Analysis

  • max time kernel
    299s
  • max time network
    186s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    31/08/2026, 19:56

General

  • Target
    Load_Tender_PO_851934_Shipping_Instructions_Document.exe
  • Size 83.6MB
  • Sample260831-ynrcqayfpf
  • SHA256 c86b0c7ca5bb0fd724938186259a602608b84853738959e0443d431fce7b4281
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Load_Tender_PO_851934_Shipping_Instructions_Document.exe
    "C:\Users\Admin\AppData\Local\Temp\Load_Tender_PO_851934_Shipping_Instructions_Document.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Users\Admin\AppData\Local\Temp\3IPc3MT45x2h3AFE1GF9BnpXR7O\updater.exe
      C:\Users\Admin\AppData\Local\Temp\3IPc3MT45x2h3AFE1GF9BnpXR7O\updater.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3368
      • C:\Users\Admin\AppData\Local\Temp\3IPc3MT45x2h3AFE1GF9BnpXR7O\updater.exe
        "C:\Users\Admin\AppData\Local\Temp\3IPc3MT45x2h3AFE1GF9BnpXR7O\updater.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,14709957798140888935,14216511588206506500,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1876 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4948
      • C:\Users\Admin\AppData\Local\Temp\3IPc3MT45x2h3AFE1GF9BnpXR7O\updater.exe
        "C:\Users\Admin\AppData\Local\Temp\3IPc3MT45x2h3AFE1GF9BnpXR7O\updater.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --field-trial-handle=1884,i,14709957798140888935,14216511588206506500,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1960 /prefetch:11
        3⤵
        • Executes dropped EXE
        PID:532
      • C:\Users\Admin\AppData\Local\Temp\3IPc3MT45x2h3AFE1GF9BnpXR7O\updater.exe
        "C:\Users\Admin\AppData\Local\Temp\3IPc3MT45x2h3AFE1GF9BnpXR7O\updater.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,14709957798140888935,14216511588206506500,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=1956 /prefetch:10
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4676

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\3IPc3MT45x2h3AFE1GF9BnpXR7O\chrome_100_percent.pak
        • Size 112KB
        • SHA256 45d14a4278b1e152b363197401a5604aa5a3cee6512a6b52df978038fa521a0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\LICENSES.chromium.html
        • Size 14.4MB
        • SHA256 c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\chrome_200_percent.pak
        • Size 182KB
        • SHA256 aafc61b89748d17fcbc9fecd9844a77be2c584529a81714c98e0c4d453ea9496
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.5MB
        • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxcompiler.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\dxcompiler.dll
        • Size 24.9MB
        • SHA256 6f02237496ce3d04459539c530521e6ae2aa05dc6e3f669769898e604b8d5dd7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxil.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\dxil.dll
        • Size 1.4MB
        • SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\ffmpeg.dll
        • Size 2.9MB
        • SHA256 e8ef0c488acde7242b318b7babf6e45297a57ec968abd700f989d6269bf36831
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\icudtl.dat
        • Size 10.0MB
        • SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\libEGL.dll
        • Size 492KB
        • SHA256 cc90ee15962abb35fcc409b854de08b2e640b5aa44c9211be3eafca43917074b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\libGLESv2.dll
        • Size 8.0MB
        • SHA256 273e0c34c3511fa793eb8c7a30623218c530c01668640d890a70d8c77a5a9466
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\af.pak
        • Size 568KB
        • SHA256 ca253121434ef430661c30672e1097e6d238e42821585b700776b56977c05d97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\am.pak
        • Size 921KB
        • SHA256 c348b68d8a552f5b7c074d424ecb54ab19aac93e17b61295b36ac10315da5ced
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\ar.pak
        • Size 1016KB
        • SHA256 6b050deccd06de33dfc9abe68dd2e256b0838be7bd91f926c03f4edfc6b32cf6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\bg.pak
        • Size 1.0MB
        • SHA256 f2a46c4ee04330ef49f6acc62c26ed7ec57dfe124aa386e08c5b582832c4000e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\bn.pak
        • Size 1.3MB
        • SHA256 b4ada9665be5c9d9fe4254bff291978dfb50c2b22a7149faf9b9c3f470f0d32f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\ca.pak
        • Size 640KB
        • SHA256 46a7488ffcb9d7d8b2d9b93ba035ec46fc950dc936a03617ab2606294851c650
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\cs.pak
        • Size 663KB
        • SHA256 609f32e921928b33de0f007e7db6f0ff12f411fbbcb85b0596e4f674bcc6d399
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\da.pak
        • Size 598KB
        • SHA256 3f33e371a8be4ec3946a6cd484d73260abad36c29560773158f03028be444a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\de.pak
        • Size 640KB
        • SHA256 06b1bba011530d78f5cd5d38c54f1e96d49dfb97d582112761002d8e99eddff8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\el.pak
        • Size 1.1MB
        • SHA256 dc27d24e9afd24124abca6dca1a362462851267902fe6493ff3165a1c5aab69f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\en-GB.pak
        • Size 518KB
        • SHA256 ee6fc979d1fff0c1a4d6bca929691733665c5df7e7a43cc54f1165ea14cffa67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\en-US.pak
        • Size 524KB
        • SHA256 bfa782c9efae2c9cd2c0214dae1bbb3c259d4d4c38d920b06677b9c4cf4f813d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\es-419.pak
        • Size 631KB
        • SHA256 fcff3af49b63faf72e07c36240887420a0041f27645bad58c5462c29b471988c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\es.pak
        • Size 628KB
        • SHA256 0668fe4b1abb52581cbd0068cb9ee71023dc844e2f830e531a6302de24933bbf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\et.pak
        • Size 573KB
        • SHA256 e5eddafe1f10905caea4610499067943fb329287fa09fa7cf3ee8bc71670b177
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\fa.pak
        • Size 946KB
        • SHA256 495d6d9570cd7a4d8099968b6f315b80d13719d822cedf6d7c3dc00ae85efb56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\fi.pak
        • Size 584KB
        • SHA256 c04f5e2b7f30e8e350feefd6cc45f266dbeacf11837cc774c977bf76e9b403a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\fil.pak
        • Size 662KB
        • SHA256 48884f90e800b0b0803ddaa0bbebbea1292bf8e1bb5ee8f035a79371bef7ac2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\fr.pak
        • Size 682KB
        • SHA256 9ff765a541603297f1c1ad2ddc53d282e30f185b2eda4ea981c84d2127bfd31d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\gu.pak
        • Size 1.3MB
        • SHA256 11e4ab3cfa421ea0d4d0971b038a6e7a254094fa6dfe9b8f65fd1572f36bcabb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\he.pak
        • Size 829KB
        • SHA256 3bf33db3a0232d8e7306450254a452b0f731bb6ed2bdd76979d8fafd65416900
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\hi.pak
        • Size 1.4MB
        • SHA256 bb19f47ad91101332c37cb7820a527342b705a6e1863f54edb66c032e993061b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\hr.pak
        • Size 639KB
        • SHA256 fe9ef06fbd137dd08a78661ac242a716e9efba4a2ecb0e8ddaf15b65c524f956
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\hu.pak
        • Size 684KB
        • SHA256 501569c5e74285231b41d067e0ea28972ef0ab7b269886485cf1b42cd78cbd1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\id.pak
        • Size 565KB
        • SHA256 09d4dd7cbe4eb1b7730a80a3a3cd0606139f4b9647b0a04b49314638680b0a31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\it.pak
        • Size 619KB
        • SHA256 fb06883d2e2986f407c2fda6fb9a582d7b3a3d32f8864cb5d6655018f908c20f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\ja.pak
        • Size 754KB
        • SHA256 0369673208ec4758abfed3094e5be0331877fe66af0c1beef6f9d8e7883b769c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\kn.pak
        • Size 1.5MB
        • SHA256 76938de8f9377f9dff4672d7f43e233e42bc2053b17e2764115b18f8de47bfa7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\ko.pak
        • Size 640KB
        • SHA256 b8ecd18ce8601686ef64129c77f5307d0c60656d27eede7a23b4f3947647b302
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\lt.pak
        • Size 694KB
        • SHA256 6d648211ff3a6801e049c9a3931afaf3007857b2872e55ae11e19849180d19da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\lv.pak
        • Size 692KB
        • SHA256 b16771adf895df173370d3f3e7411545d01d5ffa0bea4f5061a2a1ded9dcefe7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\ml.pak
        • Size 1.5MB
        • SHA256 2bc35d18af85b3c7004a6e1e02591f5db4430a2f334f5c4be3c0a0e04837d9ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\mr.pak
        • Size 1.3MB
        • SHA256 5dee369e9366bfcc4fc95aec6c58b915933efd72c718d56802e35e8af5a880a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\ms.pak
        • Size 595KB
        • SHA256 5af99080b311e15a19f9988779a1cdd939a7fb9b98bf093fca324eeb58b39602
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\nb.pak
        • Size 572KB
        • SHA256 11e798ef612a1d22b90450c547998bf0b23ccc4ca5265f27f1924c8b09f22937
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\nl.pak
        • Size 594KB
        • SHA256 bf2a7d52d8c061b5f5543e7c4e20b4eac96e65e02a967752af873c3ec30034b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\pl.pak
        • Size 663KB
        • SHA256 d22e7666c9c66df8a5bee3b8040a0f9dafe15e9cf908b6712eb5a26812218a93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\pt-BR.pak
        • Size 621KB
        • SHA256 d5370596d47bad2a2c930688e7f67970381e63b3ae37384b77fd0b631eec3725
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\pt-PT.pak
        • Size 625KB
        • SHA256 b727b377a6ccf25952189c59ef175c213dd1e29e896b6b5fdfacd024c711ac93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\ro.pak
        • Size 648KB
        • SHA256 205ea8cc0b368426f06c533b636a2845e66e3f7932aa6a680645e79de15edff3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\ru.pak
        • Size 1.0MB
        • SHA256 447e788b9d36e6219ba1319a0831d4ea1c1e5e90c7db88bd7a6e6845d2a27d44
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\sk.pak
        • Size 675KB
        • SHA256 abdebceb4dd71f603cea0e9362943ddc4eb4e65fa0ad417f0958121fc5b2660b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\sl.pak
        • Size 646KB
        • SHA256 52426fb8fc82d1ed28797ccb62b7fe14f123cddf011f5d5875b076cdb0c33695
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\sr.pak
        • Size 993KB
        • SHA256 e67b36698412b94a6d3a63ffc398f74f005471fb1bdbd195e53330cfc8bbb62d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\sv.pak
        • Size 578KB
        • SHA256 3e94e4e0d0ce0c4d0a630540f43c83fe0d898c935f370a0baecf902cd4d04f12
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\sw.pak
        • Size 610KB
        • SHA256 e3bf553f18a0008dc5ac86e001a0ffb190f885260a7bf06feaf34822f0dde36a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\ta.pak
        • Size 1.5MB
        • SHA256 b04bec20fed826231af9ba7329cd04227e861e758eb9884ee485d33ae24810ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\te.pak
        • Size 1.4MB
        • SHA256 62b6f656b301bb7b678f809f9eaa2ff64e020211cb1930aebd16cc1222ce2a53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\th.pak
        • Size 1.2MB
        • SHA256 92919a8a65e9c344dc10a512ad238d4b3c4f6ab30b05e9515712fd7a2450d0b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\tr.pak
        • Size 621KB
        • SHA256 cb445b78fc9c1500a5acaec7eb49e1b36eab8797b82a0257c0e0cdbaf643d6e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\uk.pak
        • Size 1.1MB
        • SHA256 b5534d58e5624f94f48ed010251d5cf3d0cb5063acca310c4c8c6ee61e50e7a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\ur.pak
        • Size 933KB
        • SHA256 c0d81e0446bae6d62b496f5268222ad53fe5e6f7325c19bdb7685974967beb3b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\vi.pak
        • Size 737KB
        • SHA256 5f11a5911d63793462087c2950ff86cd1ea2af68b11d306c0dc35f59266b157c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\zh-CN.pak
        • Size 529KB
        • SHA256 9b968ef2fb8f21ed334d37fa2136495666107abda481665ed68381faf7b26e2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\locales\zh-TW.pak
        • Size 523KB
        • SHA256 f4bc5203f5954709aa33e9efcac2c3d197ea8b192280d1e30f01b12a416f9312
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\resources.pak
        • Size 6.0MB
        • SHA256 7e2f5fb099e9a625298f6d094c4b1ef2d59c295e223fccc9ac52af1fdf789b8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app.asar

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\resources\app.asar
        • Size 143KB
        • SHA256 1571645d18a936c9233cf135c878c2d99259cbffe9381b4c01f71447203b1a78
        • MD5 SHA1 SHA512 SSDEEP TLSH

        main.jsc

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\resources\app.asar.unpacked\compiled\main.jsc
        • Size 3KB
        • SHA256 15a81bf87dc37781ea9aa1c413c6c03333099022b816ddeddb1cf873e231a296
        • MD5 SHA1 SHA512 TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\snapshot_blob.bin
        • Size 394KB
        • SHA256 8c838a849558a994c524476bf6bc2fab1a36f826f957b9f729261e66f70dcf45
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\v8_context_snapshot.bin
        • Size 758KB
        • SHA256 fe4724f2a788e8902fe4a0419468bf06e556dbbd419cbd38e95a39c7c0acc2d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\vk_swiftshader.dll
        • Size 5.4MB
        • SHA256 1df00e64394fa563016ec1885271e4665d5813da5f9d1ce910d71d9a090e5d81
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\7z-out\vulkan-1.dll
        • Size 922KB
        • SHA256 e6663e25b7380f110166e194eff87257bb25a2a7455037e9e0f33bebeabd1d6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nse1BE1.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/4676-610-0x00000243709C0000-0x00000243709C1000-memory.dmp

        memory/4676-612-0x00000243709C0000-0x00000243709C1000-memory.dmp

        memory/4676-603-0x00000243709C0000-0x00000243709C1000-memory.dmp

        memory/4676-602-0x00000243709C0000-0x00000243709C1000-memory.dmp

        memory/4676-601-0x00000243709C0000-0x00000243709C1000-memory.dmp

        memory/4676-614-0x00000243709C0000-0x00000243709C1000-memory.dmp

        memory/4676-613-0x00000243709C0000-0x00000243709C1000-memory.dmp

        memory/4676-615-0x000002436D090000-0x000002436E97A000-memory.dmp

        memory/4676-611-0x00000243709C0000-0x00000243709C1000-memory.dmp

        memory/4676-608-0x00000243709C0000-0x00000243709C1000-memory.dmp

        memory/4676-609-0x00000243709C0000-0x00000243709C1000-memory.dmp

        memory/4948-585-0x00000297CFAE0000-0x00000297D13CA000-memory.dmp

        memory/4948-587-0x00000297CFAE0000-0x00000297D13CA000-memory.dmp

        memory/4948-617-0x00000297CFAE0000-0x00000297D13CA000-memory.dmp