory/4684-612-0x00000240EECC0000-0x00000240EEEDC000-memory.dmp
              Download