Overview
overview
7Static
static
3wows-monitor.exe
windows10-2004-x64
7wows-monitor.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
3chrome_100...nt.pak
windows10-2004-x64
3chrome_100...nt.pak
windows11-ltsc_2024-x64
3d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1ffmpeg.dll
windows11-ltsc_2024-x64
1icudtl.dat
windows10-2004-x64
3icudtl.dat
windows11-ltsc_2024-x64
3libEGL.dll
windows10-2004-x64
1libEGL.dll
windows11-ltsc_2024-x64
1libGLESv2.dll
windows10-2004-x64
1libGLESv2.dll
windows11-ltsc_2024-x64
1locales/en-US.pak
windows10-2004-x64
3locales/en-US.pak
windows11-ltsc_2024-x64
3resources/...te.yml
windows10-2004-x64
3resources/...te.yml
windows11-ltsc_2024-x64
3resources/app.js
windows10-2004-x64
3resources/app.js
windows11-ltsc_2024-x64
3resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3vk_swiftshader.dll
windows10-2004-x64
1vk_swiftshader.dll
windows11-ltsc_2024-x64
1vulkan-1.dll
windows10-2004-x64
1vulkan-1.dll
windows11-ltsc_2024-x64
1wows-monitor.exe
windows10-2004-x64
7Resubmissions
28/08/2026, 21:24
260828-z889pstdkg728/08/2026, 20:52
260828-zn2dcssye1728/08/2026, 19:44
260828-yf4cbaea567Analysis
- max time kernel
151s - max time network
160s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 19:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
wows-monitor.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
wows-monitor.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral9
Sample
chrome_100_percent.pak
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
chrome_100_percent.pak
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
icudtl.dat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
icudtl.dat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
libEGL.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
libGLESv2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
libGLESv2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
locales/en-US.pak
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
locales/en-US.pak
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/app-update.yml
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/app-update.yml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/app.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/app.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
wows-monitor.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target wows-monitor.exe
- Size 102.2MB
- Sample260828-yf4cbaea56
- SHA256 95c74075432cb843c1a692e52e6d38982c8def4390f56e039f812c5bacb9d0ec
- MD5 cb715f3f05c69b5160103c6978b19444
- SHA1 f03671e605af1dad7ac3f6eba305f2efdbafb87b
- SHA512 e8f63ba5cab98009ebced90aa9a812cca0ff759803bd342b9979c69e52f915a6e1cd56582c4e014190419bf73c2c791301919dfd52a6609d5408d796f41a7d58
- SSDEEP 3145728:lyZytZnw93ywE51EreDVOfpENoAHsFBNALyC7:UZ7ip51WeDVOUHs3a
- TLSH T1933833A0C084583F6C9E1D3E429E6FD577FA94BA0B25B99AC5984466F3C54CC03BAC37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 3328 wows-monitor.exe 2988 wows-monitor.exe 5496 wows-monitor.exe 2980 wows-monitor.exe 976 wows-monitor.exe - Loads dropped DLL 13 IoCs
pid Process 1752 wows-monitor.exe 1752 wows-monitor.exe 3328 wows-monitor.exe 2988 wows-monitor.exe 5496 wows-monitor.exe 2988 wows-monitor.exe 2980 wows-monitor.exe 2988 wows-monitor.exe 2988 wows-monitor.exe 2988 wows-monitor.exe 2988 wows-monitor.exe 976 wows-monitor.exe 976 wows-monitor.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wows-monitor.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3328 wows-monitor.exe 3328 wows-monitor.exe 3328 wows-monitor.exe 3328 wows-monitor.exe 976 wows-monitor.exe 976 wows-monitor.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe Token: SeShutdownPrivilege 3328 wows-monitor.exe Token: SeCreatePagefilePrivilege 3328 wows-monitor.exe - Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 3328 wows-monitor.exe 3328 wows-monitor.exe 3328 wows-monitor.exe 3328 wows-monitor.exe 3328 wows-monitor.exe 3328 wows-monitor.exe 3328 wows-monitor.exe 3328 wows-monitor.exe 3328 wows-monitor.exe 3328 wows-monitor.exe - Suspicious use of SendNotifyMessage 6 IoCs
pid Process 3328 wows-monitor.exe 3328 wows-monitor.exe 3328 wows-monitor.exe 3328 wows-monitor.exe 3328 wows-monitor.exe 3328 wows-monitor.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1752 wrote to memory of 3328 1752 wows-monitor.exe 88 PID 3328 wrote to memory of 2988 3328 wows-monitor.exe 89 PID 3328 wrote to memory of 2988 3328 wows-monitor.exe 89 PID 3328 wrote to memory of 5496 3328 wows-monitor.exe 90 PID 3328 wrote to memory of 2980 3328 wows-monitor.exe 91 PID 3328 wrote to memory of 2980 3328 wows-monitor.exe 91 PID 3328 wrote to memory of 2980 3328 wows-monitor.exe 91 PID 3328 wrote to memory of 976 3328 wows-monitor.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\wows-monitor.exe"C:\Users\Admin\AppData\Local\Temp\wows-monitor.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\wows-monitor.exeC:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\wows-monitor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\wows-monitor.exe"C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\wows-monitor.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\wows-monitor" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1788 --field-trial-handle=1792,i,15303827724971133832,11794078729788238778,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988
-
-
C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\wows-monitor.exe"C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\wows-monitor.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\wows-monitor" --mojo-platform-channel-handle=2152 --field-trial-handle=1792,i,15303827724971133832,11794078729788238778,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5496
-
-
C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\wows-monitor.exe"C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\wows-monitor.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\wows-monitor" --app-user-model-id=com.wows-monitor.app --app-path="C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2852 --field-trial-handle=1792,i,15303827724971133832,11794078729788238778,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980
-
-
C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\wows-monitor.exe"C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\wows-monitor.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\wows-monitor" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2356 --field-trial-handle=1792,i,15303827724971133832,11794078729788238778,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:976
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\291f23a0-9c64-4106-b67f-920a7094660e.tmp.ico
- Size 14KB
- SHA256 a7fd03250df6e3d74473fadd32d134acd4f7e0a2c1b919f97b6d31dfa0c2cf03
- MD5 66372c6e5efc188790af1a69beb559a7
- SHA1 076ba2cc169e974820e8952f058a82a3e95e9fdb
- SHA512 1f4282def503fdff634a54092f28b752296b9b7d0488c6565d118a6945e0c6d119c0bd6abd22e36f8bc5f6c83790d9d9fbe21c5ac3a945504fcb65802478acb7
- SSDEEP 96:jwqrjdpMux3lvXiPXSf4rWIIU8FmvK7oAvGYFgz5:jwqnjDl2m4rWIIU8IAGYFgz5
- TLSH T164626430F40EC04AFBDD81378D6ECAE8D14A2E962D15AB8CBD1F771D167D1E582190BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\chrome_100_percent.pak
- Size 132KB
- SHA256 24d92bbeb63d06b01010fe230c1e3a31e667a159be7e570a8efe68f83ed9ad40
- MD5 e4cbb48c438622a4298c7bdd75cc04f6
- SHA1 6f756d31ef95fd745ba0e9c22aadb506f3a78471
- SHA512 8d3ea1b5ca74c20a336eaa29630fd76ecd32f5a56bb66e8cef2bce0fa19024ea917562fd31365081f7027dde9c8464742b833d08c8f41fdddc5bd1a74b9bc766
- SSDEEP 3072:TzwJCGIekwc9W2bg3yhPaL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Tzw1IekZ42k3yMK18Gb0OV8ld0GecQ35
- TLSH T154D3D0D7B3F4EE7DCA6756F7A62500B1ECB3462806A1434B078BD8752A26748DCC8793
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\chrome_200_percent.pak
- Size 191KB
- SHA256 55d873a9f3ac69bbf6eb6940443df8331ebd7aa57138681d615f3b89902447e7
- MD5 99b95d59d6817b46e9572e3354c97317
- SHA1 6809db4ca8e10edd316261a3490d5fc657372c12
- SHA512 3071cfeb74d5058c4b7c01bfe3c6717d9bb426f3354c4d8a35bd3e16e15cde2f2c48238cb6382b0703b1cc257d87fcecfb84fbf4f597f58e64463ceede4366dd
- SSDEEP 3072:ZDQYaE/N6Mrvy/3JPD9W2bg3yhPaafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+y:ZDQYaSN6svydD42k3yxgx5GMRejnbdZR
- TLSH T1F214E0D7A3B89D7DC5670AB3622601F1ECB211395AB6525B07CFDC357A56BC888C8283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\ffmpeg.dll
- Size 2.7MB
- SHA256 08bf8e22d8d240bfa888bf2e51e545083be60e4817641c08a7d3c915ba08569d
- MD5 5a1440d4b339572d56f44bcde6aa024b
- SHA1 9ec8606de6ba93887670e3f747927e3f6de37634
- SHA512 e3b42da5c05ddb4b85228fee885215adb8f55da50035122f8317330516d2be851358eb0375832357763539884641220bdbca88bfb5ac5f34cf93dffe8734ec19
- SSDEEP 49152:R8h7ilnY895zc09Myl6QL3n6F+hTf6yfPvJr8PNStFwLluJMWykOFS:pn1H9MDCn6OFMWyBS
- TLSH T1FED59D07E6DA40D9D01AC170879FA233F62134468B24A7EF1B9196252F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\icudtl.dat
- Size 10.1MB
- SHA256 7c40c811d30d459dbf04a04c141b60eb4247cd58a008fb836605317df665748f
- MD5 62880b7d351a9f547b62b8da6c97ce25
- SHA1 057f11003013cfb3f1c63e6bdd4f2f9949ff0104
- SHA512 0d6f83175a91d90f4cc3ec4d9071b7acd0cd8ebbcc592322e46fde2adb7198e035af62c45a11a622f2a908e26d4dd8b8d1af023e634a74d0824d02c791ba3c1a
- SSDEEP 196608:1IPBhORjFQwCliXUxbblHa93Whli6Z86WOH:1kwVAliXUxbblHa93Whli6Z8I
- TLSH T17AB62803A2FB4DC2F9F76F31D8F492679567BD496E32805A01042F3B5C336908A65BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\libEGL.dll
- Size 469KB
- SHA256 5bad347c20c393fec607ce9c6721ff6c214e607a9afae3662fa78dc42eefd8ba
- MD5 dd827ad7dd7ccd90c2de005d7c6381d4
- SHA1 78177b34c76b6d97f40afd416a0c8104ecba7e1c
- SHA512 db853bca3e6c193a39a0adb0d00a88d14c6c51a76ad0ae106f9b85be78a2c3799cb18d6c5a6eddd3f513f5387306c406b6441a31297616106754a33bab966cf9
- SSDEEP 6144:eI9l960ewE3X883ZrzMkBmi12EvUGsADnIgHc:eClY0WM8JrzMIKODX
- TLSH T1F6A47C15779854A9D07AC430CA534652EE72B8960F21FADF0394E27D2F7BBE85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\libglesv2.dll
- Size 7.1MB
- SHA256 e0e07c02de2f6561f04e296871ca06cb2db325a7f0143b3e0d1505a1f68be7d8
- MD5 899a686e6e9e13252cd1a9241641c5d7
- SHA1 8b6056b83d3234407a0e5c1e27883e30f7d3265d
- SHA512 2e4e5f567e95400f2eb49c11d41e3d8654120011574d94c55c092a437cb7ae8222372ecc639133fc682b3fdb31f394ae96f0626e650c2c38c4eb10c9e7db9f0c
- SSDEEP 98304:tAgpTkR1+f1SlkWW6yAKwCD2x9Stm5H5wXVoJ:e9nSYxCdcKo
- TLSH T1E0767C13F6A281D9D05ED2B887579123FA30B8A9472072CF2A9817113F77BE06B7D725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\locales\en-US.pak
- Size 391KB
- SHA256 0364c73f320e441b03cb2afcaaca3ffbfac51a3559dcd0ff99a1accf82c7f762
- MD5 c9c2abcb04e1ad5f1a20244da8d595a8
- SHA1 89ca81da21900074a5ccdcdc852768277b2b620b
- SHA512 96bbf21174f56a111a2fc6ec024ab2f143945306797e77d773367a7fad42b7828ebb7b08d0dab76858d9fa340bf3205be403bc53df9e5e4e390058c94a751ffd
- SSDEEP 6144:1InAdQi32OqOMWvX3BO4XMP9ehWMIfaYRGrc55FSMnC/M1UwB:1IAdQqOONvXMyWMGv57SoUwB
- TLSH T121845C1FF744226A069352627F0956B2BF32D06CA36112563CBD812C33B7B66C3776E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\resources.pak
- Size 5.2MB
- SHA256 6f7b84f43e96c3e4681d998eb46e5adb5e04005d46d480400dc9314d4a253c43
- MD5 6e1fad905fa7f5f18dd5ce2fb95fb502
- SHA1 215869f0ec522461305573d9656129c53c2373fd
- SHA512 3cce71cdb801f06ae885fe65736f4c9424f4d5d527ca80d5149100f1815df0ea52bcae9e7ce06e5dd6cf67a5214b264ab806fbe770798ccefb2984ed2cba4235
- SSDEEP 98304:KUxSthDqmWPV95jG1p60RCPNSIh1SUeCQ29GrwrJ9ctYXiQxSlzY7G/bh4sWrr:KUktJqdd95jghUV/hQUeCN8krJ9YY+UT
- TLSH T1F9463310F6251C37E8E8A7B5C0A911733F3915431AE17C2EB1CE611D5FA871E8AA49FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\resources\app.asar
- Size 8.1MB
- SHA256 bd01bb467a2808b92a1c86cef253b63ac364d0e4929b298dc050348744e98355
- MD5 b401c6412c2d40734c727989d21e1835
- SHA1 fba6f061282a152a7c4cd7beaea659c805de6019
- SHA512 ed1ff54b8adba301e6cfe3b9803f95a04b415322d09dea8efc7d697a03b4cf87546b187990c908d7eceed364868bf9df22982a92f4d5446224ce2448a587b189
- SSDEEP 98304:waKbPkmcXGnYmlYtWAC+CSICL89/h9rQJpNBVQXMAERe4:waKbsfWnrCtoFCL8h9UhB6Xlt4
- TLSH T18486D0DAB3E0B071C3D351B9803B1555F23E1859B508456CF62CEAE96AB98C9523BF3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\v8_context_snapshot.bin
- Size 581KB
- SHA256 ed559c6e81b6003b2057e5c1b0bdb5b28ca094b895ca86c69fe11c5c9e014f06
- MD5 264e3b574e4f86b1fc47b2427402e779
- SHA1 4a4f9e7c3da262713e4cf7af6ac51822c56b5ef3
- SHA512 144365d0fb83576aaa02ea6ecea51d7ba2cacb044eea568a08f65b98a83d3e7d7e693738e065e22f94bfd1165d0ea93a749dd1325d829257a9bb6607a9a927db
- SSDEEP 6144:6TY0P3R2EpdCFbECxUg8zifcarDJI2GZaGKtQPd9ZVetBRkPjBgnYAz7E:m5itRHtQfVEP7E
- TLSH T114C44E02B745EF2BC0167EF48DE289D535B076849F93195BB3A6873E3279B740E212D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\vk_swiftshader.dll
- Size 4.9MB
- SHA256 fac0fb613864b5fcad21b5dabb7162fd3c11fd761c4ddb80ef57d94237342aeb
- MD5 32e09c64943e115c05868a451ceebea6
- SHA1 496d79a5d9d6ab52c93a1c6747a96c18652ed5c9
- SHA512 ab82dcbd3bfa4aaee4a9fb9eaee210b221b6fdf96db4a259bac964638a4f8964a927c43d9215d5fe8f0d09f7343efb771eaab5fc36bfdcdec9629b00d231f10b
- SSDEEP 49152:Q6PkZFjKeDTIEvAvlo6coVQxa8sVr0yN1J+MuXy557nDOPNt7wpr30sN+05uQKYP:QNZFjAgpOz2VeCCAkEvkCvGZN9z
- TLSH T1EA364903B28581D9F05DD5B9875BA632F631F8811B6276DF42A40F192E3BFE02B39B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\vk_swiftshader_icd.json
- Size 106B
- SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
- MD5 8642dd3a87e2de6e991fae08458e302b
- SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
- SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
- TLSH T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2deRCdYfNKDXWs87rq8UvIwOLyY\vulkan-1.dll
- Size 917KB
- SHA256 af0534b4288dd27f458cfe997200094a121acf4e4320e1c317761c762b9127a0
- MD5 291cf47b098075135ced306a22041027
- SHA1 903efee96043861f55817df1a02e6edb1361d67a
- SHA512 6b9e5cccaf3582eee87a21806fd6b3c5718acb30558f5855dc47ad8469dec43c33f664c681bc329a2ba06c06fe1276df307aedfb3dc99f05bc813228b1c015bf
- SSDEEP 24576:NV9nIy2kwpHHPDnCo3A1XpQ66Z5WoDYsHs6g3P0zAk78G3:Bt2zNLnxA1+66Z5WoDYsHs6g3P0zAk7/
- TLSH T1FE155E139A944569D476C034C9C28607CA7178921B25B9CF03A85B09BFAFBF43B7D73A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb9EB8.tmp\StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb9EB8.tmp\System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\wows-monitor\DawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\wows-monitor\DawnCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\wows-monitor\DawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\wows-monitor\DawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\wows-monitor\Network\Network Persistent State
- Size 579B
- SHA256 a41e017a3619f5b4d536d04e86e9430c532d574540647f3c60d16125a9f64d17
- MD5 2c2bc783f32d7c200bd1e3e6094c4937
- SHA1 d4fd9068d33f63a1ff389b1361a268d67a752f80
- SHA512 5fb8bbd5a3759fe06edcad53aab924177292d99e622adcda08e839a2ca256e9e21950a01238b5b001592c2e5bf1f86a38987b3780c70002be048e471198d02de
- TLSH T113F04CABC3E449BE4651A6F52B152E13C5FD0519532C7C07C4C4EB1E47B2875550048F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\wows-monitor\Network\Network Persistent State~RFe5ad7e3.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\wows-monitor\Session Storage\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512