3fd394043eb38f56ba7d2ca56a74fe18ad0cb72aec4d0de684b05be85d4ae49a

Analysis

user interaction
yes
max time kernel
25s
max time network
22s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mvz993x5-2e6f33dc1b5d.exe
Size 74.1MB
Sample261102-p336dswv2k
SHA256 3fd394043eb38f56ba7d2ca56a74fe18ad0cb72aec4d0de684b05be85d4ae49a
MD5 60cf99319712127b4eb9b30584a7e234
SHA1 d4d1e4929f3326f3fc728cfe71335563cb40c905
SHA512 7bf1f2516935c3d70688003b1114f68461f0cd04b58b8134fc4d433c7f643b2dcc00997163e5f4547a3b16856ada0558a5f1884c7fc0be54c0c27a5833d6f883
SSDEEP 1572864:PSsaAvcRGC0wnpBeHMHK3N+rtGhnn7/cSqqRWrhsjqU5W07:PS7AvcR7B/HK3Art+7cLWZGW7
TLSH
T12D083324C824E2A7E697CDBF47FA16330C6DD4612AB3E81E061CF36A158D5CC4625F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4164	test.exe
5412	test.exe
616	test.exe

Loads dropped DLL 11 IoCs

pid	Process
3552	mvz993x5-2e6f33dc1b5d.exe
3552	mvz993x5-2e6f33dc1b5d.exe
3552	mvz993x5-2e6f33dc1b5d.exe
4164	test.exe
616	test.exe
5412	test.exe
5412	test.exe
5412	test.exe
5412	test.exe
5412	test.exe
5412	test.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	test.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	test.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	test.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	test.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mvz993x5-2e6f33dc1b5d.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3552	mvz993x5-2e6f33dc1b5d.exe
Token: SeShutdownPrivilege	4164	test.exe
Token: SeCreatePagefilePrivilege	4164	test.exe
Token: SeShutdownPrivilege	4164	test.exe
Token: SeCreatePagefilePrivilege	4164	test.exe
Token: SeShutdownPrivilege	4164	test.exe
Token: SeCreatePagefilePrivilege	4164	test.exe
Token: SeShutdownPrivilege	4164	test.exe
Token: SeCreatePagefilePrivilege	4164	test.exe
Token: SeShutdownPrivilege	4164	test.exe
Token: SeCreatePagefilePrivilege	4164	test.exe
Token: SeShutdownPrivilege	4164	test.exe
Token: SeCreatePagefilePrivilege	4164	test.exe
Token: SeShutdownPrivilege	4164	test.exe
Token: SeCreatePagefilePrivilege	4164	test.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 4164	3552	mvz993x5-2e6f33dc1b5d.exe	90
PID 4164 wrote to memory of 5412	4164	test.exe	91
PID 4164 wrote to memory of 5412	4164	test.exe	91
PID 4164 wrote to memory of 616	4164	test.exe	92

C:\Users\Admin\AppData\Local\Temp\mvz993x5-2e6f33dc1b5d.exe
"C:\Users\Admin\AppData\Local\Temp\mvz993x5-2e6f33dc1b5d.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Users\Admin\AppData\Local\Temp\3LYGiNzGpW6Z0ycXhXlVovR3yDM\test.exe
  C:\Users\Admin\AppData\Local\Temp\3LYGiNzGpW6Z0ycXhXlVovR3yDM\test.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Users\Admin\AppData\Local\Temp\3LYGiNzGpW6Z0ycXhXlVovR3yDM\test.exe
    "C:\Users\Admin\AppData\Local\Temp\3LYGiNzGpW6Z0ycXhXlVovR3yDM\test.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\test" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1840,i,14910924450591059652,15203517124617849149,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5412
- - C:\Users\Admin\AppData\Local\Temp\3LYGiNzGpW6Z0ycXhXlVovR3yDM\test.exe
    "C:\Users\Admin\AppData\Local\Temp\3LYGiNzGpW6Z0ycXhXlVovR3yDM\test.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\test" --field-trial-handle=2104,i,14910924450591059652,15203517124617849149,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\chrome_100_percent.pak
Size 148KB
SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
MD5 83ec43f2af9fc52025f3f807b185d424
SHA1 ea432f7571d89dd43a76d260cb5853cada253aa0
SHA512 6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86
SSDEEP 3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
TLSH
T179E3E1D3B3F4ED3DCB9716B7A2260072ECB3466D0692124B168AD4752A66B8CCCC47D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\chrome_200_percent.pak
Size 223KB
SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
MD5 dc48a33bd20bfc7cacfc925a84b015b6
SHA1 8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c
SHA512 1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a
SSDEEP 6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
TLSH
T11E24F1C7B3F8DD3DD9630AB3522A01F1EDB2113905B6560F57CB9C347999AC988C9283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\ffmpeg.dll
Size 2.8MB
SHA256 4a3ce3e8a30d1bfea36446f884e51bb2eb65b9e559dc016300e0e18c0f823e5f
MD5 e4d06c9d97d4eb125c0d8e0bf6cc5bdc
SHA1 436c699c627e23092105ac0b41994e0c6ef42d2d
SHA512 71c670b14b3e0fa3d442fbdc711aa564df9beca5f4d7963b04ecdafe49ff31ef5e5a34b8c52f90d02c72c7bd171755cc22f545f8f40315abc8230fc5f84690ce
SSDEEP 49152:6FUWNgdIjHFoDr2XlKVDdusGH6qfLgvsI74i3OQ+Jpp:6F2IDq3CYVDdufU4i6pp
TLSH
T1D9D5AE03F6D950DDD029C075979F9223F671344A8F1266EF26E05A202E67FD86E3E329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\libEGL.dll
Size 481KB
SHA256 3839ad80072ba6fd0516fa5b947ab794eda5fc679ece5492b25f888e3006327e
MD5 6ea73dcb05168e3abf168a2eab9cc441
SHA1 48497760ba5c65b57be5ad111b90b3d8b6f0f5bd
SHA512 0fc8b64ec0e3a8f4a8612daea2f7a09b087b7e6949f7d8a44a0bb3764a1007196ecd09f9fd8520f40339f140b733867de4ea09e361ab64eb2e810f8cc13dcdde
SSDEEP 6144:C3f2CrNZCHZWHCxmx0vfbjj306LhQQ3WU3y0iSj/8lPg:ovQ0CxmqvfbjLTQRU3y0iSAlo
TLSH
T10DA49E15B3E444B9E06AD174CA534642DB76B4920F69FBDF03A492392F37BE85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\libGLESv2.dll
Size 8.0MB
SHA256 d5142ccdb81a06fd43e1f789c5a2f636973e019d1e9fdab7b7bf738145333554
MD5 92128651eba3bcf49bb3b1e4c31b296b
SHA1 77b769fa5c83e5b895408f00be9ffb41bdbc88c9
SHA512 b25ddd64a3b13689915cb23145fd55576e5102abbc81918c5000d01807cf0ee9c5ed79a15d990e7dd5e1a0d859ec87ee8b82207fef98f7b8028d846d2f16905a
SSDEEP 98304:09aDUngXCAFxUrAYF8V3tcUl1XMX43vleA:0CO5k33X4svl
TLSH
T18B867C03F69580D9D00DE2B9975B9627FA3078840728B6CF269417192F7BFE0AB7E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\locales\en-US.pak
Size 478KB
SHA256 75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82
MD5 a99b6152bdeac44148f94394c4149622
SHA1 df7371533e92aa24f48469116d9a8ac73249315e
SHA512 3160b58d10ca147594ff4aca004007d4e6823421be349cfad945c681e220eec7266d88434a4d31c719a346650ac0ed31f1f13fca3e824d81bb65ebb4d21cc2c1
SSDEEP 6144:1kdXRDCEmszpReMP9e0QcD2faYjNCu454ZxDng/t/XFLwB:1sUEmGeM1QcDq+5UxOLwB
TLSH
T175A43C1FF7441229069352627F09A5A2FF36D06CA39112563CBD812C33B7B6AC3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\locales\pt-BR.pak
Size 567KB
SHA256 1c0d67a4259df36655aa97761e71e02bb0407e7bb1fe1319394e0916c7d76f7f
MD5 a25a1fe3b44192d6ccf354fa2c152e6f
SHA1 d0757f15c07f25cc8cca123d7d9c8aab3cdfc9fa
SHA512 beaa71be07a2ea7b01440703dd46a26bec6c7922af2f9bbd528bfc60bb1c290a34c512459eb8a10f0668399f72bea233e6bf93feb55561fe279d8a699bcc4f1d
SSDEEP 6144:m2anjN9EXm1fwXNBXBLVfm9ydz5GHyXuH0msRoM/I2:UnjNVwV5RXIsR1/N
TLSH
T1CCC42B2A6DC9136605225350B74EEB43E5881745FE0ACA87DCFF4F06A3DDE40DA33AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources.pak
Size 5.5MB
SHA256 a1e5297e2bee9a26960025049c0570340b230e6e1bdbbb55d6fabd11cfffe89e
MD5 9a641272dc25d0908bb79aae27ab2c51
SHA1 8ba37601520be18691a47c6ab496e4f6db32c6da
SHA512 3e636c8d985f24684dd1124ed58d2ab8b6ef396e0cecdb9da04d220a027105bf71511da82b8cc54bfbca2901e23887a740fe00828a2a647fc090b68a925d2874
SSDEEP 98304:pZryi6+pkrht455GGPeenn0dJGO4EpxIvMi8rwrGU3nAabpdkmYAzFKwR4:DmilpkrP455GGHnbEXU8kr1Xddf1FvG
TLSH
T127463395B364CD27E86C0B7E41E442324378D12627533A1B319CF16C6EBC29E5BA297E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_binder.exe

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\_binder.exe
Size 13.1MB
SHA256 c7564fb0c4ac7c5782e4ea4a0c1c7f4a03a6349e3fb5fe32dca1987040af0698
MD5 b049a2b1c63a50c9cae307330fa79971
SHA1 c543e39468725d59260cf5da1919973fb1123078
SHA512 91e27d431abf932ccb84088db103f94455f9a12c982af756e3d0566014a651400254be7b735271dc07165dd72d825142e2713ffeaccc3664c0f44734fbacbb6e
SSDEEP 196608:nJSHcoodtuGjpYrUr9klJVdGF5D0GW44c8Coln2aVexQ7oE:E+uGjp7r9kgIo4HCgReWoE
TLSH
T122D6F1A1A79C4F5EE06BB038C197520793F5BC092732CF8B96C04D675D1F6A0F69A24E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\app.asar
Size 11.6MB
SHA256 61024fdebd40b9b1d88a6f08443f97c306f045b6c1878b87a29b0c4f6daae2f1
MD5 0e6560117e37d4ae82e38def0739d4ae
SHA1 61460c17ed6c52db631df3345f443ffcd73e2ed8
SHA512 45ea69ea4e14ef94df39636c5924e7c3d1794e7a5a1b54cafbad6d4db24e11238b8ff9b4d76f6e4d527eeabeb1b0f0d7577dac69d7ae207d4ac25a029d9d1a38
SSDEEP 49152:Vh0TwALjZHaZrQwuqZ2PRr9ZKq7o3MtFUnB6TrovR+wNIIQaF9D3Z86P6kp0dv1V:QwAfUSV
TLSH
T167C6F8446AE2F013028F6277BF4B959AE235D823544CE856B44CBA9C6F9C01ED2F6FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\LICENSE
Size 1KB
SHA256 455dda47a3fc2f58ab06d8e526f490ec43d0fc23a5ea80dd0942644397316d9b
MD5 7bd114b023fa6209fb7b02150a202ccc
SHA1 4451515f9d7b16ce8983abb4e85609fe4162c4d4
SHA512 87ee4dc1da13937055eade250f1f8a357f549c709b9659258c137009060080aca5cfd979890a7b2d662083f4c646cce9af6e20774b58541af9e712fb5f4f1c60
TLSH
T15F11861F72950363189257615569ECC5F12BB14A7FAB1A84346DF209132605CC5FFC64
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\dist\index.js
Size 412B
SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
MD5 0b33e83d33b01a51625a0fdcbef42ce3
SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
TLSH
T1BFE02B177EF5E8EAC64082CA4736D4531EE98CBB3600781AE2CA8AF25315984E490D24
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\package.json
Size 934B
SHA256 59f4704391d2247b2a8d029d7338566d47d2ff0cd7477c49343efe93475f7a12
MD5 83a6b767cd4ade2116654eb0a90fec3c
SHA1 07a0f29ddb1c8a48947ee05bb4d6ec3d2abe1df9
SHA512 404ed15686b7d611ba8aeac12e706af75a876502c51e40e48a598d05a9ac89f88902b2830a5c679f9bb7931f5c33bb10da3a32753fdb8c71a9d7b4346a1be8d0
TLSH
T134112336C928C9630BC819D5EC391252A6224C1B8D58FE0D37D2836C8B1D1BF32BD66C
MD5 SHA1 SHA512 TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node
Size 137KB
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
TLSH
T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\index.js
Size 420B
SHA256 125c1a517628169f4e66e0e237d201be226afb5c704a684aee5155de69281685
MD5 394a6022c9e7aa401b3c992c4b92ea94
SHA1 cae58c8959c078b24484148a0d09da816d350699
SHA512 cbd75168e3054a8412eec7fc1415ad1906d8a3228a16a486674909bec0f3a8b177f02e4c9c3419598e13fb0676d87132e82ee1182549c69c6bcf59fb59aaf0ce
TLSH
T1F4E0E5C546FAB59273CA72D3F1868903A6E2C060040A872A4244E3CC76119A091B3DA9
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\darwin\index.js
Size 5KB
SHA256 f84c2f6429051e0cf0d5d20aaedaddf1b92807fed19509740d9857a90ae49de9
MD5 be6b78c29a2dea28f09518a9735cbcfc
SHA1 8663483ee07f4b018588104715309cada602a9c8
SHA512 da105344d0afc548f7655a2107b35d6e305efcc5d71a93862c342c071571afbb7f651ecc08a7a950708fe3c1599c691bc31642d0fe826c774cf69b9350a5943a
SSDEEP 96:5+QUeOlMpnYW+6o9wGXxtwWMK6kZWiLMSnNjee+e9mO8q70VwJmyV5q+uMxKvWE:wQtdpL+9wWx2WKSxNjeb9O/70VwJmyVc
TLSH
T1B1C1208962F16B304787FAA5188F870BF6368403295A9F0C7D8C53A41F47A70D7D2EE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\linux\index.js
Size 5KB
SHA256 0897caf86db7f8abb83328b891bd3160efd1f5318955aaf7142a338d92f1e9e4
MD5 a97974d462ffdd6f356d1c6b9219a094
SHA1 49b8e2896ef69a5e09c1ad278a75f61a8464daba
SHA512 d0797f37378bc01bbf613285ff2fe03496af0bd435672830dbedc5230493d45385577a1a4a58c91fb0a155b4ea532f6f5c346577588c1b798dc7b90459d9c761
SSDEEP 96:9CLjAz83t+bInwLdA+0y32wLdA+e9wLdA+AuHk2D1L0qn+6m3QB/CP9l9ODIW:9CLjA7sedATyGedAhedA3090L6m3Hl9c
TLSH
T105B1E18B13952E90537EA8C3392B640EE23F755350876C97F88CD6D85F87A44D6C7AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utils.js

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\utils.js
Size 1KB
SHA256 857cf82f33d021558aae989ae47fdaef22ceede17ec7492c92fc8052253f3c75
MD5 46f2f241643026741f8e08ded147aac9
SHA1 44f7890b08ff2c596a381863a1b097ba4ce9b0d2
SHA512 b04ea14aebf6f3c6335aa38734c23e62640fda6da9180a98290eb495e422e32c4a882f074667a4cab46873685216b76fd30c7122f150cc23aa228ccc58985573
TLSH
T1BE11088B74E9B53C874BFE62D01F890FF3139913501C6E18B89EE6502F4BAB47741A99
MD5 SHA1 SHA512 TLSH

Submit Download

app.manifest

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\app.manifest
Size 350B
SHA256 8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83
MD5 8951565428aa6644f1505edb592ab38f
SHA1 9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2
SHA512 7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5
TLSH
T150E08680A46590EDB395A0615566F280A99947FF04DD41B8B05C8C6E7F15DCAC3431F3
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\index.js
Size 3KB
SHA256 77a3965315946a325ddcf0709d927ba72aa47f889976cbccf567c76cc545159f
MD5 d226502c9bf2ae0a7f029bd7930be88e
SHA1 6be773fb30c7693b338f7c911b253e4f430c2f9b
SHA512 93f3d885dad1540b1f721894209cb7f164f0f6f92857d713438e0ce685fc5ee1fc94eb27296462cdeede49b30af8bf089a1fc2a34f8577479645d556aaac2f8e
TLSH
T1A06155AA6AB266204313F5CB191F431A603784033655BA94BC8CD4C5AFA76B4C3B3EDC
MD5 SHA1 SHA512 TLSH

Submit Download

screenCapture_1.3.2.bat

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat
Size 13KB
SHA256 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
MD5 da0f40d84d72ae3e9324ad9a040a2e58
SHA1 4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA512 30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP 384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx
TLSH
T1A95263095E1341B5183330266FCB839AFA2B417375AAED40395C8375DF26A1BC675BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\package.json
Size 696B
SHA256 4d662cf72e93a7863e28db10de4ef1b91a1841b916f3c5646f37c2b9be58b07b
MD5 0c7467f9fdd2e73251dae25ae535de7b
SHA1 927ff7f6057746c06227d448cc334db6434abf0d
SHA512 9d71dbc18d421d10788b5238be9e335a075af66b4ee15409453a8b1a8a94766cfff4567d577390fca6f8787d6a8e8961a338587cc907ab176474e9557093a4ab
TLSH
T19B01D8B6892454B31AD929EDECA95402F3624C07C598AC0937CF012CCB5D66B05BC12C
MD5 SHA1 SHA512 TLSH

Submit Download

test.js

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\test.js
Size 1KB
SHA256 b168cd32cb9fc6d1b4a61536b26e86536a876f23ca803b3eb0fb7f6b0eb5c059
MD5 17081f555ff4c8283f16a317c860b7b1
SHA1 6af3bd46505e6b6b28edee93069aad8d849571d9
SHA512 48caa7971c267820c7d4a2aaafa5c2819b2667e5d1a86fae0a259307e453087031018a199d3420f17ca8f743e829628c995e8bf6da637954725bdf94cbc48317
TLSH
T1ED416BE64BE247B08753B595EC2B9316B236880611A83F56F8CC5971170FB38DBE2858
MD5 SHA1 SHA512 TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\snapshot_blob.bin
Size 309KB
SHA256 31b6067f7e43c00946343d88f5f9167151543292211874f1edf8ba9b6b19d9eb
MD5 bdf2e2cab5037adc41774fa1caba8ea1
SHA1 b1669825b4ec8661d2f65eaf70eb2abef1ff0e10
SHA512 5138e55645dda2918ef73638547fd8851b7bd3211c5fd5ac4f8331c5cf48425af58d4fb8aee223b12606865b37ade17bf8252d2dc079f3a5c432af5ab913d8fc
SSDEEP 3072:M+JfFRciefJNlUMX2kIE1aOaVsS/3hYeFWYSITdJgClE+ceNTbM:MefPciePmMXh1aOCsy3hpFRlzVw
TLSH
T17764FB44B660CB16D75526B48CE8DB993A78F2CD6F06AA0F318D43FD3976B340A053AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\v8_context_snapshot.bin
Size 671KB
SHA256 96539ed02416163441b9847175f2ec1f5708e321e1fad25b03ff7b47b7aa991e
MD5 04d61b8d7f3e6a3a81df5bdf418904f1
SHA1 353ec04045f72d7712e013bc0e1e782e24275015
SHA512 608021d64470fdc4cfd20e55b92dbf2e901b1d239395ca7754df1260cb7884f45f175951a81ed5cfc6165c1cd91997725a2ca060b7cf701102bad33c1cf34054
SSDEEP 6144:iPYRCOn2E6keR1PciePmMXh1aOCsy3hbHRlEDMrVkSiF01gwoHZHCvqmO9iXz8pk:iPY5nnbe3WZBr/iXo73nVE+2l
TLSH
T1C4E493A5B311DB02C7C95DB89DE5CB563E79F08AAF0BA51B314803FE6036B750A0536E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 22b81a04d2d7ff13c86317148080a7feb1d967ebdf10ba8d2446dad6db849913
MD5 251f0372d263f52c9593fb39d4ef621d
SHA1 e01a91d211e442dc9cc43e74a8bae9708a82a971
SHA512 c32afda44ee135a1be318e07dd965deeb440c9c56515d61343b11cef09254508ee8d67c3fe0d08201eece9575671ac0fd69ab1d280de94f2ee949e6bbb62ed34
SSDEEP 49152:KaNFNu2naDoYXAqk7ZSrblOR5HAlUDv/FelNotSOnaHJcF5C7d6mrI0VI2fa2E+8:p62naMskwtEMaQPJnyVh
TLSH
T145463803F2858099F05DE579875BA623F632B8811B72B6DF52A01F192E77FE06B39701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\7z-out\vulkan-1.dll
Size 874KB
SHA256 08e6cc4aa3e1154b1b236a0ad0837b35ad07daea2febc4e567e59c02b27d8646
MD5 4ecf3e42731c897fa4f0f74468c1874a
SHA1 4fb19be1e78b4f8206befd8ee05160a08436e392
SHA512 42d65eedc61236bfd7738ac57dd9489903f22dc7121cf74c03dfd4055155db783b4b69ee300da68a4c96e222a8793c753630c8144d7c6586207808c91d0fad86
SSDEEP 24576:f4cMT4Bv88wonwyHp9zDp6Z5WjDYsHy6g3P0zAk7TKC:f4bo3/nwyPzDp6Z5WjDYsHy6g3P0zAkP
TLSH
T1CA157C23E6648669E4768034C9D24A03C9F274921725B9CF02A84718BF6FFF47B7DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb458C.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads