Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 22:56

General

  • Target
    NightCord-Installer (1).exe
  • Size 50.9MB
  • Sample260730-2wp2ea11gz
  • SHA256 207e1e9288506ae88cad168db38f1d3b278b67fa5a453b830739dbb93193a7e9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NightCord-Installer (1).exe
    "C:\Users\Admin\AppData\Local\Temp\NightCord-Installer (1).exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5064
    • C:\Users\Admin\AppData\Local\Temp\3H3G1OZPM8NryM6MZeMPNoLfJSh\Nightcord.exe
      C:\Users\Admin\AppData\Local\Temp\3H3G1OZPM8NryM6MZeMPNoLfJSh\Nightcord.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:6004
      • C:\Users\Admin\AppData\Local\Temp\3H3G1OZPM8NryM6MZeMPNoLfJSh\Nightcord.exe
        "C:\Users\Admin\AppData\Local\Temp\3H3G1OZPM8NryM6MZeMPNoLfJSh\Nightcord.exe" --type=gpu-process --field-trial-handle=1600,2726517041719357138,6333711170443703761,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1608 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2916
      • C:\Users\Admin\AppData\Local\Temp\3H3G1OZPM8NryM6MZeMPNoLfJSh\Nightcord.exe
        "C:\Users\Admin\AppData\Local\Temp\3H3G1OZPM8NryM6MZeMPNoLfJSh\Nightcord.exe" --type=renderer --field-trial-handle=1600,2726517041719357138,6333711170443703761,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\3H3G1OZPM8NryM6MZeMPNoLfJSh\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:1756
      • C:\Users\Admin\AppData\Local\Temp\3H3G1OZPM8NryM6MZeMPNoLfJSh\Nightcord.exe
        "C:\Users\Admin\AppData\Local\Temp\3H3G1OZPM8NryM6MZeMPNoLfJSh\Nightcord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,2726517041719357138,6333711170443703761,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2036
      • C:\Users\Admin\AppData\Local\Temp\3H3G1OZPM8NryM6MZeMPNoLfJSh\Nightcord.exe
        "C:\Users\Admin\AppData\Local\Temp\3H3G1OZPM8NryM6MZeMPNoLfJSh\Nightcord.exe" --type=gpu-process --field-trial-handle=1600,2726517041719357138,6333711170443703761,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1484 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:928
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5524

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          LICENSE.electron.txt

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\LICENSE.electron.txt
          • Size 1KB
          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
          • MD5 SHA1 SHA512 TLSH

          LICENSES.chromium.html

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\LICENSES.chromium.html
          • Size 5.1MB
          • SHA256 fc2a256467fb4d4ff72be6c423e5961e98b418554deeec296aded0e757b9a585
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_100_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\chrome_100_percent.pak
          • Size 138KB
          • SHA256 c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_200_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\chrome_200_percent.pak
          • Size 202KB
          • SHA256 b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          d3dcompiler_47.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\d3dcompiler_47.dll
          • Size 4.3MB
          • SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ffmpeg.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\ffmpeg.dll
          • Size 2.6MB
          • SHA256 39293258d5a2418841edb5ccf9ab3ad23064fb95e1ddfa7a3c6295a24c272a08
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icudtl.dat

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\icudtl.dat
          • Size 9.9MB
          • SHA256 6e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libEGL.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\libEGL.dll
          • Size 429KB
          • SHA256 23046e7fe2bbf76ee2c5596b6beac723ad465fdbaa44266486102cdb292148a1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libGLESv2.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\libGLESv2.dll
          • Size 7.6MB
          • SHA256 dd74029716da56a0e4b64bc5cea0c169e1c4b31143ff39213d3c544792e8f2b9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          am.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\am.pak
          • Size 150KB
          • SHA256 5f323c0bd185d5bd5f7ea737018f14fd6ea500ba5440bc74f5c09b635518eadc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\ar.pak
          • Size 153KB
          • SHA256 e7f9a474399c0ca0daf28c6153f6ec7ae87423e66c8ffe0849407471d20b6237
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bg.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\bg.pak
          • Size 166KB
          • SHA256 bd3a3aacc3cee9864404755eee9542e0f21efbebd4a71e5333d15783d4ce18c9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\bn.pak
          • Size 216KB
          • SHA256 b4ed891e8b38452623348da12d325b52407446114cba664a8e25a26a7cfaf773
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ca.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\ca.pak
          • Size 105KB
          • SHA256 9a4e286a58bb9a58e9e30d982783663c9bce40730cb6dad4c37980038040919e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cs.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\cs.pak
          • Size 107KB
          • SHA256 c00829fc57c7e1e5419fe3202f114d394a590b8b32b1e55af42772c93755945d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          da.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\da.pak
          • Size 98KB
          • SHA256 6da77a20fd6fbb228b2de5f197225342da18cbc58d26ebf542cf20d23e00f033
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\de.pak
          • Size 105KB
          • SHA256 e964d841b9588b7412f1ff86f004e6b052f993bf2153e4dc4bee6c5536be1744
          • MD5 SHA1 SHA512 SSDEEP TLSH

          el.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\el.pak
          • Size 184KB
          • SHA256 b624633365c19e6e3cbe200b39889711994809796dbee7988883165d0cc1d6c2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-GB.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\en-GB.pak
          • Size 87KB
          • SHA256 4a5e6439c6731a5273970c8c053b4a89018c57f1d9be81d85f24978233675442
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-US.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\en-US.pak
          • Size 88KB
          • SHA256 781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es-419.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\es-419.pak
          • Size 103KB
          • SHA256 2e1cf9d3e3eebe607da44873cfe37b9a84615962e3450313c3947920d4de4fda
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\es.pak
          • Size 105KB
          • SHA256 b927984d25359f3d7a20d71aa4b16d2ec4c574461177825b5221865f416d1e71
          • MD5 SHA1 SHA512 SSDEEP TLSH

          et.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\et.pak
          • Size 94KB
          • SHA256 9cdefc472c67247e67da040b984e800cc8b903a1b39c742e6962ff5c423f391e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fa.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\fa.pak
          • Size 147KB
          • SHA256 7e8f7f42300178f001ea5f74c63db25d813b7c25989114dc7673c76fd92a72c9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\fi.pak
          • Size 97KB
          • SHA256 4e538a14f1dbc872a85fdb4be1e19145553ecfa3b07ee7c810b690c52b889684
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fil.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\fil.pak
          • Size 107KB
          • SHA256 cb536b478feffd3b55ec53676cce84cefc9e000c1205273bafcdaf6ee6edd381
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\fr.pak
          • Size 113KB
          • SHA256 f3bfcd6a297a7634c24f2fbd3de96f02588b0603d4a7618bb7588f6c091beb2e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\gu.pak
          • Size 207KB
          • SHA256 1d4d407233a4c78d5a9a242b43b21aa89fb68a0632bc52b0a515d69491632e85
          • MD5 SHA1 SHA512 SSDEEP TLSH

          he.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\he.pak
          • Size 129KB
          • SHA256 4a9862ee8e139ae74e6336e0207d484e1a1ae0f689b5f1cc06b6fea66d2090d9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\hi.pak
          • Size 213KB
          • SHA256 06424570167c9bdd7e13b115a632d6ab58de7a4fa14f8d094627bd12d85e9318
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\hr.pak
          • Size 102KB
          • SHA256 cc48d7deaf73103e22e3e5900503396e2a2c9e5bf1450a4df8ce94179b1e47a2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\hu.pak
          • Size 110KB
          • SHA256 61ae4e65474cb4ecf5edb2ec9bb9ea2b7a47bbf769f81c8fee1282c13b209783
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\id.pak
          • Size 94KB
          • SHA256 e07be6b1a095f235a4babb2ad5e8018c8c1b2f7cd6feab170124d25898e764c6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\it.pak
          • Size 103KB
          • SHA256 4e2089d3fd90977f9a3a88b2af7fa9ff3b9864969d2f4582431626ae1f37c158
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\ja.pak
          • Size 124KB
          • SHA256 275307a3a9708c0698565f10941c57d42e1d2f55709a025d37e588699b5a985e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          kn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\kn.pak
          • Size 237KB
          • SHA256 1a3fa5261b58113ae1a5cf140abd93e812b4a866a19a4c54929fffee5f42b18b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\ko.pak
          • Size 104KB
          • SHA256 0a46cce08401a72e44178349a61cdbae5fd78ca4f071bff2bf5f2e8c877a25f8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lt.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\lt.pak
          • Size 111KB
          • SHA256 225e5784a7a616f83d81e6f3fdc5510e975e9fbde741b673deece5ded1604a9d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\lv.pak
          • Size 111KB
          • SHA256 d58b6308b64a1cda4ee0b2b395672728ce7abb73c44961fc911386569caee60e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ml.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\ml.pak
          • Size 250KB
          • SHA256 e51d9a02ad11cb9825368da9a17af7294b7e6bf11079e2072e4bec028ecaf20f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\mr.pak
          • Size 204KB
          • SHA256 4293afacf1c4dce2423c368a45fec4b33aac7232e7b7c1919aa8a5a20fb026a1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ms.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\ms.pak
          • Size 97KB
          • SHA256 83248a2aaefb87fc19454afa34bf5df99b95b98f823b534de0bae552c8260d93
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nb.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\nb.pak
          • Size 96KB
          • SHA256 21f3efe54a2a0ed9e2f618b2a50f89b44957bc7c779e7f88c1f10b310cea8bd5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\nl.pak
          • Size 99KB
          • SHA256 e94551ca94505f068ecd0619af676b7b3a869f6068af87f0f537cace8055ba4b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\pl.pak
          • Size 108KB
          • SHA256 c57c2e534da554e42388815cd3e848630ed46e1e61e640a6f3d4fd7cbdfb2aed
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-BR.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\pt-BR.pak
          • Size 102KB
          • SHA256 ed9adacad575344216ee986e9c04908a5093aa7a0ebfbf2549df4c668a35f356
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-PT.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\pt-PT.pak
          • Size 103KB
          • SHA256 da64b5178bb41be0684cb3ef1204becb457520fe4960c3252f5ccd6a9ee9e29a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ro.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\ro.pak
          • Size 106KB
          • SHA256 99730524e53ca07481f8cdbbdace228aed42abc19d2277d26c42f47653f3cf07
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ru.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\ru.pak
          • Size 166KB
          • SHA256 ec6654ffd877ec62d8afcf90469ecef5790e17c7306654cfe4b905de449b06d8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\sk.pak
          • Size 109KB
          • SHA256 d7baa6b1c0355e1ce9088c6eb508235c7a640ba70cc7ad84c9ac607026400495
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\sl.pak
          • Size 104KB
          • SHA256 48e9004441f8afb200601ec2843a03892076deb1706e1d3a7bbdbfcdd137ab57
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\sr.pak
          • Size 158KB
          • SHA256 68a04bae37629675c49d9aaeb68a1da974aac427b61151a18f3210499702202d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\sv.pak
          • Size 96KB
          • SHA256 c63e812fee929492974c9b5dfa14a7587258e6fabed355a105015b296246b068
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sw.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\sw.pak
          • Size 97KB
          • SHA256 8b07bfafa5c97be2da9b6146535b7848d88a44d43a45ab06dfae286d93fd64ce
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ta.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\ta.pak
          • Size 245KB
          • SHA256 22eb9d73331e92c898b27546a9e775fa8df0fdada391734a9291b2a016662652
          • MD5 SHA1 SHA512 SSDEEP TLSH

          te.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\te.pak
          • Size 228KB
          • SHA256 2dd8a542ee0778ee39639380208c584d9eec8932d1307bd5563e1eab320fe0d8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          th.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\th.pak
          • Size 195KB
          • SHA256 cffd61f7954ca10038529d14fda6a4e34c8ea1a9f202ead0b0c2db93143ef485
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\tr.pak
          • Size 101KB
          • SHA256 b1b66bfec0aff21c64ec8ba3f19008501f196f80e7e41b2e8ae73114357df458
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\uk.pak
          • Size 167KB
          • SHA256 fa035595c375522d09f9de5a545f5339fcd3ddb224fb19f1828a7958b7dff3e8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\vi.pak
          • Size 119KB
          • SHA256 044c48581c2395a8eb0f85b5905e1b4cce1fc1fef2196710cef06e197afdfa99
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-CN.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\zh-CN.pak
          • Size 88KB
          • SHA256 690dafdeb5be360e8b3a84c711d0d48b3cfc74c871b89a8f03f8058738ca9834
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-TW.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\locales\zh-TW.pak
          • Size 88KB
          • SHA256 8187e67cde3292c6f18ea0a40f8f8d3f2cd604e62feec9ec40c71b5d2bcdec9d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          resources.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\resources.pak
          • Size 4.9MB
          • SHA256 a30b8269e588c6cc2cea5fd4685da3012fd10451edb59a283005116f8e033182
          • MD5 SHA1 SHA512 SSDEEP TLSH

          app.asar

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\resources\app.asar
          • Size 1.1MB
          • SHA256 d8a5875c2eff5f82fdcf23a84114176e62bd3835b3a334e825c07d6d63933e43
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icon.icns

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\resources\assets\icon.icns
          • Size 46KB
          • SHA256 a4dc3ce7a64207d10d15c4c537599f47b4ec1f16b53dbf3a92466d050ed4fcc5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icon.ico

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\resources\assets\icon.ico
          • Size 49KB
          • SHA256 c079322ded8d8ebb655b2b93be10b18b2a7a5080dde945da6acf517caf3acf3d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          background.png

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\resources\assets\images\background.png
          • Size 297B
          • SHA256 1d370406c3b0c6bfe109feb76229fd4a0fe1d4171ae2a77655a0fd3264558d2f
          • MD5 SHA1 SHA512 TLSH

          canary.png

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\resources\assets\images\canary.png
          • Size 2KB
          • SHA256 dfd3446ba31a55a11b45e0196b4eb2800e0271749c99102660d0df59f2ad9b85
          • MD5 SHA1 SHA512 TLSH

          splash.bmp

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\resources\assets\images\splash.bmp
          • Size 564KB
          • SHA256 c14a86e456f5b9783ed3e2118c9e97de6306fbd2b40cf9cd0dfb821b945c3569
          • MD5 SHA1 SHA512 SSDEEP TLSH

          stable.png

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\resources\assets\images\stable.png
          • Size 1KB
          • SHA256 b5b0f8076b0ac106fcc8f172b5e81516b69387f4119ca54715bd00739861fa27
          • MD5 SHA1 SHA512 TLSH

          license.txt

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\resources\assets\license.txt
          • Size 3KB
          • SHA256 7a274954056aa1065eb96c64b014ecf9e2e535d78633204303feeb2f6e802c72
          • MD5 SHA1 SHA512 TLSH

          elevate.exe

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\resources\elevate.exe
          • Size 105KB
          • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
          • MD5 SHA1 SHA512 SSDEEP TLSH

          snapshot_blob.bin

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\snapshot_blob.bin
          • Size 47KB
          • SHA256 e03a33c2feb3cd9fd04fb1aa086febd0a6fdf5c680f48b6c5c80ef75767863d9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libEGL.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\swiftshader\libEGL.dll
          • Size 448KB
          • SHA256 b1054e0dc2ab31a7cf3cd7f3dae07b1ec31acd42c157be13ce47ea870840f0cc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libGLESv2.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\swiftshader\libGLESv2.dll
          • Size 3.1MB
          • SHA256 2e10d308d0207835b07df3bb38bee88300aa57fcb214051e8654d29587257744
          • MD5 SHA1 SHA512 SSDEEP TLSH

          v8_context_snapshot.bin

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\v8_context_snapshot.bin
          • Size 161KB
          • SHA256 09686ad5bf03d95de7c251d204e60a8e3824bd6420bedddee80b2c6e5609fb26
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\vk_swiftshader.dll
          • Size 4.5MB
          • SHA256 cc947f08b87f4636213211b22328c32d1986d49abc96a619799091fa6a15c851
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader_icd.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\vk_swiftshader_icd.json
          • Size 106B
          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
          • MD5 SHA1 SHA512 TLSH

          vulkan-1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\7z-out\vulkan-1.dll
          • Size 707KB
          • SHA256 26460b9250e904a9db6e5e0893e746a84ffae21c02e083e3f33a913d7cc79111
          • MD5 SHA1 SHA512 SSDEEP TLSH

          StdUtils.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\StdUtils.dll
          • Size 100KB
          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          System.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\System.dll
          • Size 12KB
          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsis7z.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsg5E73.tmp\nsis7z.dll
          • Size 424KB
          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
          • MD5 SHA1 SHA512 SSDEEP TLSH

          default.exc

          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512

          Network Persistent State

          • Path C:\Users\Admin\AppData\Roaming\Nightcord Installer\Network Persistent State
          • Size 175B
          • SHA256 bd367325bb3c469e1aa6dcff50b6296b9b8d5bf5bed538f01f36c29b0603511a
          • MD5 SHA1 SHA512 TLSH

          Network Persistent State~RFe5a96d3.TMP

          • Path C:\Users\Admin\AppData\Roaming\Nightcord Installer\Network Persistent State~RFe5a96d3.TMP
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH

          memory/2916-430-0x00007FF97D910000-0x00007FF97D911000-memory.dmp

          memory/2916-498-0x0000027914220000-0x0000027914336000-memory.dmp

          memory/2916-503-0x0000027914220000-0x0000027914336000-memory.dmp

          memory/2916-497-0x0000027914220000-0x0000027914336000-memory.dmp

          memory/2916-494-0x0000027914220000-0x0000027914336000-memory.dmp