455ac4c82e39bf726130d12b5206be3d6443ebbbd022b900f7dc4c7d0dd6d276

Analysis

max time kernel
151s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app.v2.9.2.exe
Size 70.9MB
Sample260920-1bawbas1cv
SHA256 455ac4c82e39bf726130d12b5206be3d6443ebbbd022b900f7dc4c7d0dd6d276
MD5 8dcf7359ac57b3b4614dd62e4bbe3e79
SHA1 ea3e86b11335c5ac0b5faa70fe662e1aac4d0513
SHA512 b0feba82e17ab4951e8069fdf9d1d392303dcc08fbba28d6d16eaefe9e6c7799f897bfbdf42896c54dd354ae3ecb422763c45d20f66ab68b0019e0d02f7fc7bc
SSDEEP 1572864:YOe4hqIZHv/HpynQ3Y9GF0J2/3M4fvHLTkEY68xsqBJzdu:YOe4osPvgI/0A/3/vHLosENdu
TLSH
T117F73363BD7A49B5C0D1B7BDA01F45A58A2B380E5E0E10B5B36F51BBE8F19014E264CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1928	HydraSteamTools.exe
2684	HydraSteamTools.exe
3264	HydraSteamTools.exe
2928	HydraSteamTools.exe

Loads dropped DLL 15 IoCs

pid	Process
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
1928	HydraSteamTools.exe
2684	HydraSteamTools.exe
3264	HydraSteamTools.exe
2928	HydraSteamTools.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Program Files directory 50 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\LICENSE.electron.txt	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\v8_context_snapshot.bin	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\arm\7za	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\ia32	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\win\x64\7za.exe	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\icudtl.dat	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\libEGL.dll	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\LICENSE.txt	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\ffmpeg.dll	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\locales\en-GB.pak	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\package.json	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\win\ia32	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\uninstallerIcon.ico	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\index.js	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\arm	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\arm64	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\x64	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\x64\7za	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\x64\do-build.sh	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\mac	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\chrome_200_percent.pak	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources.pak	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\mac\arm64	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\mac\x64	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\mac\x64\7za	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\libGLESv2.dll	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\ia32\7za	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\x64\build.sh	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\win	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\locales	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\elevate.exe	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\7x.sh	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\mac\arm64\7za	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\win\ia32\7za.exe	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\win\x64	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\$null	cmd.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\chrome_100_percent.pak	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\snapshot_blob.bin	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\locales\en-US.pak	app.v2.9.2.exe
File opened for modification	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\arm64\7za	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\Uninstall HydraSteamTools.exe	app.v2.9.2.exe
File created	C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\HydraSteamTools.exe	app.v2.9.2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2904	cmd.exe
2828	cmd.exe
5108	cmd.exe
1872	cmd.exe
3028	cmd.exe
4792	cmd.exe
5036	cmd.exe
5732	cmd.exe
2036	cmd.exe
5168	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	app.v2.9.2.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
2184	app.v2.9.2.exe
5464	powershell.exe
5464	powershell.exe
5464	powershell.exe
3004	WMIC.exe
3004	WMIC.exe
3004	WMIC.exe
3004	WMIC.exe
1928	HydraSteamTools.exe
1928	HydraSteamTools.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2184	app.v2.9.2.exe
Token: SeShutdownPrivilege	1928	HydraSteamTools.exe
Token: SeCreatePagefilePrivilege	1928	HydraSteamTools.exe
Token: SeDebugPrivilege	5464	powershell.exe
Token: SeShutdownPrivilege	1928	HydraSteamTools.exe
Token: SeCreatePagefilePrivilege	1928	HydraSteamTools.exe
Token: SeIncreaseQuotaPrivilege	5464	powershell.exe
Token: SeSecurityPrivilege	5464	powershell.exe
Token: SeTakeOwnershipPrivilege	5464	powershell.exe
Token: SeLoadDriverPrivilege	5464	powershell.exe
Token: SeSystemProfilePrivilege	5464	powershell.exe
Token: SeSystemtimePrivilege	5464	powershell.exe
Token: SeProfSingleProcessPrivilege	5464	powershell.exe
Token: SeIncBasePriorityPrivilege	5464	powershell.exe
Token: SeCreatePagefilePrivilege	5464	powershell.exe
Token: SeBackupPrivilege	5464	powershell.exe
Token: SeRestorePrivilege	5464	powershell.exe
Token: SeShutdownPrivilege	5464	powershell.exe
Token: SeDebugPrivilege	5464	powershell.exe
Token: SeSystemEnvironmentPrivilege	5464	powershell.exe
Token: SeRemoteShutdownPrivilege	5464	powershell.exe
Token: SeUndockPrivilege	5464	powershell.exe
Token: SeManageVolumePrivilege	5464	powershell.exe
Token: 33	5464	powershell.exe
Token: 34	5464	powershell.exe
Token: 35	5464	powershell.exe
Token: 36	5464	powershell.exe
Token: SeIncreaseQuotaPrivilege	5464	powershell.exe
Token: SeSecurityPrivilege	5464	powershell.exe
Token: SeTakeOwnershipPrivilege	5464	powershell.exe
Token: SeLoadDriverPrivilege	5464	powershell.exe
Token: SeSystemProfilePrivilege	5464	powershell.exe
Token: SeSystemtimePrivilege	5464	powershell.exe
Token: SeProfSingleProcessPrivilege	5464	powershell.exe
Token: SeIncBasePriorityPrivilege	5464	powershell.exe
Token: SeCreatePagefilePrivilege	5464	powershell.exe
Token: SeBackupPrivilege	5464	powershell.exe
Token: SeRestorePrivilege	5464	powershell.exe
Token: SeShutdownPrivilege	5464	powershell.exe
Token: SeDebugPrivilege	5464	powershell.exe
Token: SeSystemEnvironmentPrivilege	5464	powershell.exe
Token: SeRemoteShutdownPrivilege	5464	powershell.exe
Token: SeUndockPrivilege	5464	powershell.exe
Token: SeManageVolumePrivilege	5464	powershell.exe
Token: 33	5464	powershell.exe
Token: 34	5464	powershell.exe
Token: 35	5464	powershell.exe
Token: 36	5464	powershell.exe
Token: SeIncreaseQuotaPrivilege	5464	powershell.exe
Token: SeSecurityPrivilege	5464	powershell.exe
Token: SeTakeOwnershipPrivilege	5464	powershell.exe
Token: SeLoadDriverPrivilege	5464	powershell.exe
Token: SeSystemProfilePrivilege	5464	powershell.exe
Token: SeSystemtimePrivilege	5464	powershell.exe
Token: SeProfSingleProcessPrivilege	5464	powershell.exe
Token: SeIncBasePriorityPrivilege	5464	powershell.exe
Token: SeCreatePagefilePrivilege	5464	powershell.exe
Token: SeBackupPrivilege	5464	powershell.exe
Token: SeRestorePrivilege	5464	powershell.exe
Token: SeShutdownPrivilege	5464	powershell.exe
Token: SeDebugPrivilege	5464	powershell.exe
Token: SeSystemEnvironmentPrivilege	5464	powershell.exe
Token: SeRemoteShutdownPrivilege	5464	powershell.exe
Token: SeUndockPrivilege	5464	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1928	HydraSteamTools.exe
1928	HydraSteamTools.exe
1928	HydraSteamTools.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1928	HydraSteamTools.exe
1928	HydraSteamTools.exe
1928	HydraSteamTools.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2684	1928	HydraSteamTools.exe	91
PID 1928 wrote to memory of 2684	1928	HydraSteamTools.exe	91
PID 1928 wrote to memory of 3264	1928	HydraSteamTools.exe	92
PID 1928 wrote to memory of 2928	1928	HydraSteamTools.exe	93
PID 1928 wrote to memory of 2928	1928	HydraSteamTools.exe	93
PID 1928 wrote to memory of 2928	1928	HydraSteamTools.exe	93
PID 1928 wrote to memory of 2904	1928	HydraSteamTools.exe	94
PID 2904 wrote to memory of 5876	2904	cmd.exe	96
PID 1928 wrote to memory of 2828	1928	HydraSteamTools.exe	97
PID 2828 wrote to memory of 5464	2828	cmd.exe	99
PID 1928 wrote to memory of 3028	1928	HydraSteamTools.exe	101
PID 3028 wrote to memory of 3004	3028	cmd.exe	103
PID 1928 wrote to memory of 4792	1928	HydraSteamTools.exe	104
PID 4792 wrote to memory of 5108	4792	cmd.exe	106
PID 1928 wrote to memory of 5036	1928	HydraSteamTools.exe	107
PID 5036 wrote to memory of 1716	5036	cmd.exe	109
PID 1928 wrote to memory of 1872	1928	HydraSteamTools.exe	111
PID 1872 wrote to memory of 4896	1872	cmd.exe	113
PID 1928 wrote to memory of 5732	1928	HydraSteamTools.exe	114
PID 5732 wrote to memory of 3124	5732	cmd.exe	116
PID 1928 wrote to memory of 2036	1928	HydraSteamTools.exe	117
PID 2036 wrote to memory of 3056	2036	cmd.exe	119
PID 1928 wrote to memory of 5168	1928	HydraSteamTools.exe	120
PID 5168 wrote to memory of 2900	5168	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\app.v2.9.2.exe
"C:\Users\Admin\AppData\Local\Temp\app.v2.9.2.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\HydraSteamTools.exe
"C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\HydraSteamTools.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\HydraSteamTools.exe
  "C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\HydraSteamTools.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\hydrasteamtools" --gpu-preferences=WAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=1664 --field-trial-handle=1668,i,6354437512622964689,4843136267353584059,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2684
- C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\HydraSteamTools.exe
  "C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\HydraSteamTools.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\hydrasteamtools" --mojo-platform-channel-handle=1728 --field-trial-handle=1668,i,6354437512622964689,4843136267353584059,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3264
- C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\HydraSteamTools.exe
  "C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\HydraSteamTools.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hydrasteamtools" --app-user-model-id=com.onyxax.hydrasteamtools --app-path="C:\Program Files (x86)\Hydra Steam Tool\HydraSteamTools\resources\app.asar" --enable-sandbox --first-renderer-process --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2308 --field-trial-handle=1668,i,6354437512622964689,4843136267353584059,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:5876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAJABkAD0AKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlAHwAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQApAC4AUwBlAHIAaQBhAGwATgB1AG0AYgBlAHIAOwAkAG0APQAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQgBhAHMAZQBCAG8AYQByAGQAKQAuAFMAZQByAGkAYQBsAE4AdQBtAGIAZQByADsAJABjAD0AKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAbwByACkALgBQAHIAbwBjAGUAcwBzAG8AcgBJAGQAOwBbAEMAbwBuAHMAbwBsAGUAXQA6ADoATwB1AHQALgBXAHIAaQB0AGUAKAAiACQAZAB8ACQAbQB8ACQAYwAiACkA 2>$null"
  2⤵
  - Drops file in Program Files directory
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAJABkAD0AKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlAHwAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQApAC4AUwBlAHIAaQBhAGwATgB1AG0AYgBlAHIAOwAkAG0APQAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQgBhAHMAZQBCAG8AYQByAGQAKQAuAFMAZQByAGkAYQBsAE4AdQBtAGIAZQByADsAJABjAD0AKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAbwByACkALgBQAHIAbwBjAGUAcwBzAG8AcgBJAGQAOwBbAEMAbwBuAHMAbwBsAGUAXQA6ADoATwB1AHQALgBXAHIAaQB0AGUAKAAiACQAZAB8ACQAbQB8ACQAYwAiACkA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c vol C:"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\cmd.exe
    cmd /c vol C:
    3⤵
    - Executes a command shell one-liner
    PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac /fo csv /nh 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\system32\getmac.exe
    getmac /fo csv /nh
    3⤵
    PID:1716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\Software\Valve\Steam" /v SteamPath"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\system32\reg.exe
    reg query "HKLM\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:3056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\Software\Valve\Steam" /v SteamPath"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Windows\system32\reg.exe
    reg query "HKLM\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

02aed1d8-f3a1-43f2-9d68-7c23701c8cf9.tmp.ico

Path C:\Users\Admin\AppData\Local\Temp\02aed1d8-f3a1-43f2-9d68-7c23701c8cf9.tmp.ico
Size 32KB
SHA256 22c225def296b639ad47f47446991817cc63984ae199cfd505d0a8b12b0765e1
MD5 ec5b96ac08bba51c6ca2500acffea1a1
SHA1 9d9e6130f6923f9a6b00419d96a810c041135b07
SHA512 66680457aef46aee369f5dd44de45c3efbc78c295c57fdc3e6be0b137abc926d6aa2e881993c3c1a0572c2cccaff311c554db11253810d87788b424b68ad9efe
SSDEEP 384:DqCpSHC3XcxFvXycE+IGx2UvYVHwqJMr+G5hiVPgqkpMeDS7uVKi04aHmdsxs18g:DUmcEzUvYD4cV362Q0VGKxlp8Kc4Y
TLSH
T1CFE2D057102E9299C28B16B9277F105DDEBB09D846602ADE7E84F218A28E60F3FD6194
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\chrome_100_percent.pak
Size 163KB
SHA256 b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
MD5 4fc6564b727baa5fecf6bf3f6116cc64
SHA1 6ced7b16dc1abe862820dfe25f4fe7ead1d3f518
SHA512 fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2
SSDEEP 3072:IOzwJCGIekwdLpsXYFAXg6IL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:IOzw1Iekam5QpK18Gb0OV8ld0GecQ3Ey
TLSH
T142F3E1D7B7B4EE3DCA5752B7626600B1ECB7452807A1434B178BD8763A72348D8C8793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\chrome_200_percent.pak
Size 222KB
SHA256 fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
MD5 47668ac5038e68a565e0a9243df3c9e5
SHA1 38408f73501162d96757a72c63e41e78541c8e8e
SHA512 5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89
SSDEEP 6144:QsDQYaSN6svydHLhQegx5GMRejnbdZnVE6YoppO4:QBfSN6svydrx6edhVELoXO4
TLSH
T1F024E1CB67B8DD3CC96706B3622601F1FCB6113856B6525B03DBEC357A9668988CD383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\ffmpeg.dll
Size 2.7MB
SHA256 c8476ee68088d72b9fab25703093df19237d14387016b77f472e10c99c9415ed
MD5 fa145097e0274da929aacd68c31338ab
SHA1 a999806ef0c15593100e21bc8632d7b1806bac47
SHA512 d4898eed2ea09cb9b1810d783558ee7bf284701734437fbd9e1035138216e1ddbddd77d588a0b722adc5c5fd4a245871537bfb9b168910fc2bffbd6cb78c3c9f
SSDEEP 49152:pPDtyvMYqXiOaeQ3NZ+GEMDbG7m8x7n6mfu/oBLpweNsgMzqvU9n7xN:9SOONYbQG7m8bdazl9n7r
TLSH
T1D7D5AE06F6D640D9D01DC074869F9223F631354A8B24A7EF1B909A252FBBFD46E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\icudtl.dat
Size 10.2MB
SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
MD5 e0f1ad85c0933ecce2e003a2c59ae726
SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
TLSH
T1B8B63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\libEGL.dll
Size 467KB
SHA256 7bee4e33d89e5a4f2b3bc74d632f7c773ae9a399b6b2ba6d29b1192e25695a8b
MD5 5db499ae909083620e47eeea1623b2af
SHA1 bc23303d6885b8f5c3fb84b3fecdf1a678e94a25
SHA512 d656bfa6d59c495d85eee872b372f7fba24f89101c38de1de904ece0d9ffa6eb93de81fdf674efa5ef724ea73188b908b8ad32cfee03c656accb835683929311
SSDEEP 6144:ZuF2Dw0NiKxN6YTfDVTCanVJhPadWQo+gehJp/Ej4:w0iKbbTfDVJ2dWQo+genp/EU
TLSH
T1A2A48D15779444A9E06BC174CA534642EE72B8960F25FBDF03A492392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\libGLESv2.dll
Size 7.4MB
SHA256 ee039e42a4948e9f26ece8515f3c699014fa7803ae597cd3427fa1548962f9af
MD5 57c23aa2c39f11528e56a48ea1824036
SHA1 d4fbf180266eb210f8d83360cbbd3804249c60b8
SHA512 77487060b824cc70b30b30b144b8f174fd08ca6a298fd8c8f45d8417b90b7914a0d135edab39d6a5b2b883d49e9386da382a9ce5c52dc07ecd147f49118efa63
SSDEEP 98304:Ceo+zGD6g/ZXxUhH2jsS5Tgg+uPGOja21pcwXm3zq:C1u0MhHUmkjFCzq
TLSH
T1C6768C03F29641D9C05DD2B98B5B9123FA30B8944B34B6DF2A5847253F77BE06B3AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\locales\en-GB.pak
Size 424KB
SHA256 4e4d71f24f5eea6892b961fcda014fc74914c1340366f9c62f0535e9b94ae846
MD5 a1aa885be976f3c27a413389ea88f05f
SHA1 4c7940540d81bee00e68883f0e141c1473020297
SHA512 8b6d67e09fbe7a2152a71532a82c1e301d56cdde34b83a9f17d9f471e258b255d5b2d4a0c39f38581da3a31cec24fb403156a8e493560d7206e1ec3db7e68b72
SSDEEP 6144:heMA5+ocjYbYMP9ejI/AfaYzyJyC5+S6Bc0RIIf:kMhoxYMEI/+I5+Smf
TLSH
T1F0943C1FF784226A069311727B0AA6A2FF22D06CB35116567CBD802C33B6756C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\locales\en-US.pak
Size 428KB
SHA256 0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb
MD5 809b600d2ee9e32b0b9b586a74683e39
SHA1 99d670c66d1f4d17a636f6d4edc54ad82f551e53
SHA512 9dfbe9fe0cfa3fcb5ce215ad8ab98e042760f4c1ff6247a6a32b18dd12617fc033a3bbf0a4667321a46a372fc26090e4d67581eaab615bf73cc96cb90e194431
SSDEEP 6144:5GdVxPtFXqVtOMP9eXe9HfaYvaVP51SLngF/cjjwB:yVpwOMge9B251SXjwB
TLSH
T110944C1FF7442229069312627F09A6A2FF36D06DA35112563CBD812C33B6B66C3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources.pak
Size 5.1MB
SHA256 1d241f5d4403a6e802e898c61e4753f8508ae4dda8fcb7750558ec1ecade52c6
MD5 0e69910860463d5045ec257234bd8dd4
SHA1 33c923c33129d1dccf0bb2dcbe8af983a7000444
SHA512 f6bb7c7b51bb202877739801498522095637caf8a03e2e1f2c6319fede3d3ca656f552061e171ec5e35e176c267fe278c326805d760add1371590bed58e12375
SSDEEP 98304:Ct1j25juJgWPVcz+cd31rJ7JBXbwHgf3IvVrwrWBpcdmTHWCF3UlfPcauPFcHNp:Ctp8CJPdB831FJ5wHwOVkrWBQmTHWo0l
TLSH
T1EE363320F6385C36D0F0A2BE816812738B39D8139665781DB1DF932C5F7CA5E85B47AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar
Size 37.4MB
SHA256 acd11009c75b0d5e1bf370bd8e95363129545d71c2a86e147d410a996b197cbf
MD5 e4576ece622296097be3c7b9b3111b93
SHA1 f0de8ecb6492b74229e0c4df3d19acc013b3d6af
SHA512 3ec4d490bda9afa0dfe7a8062bd3a4e01b2b53cabe3ccf96f3a5b03fa4659039e68fa241b9623911cbeb881e4e9272c9199aeff390958063a5f7a93ac56e90e6
SSDEEP 98304:q3mRy9A2Qp7X6FQw+SOuSpJnGzOZFkO5w4JSMnyDrZ/Nzeow64FbvrZ/MnyDrZII:0mhV
TLSH
T14987282262D324634B5F1EB313CE6146EE79912F750898007B8DC7597B84F26E2A7EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7x.sh

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\7x.sh
Size 235B
SHA256 ad693686d24184b7bc49fc357b93fca63d35a62d6509b7225252d7f18701f49a
MD5 8a65a1ab93601ddecb93af2a310dd68b
SHA1 a1d449ca51b5ba67be9cbcaa7901cf9b3f1c0f04
SHA512 25844b7975d5567b70d793369342211bac5ceb5d17fee7cc7a0a6a0a2b8d42f4188119544927da81cd88c115fad9d09993f2ef61ee228ed16fc20e0ab323482a
TLSH
T1DCD02B11D01DA8841049060311457428C821A859330C3EC99C5216BFEE15F632819358
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\LICENSE.txt
Size 1KB
SHA256 e9f2248a07935f444c613d84e5a0239eab7537a80cc02212f386662f0ded0e11
MD5 d9fb291501a56892c48e0808076b7037
SHA1 ee89eb7662881fd2d5e21d5cc802162884ffec2f
SHA512 a1f2d6b0ddc8acf88d2a773c768e5f77829b9d3fd6cd04ad987df8a4ee153261de9babb7f487a9e0ca3c9c8accafd2de08906e0ae5aee1f1c63b969680872114
TLSH
T13D11861E73550762189B13605A7868D8F12B725F7A5F2A88246DF345233A0ACD1FF840
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\index.js
Size 500B
SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
MD5 9fe8a485038be54d687ad7dd9dff80d3
SHA1 76fc7b47a329b759539bca0b785ad41c083c29be
SHA512 0f3b2ce074ede02079bdab4229f6d4ded5eb7ec64546c3b9f103114aabb35093fecfd04677a0a84d3691fb49bae8a6c5489cee946c7f5f4b86aec3e96434dfac
TLSH
T13AF02E5975DB81204345D3A43D28480AE4E8DCF363491E3A90C097F4BB65D7143F25BE
MD5 SHA1 SHA512 TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\arm64\7za
Size 1.1MB
SHA256 d363b0055afb4f7f336152dd5d00f1cc992d6e86a56e4a1ec84b2ac26dee27ff
MD5 bbbf518e41f7ac044cbf5e25bfae8b2d
SHA1 5f1df07d814224931d0aef78d8b45ff89474ac78
SHA512 02c447db478013e8d4452be017222ccd261d6a818c28e210bfac8c4c2ed2caca16c0b8bc8290af5fdd61077de43fa36cb012007609279714051640dd276be1be
SSDEEP 12288:Zj4X5AliTSvnzjfTET2oplihyabHIEigotxcfR+DVAW9a55XdcOuFvPJ8k:Zj4X5A4Ovnzjq2oKybpUe33
TLSH
T15E352A4BF60C7C43E383E1BCEF89CEB1B62B75B9932680A07596419CD1D25A5CE72643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\arm\7za
Size 983KB
SHA256 3a68d5c794bb8534040f3f93480a7fe8194bf5ed8e0d3e2ac0de4dea9677a64c
MD5 601642dc448c3b398e92ec0d19e447a1
SHA1 114f88fca99d59eb7a1a180f0e3ece3f056f28c9
SHA512 e67cb183e4e7f8ee30d7ca8e3357573acf6c04fa31415862d75703a9536e1c46c2a340f4b6f8a06213a05d802d0cd8b044d1e84d51a4e39211896ba3d1f9fb5d
SSDEEP 12288:HgxgE4Zq83N97ECVgV+w1DIaEOXRq/vjwBgLI/z1o8JdX4O7eCBjj:HgCTNZD7+XR4rwH71tX4I
TLSH
T1CF25E4A6F5419B63C6C05A77FA4EC29E332317BDD2E9710599240B64BBCF59E0F3A102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\ia32\7za
Size 1.6MB
SHA256 8400fe1f78c7033ddf16f55b82c3a520a91c424a29d5163c45c6e085c5834373
MD5 dba8ad5c0f1a27e9e387817df9ceebbd
SHA1 33b7ae00c218a250c30588fa134dc9946665147b
SHA512 1276bff843177a0d4c6b6edbe4bcba26b88164853fd7a518d6adc114e1f87d01ce3efe3cb8f3e8a83355b3789b7f4da53231a0e994e0314b8e38fcee20e674e1
SSDEEP 24576:g94/Rty7JgYr+JA7Ick1PmkRYPjQxVL5I+vjgR5ONbwe+AqDAKcNJHn36kWQ:gK/RtB0vk0d4I+vkzw+LAPJHnV
TLSH
T159750953ED21891CD018227194EB273AFD24C6FBD06F53AA9684FD3ABD73642978874C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\x64\7za
Size 1.4MB
SHA256 afc9448bd0cc2eeda131cce313ef4994f9656417e0a15c8465fcda9ca859b280
MD5 6a2e4039a2f56265369f22ecb1a19fd5
SHA1 b0ea59484a4827d7d9a0a27a5270310ef07e61a8
SHA512 796188635271cbd7dbd6a7f37cb4d4d5b394c8a302dc62008c40b4be507382925eeb8a550ca11e81c791d5dbda238f95dedecbdd0daddf84907c4fa3a9b1ca59
SSDEEP 24576:Z3qW/EbABBtyz89OfxvH7WlwAMEd2rZXTN9H8lBFwEP:Z3zEbO3a7ucjN9HUwE
TLSH
T146657C43F9B6547DCE9AC775821E9232F678F44906309F37B284EB302A52E60DF69B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build.sh

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\x64\build.sh
Size 266B
SHA256 0ec26a7d575cc22ef6dd2fc6f35e9240593190faf20b7f76b3f4bbd2b7eab5fb
MD5 08025b57ddf3df9bc3e2844d86e4135f
SHA1 becacdd4705fd90eb2a8f45775572ffa08629082
SHA512 914d2da94700e3c91974da71b16366dfc8972ad59ed64719c4eb7805a89ee3ed1b12712a292c9c73164cdb9f9df6f6cfa847eb123387ed499205d9157cdbe65f
TLSH
T1C6D02B11CC21C02159845E1B23B34714D16954F5C6E07BF998D1C87CD08A241CC3A9CF
MD5 SHA1 SHA512 TLSH

Submit Download

do-build.sh

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\linux\x64\do-build.sh
Size 646B
SHA256 4304f90e9b9266cccf357b212c6a8ea3b0816b68c39a4d4691d638c9e2f07286
MD5 2f48a9c98543108edadedcbf4d45b4ae
SHA1 a7b0bafdfb070e0cc6fdfa2977648b8d07593f5e
SHA512 cd17c759b1e7800260eb70befd37c273c78b34c44280290d60d406efe0a174cb34a727bc2cf42e8fb80bb65924ac405175bff69f34c115527ebc573a6a430b42
TLSH
T1D8F02380C864B031D5C8CE0373B69B28BC2658858FE8F95CDDA90CB8C104952B71ABCE
MD5 SHA1 SHA512 TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\mac\arm64\7za
Size 965KB
SHA256 6f4dd78a82cf574f49118d99be620fd3edcfa9e48971d8523816b7ed20419c47
MD5 d8257aa0b1eb873e9ee8f89e97ed9b26
SHA1 0b3be717f56ad4ab2c1745da8be7a7833b47d3f6
SHA512 b850de0e1e85dae63ea4b857129ec1eb0bcb7eae3c2100a9fa600d2d5f4d9bc8daa0d07e148a2a57079e5496a68013c03725ac8dd3a39311e51660f27d29d1de
SSDEEP 12288:tfzSbxCCUWOQfK4okeJSdieTD76s88y2fFvNZSxrvOWwy5BpAGcKB:FSMCUWOQNYJde32ZkfFvN0x7ycAGcKB
TLSH
T1B5253901F91C6C22F2C6B1BE9E850FA5352BB57041B0C2DA7877525CEC96AE1983D7B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\mac\x64\7za
Size 2.8MB
SHA256 434075f6ff5ea9250571033ca06b95d464efcad87a528dd0b224816c86b1a444
MD5 335361d7f6faf13cadbf116bfdb97226
SHA1 d6cba0f2e221d1061261767ec38ddd7c550015a3
SHA512 5fa86f6ec50e0f2fa87ec7cfa0e98cf2bfe158035e5af024e017cce4ddb33aea631008e43328e6049e0f95e8c63dac8b1e03d3c949b34ad2a3e94ab979cad0e0
SSDEEP 49152:VxV0AtX4EEf/Gf80I+qnyVUdbU1t4t1zCtmf3ybzh2uI1I+wwBV2Lg800h/E2zz8:Vf54EEf/Th0VEHf3yb5U0h/ELGCTZ5
TLSH
T1D0D59E17A6B0A568E082C07427CF97729670B9B62A29324F37C4E6293F7ACD1F715353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\package.json
Size 244B
SHA256 0259d425453d43f69bdf1abf18b24a11f99b2cb1a7e1450c63595cfbd6e33129
MD5 e4702657daf538acdd8f733c8f40b7c6
SHA1 e9d46bbd00f934aa64bf0e4af431728cbbc2822f
SHA512 9eaefe404f93c681461ed8642d7880af86754401ba336d6301abd771a52b3b9c0841a89bb67359fb86fdf4d7718fe5e1c52a24799db5e6f012c02f7fd6415f8a
TLSH
T1F0D05E20C5180D3301D8D6981C56434617210C074D90BD0C37EB435C0BAD2FF05FA23E
MD5 SHA1 SHA512 TLSH

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\win\ia32\7za.exe
Size 722KB
SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
MD5 43141e85e7c36e31b52b22ab94d5e574
SHA1 cfd7079a9b268d84b856dc668edbb9ab9ef35312
SHA512 9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc
SSDEEP 12288:AwAxBpwU5gU+2/9dB5XlH1YAEa5OLW0TjLWG3rn0Yf5ogmn9X9Rf6TIALr22DIVM:AhY2gUfVH5XlVYzagW4/3rn0Y5zmzRfq
TLSH
T177F48D227BF6C0B7C64211318A1C6BF690F6F3190B3059C367908F6D6B399D5D63AE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-min\node_modules\7zip-bin\win\x64\7za.exe
Size 1.1MB
SHA256 8117e40ee7f824f63373a4f5625bb62749f69159d0c449b3ce2f35aad3b83549
MD5 e86eff95691b1c0e7e4f3e9cb1ae2e49
SHA1 d0acbf9ae29ec74acc67b53b2063bbc9739bc9e8
SHA512 1c26201f214fc068d2d7f7c812be022dbc102077ef34bc1f231ac118aa04b94139cc2005628491747888faf95863241b3847524db097f4822b75f646f4345ff6
SSDEEP 24576:IyotkuwTgCfs7Ck+PCZbS1IJdJ0FAH48fw2:ITtkVxkdyCZbS1oCFo/fw
TLSH
T128351A66F6748375D073C0B9C6D2AB9AEE713085073086CB5285D7693F17BE68A3A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\snapshot_blob.bin
Size 270KB
SHA256 b6bea91727efb8c88e7c059856553d3a47abd883e60dd60efc01b04dc6eec621
MD5 d20922aefcad14dc658a3c6fd5ff6529
SHA1 75ce20814bdbe71cfa6fab03556c1711e78ca706
SHA512 dbd63a9f01feb3c389c11b55d720b5d689558626041fb1dd27ded2be602e5e2a8d210f785fde025d7b9959f81de3df7fef06981269b58be564df05aec190dd1c
SSDEEP 3072:FPXttcgbBDoChde06wbRMYKHUeynXtxZ4fQe1:tXPh9oCWCNMXo6
TLSH
T12B445493B180DF27D12536B4B8CFA58A6126712A7F86420B3779B3BD3F712722F05166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\7z-out\v8_context_snapshot.bin
Size 627KB
SHA256 2db4a98abe705ef9bc18e69d17f91bc3f4c0f5703f9f57b41acb877100718918
MD5 1e4da0bc6404552f9a80ccde89fdef2b
SHA1 838481b9e4f1d694c948c0082e9697a5ed443ee2
SHA512 054917652829af01977e278cd0201c715b3a1280d7e43035507e4fa61c1c00c4cd7ed521c762aebd2ea2388d33c3d4d4b16cee5072d41e960021b6f38745a417
SSDEEP 6144:LlAKlrnVVc/eK7cPg9oCWCNM+MFjfjfGJCWXecRvUsoA4EytPcAzCYY:LZ0t7cP+Yz7Vcrz
TLSH
T176D48FA3B345CF67C1642DB0BACAD656B5B43449BF4A062B7368A3BE37396311F14072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyA417.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\hydrasteamtools\Network\Network Persistent State
Size 1KB
SHA256 c9173d4aa426c2a71df622628459438988b4842845745ee177f044838431e66a
MD5 a5437d0710feb329d49381c5f7ebe87e
SHA1 efc76f5744b07b26ce716674dbcf3781a0f30f5c
SHA512 1067e27e8ff480db132b0817e2c36659202691aba031212548da36bd37b2be952b910b92e5308ecf239c85d115b7e71e38209b2046fddc6b019d92e6618d0711
TLSH
T1782197D6C3D84AAD8A1256F11F257E23C5AE096C52283D0688C8EF8E53E18769A0004E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b0934.TMP

Path C:\Users\Admin\AppData\Roaming\hydrasteamtools\Network\Network Persistent State~RFe5b0934.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\hydrasteamtools\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

memory/2928-289-0x00007FFD9E940000-0x00007FFD9E941000-memory.dmp

Download

memory/2928-288-0x00007FFD9E750000-0x00007FFD9E751000-memory.dmp

Download

memory/5464-316-0x000001296AEB0000-0x000001296AECE000-memory.dmp

Download

memory/5464-317-0x000001296AED0000-0x000001296AF82000-memory.dmp

Download

memory/5464-318-0x000001296AEA0000-0x000001296AEAA000-memory.dmp

Download

memory/5464-320-0x000001296B110000-0x000001296B134000-memory.dmp

Download

memory/5464-319-0x000001296B110000-0x000001296B13A000-memory.dmp

Download

memory/5464-313-0x000001296ABE0000-0x000001296AC02000-memory.dmp

Download