Analysis

  • max time kernel
    152s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 16:37

General

  • Target
    Ion Cannon.exe
  • Size 69.2MB
  • Sample260804-t47mesam5t
  • SHA256 7dcc88c993ecc63cbc519335b1e0d5f49727ca5363093a73a37c217db9debc73
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ion Cannon.exe
    "C:\Users\Admin\AppData\Local\Temp\Ion Cannon.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4180
    • C:\Users\Admin\AppData\Local\Temp\3HNv5eZXWOHlaA8Po8zJOrqFyLi\Ion Cannon.exe
      "C:\Users\Admin\AppData\Local\Temp\3HNv5eZXWOHlaA8Po8zJOrqFyLi\Ion Cannon.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4400
      • C:\Users\Admin\AppData\Local\Temp\3HNv5eZXWOHlaA8Po8zJOrqFyLi\Ion Cannon.exe
        "C:\Users\Admin\AppData\Local\Temp\3HNv5eZXWOHlaA8Po8zJOrqFyLi\Ion Cannon.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Ion Cannon" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1716,i,264258120437603120,7245525724844872896,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3272
      • C:\Users\Admin\AppData\Local\Temp\3HNv5eZXWOHlaA8Po8zJOrqFyLi\Ion Cannon.exe
        "C:\Users\Admin\AppData\Local\Temp\3HNv5eZXWOHlaA8Po8zJOrqFyLi\Ion Cannon.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Ion Cannon" --field-trial-handle=2248,i,264258120437603120,7245525724844872896,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4432
      • C:\Users\Admin\AppData\Local\Temp\3HNv5eZXWOHlaA8Po8zJOrqFyLi\Ion Cannon.exe
        "C:\Users\Admin\AppData\Local\Temp\3HNv5eZXWOHlaA8Po8zJOrqFyLi\Ion Cannon.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ion Cannon" --app-path="C:\Users\Admin\AppData\Local\Temp\3HNv5eZXWOHlaA8Po8zJOrqFyLi\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2344,i,264258120437603120,7245525724844872896,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4844
      • C:\Users\Admin\AppData\Local\Temp\3HNv5eZXWOHlaA8Po8zJOrqFyLi\Ion Cannon.exe
        "C:\Users\Admin\AppData\Local\Temp\3HNv5eZXWOHlaA8Po8zJOrqFyLi\Ion Cannon.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Ion Cannon" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3284,i,264258120437603120,7245525724844872896,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1620 /prefetch:10
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:932

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\LICENSES.chromium.html
        • Size 8.7MB
        • SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\chrome_100_percent.pak
        • Size 148KB
        • SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\chrome_200_percent.pak
        • Size 223KB
        • SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.7MB
        • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\ffmpeg.dll
        • Size 2.8MB
        • SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\icudtl.dat
        • Size 10.0MB
        • SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\libEGL.dll
        • Size 481KB
        • SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\libGLESv2.dll
        • Size 8.0MB
        • SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\af.pak
        • Size 520KB
        • SHA256 c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\am.pak
        • Size 840KB
        • SHA256 49a2095ad9ffac0b7ffaadba64d2c2b51a05e0695e21d1c428735485757bd11c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\ar.pak
        • Size 921KB
        • SHA256 817829ad75dbc7d59b5042d7f056fa2485f82d1ae2af50ed83fd89f86f3d58fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\bg.pak
        • Size 959KB
        • SHA256 f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\bn.pak
        • Size 1.2MB
        • SHA256 5a57265ebac6df683f0279684909755ad71ea70fea71c6ecc1810eac61d1cb3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\ca.pak
        • Size 584KB
        • SHA256 bc2b7d6a769c69b27a81cc09a1babd4ccaf003fae32f8294a38e498f2c529c89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\cs.pak
        • Size 602KB
        • SHA256 db040e9f17d2792801c07a7bb3ac96c21d8189c98e9ab34210c5888b2ee53aa1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\da.pak
        • Size 545KB
        • SHA256 e32681cdd03db28eb360b1b4203c2988190b7b6f77679ca807cd95a1967ded04
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\de.pak
        • Size 582KB
        • SHA256 4f123245b062d71d56819ac1198d13a3d7953decd4491fca0fbd22c5e129c3bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\el.pak
        • Size 1.0MB
        • SHA256 b8707f2511c4ec5533077009771f3aa92b0fb5b395b13907f5860a9151b2431d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\en-GB.pak
        • Size 474KB
        • SHA256 3bf7e7e02c40dac55ce9bd5b4789eaa99e57271b2d907a5ce2ca90b979a58c39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\en-US.pak
        • Size 478KB
        • SHA256 75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\es-419.pak
        • Size 575KB
        • SHA256 4dedec1ac933c73773b1e54caab1c4d606d12f3788cbeef4d6a2a382138cc907
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\es.pak
        • Size 575KB
        • SHA256 a32221be9b65aead3fa779dc54e5ca483a7d73c4815e5c7c3b53711f560bd301
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\et.pak
        • Size 523KB
        • SHA256 a4d1fe9903641540b11e0d00e574a6665a1602ad81f6aae9a083ebd04bc768c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\fa.pak
        • Size 855KB
        • SHA256 ef9e5b71063c26b1a5d512f5e14c3f7fe5a1925ff25ca799c51f8073c33bb90a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\fi.pak
        • Size 534KB
        • SHA256 93c49ec40accea8e1f4f9b7db68b9b818f8db0b7591cea67ae9bf663c1c57728
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\fil.pak
        • Size 604KB
        • SHA256 9b69d82f50c159d1ec5603ef45dc139143b4f05761f38f263a66fffedd28ff5e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\fr.pak
        • Size 622KB
        • SHA256 8bf019aed30d972883d5c29d3f44c8b0d8fc6425ab48ae3354d71e4762a0cf01
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\gu.pak
        • Size 1.2MB
        • SHA256 1adaaacf2f9ab872fb35932fd1ed3b005f370f0ec22b95b42039b4c58660675c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\he.pak
        • Size 751KB
        • SHA256 df1b83384ad42d4ca9f47aebc909baa8a6dde79fa1b0706023a279698e302e89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\hi.pak
        • Size 1.3MB
        • SHA256 f73ccac3debba20fb225209805ff2383609853111f931e6b82095c1eb56a6ce4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\hr.pak
        • Size 581KB
        • SHA256 630277358f658c9c39a775dee247f38ac0a0a618a5645260f445ac89d7ac7a46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\hu.pak
        • Size 625KB
        • SHA256 ec81ac981af0e962654ad4f65030064a6369dc2316cb1b10bb24b473808ad1e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\id.pak
        • Size 516KB
        • SHA256 aeb815a3dc6ce3cd1edf2c158a3b16e9c8039af25752367bf13826516a295cb9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\it.pak
        • Size 567KB
        • SHA256 1b16b0af558629dd53e35d1b4bb7b18dc1d8cb5353a4261112d2cd3b0a4c55ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\ja.pak
        • Size 691KB
        • SHA256 b2afe7e5f6ebba31248ea00a157c9f5752cd6855194a0d122b3a6c90a1d9be83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\kn.pak
        • Size 1.4MB
        • SHA256 4e323def774ac53daf99d2075878456d8885c3380c7895ecf3ab10a2953d532a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\ko.pak
        • Size 585KB
        • SHA256 dc1d4b203674269f00aeb303f74e2948bc74e5956b1770acd2fbb517ad4274a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\lt.pak
        • Size 629KB
        • SHA256 9fe73d75dd155d0bda60a638b8f8d48048d17fadfd2d746bac597e5ac3b7f6dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\lv.pak
        • Size 628KB
        • SHA256 5c74465b83cef9aae45a6b61499e79b745a91a6038fdd61a3321425056f77b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\ml.pak
        • Size 1.4MB
        • SHA256 67d9ae2dbfecdfddc4c23a206828010c6d42b8094477a03ce04b60a8d110eea2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\mr.pak
        • Size 1.2MB
        • SHA256 7181c3bc7a369d2d0b8ae6c1cf8f160603ec56996d20b266833edc3acce4c78e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\ms.pak
        • Size 541KB
        • SHA256 6a3ced7828f0608297da29c99832a389ec9d0d03060ddb20304cd081be494adb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\nb.pak
        • Size 525KB
        • SHA256 697882ac2da78894e449cb1f75da43e7115c2481bbd2fee3bdaa425e82fc232c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\nl.pak
        • Size 543KB
        • SHA256 ac22005c476adbb7f3bcf0b17597a7a1595b83c4e6a8760d5553b630f0833305
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\pl.pak
        • Size 604KB
        • SHA256 e8a107b3568a289a6e60118e4b8e2f27338116dafcef078311bc16f0857b1f35
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\pt-BR.pak
        • Size 567KB
        • SHA256 1c0d67a4259df36655aa97761e71e02bb0407e7bb1fe1319394e0916c7d76f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\pt-PT.pak
        • Size 571KB
        • SHA256 9ebafb943bf20c66f8d9ca533633fdc63519e8ad38d78a3dd28b4457c38ba79d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\ro.pak
        • Size 592KB
        • SHA256 cf59cd7c26cfe3d87ed2b3a2ef254c3a3667824bbf06cd591bfc9dbf2a83ab91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\ru.pak
        • Size 972KB
        • SHA256 2d682d4a3ee1157085086c839cf55e500ec1d1674f66be7088eb25768a30c7a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\sk.pak
        • Size 611KB
        • SHA256 347196c447db2926f9e410905ff47fc0900ca97645e43236ba3b49f0550cfa24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\sl.pak
        • Size 587KB
        • SHA256 e8b877b4830b3a1163618107342e55756efe494adcdc82d10d963ad900b9f572
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\sr.pak
        • Size 903KB
        • SHA256 6f3d0c4ea29880624f07f0f794a6ea1ef735255dc218a241be1557331ebc3c28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\sv.pak
        • Size 528KB
        • SHA256 d6ad9726da354174df5eb7ea3ceba202df17936c5075a4b8e096de35f1abbe42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\sw.pak
        • Size 557KB
        • SHA256 434879a83079fba562af9dac928ad2fcc1033e0a6a5a1f4822d36e710decdd2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\ta.pak
        • Size 1.4MB
        • SHA256 0e1d7c0fa1eab312b42ff5e8978b7146d6cac313603fcaf101bef2eedc70313b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\te.pak
        • Size 1.3MB
        • SHA256 1faa8cb780908552f3ca0d2b0e20eb6aaa902cb5bd759c18ed1238beb0bb34dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\th.pak
        • Size 1.1MB
        • SHA256 9210c77f0024c705018f5292b3021d3eca58bb290604b116e2d4e355b8ebfc59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\tr.pak
        • Size 567KB
        • SHA256 25d1667b691b5a950b8b42652f7763338cfd238b22d6bd35a5c38da8cb73a67a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\uk.pak
        • Size 972KB
        • SHA256 017e34397fd52f4e42bb99ab1d7c4624055312a16d58da03aafffdcae770aecd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\ur.pak
        • Size 850KB
        • SHA256 ace832351fb9392fc308730ff74e5063caefe9903c5a01d9083a3ddf2ba93755
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\vi.pak
        • Size 673KB
        • SHA256 536538d1704c7b23d3b21beddcd4669151de276d259a9ea7192132696e54e146
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\zh-CN.pak
        • Size 484KB
        • SHA256 6446826e1e9f38f06ab85bf2abe05af88fa7fd5c636c2c74aa2b989c458b879b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\locales\zh-TW.pak
        • Size 479KB
        • SHA256 514d6a95fc7094ff00cb7700bca2b10191df866c18c551e1d2c07050ddee80bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\resources.pak
        • Size 5.5MB
        • SHA256 ffaeea94c6594d4e66fc523c218c161c58aee1f59b9cb006bbb45d9a49e3a6a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app.asar

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\resources\app.asar
        • Size 228KB
        • SHA256 8859dbe2fecf201636a01335d730548fd5eb44156fc3623830c5b34d082bfac6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\snapshot_blob.bin
        • Size 309KB
        • SHA256 397bfb1c55eb98bc8c1e1ba1155e24efc105c155def665c678ac3a135f4bbcc7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\v8_context_snapshot.bin
        • Size 671KB
        • SHA256 e8fac5817d9b33ae78b0bd2863750047cbbda211bc28342d0cbea97a07656757
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\vk_swiftshader.dll
        • Size 5.3MB
        • SHA256 409a0fa76f055a87ae70434414586d144502beb25fa3004866ee70abd9a8547e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\7z-out\vulkan-1.dll
        • Size 874KB
        • SHA256 f6c99137c3d6af45bc2262815867d6d37f5dcb0552caffc90cd77fb6561b7491
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsa5C7F.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        data_0

        • Path C:\Users\Admin\AppData\Roaming\Ion Cannon\GPUCache\data_0
        • Size 8KB
        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
        • MD5 SHA1 SHA512 SSDEEP

        data_1

        • Path C:\Users\Admin\AppData\Roaming\Ion Cannon\GPUCache\data_1
        • Size 264KB
        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
        • MD5 SHA1 SHA512 SSDEEP

        data_2

        • Path C:\Users\Admin\AppData\Roaming\Ion Cannon\GPUCache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP

        data_3

        • Path C:\Users\Admin\AppData\Roaming\Ion Cannon\GPUCache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP

        default.exc

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512

        memory/932-487-0x000001D332EA0000-0x000001D332EA1000-memory.dmp

        memory/932-485-0x000001D332EA0000-0x000001D332EA1000-memory.dmp

        memory/932-491-0x000001D332EA0000-0x000001D332EA1000-memory.dmp

        memory/932-493-0x000001D332EA0000-0x000001D332EA1000-memory.dmp

        memory/932-494-0x000001D332EA0000-0x000001D332EA1000-memory.dmp

        memory/932-495-0x000001D332EA0000-0x000001D332EA1000-memory.dmp

        memory/932-496-0x000001D332EA0000-0x000001D332EA1000-memory.dmp

        memory/932-492-0x000001D332EA0000-0x000001D332EA1000-memory.dmp

        memory/4844-405-0x00007FFCB3540000-0x00007FFCB3541000-memory.dmp

        memory/4844-406-0x00007FFCB3550000-0x00007FFCB3551000-memory.dmp