Analysis

  • max time kernel
    151s
  • max time network
    160s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/09/2026, 13:05

General

  • Target
    ProjeAV 1.0.0.exe
  • Size 67.3MB
  • Sample260903-qbqawsxeph
  • SHA256 979535a601ee7827a6275d19d3133b6046c47300d58aeb31fbe57a66083424d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ProjeAV 1.0.0.exe
    "C:\Users\Admin\AppData\Local\Temp\ProjeAV 1.0.0.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Users\Admin\AppData\Local\Temp\3HHf4T1Sp7VTLOpbgDDSyOeH2Dl\ProjeAV.exe
      C:\Users\Admin\AppData\Local\Temp\3HHf4T1Sp7VTLOpbgDDSyOeH2Dl\ProjeAV.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5636
      • C:\Users\Admin\AppData\Local\Temp\3HHf4T1Sp7VTLOpbgDDSyOeH2Dl\ProjeAV.exe
        "C:\Users\Admin\AppData\Local\Temp\3HHf4T1Sp7VTLOpbgDDSyOeH2Dl\ProjeAV.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\projeav" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1720,i,15401777178655986672,6870375806518919882,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2432
      • C:\Users\Admin\AppData\Local\Temp\3HHf4T1Sp7VTLOpbgDDSyOeH2Dl\ProjeAV.exe
        "C:\Users\Admin\AppData\Local\Temp\3HHf4T1Sp7VTLOpbgDDSyOeH2Dl\ProjeAV.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\projeav" --field-trial-handle=2180,i,15401777178655986672,6870375806518919882,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4420
      • C:\Users\Admin\AppData\Local\Temp\3HHf4T1Sp7VTLOpbgDDSyOeH2Dl\ProjeAV.exe
        "C:\Users\Admin\AppData\Local\Temp\3HHf4T1Sp7VTLOpbgDDSyOeH2Dl\ProjeAV.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\projeav" --app-path="C:\Users\Admin\AppData\Local\Temp\3HHf4T1Sp7VTLOpbgDDSyOeH2Dl\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2488,i,15401777178655986672,6870375806518919882,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4716
      • C:\Users\Admin\AppData\Local\Temp\3HHf4T1Sp7VTLOpbgDDSyOeH2Dl\ProjeAV.exe
        "C:\Users\Admin\AppData\Local\Temp\3HHf4T1Sp7VTLOpbgDDSyOeH2Dl\ProjeAV.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\projeav" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3440,i,15401777178655986672,6870375806518919882,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4136

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\LICENSES.chromium.html
        • Size 9.8MB
        • SHA256 c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\chrome_100_percent.pak
        • Size 146KB
        • SHA256 2fb9826a1b43c84c08f26c4b4556c6520f8f5eef8ab1c83011031eb2d83d6663
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\chrome_200_percent.pak
        • Size 220KB
        • SHA256 83d9243037b2f7e62d0fdfce19ca72e488c18e9691961e2d191e84fb3f2f7a5d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.7MB
        • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\ffmpeg.dll
        • Size 2.6MB
        • SHA256 18b1f088c7a1261c5fedc46eec98f34e79655128110a6f6c0b9bf62be22dbc95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\icudtl.dat
        • Size 10.2MB
        • SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\libEGL.dll
        • Size 469KB
        • SHA256 76efadca4ef6d2abe6ab3701b4071e04470eebfeed8d8d22c7252683bcbb37b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\libGLESv2.dll
        • Size 7.6MB
        • SHA256 150a02e43426a0886f023e88cd88454fb0e78696ea3881347a6256920c7a02ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\af.pak
        • Size 481KB
        • SHA256 716e296c2f663ad90cdde85c5134582fc2305e5ebe10649fc9653bea533500a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\am.pak
        • Size 782KB
        • SHA256 9cff5c4af5997b45fb2a384bd73560e56bcb7710149e1a7e3e172d64e6eda025
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\ar.pak
        • Size 855KB
        • SHA256 516584da5741e7bb49ba6a70c9cf2ac47ff190ca9c4f692c3a30bc03a4560f50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\bg.pak
        • Size 892KB
        • SHA256 d223e994ad1aa6e747507187f724cdede8c369d2e8e0def50c4a6c912dba3880
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\bn.pak
        • Size 1.1MB
        • SHA256 1e49980f89360b395a70e844ccd0c43b3a34eab84461b1499e7621f757149e3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\ca.pak
        • Size 542KB
        • SHA256 7e8b5bd0a7a9835f20130ed17fb68242d7eb277cfaa2be6407f08c8d0dfcd500
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\cs.pak
        • Size 558KB
        • SHA256 21916011c2668389727c8970e1407b9c0806812effab9552106da963951d9f27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\da.pak
        • Size 505KB
        • SHA256 10dfa841d08a3ab094f83e151fdc1edbd66bf8f2392f1511e325628e4e9c7a0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\de.pak
        • Size 539KB
        • SHA256 400f965d457e958b063e60131d88eaacd74fdb6213ae14cf84c4b6b45809e04d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\el.pak
        • Size 979KB
        • SHA256 58ca76aa55e11a475c830ac89010d4431f455f531079c1e8a0943490b4dd8e4b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\en-GB.pak
        • Size 439KB
        • SHA256 a672387f6fb84ade1b0c44c456ff1a19dcd464c4a9e65e439ca95a115455340f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\en-US.pak
        • Size 443KB
        • SHA256 95fd54494d992d46e72dad420ceee86e170527b94d77bfaaa2bfc01f83902795
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\es-419.pak
        • Size 534KB
        • SHA256 dba56ab390a959dc40cb79db195e4ed6b17d4009235063f738b9ebcf41c4b5cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\es.pak
        • Size 534KB
        • SHA256 ea54cbe126cdd85b2799ad9600b86ca98c994e69251344163037139296ecea7c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\et.pak
        • Size 485KB
        • SHA256 3610615dcac844cc9a64b843da606f4f8d29b1c945ecc19b288b54829d0e92e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\fa.pak
        • Size 794KB
        • SHA256 34d79e8a7fa478bf3b350412160a59249e87d31932d728f0167cee89aeff2bad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\fi.pak
        • Size 495KB
        • SHA256 01f9669cd2fa17965f882e2cd81c39fa2face2f13ba4f024c3799f1841111ffc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\fil.pak
        • Size 559KB
        • SHA256 3265ae5b6c16a09b1ec9ea53181de78df75e951c3ce28f33d4c483088a9ab37b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\fr.pak
        • Size 577KB
        • SHA256 8a283001240c59a552945d0466e3118dc125fbc9f1a10bdea4ca4197460102ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\gu.pak
        • Size 1.1MB
        • SHA256 74c62dca0b7a310aa593d1dcca8b0b0b382b052837e7cae6b87cf05b8b346b1b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\he.pak
        • Size 696KB
        • SHA256 25281efad59a66f310cabb92da67198451567da553f2c437e52388e8fd25b9a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\hi.pak
        • Size 1.2MB
        • SHA256 4b5585a8cc1a21e2dfcbd0d33f6cea87b7a583b8690f0f3635bd74bb5cbd2ed0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\hr.pak
        • Size 538KB
        • SHA256 d1f8093b91663d061bc2fa20426e2c430d53b06fc605ac1b0b2279d446dc9317
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\hu.pak
        • Size 581KB
        • SHA256 0a62d168c0f6d9d651dedb4e01be5b533b94e8617535cd70ad22717748fbbc64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\id.pak
        • Size 478KB
        • SHA256 d9fc19e683240404a60d57037f24e1d8b20cfda4c8bcacfed577b86cd8988517
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\it.pak
        • Size 527KB
        • SHA256 f38e6b6d975f8148f46dbeda89563cf71bf07af98e9b79c1a8d158b5f8f1309f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\ja.pak
        • Size 644KB
        • SHA256 6df72da472ee171acc440c20a2a194a2a4af4839b6a88323c4654c50ff8b492b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\kn.pak
        • Size 1.3MB
        • SHA256 333725ea1045d44acf2c19efc765bffc38cc5cea6e9977fe583ad6e203442582
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\ko.pak
        • Size 544KB
        • SHA256 3ad0012db772293073acb05d24b8dfb26697d6cc5dd1612150df023dbc31b674
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\lt.pak
        • Size 583KB
        • SHA256 946351ed2d74f247dea0f2742fc36d89225355480f0cec99d71599ccce3ea9e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\lv.pak
        • Size 582KB
        • SHA256 1e6f9a40f4fa1206117063234399bd7c1e7d198cbf6c4ad633e5e18ad0929836
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\ml.pak
        • Size 1.3MB
        • SHA256 f2fb440eb0518dc695810fcb854b20b72aa47e5ffc75c803aacf05861d35a94f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\mr.pak
        • Size 1.1MB
        • SHA256 a674db4e60152fc17a32d4b92add129adaebfc02a1a783a12653f984447c535e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\ms.pak
        • Size 502KB
        • SHA256 7707f79a2a4aec553e68af87802a0f19d3714a25311fb7b8afdc6ff4a5b6c5ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\nb.pak
        • Size 487KB
        • SHA256 53b12866e7265661c0088b89653d2c1cb9220e1ec0ce0049f3095d53356b3f1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\nl.pak
        • Size 503KB
        • SHA256 4736b7ec56cb845c14795e6e4fa98ddaba47c75aecec86e931f61222dff45ad9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\pl.pak
        • Size 560KB
        • SHA256 2191f77aabe75522166a3325e2660395479633b936d5173d150120367ed501a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\pt-BR.pak
        • Size 527KB
        • SHA256 1deee32edff320827dbfbe22aa42e83d8caf79f95f7cf18013424da7cdadb975
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\pt-PT.pak
        • Size 530KB
        • SHA256 fcd194e5caf36be4958c559acbde4f28a957083bf2aceac893f9e5c9e65d8a95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\ro.pak
        • Size 549KB
        • SHA256 06c6486e8a42b447a55bd789bf2bc794354fa4be062139481e4612550f16c755
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\ru.pak
        • Size 902KB
        • SHA256 6e53b1b54bac43c07798ee6507bd05806fbd2146ac0f987a7f03aae3cf5d9985
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\sk.pak
        • Size 566KB
        • SHA256 7a1db23a5b4f8e4c7cbc80a832f4f4c33fe29e31d4ae78a814bd8ca85620968f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\sl.pak
        • Size 544KB
        • SHA256 7235e631afff75cad9d25b2e5a0e74696ea6b7f4b2a05753331bbd719a0699cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\sr.pak
        • Size 839KB
        • SHA256 35e57d972a60e161f123a5783e67e250f5cae1f66a2c11b119c10b81c43bd03f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\sv.pak
        • Size 489KB
        • SHA256 bcd070d70a4284fd3144bf37c5e56994ca3a69c8f65aa72a9231748b30210e00
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\sw.pak
        • Size 515KB
        • SHA256 eb96ab83e2e08e811928742590178e97454863bc581dd8574d6a644fd3c6615a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\ta.pak
        • Size 1.3MB
        • SHA256 e213c963248c93fcb4b88b1a45936dda28a5fe39cc0428a16556c6d737fc9940
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\te.pak
        • Size 1.2MB
        • SHA256 8dd7d206379445bd9afa4e01ab986c439cf70841d080fca6e152b453e94fcc49
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\th.pak
        • Size 1.0MB
        • SHA256 a4c2c305aa9d3df52d988c4da2bda398e8ee81d320e9da1de7d4d366e826dbc2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\tr.pak
        • Size 527KB
        • SHA256 f842b56ddc4145e4474c5cfc67893900b577c131a4b123cb16cfcad48ed0f338
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\uk.pak
        • Size 902KB
        • SHA256 5dd2fcc64ef09be0775c2efe7e07dddfc18f5ba6059f878d0c22b9b0c2207cdc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\ur.pak
        • Size 790KB
        • SHA256 a0c752a805da7dd6608ad04625734f4d27cb75b682f51b2dc8ef08350cc7a2cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\vi.pak
        • Size 624KB
        • SHA256 d7f676cf557d43db07b14a22b0b20ca761ced59285cadd75c07c68613486e909
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\zh-CN.pak
        • Size 450KB
        • SHA256 48e32f53d07cad6e6dc12040619f7021fa8f0b3254cc6945905b7c6748acb787
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\locales\zh-TW.pak
        • Size 445KB
        • SHA256 a8b11c74a0512fed29b11748181ef4b1de84dc99197c48d9eecf316aceb425fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\resources.pak
        • Size 5.1MB
        • SHA256 75e03df55d7d23c840c09288da270285f17d067cef8709252451c0a8aa1254f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app.asar

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\resources\app.asar
        • Size 6.3MB
        • SHA256 ec3ebd16c470a1b26d44ddea1d932263ae5c01cf247b91d23a5fdbaf0299b0c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\snapshot_blob.bin
        • Size 300KB
        • SHA256 7f80294b63fb7cd63b43be498fcbe1e34bb05a8011cad9514c4eb9b29dfa5336
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\v8_context_snapshot.bin
        • Size 641KB
        • SHA256 0b239cf5ab92a27cfa087b49e6dc943e0c674b62cea643cff2130e1c2f8db31c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\vk_swiftshader.dll
        • Size 5.1MB
        • SHA256 6ff65b7a5faf726cf747eca6d6504e885a70664e37dc5e38e0e0cc68bed3bf6d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\7z-out\vulkan-1.dll
        • Size 935KB
        • SHA256 715dca5af441dc220a61fb0f8e66600dc4f9f63ecc106fa43bc683098e00fff8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsm53B5.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default.exc

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512

        data_0

        • Path C:\Users\Admin\AppData\Roaming\projeav\GPUCache\data_0
        • Size 8KB
        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
        • MD5 SHA1 SHA512 SSDEEP

        data_1

        • Path C:\Users\Admin\AppData\Roaming\projeav\GPUCache\data_1
        • Size 264KB
        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
        • MD5 SHA1 SHA512 SSDEEP

        data_2

        • Path C:\Users\Admin\AppData\Roaming\projeav\GPUCache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP

        data_3

        • Path C:\Users\Admin\AppData\Roaming\projeav\GPUCache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP

        Network Persistent State

        • Path C:\Users\Admin\AppData\Roaming\projeav\Network\Network Persistent State
        • Size 1KB
        • SHA256 67ec29d6d9d677d2c91aaa216eb9f80face56a5b7946bb8e520031c66a739c54
        • MD5 SHA1 SHA512 TLSH

        Network Persistent State

        • Path C:\Users\Admin\AppData\Roaming\projeav\Network\Network Persistent State
        • Size 59B
        • SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
        • MD5 SHA1 SHA512 TLSH

        Network Persistent State~RFe5a0001.TMP

        • Path C:\Users\Admin\AppData\Roaming\projeav\Network\Network Persistent State~RFe5a0001.TMP
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH

        TransportSecurity

        • Path C:\Users\Admin\AppData\Roaming\projeav\Network\TransportSecurity
        • Size 517B
        • SHA256 3e36a9e83a4fbeaf228bbdf56bcadaa075bb138c7b7de9851e3673f2adc19f38
        • MD5 SHA1 SHA512 TLSH

        TransportSecurity

        • Path C:\Users\Admin\AppData\Roaming\projeav\Network\TransportSecurity
        • Size 519B
        • SHA256 4623c21ddd3e88b0b67051bbd9feeec818019eb3a3e10ef59cfe3d3755a670ab
        • MD5 SHA1 SHA512 TLSH

        TransportSecurity

        • Path C:\Users\Admin\AppData\Roaming\projeav\Network\TransportSecurity
        • Size 519B
        • SHA256 3797a5b88236b7fb1d097d872c4fbf77738726a0c9f853a7eb9c2777964cf0a8
        • MD5 SHA1 SHA512 TLSH

        TransportSecurity

        • Path C:\Users\Admin\AppData\Roaming\projeav\Network\TransportSecurity
        • Size 519B
        • SHA256 1ee1bedb76ca68383f2142f020a9ac250ed548b32b731af43ff9c8a96321749d
        • MD5 SHA1 SHA512 TLSH

        TransportSecurity

        • Path C:\Users\Admin\AppData\Roaming\projeav\Network\TransportSecurity
        • Size 519B
        • SHA256 c287897a7a545354f998f36e01df613e2232bea5c76a6d5bea3f8a1ee990fb02
        • MD5 SHA1 SHA512 TLSH

        TransportSecurity

        • Path C:\Users\Admin\AppData\Roaming\projeav\Network\TransportSecurity
        • Size 517B
        • SHA256 58f61562619abc788f6a33b26392ef5117afff5209bfba266ea65fba0a9702ab
        • MD5 SHA1 SHA512 TLSH

        TransportSecurity

        • Path C:\Users\Admin\AppData\Roaming\projeav\Network\TransportSecurity
        • Size 517B
        • SHA256 d501bb0e3f26f5c27b9a90e8a8d0b00662948dd8503957502e0711416d80d79f
        • MD5 SHA1 SHA512 TLSH

        TransportSecurity~RFe59fa44.TMP

        • Path C:\Users\Admin\AppData\Roaming\projeav\Network\TransportSecurity~RFe59fa44.TMP
        • Size 351B
        • SHA256 194904f7b66c69092e31f47767898df39c27cecee5f340d6e2de1c63ee6b154e
        • MD5 SHA1 SHA512 TLSH

        memory/4136-567-0x000001E924960000-0x000001E924961000-memory.dmp

        memory/4136-565-0x000001E924960000-0x000001E924961000-memory.dmp

        memory/4136-574-0x000001E924960000-0x000001E924961000-memory.dmp

        memory/4136-575-0x000001E924960000-0x000001E924961000-memory.dmp

        memory/4136-576-0x000001E924960000-0x000001E924961000-memory.dmp

        memory/4136-573-0x000001E924960000-0x000001E924961000-memory.dmp

        memory/4136-572-0x000001E924960000-0x000001E924961000-memory.dmp

        memory/4136-571-0x000001E924960000-0x000001E924961000-memory.dmp