Overview

overview

7

Static

static

3

Nightlight....6.exe

windows11-21h2-x64

7

$PLUGINSDI...er.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows11-21h2-x64

3

Nightlight...er.exe

windows11-21h2-x64

7

d3dcompiler_47.dll

windows11-21h2-x64

1

dxcompiler.dll

windows11-21h2-x64

1

dxil.dll

windows11-21h2-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows11-21h2-x64

1

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

$R0/Uninst...er.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

Resubmissions

27/07/2026, 04:33

260727-e6ypzavygw8

27/07/2026, 04:24

260727-e1h3bsvhjd7

Analysis

  • geolocation tags

    eueuropefrfrance
  • max time kernel
    162s
  • max time network
    166s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    27/07/2026, 04:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Nightlight.Launcher.Setup.5.2.6.exe
  • Size 102.9MB
  • Sample260727-e1h3bsvhjd
  • SHA256 acdf4b27f24888e7fd62701221300a5e66719f693349db534faaf494bc618f85
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nightlight.Launcher.Setup.5.2.6.exe
    "C:\Users\Admin\AppData\Local\Temp\Nightlight.Launcher.Setup.5.2.6.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5124
  • C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe
    "C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe"
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3900
    • C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\nightlight-launcher" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1772,i,936314535432265219,8649701109920332413,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,13316733749621918669,14623019344187646296,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1768 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4252
    • C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\nightlight-launcher" --field-trial-handle=1772,i,936314535432265219,8649701109920332413,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,13316733749621918669,14623019344187646296,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1680 /prefetch:11
      2⤵
      • Executes dropped EXE
      PID:2536
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Valve\Steam" /v InstallPath"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1492
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Valve\Steam" /v InstallPath
        3⤵
          PID:2868
      • C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe
        "C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\nightlight-launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1785126004078585 --launch-time-ticks=532167367 --field-trial-handle=1772,i,936314535432265219,8649701109920332413,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,13316733749621918669,14623019344187646296,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2576 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3180
      • C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe
        "C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Local\nightlight-launcher" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1772,i,936314535432265219,8649701109920332413,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,13316733749621918669,14623019344187646296,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2600 /prefetch:10
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:1700

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          chrome_100_percent.pak
          • Path C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\chrome_100_percent.pak
          • Size 117KB
          • SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LICENSE.electron.txt
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\LICENSE.electron.txt
          • Size 1KB
          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSES.chromium.html
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\LICENSES.chromium.html
          • Size 19.4MB
          • SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_200_percent.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\chrome_200_percent.pak
          • Size 192KB
          • SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          d3dcompiler_47.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\d3dcompiler_47.dll
          • Size 4.5MB
          • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dxcompiler.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\dxcompiler.dll
          • Size 24.4MB
          • SHA256 f0eecdc9bd3bd048b888b19c1be803867dc5592e9b0745914ef48781a3956d32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dxil.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\dxil.dll
          • Size 1.4MB
          • SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ffmpeg.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\ffmpeg.dll
          • Size 2.9MB
          • SHA256 80d1ff5d7689071edae78164eacf92e4924689936d8cd818340377318b0a5da6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icudtl.dat
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\icudtl.dat
          • Size 10.4MB
          • SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libEGL.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\libEGL.dll
          • Size 467KB
          • SHA256 380900fd2c24f14d602e5bf6d43c86f9c69362ac911d44f9609971a62735dbd7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libGLESv2.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\libGLESv2.dll
          • Size 7.6MB
          • SHA256 d6a0d6700956b66e4b0d75f6cc102a9e0dfd7d923c5fba1ab227aa3cb0ba3b0b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          af.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\af.pak
          • Size 605KB
          • SHA256 d990f4ced39e31a1149d2a1842ce2504706885e6ab05957ee2f338c77d94c16b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          am.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\am.pak
          • Size 983KB
          • SHA256 8d3d5dfc64acfbb0c35036d74561d09ddf3b22058eeed0f8d26a2e9c0703248e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ar.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\ar.pak
          • Size 1.1MB
          • SHA256 01f11a2c50a25b12aa99e36d6f38b334179d6efbf073ac47dec7819f88dce668
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bg.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\bg.pak
          • Size 1.1MB
          • SHA256 2789212aac5f2133ed23c1f84623bc64eb4cfbd93aef7af751d1221e27a21daa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bn.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\bn.pak
          • Size 1.4MB
          • SHA256 e72b72977b40fb10472fe1a3fcffcda8b434bf52e2bb2da2935faa80da224812
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ca.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\ca.pak
          • Size 683KB
          • SHA256 4289d89e86d0394bc545d63b375fa050f3823ef99ebc6831e8b1a28d3a17fda0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cs.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\cs.pak
          • Size 709KB
          • SHA256 8386f70e830a565d0674014ae4ad385a61eb43d7e7b99d4d373d14388dfd32ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          da.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\da.pak
          • Size 637KB
          • SHA256 ff687bb6dc79bb638bca4f6a9226544a783209645922d323cf777b169690b25a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          de.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\de.pak
          • Size 684KB
          • SHA256 941c4d0ac3de30cdb5922e4bf1423354eca1148aacd3dd71499af3bba1fcea8f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          el.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\el.pak
          • Size 1.2MB
          • SHA256 3ee2e46a5a569e411ccf9d77ee4f356e1833bfccbaefcc5e71b7c1517206ab5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-GB.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\en-GB.pak
          • Size 552KB
          • SHA256 aac3b4904d021d58d053bdea2d8056a219ecda1e341d87cb70070aea2cee418f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-US.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\en-US.pak
          • Size 558KB
          • SHA256 bce3ec06227dba2273c4ff12482cba37b709cc8bf5fd29c4380f9a07b92bf821
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          es-419.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\es-419.pak
          • Size 674KB
          • SHA256 3beaef48bc776d3ebcfb867786fc47f78af2dfd6503f460094db5183666ce34e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          es.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\es.pak
          • Size 670KB
          • SHA256 669099cdff7ace75d40fa7b2fcb731b9fa3946d7939cae5dc6d751cdc88519e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          et.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\et.pak
          • Size 612KB
          • SHA256 ecc838878412cc9f28dda9efed2fc60b67315f5fdf64e912db33cee7571a5939
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fa.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\fa.pak
          • Size 1013KB
          • SHA256 c4db250c0d32645a93536b188378da51f1af9b06988aee9e930ae5ccd9c09790
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fi.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\fi.pak
          • Size 623KB
          • SHA256 18d904efd7d15a49ef3638c45a40b3aa604e5ec4b68e017ab3f568e6a8202fd4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fil.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\fil.pak
          • Size 706KB
          • SHA256 4034bd7ef11f48d7d646aacb7006562f0f9caec888785a13c36e31b9724dd798
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\fr.pak
          • Size 728KB
          • SHA256 ef6d63007598261e38b0aa356f54b517e4fba5d38ad606165785afac5a7d577d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          gu.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\gu.pak
          • Size 1.4MB
          • SHA256 b207f2046791aa8150015ca78f9f76f2f6509953a00c5e89b155bb40e3a26474
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          he.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\he.pak
          • Size 887KB
          • SHA256 33c380725d0ab1a858c594fff41a2363cb2a0ad3bc0ed7209aacdfd7a60c7c60
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hi.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\hi.pak
          • Size 1.5MB
          • SHA256 6e58e12bfc69547d03d61f23445bc996e1b09ed5e8599b00f553bf8d022a08b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hr.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\hr.pak
          • Size 682KB
          • SHA256 6990ba056fcd1cac97ed5b48024be4ab366846a9c517d43a181cbb0eefa095d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hu.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\hu.pak
          • Size 729KB
          • SHA256 b83fc60c6d3ce3a04338ea16ba4627d6dfdf81f4373fe4921ac01c7c9558bcb6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          id.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\id.pak
          • Size 603KB
          • SHA256 a6ccb8c77ecd0db5c9d8d3b809937e627fffb136737ffeba65a9c09e6469a243
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          it.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\it.pak
          • Size 660KB
          • SHA256 666f811313f9bfd0f582816ff5c9fd693da6a3b4ec0e1d6af7cbbc100d8d7bd6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ja.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\ja.pak
          • Size 804KB
          • SHA256 de290ab75b4cf9f59e6c106b12fba39666d19a98d1fbe1cd8dc18628187b50b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          kn.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\kn.pak
          • Size 1.6MB
          • SHA256 d154c50013245a268ba9b4b49639516ab0593922d893bdd551e4aa30ee6a3e2f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ko.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\ko.pak
          • Size 684KB
          • SHA256 37f167bdf1c7f0095e256dfdf1d5f40a92e29a350bc78a8fe048f364d5fdbd76
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          lt.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\lt.pak
          • Size 742KB
          • SHA256 0c755ce72d1b71e77d58ab014228458d8ce2b0c51a9b00769635c6609255c9f2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          lv.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\lv.pak
          • Size 739KB
          • SHA256 911f922f6ab11d04c4913b04088619276994104979b2c5f132182953fabc24a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ml.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\ml.pak
          • Size 1.6MB
          • SHA256 8beb5df27b5a1b88d0f441518a807b2c6acd99a81820cd0249710ea12bc179d0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mr.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\mr.pak
          • Size 1.4MB
          • SHA256 1971da05e4868841c9d9f78be5e17ab09178af99b86a6c07df385015a0c9d9ef
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ms.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\ms.pak
          • Size 636KB
          • SHA256 b60c552a9ced5d0e1f4ed408f65a04068acad7d80db7cf88528fbebbcd337e23
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nb.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\nb.pak
          • Size 608KB
          • SHA256 cb50908b03c77263297e63ff75d4d3c58fb0cb491c69a8964239e787c762f52d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nl.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\nl.pak
          • Size 634KB
          • SHA256 b6a6cecceeb0097d5fd9628c684d53339f7871948655740e0f625bfedbf526ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pl.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\pl.pak
          • Size 708KB
          • SHA256 dee5b710ca72425cd4d1236ce260f8d68b41bfdfceaeb2f98c8e89217b24208f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pt-BR.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\pt-BR.pak
          • Size 664KB
          • SHA256 8773b618385adfb3c03bac5109ea381ae2042b18a03d6929b1f9406f13dc627f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pt-PT.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\pt-PT.pak
          • Size 668KB
          • SHA256 266e49a497c6bf9e48502c7eb01aea1fa90260b6fb1609165ff50307a3d81b59
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ro.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\ro.pak
          • Size 693KB
          • SHA256 16b11fb73ea0c5d0336de453d3e2abd2de69b3e6c66dcd72bae318666525bb18
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ru.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\ru.pak
          • Size 1.1MB
          • SHA256 cf7ec388e57755475515f2a4a6b312459ae2efa693c80bedc28458df9616e638
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sk.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\sk.pak
          • Size 720KB
          • SHA256 8c14d528efad4c75e09ce70719b0b3d1162954b4de4013112e014e2ac6a84d3d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sl.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\sl.pak
          • Size 690KB
          • SHA256 1550f8df161a3484a6c7af9bc5321fae524e10d6853467afcb8749054a73e601
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sr.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\sr.pak
          • Size 1.0MB
          • SHA256 a76930f2c72e49dc3a2c9be7e7bce0f9da0c93de03b6e275521fa86da0d2d39c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sv.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\sv.pak
          • Size 615KB
          • SHA256 118cbf34d040c8946669f889393364070e88d3f0263f1b66ab4638b1f8f3c291
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sw.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\sw.pak
          • Size 651KB
          • SHA256 f4e0e2f5b49d9d767884074cc3ee8d0dd83a986f7c1d2de236885998d7a53460
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ta.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\ta.pak
          • Size 1.6MB
          • SHA256 2c5f8aaf21c9a035f71d763cfa9a20886892fcde7cf71878168a9df0faa6d417
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          te.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\te.pak
          • Size 1.5MB
          • SHA256 e9e85c763b92b5a98e74290c3ff07e7953269ab6228a4cc343745229819d7f8f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          th.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\th.pak
          • Size 1.3MB
          • SHA256 fa33c671ef03a11f1069cfb389df5c8f311daf145f7359ee78758c3a0709b209
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tr.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\tr.pak
          • Size 663KB
          • SHA256 7a42e54611e2633c9c999f121abf2ffbda37746237e01ce29dc650510af08b0c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          uk.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\uk.pak
          • Size 1.1MB
          • SHA256 39e272f1acb9c0b0bc791efa0347b92cb29e20cfbb5ae14f539628f10f45b0f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ur.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\ur.pak
          • Size 997KB
          • SHA256 0c1cfa61d9a9be6338b0a160b43ff362a982003053ae5be3b3ec867e78374d7b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vi.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\vi.pak
          • Size 789KB
          • SHA256 3594ddfb89758a3d87d51bf90e676a5dd6107a6becd96c8840df6739cf268af1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zh-CN.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\zh-CN.pak
          • Size 564KB
          • SHA256 c2c40bd2834ca62f99312d93eb47e04d22b4c8eb86197f98cc7865b52fc11baf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zh-TW.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\locales\zh-TW.pak
          • Size 556KB
          • SHA256 8e831ed21bd21ce3610dc4b658aa337229c83dd6d7cef336923d69779d0365b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          resources.pak
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\resources.pak
          • Size 6.6MB
          • SHA256 21641d8da2c30451d782c217bd156cbed278ba78df350a2d19578804b5b156b4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          app.asar
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\resources\app.asar
          • Size 19.9MB
          • SHA256 747d6ffa14b7ef72511bdfbd9ef8a2dd965287fcaea2af76bd26b8122cd72af4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevate.exe
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\resources\elevate.exe
          • Size 105KB
          • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          snapshot_blob.bin
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\snapshot_blob.bin
          • Size 338KB
          • SHA256 3641cb8756cfee0bf77a226d176793ab6f5de2c3dc61544fbbdf50acf94ecb6a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          v8_context_snapshot.bin
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\v8_context_snapshot.bin
          • Size 704KB
          • SHA256 290fd744c3499e6d9306f26d194e51b648a93ef3a25c4e25387413781ac4991b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vk_swiftshader.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\vk_swiftshader.dll
          • Size 5.3MB
          • SHA256 ae7e65a4462a2f8fdfcfa7444259a8d2625ebd3bd75c170128025fa70e1ca037
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vk_swiftshader_icd.json
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\vk_swiftshader_icd.json
          • Size 106B
          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vulkan-1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\7z-out\vulkan-1.dll
          • Size 904KB
          • SHA256 ef8b7e499fc34f5057c498702694de37fa87289ea3d866717fd1c001d955883f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SpiderBanner.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\SpiderBanner.dll
          • Size 9KB
          • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StdUtils.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\StdUtils.dll
          • Size 100KB
          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\System.dll
          • Size 12KB
          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WinShell.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\WinShell.dll
          • Size 3KB
          • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          nsExec.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\nsExec.dll
          • Size 6KB
          • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsis7z.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsx24CA.tmp\nsis7z.dll
          • Size 424KB
          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          data_0
          • Path C:\Users\Admin\AppData\Local\nightlight-launcher\GPUCache\data_0
          • Size 8KB
          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_1
          • Path C:\Users\Admin\AppData\Local\nightlight-launcher\GPUCache\data_1
          • Size 264KB
          • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_2
          • Path C:\Users\Admin\AppData\Local\nightlight-launcher\GPUCache\data_2
          • Size 8KB
          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_3
          • Path C:\Users\Admin\AppData\Local\nightlight-launcher\GPUCache\data_3
          • Size 8KB
          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\nightlight-launcher\Network\Network Persistent State
          • Size 1KB
          • SHA256 8498ee05f1fcc1cb27dbfc9f20845c9ff79ca6a40f3d1153a9b2623df23f0d5b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ddda7a34-5a89-4779-aee4-48152225c831.tmp
          • Path C:\Users\Admin\AppData\Local\nightlight-launcher\Network\ddda7a34-5a89-4779-aee4-48152225c831.tmp
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          default.dic
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512
          Submit Download

          memory/1700-827-0x000001E0F9E90000-0x000001E0F9E91000-memory.dmp
          Download

          memory/1700-828-0x000001E0F9E90000-0x000001E0F9E91000-memory.dmp
          Download

          memory/1700-820-0x000001E0F9E90000-0x000001E0F9E91000-memory.dmp
          Download

          memory/1700-824-0x000001E0F9E90000-0x000001E0F9E91000-memory.dmp
          Download

          memory/1700-830-0x000001E0F9E90000-0x000001E0F9E91000-memory.dmp
          Download

          memory/1700-826-0x000001E0F9E90000-0x000001E0F9E91000-memory.dmp
          Download

          memory/1700-829-0x000001E0F9E90000-0x000001E0F9E91000-memory.dmp
          Download

          memory/1700-831-0x000001E0FA9B0000-0x000001E0FC22E000-memory.dmp
          Download

          memory/1700-818-0x000001E0F9E90000-0x000001E0F9E91000-memory.dmp
          Download

          memory/1700-825-0x000001E0F9E90000-0x000001E0F9E91000-memory.dmp
          Download

          memory/1700-819-0x000001E0F9E90000-0x000001E0F9E91000-memory.dmp
          Download

          memory/4252-791-0x00000265B0650000-0x00000265B1ECE000-memory.dmp
          Download

          memory/4252-797-0x00000265B0650000-0x00000265B1ECE000-memory.dmp
          Download

          memory/4252-835-0x00000265B0650000-0x00000265B1ECE000-memory.dmp
          Download