Resubmissions

29/07/2026, 04:34

260729-e7gg3sgn7v5

29/07/2026, 04:23

260729-ez314swwey7

Analysis

  • max time kernel
    72s
  • max time network
    79s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/07/2026, 04:34

General

  • Target
    RadarOmega Setup 5.5.3-x64.exe
  • Size 85.3MB
  • Sample260729-e7gg3sgn7v
  • SHA256 d3a7e80d24d726402926b8a61f0cfec49878b2627c386993207aebe10b7a30b3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RadarOmega Setup 5.5.3-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\RadarOmega Setup 5.5.3-x64.exe" /S
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4872
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq RadarOmega.exe" /FO csv | %SYSTEMROOT%\System32\find.exe "RadarOmega.exe"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2252
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq RadarOmega.exe" /FO csv
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3392
      • C:\Windows\SysWOW64\find.exe
        C:\Windows\System32\find.exe "RadarOmega.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3120

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RadarOmega\chrome_100_percent.pak
        • Size 163KB
        • SHA256 0d27d5591c72721ce399133e104114aa802caf3070814570ad205987a51a8ff7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\LICENSES.chromium.html
        • Size 14.5MB
        • SHA256 a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\chrome_200_percent.pak
        • Size 252KB
        • SHA256 fa1fce57396b3e21776659e50fb1c12fd4c010c9f56f161be6f4437207d21241
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.7MB
        • SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\ffmpeg.dll
        • Size 2.9MB
        • SHA256 0d21de0f4497f126b9aad67c57b045225185c70aad2308a25db01d6086e4d5a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\icudtl.dat
        • Size 10.0MB
        • SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\libEGL.dll
        • Size 492KB
        • SHA256 dfd53ccbfce55510f2afdb52703037452370eb5bdf33143829a8b06253015625
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\libGLESv2.dll
        • Size 7.7MB
        • SHA256 b348ceedd275843cbe344a29dd8550b18e5d433abff695cdf5658470c1e71c67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\af.pak
        • Size 562KB
        • SHA256 7efae5393f523d0b23dd355e5cb165a14a4a5eb9d102f8fd7e1592fde0d81590
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\am.pak
        • Size 911KB
        • SHA256 108ac040ce13b53af88bc45f3e5b13086c1d435839dfdbabb19d6877d9daad96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\ar.pak
        • Size 1007KB
        • SHA256 69a43e3592c8cabfe8fdef53c963bca7ee137e093d20f12767df89862c0eccd8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\bg.pak
        • Size 1.0MB
        • SHA256 f4e5ceabc00d8d66a100f78540d81762e67bcd7482df116ee2545507a45de25d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\bn.pak
        • Size 1.3MB
        • SHA256 66e568b1fbb31391786dcd2af632866894fd6a23bef0b408a59587a144bd0353
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\ca.pak
        • Size 633KB
        • SHA256 bdcc6f6404dc686148977e41330461e89d5739afcf123f03557239d93b911e03
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\cs.pak
        • Size 654KB
        • SHA256 56b0e1723259bcf6abdda080ece8877f4b1586b49d3c13ef8908619e2a118972
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\da.pak
        • Size 591KB
        • SHA256 c7a554e9644dda72071d7af1dcf077b783b52af926e99b507d79a664df4acc33
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\de.pak
        • Size 633KB
        • SHA256 de5422f48522a52248ba835d4e7ef860a734b54d2ee41c9a87cd73e7e947c318
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\el.pak
        • Size 1.1MB
        • SHA256 aa9b5d10422054e87bcd6068be5a2b085b8fd3ecb1d998eabe282a72c6520570
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\en-GB.pak
        • Size 513KB
        • SHA256 e2eef21ab7b088c122b6990f66dd22ce0c7e1191c64e9ac8424435c3a6749cbe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\en-US.pak
        • Size 518KB
        • SHA256 3cd05f6512ed5d09076253dcdfd4ccc5eedfab44e1703cf3e015597dd31220c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\es-419.pak
        • Size 624KB
        • SHA256 3fb38e2a38ef336a407fe91813986522e89696bcf3d6f78c68d60c921f741db4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\es.pak
        • Size 622KB
        • SHA256 e381793151b6bb9e87e954d2ead53fac523dda92912d4d14ecf46885f86ce441
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\et.pak
        • Size 567KB
        • SHA256 19245d259d70ec459d210cc01eb6e6d05298073dead915e164aa7aedf3b873ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\fa.pak
        • Size 933KB
        • SHA256 bab2b590f945b1d864c38ebcc7167b74ba325b0ac7f3d611cd1728a53a5fb99a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\fi.pak
        • Size 578KB
        • SHA256 41137434ee1d2b1aa3603fc134e8cd52455731dfb3eec44bd7f3e36df57e4f15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\fil.pak
        • Size 655KB
        • SHA256 8a9e1a72a7d067654df9e4a761f5c06cfac267680e00c45d9d52a929b318b435
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\fr.pak
        • Size 674KB
        • SHA256 477771211fdff1fc9c8e002476e2440c1c14ce4ce69976a0993c99f2f5b47505
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\gu.pak
        • Size 1.3MB
        • SHA256 51635a11ad7349ae131927156c50f6935c38cb6628cd8d2f8a5fb6715f6140e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\he.pak
        • Size 818KB
        • SHA256 0ecf199553289880d0fa590fcab56d2165e4e571de0b77970619a244cc0285f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\hi.pak
        • Size 1.4MB
        • SHA256 5197062239f1780dff514326ca5894c39e4e4e2b4bb2c6e73f619122db31630f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\hr.pak
        • Size 631KB
        • SHA256 ea68d33fd264a2a3cb0c78f7b92ac79af7cc1ca27fc50427ca100fc468ae40ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\hu.pak
        • Size 678KB
        • SHA256 91d754bd252cd411fcc3513e04513d5e4d8165f36eace12f88d84fd7e352e857
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\id.pak
        • Size 559KB
        • SHA256 e78831cb31a4d2ab77cbe47bcc5439be3bc7d66fba7799779d5ab3e1d004115f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\it.pak
        • Size 614KB
        • SHA256 c5feff891ed9a00cdd7e0349b187cc2d26248ae468f076a09099312e04b23c21
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\ja.pak
        • Size 747KB
        • SHA256 30ea0122899ef914ee799d92667af4ae54c18cdc6e5bb780719a3f6a5dfc6435
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\kn.pak
        • Size 1.5MB
        • SHA256 b00058366c4e2febd46df14debda4ef777ddfe2c004d08f528dd17eaf8d4c17e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\ko.pak
        • Size 634KB
        • SHA256 2f26d1e6f3f505d95c26dd0a4d61c2621d8109d871bdb30fdb4718b802f10d20
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\lt.pak
        • Size 684KB
        • SHA256 473fb2217995c4c4bafc23a9d418b3cd393604248ed19d06588e719519122c2e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\lv.pak
        • Size 683KB
        • SHA256 7b589f1bc446b15d315fcd81b446b47e15ec533043abe56b1d060ab4a727b56c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\ml.pak
        • Size 1.5MB
        • SHA256 9b874b08ffe56813efce14d03e840f948f6e0ac9fb5fdef1163098d0d7ddf91f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\mr.pak
        • Size 1.3MB
        • SHA256 ab04bcdd9287640b1ce017eec44b6701e44a2e050c51eb1c9859b6367759d848
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\ms.pak
        • Size 588KB
        • SHA256 7d408f4f45fcdb66efcaf7beae9cb07e0c42a26e237461500cfc4403cdc88690
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\nb.pak
        • Size 567KB
        • SHA256 b44a1be560c7138a4d2b6b08a93fa529192e54a2256dac2695c901019cc66bce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\nl.pak
        • Size 588KB
        • SHA256 262bf074055e830d0e4d361ca24e74f0170cd55938236163d96c6b48929b6d26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\pl.pak
        • Size 655KB
        • SHA256 4994a5ad97534bc91b73ad528abc1771628848005c950bbac279d5e2b3e03465
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\pt-BR.pak
        • Size 615KB
        • SHA256 e90d7ca40487d8f5299c85f86b5f20f7188d94c3f0e8b5368495f9a73c29cd40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\pt-PT.pak
        • Size 619KB
        • SHA256 97b06698596cf084533ac7990ae73cd72b3b851927e0fc5747cd0cab4f681079
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\ro.pak
        • Size 641KB
        • SHA256 757990528d01554f5a1e476929ed3b4fd0bee20cbae07db442923cb477358d9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\ru.pak
        • Size 1.0MB
        • SHA256 7aaf8f96500bc8eb8883e46a10b84ebdc17ffdf34fe3d972cb3d69b29ed04776
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\sk.pak
        • Size 666KB
        • SHA256 1101256328b7dce3d388abfafa44e27ca416136187f366809ada6fabe1def449
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\sl.pak
        • Size 638KB
        • SHA256 eef2f7c2f3aa5572456274004104d0c79911834f002fa1fdcd5063b60a3225a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\sr.pak
        • Size 982KB
        • SHA256 9184460cb3dc15e5babf7d96c0816d4068e411a376dc7314e84c722761788538
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\sv.pak
        • Size 572KB
        • SHA256 bcc5a1a2405dd2cdb4adcdc0fd9236645de378ea179ea558b44908fdf708f93b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\sw.pak
        • Size 604KB
        • SHA256 dd7ec69741e67b471df0555096dcf3affe5a40f68753ccebae75d0cf11b07c60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\ta.pak
        • Size 1.5MB
        • SHA256 70a31eee3dc00ae51d9ae04945ad3db12de70f44a1fa913d88d599506e27c6b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\te.pak
        • Size 1.4MB
        • SHA256 1447c02054e3d9ea084311c86c010834b44d7b0863f515cc4b83ce43201787e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\th.pak
        • Size 1.2MB
        • SHA256 426a8e74828089ffb36b6ed19462eb645e407ae0352906f7f08ee19a3a5eb97a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\tr.pak
        • Size 615KB
        • SHA256 62c8ace3604a27fab3455e5e86a74f4eaca0a80c1d25a6c24a9656d0e8c37ec5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\uk.pak
        • Size 1.0MB
        • SHA256 e8c4c4c982f28789f7e710ff7e941b37179966cdc6b9a480f60b03bef866886b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\ur.pak
        • Size 923KB
        • SHA256 7e8c8a47ab450c0165602160712d0430fc751c5703de655c0d543558e54c63fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\vi.pak
        • Size 729KB
        • SHA256 6f898771f587d9c7742e3f4779eaa23fc0db554803701b698965a672dcdd6e04
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\zh-CN.pak
        • Size 523KB
        • SHA256 622f645c6b0a9cb8df6fc92c7a8e52ab2f5118a3f1b324d1910942ce34d180b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\locales\zh-TW.pak
        • Size 518KB
        • SHA256 da8923f485868aeb83f57a1b5991db7ae6474d2418e389d71512e3e5227367ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\resources.pak
        • Size 5.9MB
        • SHA256 ca47fceab76d2220a66dd5c55a444bbdb1f2300b1bd3b180693509327442b292
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app-update.yml

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\resources\app-update.yml
        • Size 126B
        • SHA256 9b0b4b709d67b62213ec0abce2d09a13d9d7b56b642e6c47d65644ae4faa63d6
        • MD5 SHA1 SHA512 TLSH

        app.asar

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\resources\app.asar
        • Size 6.0MB
        • SHA256 0118d0cca1e772eddb4418e75b0f8c1db1f4288ad076ed6f9971bd8b9a7bfb1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\resources\elevate.exe
        • Size 116KB
        • SHA256 117fc754cf4d6929f34a1e20f5363ed4a95aa45ef9548236ba9a5c10611ad8bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        todesktop-runtime-config.json

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\resources\todesktop-runtime-config.json
        • Size 44B
        • SHA256 c459c2a047e54df946bf8e8fc32cd68cd4d36ff60934e913dfc34a36ecae6c25
        • MD5 SHA1 SHA512

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\snapshot_blob.bin
        • Size 329KB
        • SHA256 9a10e7b6d4a4a19e9e825217b2eaab2e47df86fe85a70e74e6f660c89ddb0fb6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\v8_context_snapshot.bin
        • Size 695KB
        • SHA256 546db668f31be13f2a70cb2282f8073a88ad51be77eef468e1ad7a9450738da6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\vk_swiftshader.dll
        • Size 5.3MB
        • SHA256 c753107d8827525306b83d3c35da988b0954caebc4ab806d4ca6f27b7a0d8bdf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\7z-out\vulkan-1.dll
        • Size 917KB
        • SHA256 40e39b8cd62c3292f7c5ad6a2d863f6e3bd3d2c0b1b3a2a0e4d41a61d2a8f758
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BlockShutdown.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\BlockShutdown.dll
        • Size 5KB
        • SHA256 0b4f6d7348e2e00ad913b493d36e4265cf372e8a610ab8efec34c7e027fef2c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WinShell.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\WinShell.dll
        • Size 3KB
        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
        • MD5 SHA1 SHA512 TLSH

        nsExec.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\nsExec.dll
        • Size 6KB
        • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv13D2.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH