Overview

overview

8

Static

static

3

YukiTechre...64.exe

windows10-2004-x64

8

YukiTechre...64.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 15:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    YukiTechret-win-x64.exe
  • Size 75.4MB
  • Sample260924-srbtjsga45
  • SHA256 71949ae4bc3830ffd37f3dd0ca5543d6527214ed383ff4bd658bf3c68498d89b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

    Using powershell.exe command.

    execution
  • Creates a file in the Startup directory 1 TTPs 7 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 8 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\YukiTechret-win-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\YukiTechret-win-x64.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3260
    • C:\Users\Admin\AppData\Local\Temp\3IjUSri5aJK1NJQ98Bg7ksvYSXm\Yuki Techret.exe
      "C:\Users\Admin\AppData\Local\Temp\3IjUSri5aJK1NJQ98Bg7ksvYSXm\Yuki Techret.exe"
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5472
      • C:\Users\Admin\AppData\Local\Temp\3IjUSri5aJK1NJQ98Bg7ksvYSXm\Yuki Techret.exe
        "C:\Users\Admin\AppData\Local\Temp\3IjUSri5aJK1NJQ98Bg7ksvYSXm\Yuki Techret.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\YukiTechretPC" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1708,i,409120888985182704,3066746146781500098,262144 --disable-features=AutofillServerCommunication,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1676
      • C:\Windows\system32\net.exe
        net session
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          4⤵
            PID:4076
        • C:\Users\Admin\AppData\Local\Temp\3IjUSri5aJK1NJQ98Bg7ksvYSXm\Yuki Techret.exe
          "C:\Users\Admin\AppData\Local\Temp\3IjUSri5aJK1NJQ98Bg7ksvYSXm\Yuki Techret.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\YukiTechretPC" --field-trial-handle=1924,i,409120888985182704,3066746146781500098,262144 --disable-features=AutofillServerCommunication,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:11
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3296
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $exe = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe' $workDir = 'C:\Users\Admin\AppData\Local\YukiTechret' $user = $env:USERNAME $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 5 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew -Hidden $principal = New-ScheduledTaskPrincipal -UserId $user -RunLevel Highest -LogonType Interactive $bgAction = New-ScheduledTaskAction -Execute $exe -Argument '--hidden' -WorkingDirectory $workDir $bgTrigger = New-ScheduledTaskTrigger -AtLogOn -User $user try { $bgTrigger.Delay = 'PT20S' } catch {} Register-ScheduledTask -TaskName 'YukiTechretSubject' -Action $bgAction -Trigger $bgTrigger -Principal $principal -Settings $settings -Force | Out-Null $openAction = New-ScheduledTaskAction -Execute $exe -WorkingDirectory $workDir $openTrigger = New-ScheduledTaskTrigger -AtLogOn -User $user Register-ScheduledTask -TaskName 'YukiTechretOpen' -Action $openAction -Trigger $openTrigger -Principal $principal -Settings $settings -Force | Out-Null 'ok' "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3380
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $exe = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe' $workDir = 'C:\Users\Admin\AppData\Local\YukiTechret' $user = $env:USERNAME $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 5 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew -Hidden $principal = New-ScheduledTaskPrincipal -UserId $user -RunLevel Highest -LogonType Interactive $bgAction = New-ScheduledTaskAction -Execute $exe -Argument '--hidden' -WorkingDirectory $workDir $bgTrigger = New-ScheduledTaskTrigger -AtLogOn -User $user try { $bgTrigger.Delay = 'PT20S' } catch {} Register-ScheduledTask -TaskName 'YukiTechretSubject' -Action $bgAction -Trigger $bgTrigger -Principal $principal -Settings $settings -Force | Out-Null $openAction = New-ScheduledTaskAction -Execute $exe -WorkingDirectory $workDir $openTrigger = New-ScheduledTaskTrigger -AtLogOn -User $user Register-ScheduledTask -TaskName 'YukiTechretOpen' -Action $openAction -Trigger $openTrigger -Principal $principal -Settings $settings -Force | Out-Null 'ok' "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4844
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $exe = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe' $workDir = 'C:\Users\Admin\AppData\Local\YukiTechret' $user = $env:USERNAME $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 5 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew -Hidden $principal = New-ScheduledTaskPrincipal -UserId $user -RunLevel Highest -LogonType Interactive $bgAction = New-ScheduledTaskAction -Execute $exe -Argument '--hidden' -WorkingDirectory $workDir $bgTrigger = New-ScheduledTaskTrigger -AtLogOn -User $user try { $bgTrigger.Delay = 'PT20S' } catch {} Register-ScheduledTask -TaskName 'YukiTechretSubject' -Action $bgAction -Trigger $bgTrigger -Principal $principal -Settings $settings -Force | Out-Null $openAction = New-ScheduledTaskAction -Execute $exe -WorkingDirectory $workDir $openTrigger = New-ScheduledTaskTrigger -AtLogOn -User $user Register-ScheduledTask -TaskName 'YukiTechretOpen' -Action $openAction -Trigger $openTrigger -Principal $principal -Settings $settings -Force | Out-Null 'ok' "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2512
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $task = 'YukiTechretSubject' $exe = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe' $workDir = 'C:\Users\Admin\AppData\Local\YukiTechret' $user = $env:USERNAME $argList = @('--hidden') $action = if ($argList.Count -gt 0) { New-ScheduledTaskAction -Execute $exe -Argument ($argList -join ' ') -WorkingDirectory $workDir } else { New-ScheduledTaskAction -Execute $exe -WorkingDirectory $workDir } $trigger = New-ScheduledTaskTrigger -AtLogOn -User $user try { $trigger.Delay = 'PT20S' } catch {} $principal = New-ScheduledTaskPrincipal -UserId $user -RunLevel Highest -LogonType Interactive $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 5 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew -Hidden Register-ScheduledTask -TaskName $task -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null 'ok' "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:244
        • C:\Users\Admin\AppData\Local\Temp\3IjUSri5aJK1NJQ98Bg7ksvYSXm\Yuki Techret.exe
          "C:\Users\Admin\AppData\Local\Temp\3IjUSri5aJK1NJQ98Bg7ksvYSXm\Yuki Techret.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\YukiTechretPC" --app-user-model-id=com.spoilyuki.yukitechret.pc --app-path="C:\Users\Admin\AppData\Local\Temp\3IjUSri5aJK1NJQ98Bg7ksvYSXm\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features --disable-blink-features=Auxclick --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3084,i,409120888985182704,3066746146781500098,262144 --disable-features=AutofillServerCommunication,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4460
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $exe = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe' $workDir = 'C:\Users\Admin\AppData\Local\YukiTechret' $user = $env:USERNAME $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 5 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew -Hidden $principal = New-ScheduledTaskPrincipal -UserId $user -RunLevel Highest -LogonType Interactive $bgAction = New-ScheduledTaskAction -Execute $exe -Argument '--hidden' -WorkingDirectory $workDir $bgTrigger = New-ScheduledTaskTrigger -AtLogOn -User $user try { $bgTrigger.Delay = 'PT20S' } catch {} Register-ScheduledTask -TaskName 'YukiTechretSubject' -Action $bgAction -Trigger $bgTrigger -Principal $principal -Settings $settings -Force | Out-Null $openAction = New-ScheduledTaskAction -Execute $exe -WorkingDirectory $workDir $openTrigger = New-ScheduledTaskTrigger -AtLogOn -User $user Register-ScheduledTask -TaskName 'YukiTechretOpen' -Action $openAction -Trigger $openTrigger -Principal $principal -Settings $settings -Force | Out-Null 'ok' "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2788
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $exe = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe' $workDir = 'C:\Users\Admin\AppData\Local\YukiTechret' $user = $env:USERNAME $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 5 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew -Hidden $principal = New-ScheduledTaskPrincipal -UserId $user -RunLevel Highest -LogonType Interactive $bgAction = New-ScheduledTaskAction -Execute $exe -Argument '--hidden' -WorkingDirectory $workDir $bgTrigger = New-ScheduledTaskTrigger -AtLogOn -User $user try { $bgTrigger.Delay = 'PT20S' } catch {} Register-ScheduledTask -TaskName 'YukiTechretSubject' -Action $bgAction -Trigger $bgTrigger -Principal $principal -Settings $settings -Force | Out-Null $openAction = New-ScheduledTaskAction -Execute $exe -WorkingDirectory $workDir $openTrigger = New-ScheduledTaskTrigger -AtLogOn -User $user Register-ScheduledTask -TaskName 'YukiTechretOpen' -Action $openAction -Trigger $openTrigger -Principal $principal -Settings $settings -Force | Out-Null 'ok' "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2688
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $task = 'YukiTechretSubject' $exe = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe' $workDir = 'C:\Users\Admin\AppData\Local\YukiTechret' $user = $env:USERNAME $argList = @('--hidden') $action = if ($argList.Count -gt 0) { New-ScheduledTaskAction -Execute $exe -Argument ($argList -join ' ') -WorkingDirectory $workDir } else { New-ScheduledTaskAction -Execute $exe -WorkingDirectory $workDir } $trigger = New-ScheduledTaskTrigger -AtLogOn -User $user try { $trigger.Delay = 'PT20S' } catch {} $principal = New-ScheduledTaskPrincipal -UserId $user -RunLevel Highest -LogonType Interactive $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 5 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew -Hidden Register-ScheduledTask -TaskName $task -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null 'ok' "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4664
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $exe = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe' $workDir = 'C:\Users\Admin\AppData\Local\YukiTechret' $user = $env:USERNAME $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 5 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew -Hidden $principal = New-ScheduledTaskPrincipal -UserId $user -RunLevel Highest -LogonType Interactive $bgAction = New-ScheduledTaskAction -Execute $exe -Argument '--hidden' -WorkingDirectory $workDir $bgTrigger = New-ScheduledTaskTrigger -AtLogOn -User $user try { $bgTrigger.Delay = 'PT20S' } catch {} Register-ScheduledTask -TaskName 'YukiTechretSubject' -Action $bgAction -Trigger $bgTrigger -Principal $principal -Settings $settings -Force | Out-Null $openAction = New-ScheduledTaskAction -Execute $exe -WorkingDirectory $workDir $openTrigger = New-ScheduledTaskTrigger -AtLogOn -User $user Register-ScheduledTask -TaskName 'YukiTechretOpen' -Action $openAction -Trigger $openTrigger -Principal $principal -Settings $settings -Force | Out-Null 'ok' "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2124
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ws = New-Object -ComObject WScript.Shell $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yuki Techret.lnk') $s.TargetPath = 'C:\Users\Admin\AppData\Local\YukiTechret\Autostart.cmd' $s.WorkingDirectory = 'C:\Users\Admin\AppData\Local\YukiTechret' $s.IconLocation = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe,0' $s.WindowStyle = 7 $s.Description = 'Yuki Techret autostart' $s.Save() 'ok' "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Creates a file in the Startup directory
          • Suspicious behavior: EnumeratesProcesses
          PID:3944
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ws = New-Object -ComObject WScript.Shell $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yuki Techret.lnk') $s.TargetPath = 'C:\Users\Admin\AppData\Local\YukiTechret\Autostart.cmd' $s.WorkingDirectory = 'C:\Users\Admin\AppData\Local\YukiTechret' $s.IconLocation = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe,0' $s.WindowStyle = 7 $s.Description = 'Yuki Techret autostart' $s.Save() 'ok' "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Creates a file in the Startup directory
          • Suspicious behavior: EnumeratesProcesses
          PID:2832
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ws = New-Object -ComObject WScript.Shell $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yuki Techret.lnk') $s.TargetPath = 'C:\Users\Admin\AppData\Local\YukiTechret\Autostart.cmd' $s.WorkingDirectory = 'C:\Users\Admin\AppData\Local\YukiTechret' $s.IconLocation = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe,0' $s.WindowStyle = 7 $s.Description = 'Yuki Techret autostart' $s.Save() 'ok' "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Creates a file in the Startup directory
          • Suspicious behavior: EnumeratesProcesses
          PID:5168
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ws = New-Object -ComObject WScript.Shell $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yuki Techret.lnk') $s.TargetPath = 'C:\Users\Admin\AppData\Local\YukiTechret\Autostart.cmd' $s.WorkingDirectory = 'C:\Users\Admin\AppData\Local\YukiTechret' $s.IconLocation = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe,0' $s.WindowStyle = 7 $s.Description = 'Yuki Techret autostart' $s.Save() 'ok' "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Creates a file in the Startup directory
          • Suspicious behavior: EnumeratesProcesses
          PID:2352
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ws = New-Object -ComObject WScript.Shell $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yuki Techret.lnk') $s.TargetPath = 'C:\Users\Admin\AppData\Local\YukiTechret\Autostart.cmd' $s.WorkingDirectory = 'C:\Users\Admin\AppData\Local\YukiTechret' $s.IconLocation = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe,0' $s.WindowStyle = 7 $s.Description = 'Yuki Techret autostart' $s.Save() 'ok' "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Creates a file in the Startup directory
          • Suspicious behavior: EnumeratesProcesses
          PID:1688
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ws = New-Object -ComObject WScript.Shell $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yuki Techret.lnk') $s.TargetPath = 'C:\Users\Admin\AppData\Local\YukiTechret\Autostart.cmd' $s.WorkingDirectory = 'C:\Users\Admin\AppData\Local\YukiTechret' $s.IconLocation = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe,0' $s.WindowStyle = 7 $s.Description = 'Yuki Techret autostart' $s.Save() 'ok' "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Creates a file in the Startup directory
          • Suspicious behavior: EnumeratesProcesses
          PID:5924
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $target = 'C:\Users\Admin\AppData\Local\YukiTechret\Start Yuki Techret.cmd' $workDir = 'C:\Users\Admin\AppData\Local\YukiTechret' $icon = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe,0' $paths = @('C:\Users\Admin\Desktop\Yuki Techret.lnk','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yuki Techret.lnk') $stale = 'C:\Users\Admin\Desktop\Yuki Techret.cmd' $ws = New-Object -ComObject WScript.Shell foreach ($lnk in $paths) { $dir = Split-Path $lnk -Parent if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null } $s = $ws.CreateShortcut($lnk) $s.TargetPath = $target $s.WorkingDirectory = $workDir $s.IconLocation = $icon $s.Description = 'Yuki Techret' $s.WindowStyle = 7 $s.Save() } if (Test-Path -LiteralPath $stale) { Remove-Item -LiteralPath $stale -Force -ErrorAction SilentlyContinue } 'ok' "
          3⤵
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious behavior: EnumeratesProcesses
          PID:4972
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $target = 'C:\Users\Admin\AppData\Local\YukiTechret\Start Yuki Techret.cmd' $workDir = 'C:\Users\Admin\AppData\Local\YukiTechret' $icon = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe,0' $paths = @('C:\Users\Admin\Desktop\Yuki Techret.lnk','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yuki Techret.lnk') $stale = 'C:\Users\Admin\Desktop\Yuki Techret.cmd' $ws = New-Object -ComObject WScript.Shell foreach ($lnk in $paths) { $dir = Split-Path $lnk -Parent if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null } $s = $ws.CreateShortcut($lnk) $s.TargetPath = $target $s.WorkingDirectory = $workDir $s.IconLocation = $icon $s.Description = 'Yuki Techret' $s.WindowStyle = 7 $s.Save() } if (Test-Path -LiteralPath $stale) { Remove-Item -LiteralPath $stale -Force -ErrorAction SilentlyContinue } 'ok' "
          3⤵
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious behavior: EnumeratesProcesses
          PID:1956
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $target = 'C:\Users\Admin\AppData\Local\YukiTechret\Start Yuki Techret.cmd' $workDir = 'C:\Users\Admin\AppData\Local\YukiTechret' $icon = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe,0' $paths = @('C:\Users\Admin\Desktop\Yuki Techret.lnk','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yuki Techret.lnk') $stale = 'C:\Users\Admin\Desktop\Yuki Techret.cmd' $ws = New-Object -ComObject WScript.Shell foreach ($lnk in $paths) { $dir = Split-Path $lnk -Parent if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null } $s = $ws.CreateShortcut($lnk) $s.TargetPath = $target $s.WorkingDirectory = $workDir $s.IconLocation = $icon $s.Description = 'Yuki Techret' $s.WindowStyle = 7 $s.Save() } if (Test-Path -LiteralPath $stale) { Remove-Item -LiteralPath $stale -Force -ErrorAction SilentlyContinue } 'ok' "
          3⤵
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious behavior: EnumeratesProcesses
          PID:2704
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $target = 'C:\Users\Admin\AppData\Local\YukiTechret\Start Yuki Techret.cmd' $workDir = 'C:\Users\Admin\AppData\Local\YukiTechret' $icon = 'C:\Users\Admin\AppData\Local\YukiTechret\Yuki Techret.exe,0' $paths = @('C:\Users\Admin\Desktop\Yuki Techret.lnk','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yuki Techret.lnk') $stale = 'C:\Users\Admin\Desktop\Yuki Techret.cmd' $ws = New-Object -ComObject WScript.Shell foreach ($lnk in $paths) { $dir = Split-Path $lnk -Parent if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null } $s = $ws.CreateShortcut($lnk) $s.TargetPath = $target $s.WorkingDirectory = $workDir $s.IconLocation = $icon $s.Description = 'Yuki Techret' $s.WindowStyle = 7 $s.Save() } if (Test-Path -LiteralPath $stale) { Remove-Item -LiteralPath $stale -Force -ErrorAction SilentlyContinue } 'ok' "
          3⤵
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious behavior: EnumeratesProcesses
          PID:2756
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'SilentlyContinue' $appId = 'com.spoilyuki.yukitechret.pc' $paths = @('C:\Users\Admin\Desktop\Yuki Techret.lnk','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yuki Techret.lnk') Add-Type -TypeDefinition @\" using System; using System.Runtime.InteropServices; using System.Runtime.InteropServices.ComTypes; [ComImport, Guid(\"0000010b-0000-0000-C000-000000000046\"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] interface IPersistFile { void GetClassID(out Guid pClassID); [PreserveSig] int IsDirty(); void Load([MarshalAs(UnmanagedType.LPWStr)] string pszFileName, uint dwMode); void Save([MarshalAs(UnmanagedType.LPWStr)] string pszFileName, bool fRemember); void SaveCompleted([MarshalAs(UnmanagedType.LPWStr)] string pszFileName); void GetCurFile([MarshalAs(UnmanagedType.LPWStr)] out string ppszFileName); } [ComImport, Guid(\"886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99\"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] interface IPropertyStore { void GetCount(out uint cProps); void GetAt(uint iProp, out PROPERTYKEY pkey); void GetValue(ref PROPERTYKEY key, out PROPVARIANT pv); void SetValue(ref PROPERTYKEY key, ref PROPVARIANT pv); void Commit(); } [StructLayout(LayoutKind.Sequential, Pack = 4)] struct PROPERTYKEY { public Guid fmtid; public uint pid; } [StructLayout(LayoutKind.Sequential)] struct PROPVARIANT { public ushort vt; public ushort wReserved1; public ushort wReserved2; public ushort wReserved3; public IntPtr p; public int p2; } public static class Aumid { public static void Set(string lnkPath, string id) { var shell = new ShellLink(); var pf = (IPersistFile)shell; pf.Load(lnkPath, 0); var store = (IPropertyStore)shell; var pv = new PROPVARIANT(); pv.vt = 31; pv.p = Marshal.StringToCoTaskMemUni(id); var key = new PROPERTYKEY { fmtid = new Guid(\"9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3\"), pid = 5 }; store.SetValue(ref key, ref pv); store.Commit(); Marshal.FreeCoTaskMem(pv.p); pf.Save(lnkPath, true); } [ComImport, Guid(\"00021401-0000-0000-C000-000000000046\")] class ShellLink {} } \"@ foreach ($p in $paths) { try { [Aumid]::Set($p, $appId) } catch {} } "
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5144
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lzkgt1ps\lzkgt1ps.cmdline"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4412
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD112.tmp" "c:\Users\Admin\AppData\Local\Temp\lzkgt1ps\CSC243E0A9841574BDF9CC3998CDB35916.TMP"
              5⤵
                PID:5344
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'SilentlyContinue' $appId = 'com.spoilyuki.yukitechret.pc' $paths = @('C:\Users\Admin\Desktop\Yuki Techret.lnk','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yuki Techret.lnk') Add-Type -TypeDefinition @\" using System; using System.Runtime.InteropServices; using System.Runtime.InteropServices.ComTypes; [ComImport, Guid(\"0000010b-0000-0000-C000-000000000046\"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] interface IPersistFile { void GetClassID(out Guid pClassID); [PreserveSig] int IsDirty(); void Load([MarshalAs(UnmanagedType.LPWStr)] string pszFileName, uint dwMode); void Save([MarshalAs(UnmanagedType.LPWStr)] string pszFileName, bool fRemember); void SaveCompleted([MarshalAs(UnmanagedType.LPWStr)] string pszFileName); void GetCurFile([MarshalAs(UnmanagedType.LPWStr)] out string ppszFileName); } [ComImport, Guid(\"886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99\"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] interface IPropertyStore { void GetCount(out uint cProps); void GetAt(uint iProp, out PROPERTYKEY pkey); void GetValue(ref PROPERTYKEY key, out PROPVARIANT pv); void SetValue(ref PROPERTYKEY key, ref PROPVARIANT pv); void Commit(); } [StructLayout(LayoutKind.Sequential, Pack = 4)] struct PROPERTYKEY { public Guid fmtid; public uint pid; } [StructLayout(LayoutKind.Sequential)] struct PROPVARIANT { public ushort vt; public ushort wReserved1; public ushort wReserved2; public ushort wReserved3; public IntPtr p; public int p2; } public static class Aumid { public static void Set(string lnkPath, string id) { var shell = new ShellLink(); var pf = (IPersistFile)shell; pf.Load(lnkPath, 0); var store = (IPropertyStore)shell; var pv = new PROPVARIANT(); pv.vt = 31; pv.p = Marshal.StringToCoTaskMemUni(id); var key = new PROPERTYKEY { fmtid = new Guid(\"9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3\"), pid = 5 }; store.SetValue(ref key, ref pv); store.Commit(); Marshal.FreeCoTaskMem(pv.p); pf.Save(lnkPath, true); } [ComImport, Guid(\"00021401-0000-0000-C000-000000000046\")] class ShellLink {} } \"@ foreach ($p in $paths) { try { [Aumid]::Set($p, $appId) } catch {} } "
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5960
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lozseo2i\lozseo2i.cmdline"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1484
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD325.tmp" "c:\Users\Admin\AppData\Local\Temp\lozseo2i\CSC3268579022F845189472204031B18299.TMP"
                5⤵
                  PID:3132
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'SilentlyContinue' $appId = 'com.spoilyuki.yukitechret.pc' $paths = @('C:\Users\Admin\Desktop\Yuki Techret.lnk','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yuki Techret.lnk') Add-Type -TypeDefinition @\" using System; using System.Runtime.InteropServices; using System.Runtime.InteropServices.ComTypes; [ComImport, Guid(\"0000010b-0000-0000-C000-000000000046\"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] interface IPersistFile { void GetClassID(out Guid pClassID); [PreserveSig] int IsDirty(); void Load([MarshalAs(UnmanagedType.LPWStr)] string pszFileName, uint dwMode); void Save([MarshalAs(UnmanagedType.LPWStr)] string pszFileName, bool fRemember); void SaveCompleted([MarshalAs(UnmanagedType.LPWStr)] string pszFileName); void GetCurFile([MarshalAs(UnmanagedType.LPWStr)] out string ppszFileName); } [ComImport, Guid(\"886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99\"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] interface IPropertyStore { void GetCount(out uint cProps); void GetAt(uint iProp, out PROPERTYKEY pkey); void GetValue(ref PROPERTYKEY key, out PROPVARIANT pv); void SetValue(ref PROPERTYKEY key, ref PROPVARIANT pv); void Commit(); } [StructLayout(LayoutKind.Sequential, Pack = 4)] struct PROPERTYKEY { public Guid fmtid; public uint pid; } [StructLayout(LayoutKind.Sequential)] struct PROPVARIANT { public ushort vt; public ushort wReserved1; public ushort wReserved2; public ushort wReserved3; public IntPtr p; public int p2; } public static class Aumid { public static void Set(string lnkPath, string id) { var shell = new ShellLink(); var pf = (IPersistFile)shell; pf.Load(lnkPath, 0); var store = (IPropertyStore)shell; var pv = new PROPVARIANT(); pv.vt = 31; pv.p = Marshal.StringToCoTaskMemUni(id); var key = new PROPERTYKEY { fmtid = new Guid(\"9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3\"), pid = 5 }; store.SetValue(ref key, ref pv); store.Commit(); Marshal.FreeCoTaskMem(pv.p); pf.Save(lnkPath, true); } [ComImport, Guid(\"00021401-0000-0000-C000-000000000046\")] class ShellLink {} } \"@ foreach ($p in $paths) { try { [Aumid]::Set($p, $appId) } catch {} } "
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Hide Artifacts: Ignore Process Interrupts
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5804
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ldipzgtz\ldipzgtz.cmdline"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:5992
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD315.tmp" "c:\Users\Admin\AppData\Local\Temp\ldipzgtz\CSCF33B1A9F8534D8A94CC496473379348.TMP"
                  5⤵
                    PID:6072
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'SilentlyContinue' $appId = 'com.spoilyuki.yukitechret.pc' $paths = @('C:\Users\Admin\Desktop\Yuki Techret.lnk','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yuki Techret.lnk') Add-Type -TypeDefinition @\" using System; using System.Runtime.InteropServices; using System.Runtime.InteropServices.ComTypes; [ComImport, Guid(\"0000010b-0000-0000-C000-000000000046\"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] interface IPersistFile { void GetClassID(out Guid pClassID); [PreserveSig] int IsDirty(); void Load([MarshalAs(UnmanagedType.LPWStr)] string pszFileName, uint dwMode); void Save([MarshalAs(UnmanagedType.LPWStr)] string pszFileName, bool fRemember); void SaveCompleted([MarshalAs(UnmanagedType.LPWStr)] string pszFileName); void GetCurFile([MarshalAs(UnmanagedType.LPWStr)] out string ppszFileName); } [ComImport, Guid(\"886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99\"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] interface IPropertyStore { void GetCount(out uint cProps); void GetAt(uint iProp, out PROPERTYKEY pkey); void GetValue(ref PROPERTYKEY key, out PROPVARIANT pv); void SetValue(ref PROPERTYKEY key, ref PROPVARIANT pv); void Commit(); } [StructLayout(LayoutKind.Sequential, Pack = 4)] struct PROPERTYKEY { public Guid fmtid; public uint pid; } [StructLayout(LayoutKind.Sequential)] struct PROPVARIANT { public ushort vt; public ushort wReserved1; public ushort wReserved2; public ushort wReserved3; public IntPtr p; public int p2; } public static class Aumid { public static void Set(string lnkPath, string id) { var shell = new ShellLink(); var pf = (IPersistFile)shell; pf.Load(lnkPath, 0); var store = (IPropertyStore)shell; var pv = new PROPVARIANT(); pv.vt = 31; pv.p = Marshal.StringToCoTaskMemUni(id); var key = new PROPERTYKEY { fmtid = new Guid(\"9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3\"), pid = 5 }; store.SetValue(ref key, ref pv); store.Commit(); Marshal.FreeCoTaskMem(pv.p); pf.Save(lnkPath, true); } [ComImport, Guid(\"00021401-0000-0000-C000-000000000046\")] class ShellLink {} } \"@ foreach ($p in $paths) { try { [Aumid]::Set($p, $appId) } catch {} } "
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Hide Artifacts: Ignore Process Interrupts
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5952
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mynbtbim\mynbtbim.cmdline"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4276
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD45D.tmp" "c:\Users\Admin\AppData\Local\Temp\mynbtbim\CSCDE41AE0943274464B38EDCB96161EF46.TMP"
                    5⤵
                      PID:1736
                • C:\Users\Admin\AppData\Local\Temp\3IjUSri5aJK1NJQ98Bg7ksvYSXm\Yuki Techret.exe
                  "C:\Users\Admin\AppData\Local\Temp\3IjUSri5aJK1NJQ98Bg7ksvYSXm\Yuki Techret.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\YukiTechretPC" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1264,i,409120888985182704,3066746146781500098,262144 --disable-features=AutofillServerCommunication,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:10
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:5628

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 5a84db062bc4afc3432fc28c3160a7fee2cb05ea7e139a81b9de9e8553df6a62
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 749aaba736648e246b89ae3a6987b644bd1a90bcc2e9f73bfbf9eb03a77c32e9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 c0221f3f11e95e959f2125f66967d0167b2ae29952717d3d44b067c7f3cbab5d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 5dcd91ad3f93816d83f446e3c97670ecfbeed3eacea297b4ce7fa9eb72aa4820
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 2ec52d16afc863f5cecd4fffa85c436b22ecaf89c8cd223bac928fe243d2a270
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 3609deed43955c5f1c8b97fba68e8fcb555f7afd48a02576cc1bf25461f4947d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 fa3b5247d38b18ba682f4f8f4cee76b5e58e7fbf20306684032889bd05eda9f1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 645517f919ae26ee38d03142e08d276d3d67a90e0101fd7a586c252bfe9dbb4a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 b27052db5ca4073265ef65f0ba20eb59972d4dfe3798bad344b34985ca05ddee
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  RESD112.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\RESD112.tmp
                  • Size 1KB
                  • SHA256 f56f88406089728cb96eedddb650b9adcdeea96b1d4ef9cbbf92e05fb3ede50c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  RESD315.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\RESD315.tmp
                  • Size 1KB
                  • SHA256 482439442c6da34badbe67e031e345088bb285e7f34a29527c1ad7b2382ffbae
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  RESD325.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\RESD325.tmp
                  • Size 1KB
                  • SHA256 2ed1b96f74c8c36ee22afbeddb6f6b775ba92f47228bcc032d5c5b8c23d51d75
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  __PSScriptPolicyTest_xc4drn0k.tca.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xc4drn0k.tca.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  lzkgt1ps.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\lzkgt1ps\lzkgt1ps.dll
                  • Size 4KB
                  • SHA256 c45ff37c37cbb83888822903fb8b46888e9f7b36b8d0290ffa9b7bd72ca0eec6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  LICENSE.electron.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\LICENSE.electron.txt
                  • Size 1KB
                  • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  LICENSES.chromium.html
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\LICENSES.chromium.html
                  • Size 8.7MB
                  • SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_100_percent.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\chrome_100_percent.pak
                  • Size 148KB
                  • SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_200_percent.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\chrome_200_percent.pak
                  • Size 223KB
                  • SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  d3dcompiler_47.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\d3dcompiler_47.dll
                  • Size 4.7MB
                  • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ffmpeg.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\ffmpeg.dll
                  • Size 2.8MB
                  • SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icudtl.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\icudtl.dat
                  • Size 10.0MB
                  • SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libEGL.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\libEGL.dll
                  • Size 481KB
                  • SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libGLESv2.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\libGLESv2.dll
                  • Size 8.0MB
                  • SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  af.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\af.pak
                  • Size 520KB
                  • SHA256 c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  am.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\am.pak
                  • Size 840KB
                  • SHA256 49a2095ad9ffac0b7ffaadba64d2c2b51a05e0695e21d1c428735485757bd11c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ar.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\ar.pak
                  • Size 921KB
                  • SHA256 817829ad75dbc7d59b5042d7f056fa2485f82d1ae2af50ed83fd89f86f3d58fc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bg.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\bg.pak
                  • Size 959KB
                  • SHA256 f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bn.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\bn.pak
                  • Size 1.2MB
                  • SHA256 5a57265ebac6df683f0279684909755ad71ea70fea71c6ecc1810eac61d1cb3d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ca.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\ca.pak
                  • Size 584KB
                  • SHA256 bc2b7d6a769c69b27a81cc09a1babd4ccaf003fae32f8294a38e498f2c529c89
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cs.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\cs.pak
                  • Size 602KB
                  • SHA256 db040e9f17d2792801c07a7bb3ac96c21d8189c98e9ab34210c5888b2ee53aa1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  da.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\da.pak
                  • Size 545KB
                  • SHA256 e32681cdd03db28eb360b1b4203c2988190b7b6f77679ca807cd95a1967ded04
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  de.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\de.pak
                  • Size 582KB
                  • SHA256 4f123245b062d71d56819ac1198d13a3d7953decd4491fca0fbd22c5e129c3bd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  el.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\el.pak
                  • Size 1.0MB
                  • SHA256 b8707f2511c4ec5533077009771f3aa92b0fb5b395b13907f5860a9151b2431d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  en-GB.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\en-GB.pak
                  • Size 474KB
                  • SHA256 3bf7e7e02c40dac55ce9bd5b4789eaa99e57271b2d907a5ce2ca90b979a58c39
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  en-US.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\en-US.pak
                  • Size 478KB
                  • SHA256 75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  es-419.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\es-419.pak
                  • Size 575KB
                  • SHA256 4dedec1ac933c73773b1e54caab1c4d606d12f3788cbeef4d6a2a382138cc907
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  es.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\es.pak
                  • Size 575KB
                  • SHA256 a32221be9b65aead3fa779dc54e5ca483a7d73c4815e5c7c3b53711f560bd301
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  et.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\et.pak
                  • Size 523KB
                  • SHA256 a4d1fe9903641540b11e0d00e574a6665a1602ad81f6aae9a083ebd04bc768c7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fa.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\fa.pak
                  • Size 855KB
                  • SHA256 ef9e5b71063c26b1a5d512f5e14c3f7fe5a1925ff25ca799c51f8073c33bb90a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fi.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\fi.pak
                  • Size 534KB
                  • SHA256 93c49ec40accea8e1f4f9b7db68b9b818f8db0b7591cea67ae9bf663c1c57728
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fil.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\fil.pak
                  • Size 604KB
                  • SHA256 9b69d82f50c159d1ec5603ef45dc139143b4f05761f38f263a66fffedd28ff5e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\fr.pak
                  • Size 622KB
                  • SHA256 8bf019aed30d972883d5c29d3f44c8b0d8fc6425ab48ae3354d71e4762a0cf01
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gu.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\gu.pak
                  • Size 1.2MB
                  • SHA256 1adaaacf2f9ab872fb35932fd1ed3b005f370f0ec22b95b42039b4c58660675c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  he.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\he.pak
                  • Size 751KB
                  • SHA256 df1b83384ad42d4ca9f47aebc909baa8a6dde79fa1b0706023a279698e302e89
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  hi.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\hi.pak
                  • Size 1.3MB
                  • SHA256 f73ccac3debba20fb225209805ff2383609853111f931e6b82095c1eb56a6ce4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  hr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\hr.pak
                  • Size 581KB
                  • SHA256 630277358f658c9c39a775dee247f38ac0a0a618a5645260f445ac89d7ac7a46
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  hu.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\hu.pak
                  • Size 625KB
                  • SHA256 ec81ac981af0e962654ad4f65030064a6369dc2316cb1b10bb24b473808ad1e9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  id.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\id.pak
                  • Size 516KB
                  • SHA256 aeb815a3dc6ce3cd1edf2c158a3b16e9c8039af25752367bf13826516a295cb9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  it.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\it.pak
                  • Size 567KB
                  • SHA256 1b16b0af558629dd53e35d1b4bb7b18dc1d8cb5353a4261112d2cd3b0a4c55ea
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ja.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\ja.pak
                  • Size 691KB
                  • SHA256 b2afe7e5f6ebba31248ea00a157c9f5752cd6855194a0d122b3a6c90a1d9be83
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  kn.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\kn.pak
                  • Size 1.4MB
                  • SHA256 4e323def774ac53daf99d2075878456d8885c3380c7895ecf3ab10a2953d532a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ko.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\ko.pak
                  • Size 585KB
                  • SHA256 dc1d4b203674269f00aeb303f74e2948bc74e5956b1770acd2fbb517ad4274a2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  lt.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\lt.pak
                  • Size 629KB
                  • SHA256 9fe73d75dd155d0bda60a638b8f8d48048d17fadfd2d746bac597e5ac3b7f6dd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  lv.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\lv.pak
                  • Size 628KB
                  • SHA256 5c74465b83cef9aae45a6b61499e79b745a91a6038fdd61a3321425056f77b5b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ml.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\ml.pak
                  • Size 1.4MB
                  • SHA256 67d9ae2dbfecdfddc4c23a206828010c6d42b8094477a03ce04b60a8d110eea2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  mr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\mr.pak
                  • Size 1.2MB
                  • SHA256 7181c3bc7a369d2d0b8ae6c1cf8f160603ec56996d20b266833edc3acce4c78e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ms.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\ms.pak
                  • Size 541KB
                  • SHA256 6a3ced7828f0608297da29c99832a389ec9d0d03060ddb20304cd081be494adb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\nb.pak
                  • Size 525KB
                  • SHA256 697882ac2da78894e449cb1f75da43e7115c2481bbd2fee3bdaa425e82fc232c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nl.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\nl.pak
                  • Size 543KB
                  • SHA256 ac22005c476adbb7f3bcf0b17597a7a1595b83c4e6a8760d5553b630f0833305
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pl.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\pl.pak
                  • Size 604KB
                  • SHA256 e8a107b3568a289a6e60118e4b8e2f27338116dafcef078311bc16f0857b1f35
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pt-BR.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\pt-BR.pak
                  • Size 567KB
                  • SHA256 1c0d67a4259df36655aa97761e71e02bb0407e7bb1fe1319394e0916c7d76f7f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pt-PT.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\pt-PT.pak
                  • Size 571KB
                  • SHA256 9ebafb943bf20c66f8d9ca533633fdc63519e8ad38d78a3dd28b4457c38ba79d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ro.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\ro.pak
                  • Size 592KB
                  • SHA256 cf59cd7c26cfe3d87ed2b3a2ef254c3a3667824bbf06cd591bfc9dbf2a83ab91
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ru.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\ru.pak
                  • Size 972KB
                  • SHA256 2d682d4a3ee1157085086c839cf55e500ec1d1674f66be7088eb25768a30c7a1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sk.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\sk.pak
                  • Size 611KB
                  • SHA256 347196c447db2926f9e410905ff47fc0900ca97645e43236ba3b49f0550cfa24
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sl.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\sl.pak
                  • Size 587KB
                  • SHA256 e8b877b4830b3a1163618107342e55756efe494adcdc82d10d963ad900b9f572
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\sr.pak
                  • Size 903KB
                  • SHA256 6f3d0c4ea29880624f07f0f794a6ea1ef735255dc218a241be1557331ebc3c28
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sv.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\sv.pak
                  • Size 528KB
                  • SHA256 d6ad9726da354174df5eb7ea3ceba202df17936c5075a4b8e096de35f1abbe42
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sw.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\sw.pak
                  • Size 557KB
                  • SHA256 434879a83079fba562af9dac928ad2fcc1033e0a6a5a1f4822d36e710decdd2b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ta.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\ta.pak
                  • Size 1.4MB
                  • SHA256 0e1d7c0fa1eab312b42ff5e8978b7146d6cac313603fcaf101bef2eedc70313b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  te.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\te.pak
                  • Size 1.3MB
                  • SHA256 1faa8cb780908552f3ca0d2b0e20eb6aaa902cb5bd759c18ed1238beb0bb34dd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  th.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\th.pak
                  • Size 1.1MB
                  • SHA256 9210c77f0024c705018f5292b3021d3eca58bb290604b116e2d4e355b8ebfc59
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tr.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\tr.pak
                  • Size 567KB
                  • SHA256 25d1667b691b5a950b8b42652f7763338cfd238b22d6bd35a5c38da8cb73a67a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  uk.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\uk.pak
                  • Size 972KB
                  • SHA256 017e34397fd52f4e42bb99ab1d7c4624055312a16d58da03aafffdcae770aecd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ur.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\ur.pak
                  • Size 850KB
                  • SHA256 ace832351fb9392fc308730ff74e5063caefe9903c5a01d9083a3ddf2ba93755
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vi.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\vi.pak
                  • Size 673KB
                  • SHA256 536538d1704c7b23d3b21beddcd4669151de276d259a9ea7192132696e54e146
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  zh-CN.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\zh-CN.pak
                  • Size 484KB
                  • SHA256 6446826e1e9f38f06ab85bf2abe05af88fa7fd5c636c2c74aa2b989c458b879b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  zh-TW.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\locales\zh-TW.pak
                  • Size 479KB
                  • SHA256 514d6a95fc7094ff00cb7700bca2b10191df866c18c551e1d2c07050ddee80bf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\resources.pak
                  • Size 5.5MB
                  • SHA256 ffaeea94c6594d4e66fc523c218c161c58aee1f59b9cb006bbb45d9a49e3a6a1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevate.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\resources\elevate.exe
                  • Size 105KB
                  • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icon.ico
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\resources\icon.ico
                  • Size 106KB
                  • SHA256 89ed8edf9d08d7eb6a1d89a2633b170c71ef99723b8574f7536036ce5241e99f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  snapshot_blob.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\snapshot_blob.bin
                  • Size 309KB
                  • SHA256 397bfb1c55eb98bc8c1e1ba1155e24efc105c155def665c678ac3a135f4bbcc7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  v8_context_snapshot.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\v8_context_snapshot.bin
                  • Size 671KB
                  • SHA256 e8fac5817d9b33ae78b0bd2863750047cbbda211bc28342d0cbea97a07656757
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\vk_swiftshader.dll
                  • Size 5.3MB
                  • SHA256 409a0fa76f055a87ae70434414586d144502beb25fa3004866ee70abd9a8547e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader_icd.json
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\vk_swiftshader_icd.json
                  • Size 106B
                  • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  vulkan-1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\7z-out\vulkan-1.dll
                  • Size 874KB
                  • SHA256 f6c99137c3d6af45bc2262815867d6d37f5dcb0552caffc90cd77fb6561b7491
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  StdUtils.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\StdUtils.dll
                  • Size 100KB
                  • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\System.dll
                  • Size 12KB
                  • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nsis7z.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4F31.tmp\nsis7z.dll
                  • Size 424KB
                  • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Autostart.cmd
                  • Path C:\Users\Admin\AppData\Local\YukiTechret\Autostart.cmd
                  • Size 164B
                  • SHA256 1c0a28317d2c4a67aa41079d06b146c4257d6a77f63930110865955acfbb6a17
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Start Yuki Techret.cmd
                  • Path C:\Users\Admin\AppData\Local\YukiTechret\Start Yuki Techret.cmd
                  • Size 309B
                  • SHA256 a113d0c441e1af09b07cef5a5329e1d82a1f945280f31622e90be05b00502ecb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  device-identity.json
                  • Path C:\Users\Admin\AppData\Local\YukiTechret\device-identity.json
                  • Size 205B
                  • SHA256 eab6215c61328c7b5357e9ae8ad4af52e5c67636555bc7c1dbb52d0474a0e385
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  default.exc
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                  • Size 2B
                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                  • MD5 SHA1 SHA512
                  Submit Download

                  Yuki Techret.lnk
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yuki Techret.lnk
                  • Size 2KB
                  • SHA256 c41c3117901b22fb4501b7d0238d583250396b01e8d47f5274f08cd05077a0f5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Yuki Techret.lnk
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yuki Techret.lnk
                  • Size 2KB
                  • SHA256 c93b13765428938079e518b6cc36aded335df867cb93aef30392c7907eec6a2d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Yuki Techret.lnk
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yuki Techret.lnk
                  • Size 2KB
                  • SHA256 911dd51c6f685fed9c3ac7dd05308e5ef637ca9bf1dda909f3cffe30c6e4bc6c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Roaming\YukiTechretPC\DawnWebGPUCache\data_1
                  • Size 264KB
                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Roaming\YukiTechretPC\GPUCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Roaming\YukiTechretPC\GPUCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Roaming\YukiTechretPC\GPUCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Roaming\YukiTechretPC\Session Storage\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  yuki-vault.bin
                  • Path C:\Users\Admin\AppData\Roaming\YukiTechretPC\yuki-vault.bin
                  • Size 449B
                  • SHA256 1e95cf83804d1868e363f615e646535c08db9a4725d0dd566a0c967d5a2379f0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Yuki Techret.lnk
                  • Path C:\Users\Admin\Desktop\Yuki Techret.lnk
                  • Size 2KB
                  • SHA256 c139b8acd68b71de9d6edeca0826cc44422f6f5826dbe1f28853d54c35fb6be2
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  CSCF33B1A9F8534D8A94CC496473379348.TMP
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\ldipzgtz\CSCF33B1A9F8534D8A94CC496473379348.TMP
                  • Size 652B
                  • SHA256 ed82d8b968c2771d592900f3be92e95bc20a9628a5f563115d28340e086f1854
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ldipzgtz.cmdline
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\ldipzgtz\ldipzgtz.cmdline
                  • Size 369B
                  • SHA256 442ff532e1986096caf40f0dcd6450850b67937618de90cf58cca4f1f989751b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  CSC3268579022F845189472204031B18299.TMP
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\lozseo2i\CSC3268579022F845189472204031B18299.TMP
                  • Size 652B
                  • SHA256 251b2396513107a906db6c857fdc8de433c44359652b1827a9776e0aa65d6968
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  lozseo2i.cmdline
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\lozseo2i\lozseo2i.cmdline
                  • Size 369B
                  • SHA256 749e528c745e16663d5e0a4988c5f7fc28b747a1a50e13db2ad56899f6379ef3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  CSC243E0A9841574BDF9CC3998CDB35916.TMP
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\lzkgt1ps\CSC243E0A9841574BDF9CC3998CDB35916.TMP
                  • Size 652B
                  • SHA256 3e7840c6164718c6fe8970de4e97229bc288d84baf39cb33e8207b4e54084577
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  lzkgt1ps.0.cs
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\lzkgt1ps\lzkgt1ps.0.cs
                  • Size 1KB
                  • SHA256 da081825161c477300093aa769935399ffea6ce7d06177322cecf449932d3ce3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  lzkgt1ps.cmdline
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\lzkgt1ps\lzkgt1ps.cmdline
                  • Size 369B
                  • SHA256 90c16c01599036f3eae6f8ed21e6797d1ab7afd352fcdb6ddfef98f1ac5d0fc8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/3380-496-0x0000017652C90000-0x0000017652D42000-memory.dmp
                  Download

                  memory/3380-495-0x0000017652C70000-0x0000017652C8E000-memory.dmp
                  Download

                  memory/3380-414-0x0000017652BD0000-0x0000017652BF2000-memory.dmp
                  Download

                  memory/3380-497-0x0000017652D50000-0x0000017652D5A000-memory.dmp
                  Download

                  memory/3380-529-0x00000176531E0000-0x00000176531FE000-memory.dmp
                  Download

                  memory/5144-683-0x0000020C8B170000-0x0000020C8B178000-memory.dmp
                  Download

                  memory/5628-728-0x000001C595570000-0x000001C595571000-memory.dmp
                  Download

                  memory/5628-722-0x000001C595570000-0x000001C595571000-memory.dmp
                  Download

                  memory/5628-724-0x000001C595570000-0x000001C595571000-memory.dmp
                  Download

                  memory/5628-729-0x000001C595570000-0x000001C595571000-memory.dmp
                  Download

                  memory/5628-733-0x000001C595570000-0x000001C595571000-memory.dmp
                  Download

                  memory/5628-732-0x000001C595570000-0x000001C595571000-memory.dmp
                  Download

                  memory/5628-731-0x000001C595570000-0x000001C595571000-memory.dmp
                  Download

                  memory/5628-730-0x000001C595570000-0x000001C595571000-memory.dmp
                  Download

                  memory/5804-707-0x000001C17E610000-0x000001C17E618000-memory.dmp
                  Download

                  memory/5952-718-0x000001AFE9870000-0x000001AFE9878000-memory.dmp
                  Download

                  memory/5960-708-0x00000160BCC10000-0x00000160BCC18000-memory.dmp
                  Download