Analysis

  • max time kernel
    151s
  • max time network
    121s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 17:18

General

  • Target
    WAR Battle Beta Setup 1.0.0-beta.1.exe
  • Size 84.9MB
  • Sample260804-vveeysec33
  • SHA256 5c1da7a9a4710eaad86e60815bde009406537cc5053dead5be32c5f11d244c0b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 17 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WAR Battle Beta Setup 1.0.0-beta.1.exe
    "C:\Users\Admin\AppData\Local\Temp\WAR Battle Beta Setup 1.0.0-beta.1.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2568
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2184
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\war-battle-beta', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1544
  • C:\Users\Admin\AppData\Local\Programs\war-battle-beta\WAR Battle Beta.exe
    "C:\Users\Admin\AppData\Local\Programs\war-battle-beta\WAR Battle Beta.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Users\Admin\AppData\Local\Programs\war-battle-beta\WAR Battle Beta.exe
      "C:\Users\Admin\AppData\Local\Programs\war-battle-beta\WAR Battle Beta.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\war-battle-beta" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1748,i,18360894251645789223,5375223250580270569,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3688
    • C:\Users\Admin\AppData\Local\Programs\war-battle-beta\WAR Battle Beta.exe
      "C:\Users\Admin\AppData\Local\Programs\war-battle-beta\WAR Battle Beta.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\war-battle-beta" --field-trial-handle=1748,i,18360894251645789223,5375223250580270569,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:11
      2⤵
      • Executes dropped EXE
      PID:1664
    • C:\Users\Admin\AppData\Local\Programs\war-battle-beta\WAR Battle Beta.exe
      "C:\Users\Admin\AppData\Local\Programs\war-battle-beta\WAR Battle Beta.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\war-battle-beta" --app-path="C:\Users\Admin\AppData\Local\Programs\war-battle-beta\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1748,i,18360894251645789223,5375223250580270569,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5428
    • C:\Users\Admin\AppData\Local\Programs\war-battle-beta\WAR Battle Beta.exe
      "C:\Users\Admin\AppData\Local\Programs\war-battle-beta\WAR Battle Beta.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\war-battle-beta" --field-trial-handle=1748,i,18360894251645789223,5375223250580270569,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:12
      2⤵
      • Executes dropped EXE
      PID:2852

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 4b24f43efd480f116e354d212b8d8cdd6ab71e39b9c5ed1a6de6f5f73e447ac5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StartupProfileData-NonInteractive

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 16KB
        • SHA256 147ad004d3f45c114b0c17e81599235b68c3e284ce957191cb9aa77fdd513f42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __PSScriptPolicyTest_dgm1vfhk.qxj.ps1

        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dgm1vfhk.qxj.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\LICENSES.chromium.html
        • Size 11.7MB
        • SHA256 5d67aba37acc9e0e0a88546d940ed23f29ea3441aac7dd06dcc08a1b1c93b0a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\chrome_100_percent.pak
        • Size 144KB
        • SHA256 6ce0ccf6a0cc4ea8be11262d168a344bc3ee78a4a6365d755ffb5570bc48d6d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\chrome_200_percent.pak
        • Size 215KB
        • SHA256 68e92cde2557d68eddcf8df21ce4d1ef7a85581fb28cd5ab93db20812217e073
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.7MB
        • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\ffmpeg.dll
        • Size 2.9MB
        • SHA256 99fbd8bd11696e24479d22e29b490c7e96c7d9875ab4392ff12307ddfb5a9503
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\icudtl.dat
        • Size 10.0MB
        • SHA256 a9f6072e858ea29cb66501847856d403c862f23d03cac2656d1e0fa2865fdc7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\libEGL.dll
        • Size 481KB
        • SHA256 e55fb10fb929b28446583ebc5afa89fc647bafc2eebf3b12e6a0adf91a7bb202
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\libGLESv2.dll
        • Size 7.6MB
        • SHA256 2289eb00380b7f143d81df224d5bb412dec9b5eb6002b5213518e295ae8256b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\af.pak
        • Size 536KB
        • SHA256 842fa605183eb7cb2764af9ef34eade4a6dbf59ffa726b240a799ec4f829cacd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\am.pak
        • Size 868KB
        • SHA256 ecbadbf260e62099e6140327f0acb40d79ac010676d48f4fd557085f6668f43d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\ar.pak
        • Size 954KB
        • SHA256 eb80f7d9b8ef4895f4b122616ae97ec63a5123b37ae68d68ecb5f332095ec2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\bg.pak
        • Size 991KB
        • SHA256 12b755ee6a50f30b327980e59d086e9f178c6e1bccd0c2bf387696e2c538a5b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\bn.pak
        • Size 1.2MB
        • SHA256 43a0c8bf652288c7a1efaf19926d25275507fa03e9134cfe5e3a580e8e7cd203
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\ca.pak
        • Size 602KB
        • SHA256 5a03f4f7ba62998eabf8ccdbd55a49b06398bf5f7aa3eb3f0ae26cfe8a65c31f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\cs.pak
        • Size 622KB
        • SHA256 0a11d902fcf7f082ea6d602cba67d2befcc639de500c5fef56a7055a0b444a9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\da.pak
        • Size 562KB
        • SHA256 1145dc560e49c746fd7466f064b1dcd1ec25d22b4b38a13261174aad5505caf8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\de.pak
        • Size 601KB
        • SHA256 3695fb21a7d356c5dbaf7f8393d3e53554e4c19c2979358c0e59411fac67a5e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\el.pak
        • Size 1.1MB
        • SHA256 55a09ed6d1bd58e73161450c828ac59cf86162a9cd18f83b246fb19ffa50e83c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\en-GB.pak
        • Size 487KB
        • SHA256 dedf16f15baa50b05832c27d1f9d030c60bcefac7e4a8cdb30df20fda4e39a7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\en-US.pak
        • Size 492KB
        • SHA256 cc7d18d3a6606b645ede826de9417c961d6ebb815f7250bad3a930da89dcd3a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\es-419.pak
        • Size 593KB
        • SHA256 ab6f9a95d333e5bb14d5420e49c5636703d8fc965212cb748e2522505b6bec91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\es.pak
        • Size 592KB
        • SHA256 590238a02b3cc14b05aaf21d5285035b45ff55575dd533264461e5170583cead
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\et.pak
        • Size 539KB
        • SHA256 605996ff0c8a43f772dc64274ab309c4313ced4e8c936f82bcd797b54cb5c6e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\fa.pak
        • Size 885KB
        • SHA256 8dd8cb4a8fdcd5833f73ef7947649ec24ed0538b3d5f079d82cf441cf955d6b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\fi.pak
        • Size 550KB
        • SHA256 1517fe8463e2bfb502e01667d7f9ed0027369f5b976b1e0a38feefe82caa2c7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\fil.pak
        • Size 623KB
        • SHA256 b87306fed8f471279c134d460581ecc13d17b533c184be7c1241d6bcf74d32e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\fr.pak
        • Size 642KB
        • SHA256 2ae85ac2b90ebaabe034b979ffb53c50f3dbe2fa9bd7420d370839da5538cef7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\gu.pak
        • Size 1.2MB
        • SHA256 8da2aef78a775083f19573a14e0861a96a8990866920b3dd4b1aa4d43552159a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\he.pak
        • Size 777KB
        • SHA256 4948fa44871e8ed5a0ed2d553f4dd698548b60618b55619239045181a8ec519e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\hi.pak
        • Size 1.3MB
        • SHA256 8ddded9b2dea1787367869152f2b27f93556ec515f7da6f361a73ac61fdcb73a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\hr.pak
        • Size 599KB
        • SHA256 9a7a1dea1bd0bf594acbc356ddac9fb64d993fa96f5d3cc1f38f9486abc888bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\hu.pak
        • Size 645KB
        • SHA256 8e00a8562e32713abf7c99fb9543f65505f8f6d0509ad6b6b7607896f689e2e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\id.pak
        • Size 532KB
        • SHA256 6d46b40dea9ba42a9ca6dda6e7ff81a3dbcd86b61fb2d7a5fe946d06bdce5d30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\it.pak
        • Size 585KB
        • SHA256 e5fb1e10e15d55c42cdd937e133a9725739259157b1b3f134333cad7110e5978
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\ja.pak
        • Size 712KB
        • SHA256 91461c3b4a426688b16926d3279a44590cab75d65d797b6fd2567e0ec5cde60e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\kn.pak
        • Size 1.4MB
        • SHA256 81a6a8d7f817bb6fbccfdf8d73f1229cd3bf74aeec0a64373a853e8bff744e8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\ko.pak
        • Size 602KB
        • SHA256 67f8b13860dfc28eb3ee150750fab39c0b41e8638f06920f240f434ce08ec753
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\lt.pak
        • Size 650KB
        • SHA256 bae83903640041b5f949398d7af1975d67070467c4925950c7a838edd73ed956
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\lv.pak
        • Size 648KB
        • SHA256 229b518ee95bc1960be7e72c8af33633fc8b9a32ee09900ae6d64b771c40d359
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\ml.pak
        • Size 1.5MB
        • SHA256 a973e6ce2c5cbba8f41e54d9aecef31bdabb070bf06e470afce1c4ed263be671
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\mr.pak
        • Size 1.2MB
        • SHA256 0eae188c9a81bd3257a21dc28448b5e9e5c3f4f4de4dc8e178e7f13cab06d6f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\ms.pak
        • Size 558KB
        • SHA256 185a275d0fb6263471ca1844c8df7fe91d2e98b209379b4a7ec18981ae642c53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\nb.pak
        • Size 539KB
        • SHA256 bc11695694983516a9806eaef25e380a5d705c2c8e91324192a0983a50d1291e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\nl.pak
        • Size 560KB
        • SHA256 124b702f9f31eb34f307cae79074812873307f36c9a72f53696567a26ea13ba8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\pl.pak
        • Size 622KB
        • SHA256 55d1f22dcb6fdea4f641984a386b3497cf6d29fdb4c069d1e906efa4404d9550
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\pt-BR.pak
        • Size 584KB
        • SHA256 8ab2fce26c0612520d152147637929c23a979ef059ef37757ac6988a9fdd26e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\pt-PT.pak
        • Size 589KB
        • SHA256 56974d3f5c4c614fed58eae2b3889898a79b4cd6a13b3468c4f370e2c09470a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\ro.pak
        • Size 610KB
        • SHA256 309118023eacfe9aeb3405f2606a323982e75b1e33887e85be9235fc2ceeae5b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\ru.pak
        • Size 1006KB
        • SHA256 e042ce451d72fc1e2fa10a66fbc0490a4d9fdbc34caad64d06307d787ff5ced0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\sk.pak
        • Size 633KB
        • SHA256 aed563cc711b2b65d4734eb6c21aca2fe5fe4411b47681b31af8996245adadf0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\sl.pak
        • Size 606KB
        • SHA256 495125af6d3cdc85bb24ea4a211ea808208d19ce7af8dbea44e1e9317e91bd5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\sr.pak
        • Size 935KB
        • SHA256 9d98eefbf8d84ad054f58a286b4891d51ae8da99f82047a09886e4b661db13d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\sv.pak
        • Size 543KB
        • SHA256 e663b723c4dec60526182c70c943c9caa4976de09831ded69d59c9fe4114283e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\sw.pak
        • Size 574KB
        • SHA256 c83bb0238ca67b1137dd73e2ccdbfdbc3c2312d8c95aa2636940cc7dfac13cf0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\ta.pak
        • Size 1.5MB
        • SHA256 b76188eff81ffd0a0d9ea7e547eff7bc05069baecd650e1c1e11aa707b40e99c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\te.pak
        • Size 1.3MB
        • SHA256 471e766e6647e4315c45b15f702dfb2a8253ce91044e141034ce37ca9e0ede68
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\th.pak
        • Size 1.1MB
        • SHA256 010ec4d2cf97d45ed2a1934372fa389e49dc32567a97946162271af1c3a6e7e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\tr.pak
        • Size 584KB
        • SHA256 801df6a4a8d52b1ebb99da0ea788d933804643cca2bf8bbc46064eb6016e17b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\uk.pak
        • Size 1009KB
        • SHA256 aa204656b9efbad5069943054f70fc0a6fc1e9f660b4bc59bcfa90cde3c3b0fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\ur.pak
        • Size 879KB
        • SHA256 b26fa64bc9d26991d7c2f1d20934e3dbd467d64096053887cde9ce99d7d0456c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\vi.pak
        • Size 693KB
        • SHA256 06b752bff885c13260adf91b51d56d3ef5048ea0058f69bb24a1db3b45bfa969
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\zh-CN.pak
        • Size 498KB
        • SHA256 82717aa331b1ab869046cd691ddc9589882a34715a2522577313f0864acd083b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\locales\zh-TW.pak
        • Size 492KB
        • SHA256 61709875e1ede0ecc2582a282896ef6398b0c2f4fec07cfabc68c696ba6dd35a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources.pak
        • Size 5.7MB
        • SHA256 4d22a8976b3e6d5bca66d59cc24f1d2db6df2163f12f9624bc07c5846adfbab6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KOMIKAX_.ttf

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\KOMIKAX_.ttf
        • Size 52KB
        • SHA256 d2c790c5ce96e4453ab7ea2d17f8c71db06cec3d3ab4f7f98db02955e63ab353
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app.asar

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar
        • Size 21.8MB
        • SHA256 62d914c4cec198f02f4f843693fcb75152feb4f8930166d4eafaad06503c3649
        • MD5 SHA1 SHA512 SSDEEP TLSH

        index.js

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\@koromix\koffi-win32-x64\index.js
        • Size 206B
        • SHA256 632ab5a01dfc1b519b06275f490d6790100a2f8d71d8f56957091d0fcc5b3e0b
        • MD5 SHA1 SHA512 TLSH

        package.json

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\@koromix\koffi-win32-x64\package.json
        • Size 644B
        • SHA256 fde372b682294d641f30e828b9e523ad2aa5ddaa9518e5d8e87b5ca0d44ed322
        • MD5 SHA1 SHA512 TLSH

        koffi.lib

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\@koromix\koffi-win32-x64\win32_x64\koffi.lib
        • Size 1KB
        • SHA256 581078774d824496b8250bf436f47ef80e1694700c83955d9e9475fcfaebd980
        • MD5 SHA1 SHA512 TLSH

        koffi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\@koromix\koffi-win32-x64\win32_x64\koffi.node
        • Size 1.0MB
        • SHA256 5390a6e75d1276cb87b8827303c4e8fc3ed9a6e012bf3c43c6c28bd6bf308d51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\LICENSE
        • Size 1KB
        • SHA256 071c22737c45e77621eb378db221ebf88cf86138474371dbcc06382d6606980f
        • MD5 SHA1 SHA512 TLSH

        index.js

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\dist\index.js
        • Size 5KB
        • SHA256 b927f8baf1180d79592900cd3a5eb5bd8ce2c2b0dcfe8a7da58fd37891d64b6c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        index.js.map

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\dist\index.js.map
        • Size 4KB
        • SHA256 22777e225b299e0b0cac6c8287e3f31e8f78bcea0f912dd5d841f70ed7baf39e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        prebuild-test-noop.js

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\dist\prebuild-test-noop.js
        • Size 120B
        • SHA256 9a7b050e26b0ee0076ebebe7b44e779d1b4b90d50331550316b47ba1d82b8cfc
        • MD5 SHA1 SHA512 TLSH

        prebuild-test-noop.js.map

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\dist\prebuild-test-noop.js.map
        • Size 140B
        • SHA256 a4ce7fc9d8cecdaa9e93b6717740e9cf83f5896f0da7d21d74db438dd201a363
        • MD5 SHA1 SHA512 TLSH

        uiohook.h

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\include\uiohook.h
        • Size 17KB
        • SHA256 f752d74b8572e1fb833a9440341a45a4c4364a354fe627f6f645b959cd897b86
        • MD5 SHA1 SHA512 SSDEEP TLSH

        input_helper.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\darwin\input_helper.c
        • Size 31KB
        • SHA256 b0bf7ad4231638589ac96454044a8ec2cd545df152613c0475ac68a9abf54780
        • MD5 SHA1 SHA512 SSDEEP TLSH

        input_helper.h

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\darwin\input_helper.h
        • Size 5KB
        • SHA256 93064e88c32ebe57c72b94b3da4015ca940d25c5e2d41568eb7b124c13fc816e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        input_hook.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\darwin\input_hook.c
        • Size 53KB
        • SHA256 58fd4b36ace091559efe8007bdafe26b1a9bab9912c284150cb71d9a4ffb71ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        post_event.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\darwin\post_event.c
        • Size 9KB
        • SHA256 6797f21c8dd8f33717f2393d59574551ca9b3fc6fc39c6a4cfdf91a04a1c3ef5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        system_properties.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\darwin\system_properties.c
        • Size 17KB
        • SHA256 4b325656c6319013d04380a52ffa9d1fc57cfde10a90a9fa42dd07bd72fba9fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logger.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\logger.c
        • Size 1KB
        • SHA256 7c980d3a0590098b682b467a6f789751bc6f30658d9f3a761c280f8c573b258d
        • MD5 SHA1 SHA512 TLSH

        logger.h

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\logger.h
        • Size 1KB
        • SHA256 60a432037bc5488fb5f82a214315ecb93e24261c81363ce41e973138fa8e2cf7
        • MD5 SHA1 SHA512 TLSH

        input_helper.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\windows\input_helper.c
        • Size 52KB
        • SHA256 e6e7212e87b7796a7d4387728d991c9c3e188f898a7b9efcdcc5c1b13c537b41
        • MD5 SHA1 SHA512 SSDEEP TLSH

        input_helper.h

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\windows\input_helper.h
        • Size 4KB
        • SHA256 05a6728996ca1ad8699b2398b284a11e3749141475d4cb84dd0ac0b124fbc2e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        input_hook.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\windows\input_hook.c
        • Size 24KB
        • SHA256 ea0e810349be7055e86c183736c5c2692501cfab4b1665698f38066519a0f1ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        post_event.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\windows\post_event.c
        • Size 8KB
        • SHA256 40119006fd5ed676084cfa5a0a5ff8841ecde15c326917e601513949fbc40c4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        system_properties.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\windows\system_properties.c
        • Size 6KB
        • SHA256 294dcc832cbb64463fa37e96bf35240a3b9b1814b4dff7d9f79c27c78fad1e3f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        input_helper.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\x11\input_helper.c
        • Size 125KB
        • SHA256 a540a9b4609cab8db9bd7525a12a3beeb4401e70a49f5e04076cc37c6cec8b16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        input_helper.h

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\x11\input_helper.h
        • Size 3KB
        • SHA256 4b02b9d69eb7d43b3c9b4db5197c77a36bac50a03c0a7c32abba096bb49c05f8
        • MD5 SHA1 SHA512 TLSH

        input_hook.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\x11\input_hook.c
        • Size 41KB
        • SHA256 fd77ed43059f15c29f9dd14010436ed944b84f1234104b45b70150654d83633f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        post_event.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\x11\post_event.c
        • Size 14KB
        • SHA256 4d37abe0ff1e145b90ae15bdc90339d6268bb77164cbc53214d8c2c0b6948f02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        system_properties.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\x11\system_properties.c
        • Size 16KB
        • SHA256 644b6f0f5faf0b948ba6897cd956150579f73dd1940c87ca4fcee9d23dc9e967
        • MD5 SHA1 SHA512 SSDEEP TLSH

        package.json

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\package.json
        • Size 724B
        • SHA256 250ed80b63037a0ba22327e34e5ff300cd417915ca01c254778bb34acac78cf1
        • MD5 SHA1 SHA512 TLSH

        uiohook-napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\prebuilds\darwin-arm64\uiohook-napi.node
        • Size 82KB
        • SHA256 f633b05e2065c9075cbe51b052aff6a27361adc1286135b31ecf8bf4bdc4b618
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uiohook-napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\prebuilds\darwin-x64\uiohook-napi.node
        • Size 57KB
        • SHA256 dae66747946c6be45f67fd1b0ae9fced492ded1d170c1971fa4baea78cdadd3c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uiohook-napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\prebuilds\linux-x64\uiohook-napi.node
        • Size 68KB
        • SHA256 8725ed2668b6f48e711ed8bb861106bc3b77eebddd76d02226f2c6e8704b687c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uiohook-napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\prebuilds\win32-arm64\uiohook-napi.node
        • Size 168KB
        • SHA256 0965d13d5e8e92c4e34aeb82e8c425ec1f11997c443614cb96dd5b2747599a42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uiohook-napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\prebuilds\win32-x64\uiohook-napi.node
        • Size 169KB
        • SHA256 ee68f046628d2e4406d8aa85c6489ad06578b64a0e19ed64822bd22e7c473b85
        • MD5 SHA1 SHA512 SSDEEP TLSH

        addon.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\src\lib\addon.c
        • Size 13KB
        • SHA256 e8fbce3d54ecb92cd908832b2c12b5aa2625c62af7566e6f2b01fe3599f63a47
        • MD5 SHA1 SHA512 SSDEEP TLSH

        napi_helpers.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\src\lib\napi_helpers.c
        • Size 1KB
        • SHA256 04a8f6de366c6f82df91a90b07b8ebc009efc3a5ace2881b86cdc40e69625bea
        • MD5 SHA1 SHA512 TLSH

        napi_helpers.h

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\src\lib\napi_helpers.h
        • Size 2KB
        • SHA256 a3fb38e83a34d7978eb700ceee527c6b1e5f1b89cd21e25fc516cfbb08aa7cd8
        • MD5 SHA1 SHA512 TLSH

        uiohook_worker.c

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\src\lib\uiohook_worker.c
        • Size 5KB
        • SHA256 29083d26828657f5c2d6f7924ae02cd168a11158ca651e0c13eacd73463256b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uiohook_worker.h

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\src\lib\uiohook_worker.h
        • Size 262B
        • SHA256 f4dbc36bbaf5ef04d701365ea7e72a0f02f77537e9f517e6cc65ebc2f2776a0b
        • MD5 SHA1 SHA512 TLSH

        ding.mp3

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\ding.mp3
        • Size 51KB
        • SHA256 ed27f5a63b6463e8f75476969cb7debd6dd9f7385ce5903fd6dfcb0f58747292
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\snapshot_blob.bin
        • Size 324KB
        • SHA256 69d9b2ecbc649fed6c41ca18e94f3a36b6770ff7038e9a0d07ae1ab824d9f7fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\v8_context_snapshot.bin
        • Size 685KB
        • SHA256 462919f1b49c9e913042f9e9a738e9510884d5920a426a8a5f1b188e28c4da91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\vk_swiftshader.dll
        • Size 5.3MB
        • SHA256 bdf28efb95d1618e211aafafd2060df77ad53b98af8db685379f88aa852c0e00
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\7z-out\vulkan-1.dll
        • Size 882KB
        • SHA256 2f0ae7c191a962a49abe65c8c5c056262de5e2108e1f341b105844034153915f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SpiderBanner.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\SpiderBanner.dll
        • Size 9KB
        • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WinShell.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\WinShell.dll
        • Size 3KB
        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
        • MD5 SHA1 SHA512 TLSH

        nsExec.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\nsExec.dll
        • Size 6KB
        • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss6345.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default.acl

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.acl
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512

        memory/1544-72-0x0000000070710000-0x0000000070A6B000-memory.dmp

        memory/1544-69-0x00000000705B0000-0x00000000705FC000-memory.dmp

        memory/2184-62-0x0000000073BF0000-0x00000000743AC000-memory.dmp

        memory/2184-50-0x0000000073BF0000-0x00000000743AC000-memory.dmp

        memory/2184-51-0x0000000073BF0000-0x00000000743AC000-memory.dmp

        memory/2184-54-0x0000000073BF0000-0x00000000743AC000-memory.dmp

        memory/2184-56-0x00000000705B0000-0x00000000705FC000-memory.dmp

        memory/2184-59-0x0000000007520000-0x00000000075B6000-memory.dmp

        memory/2184-60-0x0000000007480000-0x0000000007491000-memory.dmp

        memory/2568-38-0x0000000073BF0000-0x00000000743AC000-memory.dmp

        memory/2568-23-0x0000000005BF0000-0x0000000005C56000-memory.dmp

        memory/2568-39-0x0000000007BC0000-0x000000000823C000-memory.dmp

        memory/2568-37-0x0000000073BF0000-0x00000000743AC000-memory.dmp

        memory/2568-36-0x0000000007490000-0x0000000007533000-memory.dmp

        memory/2568-31-0x00000000705B0000-0x00000000705FC000-memory.dmp

        memory/2568-34-0x00000000071D0000-0x00000000071F0000-memory.dmp

        memory/2568-35-0x0000000073BF0000-0x00000000743AC000-memory.dmp

        memory/2568-30-0x00000000067D0000-0x0000000006806000-memory.dmp

        memory/2568-29-0x0000000006210000-0x000000000625C000-memory.dmp

        memory/2568-28-0x00000000061E0000-0x00000000061FE000-memory.dmp

        memory/2568-27-0x0000000005D00000-0x000000000605B000-memory.dmp

        memory/2568-24-0x0000000005C60000-0x0000000005CC6000-memory.dmp

        memory/2568-40-0x0000000007540000-0x000000000755A000-memory.dmp

        memory/2568-22-0x0000000005B50000-0x0000000005B72000-memory.dmp

        memory/2568-21-0x0000000073BF0000-0x00000000743AC000-memory.dmp

        memory/2568-20-0x00000000054D0000-0x0000000005B1A000-memory.dmp

        memory/2568-19-0x0000000073BF0000-0x00000000743AC000-memory.dmp

        memory/2568-18-0x0000000002CE0000-0x0000000002D16000-memory.dmp

        memory/2568-17-0x0000000073C02000-0x0000000073C03000-memory.dmp

        memory/2568-41-0x00000000075B0000-0x00000000075BA000-memory.dmp

        memory/2568-42-0x0000000007750000-0x000000000777A000-memory.dmp

        memory/2568-43-0x0000000007780000-0x00000000077A4000-memory.dmp

        memory/2568-44-0x0000000070710000-0x0000000070A6B000-memory.dmp

        memory/2568-46-0x0000000073BF0000-0x00000000743AC000-memory.dmp

        memory/5428-844-0x00007FFC4CAF0000-0x00007FFC4CAF1000-memory.dmp

        memory/5428-845-0x00007FFC4BB20000-0x00007FFC4BB21000-memory.dmp