Overview

overview

10

Static

static

1

3DSeriesGG...1).rar

windows10-ltsc_2021-x64

10

3DSeriesGG...1).rar

windows11-21h2-x64

1

3DSeriesGG...1).rar

windows11-ltsc_2024-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    175s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    04/11/2026, 16:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3DSeriesGG116.1.0Setup (1).rar
  • Size 403.7MB
  • Sample261104-vdaqfaea43
  • SHA256 cf1e8c47e318fe077dc1f19a3e72f6bc380dc445574e0868006648acbcddfdce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionneptuneratumbralpersistenceprivilege_escalationransomwarestealertrojanupx

Malware Config

Extracted

Family

  • neptunerat

C2

  • 82.22.62.40:666

Attributes
  • filename

    MasonUSB.exe

  • group

    MasonGroup

  • key

    PZySUSuxlU9MhXcx

  • rat_name

    MasonRAT

Signatures

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat
  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral
  • Detects NeptuneRAT stealer 2 IoCs
  • Detects Umbral payload 2 IoCs
  • Drops file in Drivers directory 3 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 43 IoCs
  • Loads dropped DLL 64 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Discovers running processes 1 TTPs 26 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 64 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates video capture drivers 2 TTPs 1 IoCs

    Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

    discoverydefense_evasion
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

    Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 26 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 27 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\3DSeriesGG116.1.0Setup (1).rar"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Users\Admin\AppData\Local\Temp\7zOC1503FD8\3dSeriesGG1161.0Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC1503FD8\3dSeriesGG1161.0Setup.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Users\Admin\AppData\Local\Temp\3dSeriesGG1161.0Setup.exe
        "C:\Users\Admin\AppData\Local\Temp\3dSeriesGG1161.0Setup.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3956
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /t /im "SteelSeriesGGEZ.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4792
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c tasklist /nh /fi "imagename eq SteelSeriesGGEZ.exe" | find /i "SteelSeriesGGEZ.exe"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4380
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /nh /fi "imagename eq SteelSeriesGGEZ.exe"
            5⤵
            • Discovers running processes
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4796
          • C:\Windows\SysWOW64\find.exe
            find /i "SteelSeriesGGEZ.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4260
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /t /im "SteelSeriesGG.exe"
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1484
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c tasklist /nh /fi "imagename eq SteelSeriesGG.exe" | find /i "SteelSeriesGG.exe"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1736
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /nh /fi "imagename eq SteelSeriesGG.exe"
            5⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:456
          • C:\Windows\SysWOW64\find.exe
            find /i "SteelSeriesGG.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2464
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /t /im "SteelSeriesGGMain.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4944
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c tasklist /nh /fi "imagename eq SteelSeriesGGMain.exe" | find /i "SteelSeriesGGMain.exe"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4312
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /nh /fi "imagename eq SteelSeriesGGMain.exe"
            5⤵
            • Discovers running processes
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:900
          • C:\Windows\SysWOW64\find.exe
            find /i "SteelSeriesGGMain.exe"
            5⤵
              PID:2084
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesGGEZ.exe /T /F
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4044
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesGG.exe /T /F
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3096
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesGGMain.exe /T /F
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2928
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesEngine.exe /T /F
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3612
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesEngine3.exe /T /F
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1952
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesGGClient.exe /T /F
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4992
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesEngine3Client.exe /T /F
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3668
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SSOverlay.exe /T /F
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1620
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesEngine.exe /T /F
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1252
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM gamesense-discord-x64.exe /T /F
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3992
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM AudioSync.exe /T /F
            4⤵
            • Kills process with taskkill
            PID:1312
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM now-playing.exe /T /F
            4⤵
            • Kills process with taskkill
            PID:3648
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesSystemMonitorLauncher.exe /T /F
            4⤵
            • Kills process with taskkill
            PID:184
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM runStatsElevated.exe /T /F
            4⤵
            • Kills process with taskkill
            PID:2028
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesCaptureSvc.exe /T /F
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:632
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesMoments.exe /T /F
            4⤵
            • Kills process with taskkill
            PID:1840
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM moments.exe /T /F
            4⤵
            • Kills process with taskkill
            PID:2896
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesCVGameSense.exe /T /F
            4⤵
            • Kills process with taskkill
            PID:4224
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesSonar.exe /T /F
            4⤵
            • Kills process with taskkill
            PID:816
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesPrism.exe /T /F
            4⤵
            • Kills process with taskkill
            PID:4360
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesPrismSync.exe /T /F
            4⤵
            • Kills process with taskkill
            PID:1520
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeries3DATLauncher.exe /T /F
            4⤵
            • Kills process with taskkill
            PID:1552
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM 3dat.exe /T /F
            4⤵
            • Kills process with taskkill
            PID:1644
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /IM SteelSeriesSensitivityFinder.exe /T /F
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3036
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c tasklist /nh /fi "imagename eq SteelSeriesGGEZ.exe" | find /i "SteelSeriesGGEZ.exe"
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1376
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist /nh /fi "imagename eq SteelSeriesGGEZ.exe"
              5⤵
              • Discovers running processes
              PID:3296
            • C:\Windows\SysWOW64\find.exe
              find /i "SteelSeriesGGEZ.exe"
              5⤵
                PID:4452
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c tasklist /nh /fi "imagename eq SteelSeriesGG.exe" | find /i "SteelSeriesGG.exe"
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3240
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist /nh /fi "imagename eq SteelSeriesGG.exe"
                5⤵
                • Discovers running processes
                • System Location Discovery: System Language Discovery
                PID:2028
              • C:\Windows\SysWOW64\find.exe
                find /i "SteelSeriesGG.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5052
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c tasklist /nh /fi "imagename eq SteelSeriesGGMain.exe" | find /i "SteelSeriesGGMain.exe"
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:400
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist /nh /fi "imagename eq SteelSeriesGGMain.exe"
                5⤵
                • Discovers running processes
                • System Location Discovery: System Language Discovery
                PID:3180
              • C:\Windows\SysWOW64\find.exe
                find /i "SteelSeriesGGMain.exe"
                5⤵
                  PID:3444
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c tasklist /nh /fi "imagename eq SteelSeriesEngine.exe" | find /i "SteelSeriesEngine.exe"
                4⤵
                • Executes a command shell one-liner
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1840
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist /nh /fi "imagename eq SteelSeriesEngine.exe"
                  5⤵
                  • Discovers running processes
                  • System Location Discovery: System Language Discovery
                  PID:4372
                • C:\Windows\SysWOW64\find.exe
                  find /i "SteelSeriesEngine.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2868
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c tasklist /nh /fi "imagename eq SteelSeriesEngine3.exe" | find /i "SteelSeriesEngine3.exe"
                4⤵
                • Executes a command shell one-liner
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4788
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist /nh /fi "imagename eq SteelSeriesEngine3.exe"
                  5⤵
                  • Discovers running processes
                  • System Location Discovery: System Language Discovery
                  PID:2132
                • C:\Windows\SysWOW64\find.exe
                  find /i "SteelSeriesEngine3.exe"
                  5⤵
                    PID:2832
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c tasklist /nh /fi "imagename eq SteelSeriesGGClient.exe" | find /i "SteelSeriesGGClient.exe"
                  4⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4228
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /nh /fi "imagename eq SteelSeriesGGClient.exe"
                    5⤵
                    • Discovers running processes
                    PID:2660
                  • C:\Windows\SysWOW64\find.exe
                    find /i "SteelSeriesGGClient.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:5060
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c tasklist /nh /fi "imagename eq SteelSeriesEngine3Client.exe" | find /i "SteelSeriesEngine3Client.exe"
                  4⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4360
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /nh /fi "imagename eq SteelSeriesEngine3Client.exe"
                    5⤵
                    • Discovers running processes
                    • System Location Discovery: System Language Discovery
                    PID:1252
                  • C:\Windows\SysWOW64\find.exe
                    find /i "SteelSeriesEngine3Client.exe"
                    5⤵
                      PID:3292
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c tasklist /nh /fi "imagename eq SSOverlay.exe" | find /i "SSOverlay.exe"
                    4⤵
                    • Executes a command shell one-liner
                    PID:4740
                    • C:\Windows\SysWOW64\tasklist.exe
                      tasklist /nh /fi "imagename eq SSOverlay.exe"
                      5⤵
                      • Discovers running processes
                      PID:3188
                    • C:\Windows\SysWOW64\find.exe
                      find /i "SSOverlay.exe"
                      5⤵
                        PID:4968
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c tasklist /nh /fi "imagename eq gamesense-discord-x64.exe" | find /i "gamesense-discord-x64.exe"
                      4⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      PID:4804
                      • C:\Windows\SysWOW64\tasklist.exe
                        tasklist /nh /fi "imagename eq gamesense-discord-x64.exe"
                        5⤵
                        • Discovers running processes
                        • System Location Discovery: System Language Discovery
                        PID:2580
                      • C:\Windows\SysWOW64\find.exe
                        find /i "gamesense-discord-x64.exe"
                        5⤵
                          PID:4988
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c tasklist /nh /fi "imagename eq AudioSync.exe" | find /i "AudioSync.exe"
                        4⤵
                        • Executes a command shell one-liner
                        • System Location Discovery: System Language Discovery
                        PID:2376
                        • C:\Windows\SysWOW64\tasklist.exe
                          tasklist /nh /fi "imagename eq AudioSync.exe"
                          5⤵
                          • Discovers running processes
                          • System Location Discovery: System Language Discovery
                          PID:1480
                        • C:\Windows\SysWOW64\find.exe
                          find /i "AudioSync.exe"
                          5⤵
                            PID:2652
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c tasklist /nh /fi "imagename eq now-playing.exe" | find /i "now-playing.exe"
                          4⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          PID:4956
                          • C:\Windows\SysWOW64\tasklist.exe
                            tasklist /nh /fi "imagename eq now-playing.exe"
                            5⤵
                            • Discovers running processes
                            • System Location Discovery: System Language Discovery
                            PID:3732
                          • C:\Windows\SysWOW64\find.exe
                            find /i "now-playing.exe"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:4244
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c tasklist /nh /fi "imagename eq SteelSeriesSystemMonitorLauncher.exe" | find /i "SteelSeriesSystemMonitorLauncher.exe"
                          4⤵
                          • Executes a command shell one-liner
                          PID:2928
                          • C:\Windows\SysWOW64\tasklist.exe
                            tasklist /nh /fi "imagename eq SteelSeriesSystemMonitorLauncher.exe"
                            5⤵
                            • Discovers running processes
                            PID:3260
                          • C:\Windows\SysWOW64\find.exe
                            find /i "SteelSeriesSystemMonitorLauncher.exe"
                            5⤵
                              PID:1828
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c tasklist /nh /fi "imagename eq runStatsElevated.exe" | find /i "runStatsElevated.exe"
                            4⤵
                            • Executes a command shell one-liner
                            • System Location Discovery: System Language Discovery
                            PID:1268
                            • C:\Windows\SysWOW64\tasklist.exe
                              tasklist /nh /fi "imagename eq runStatsElevated.exe"
                              5⤵
                              • Discovers running processes
                              • System Location Discovery: System Language Discovery
                              PID:3364
                            • C:\Windows\SysWOW64\find.exe
                              find /i "runStatsElevated.exe"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:224
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c tasklist /nh /fi "imagename eq SteelSeriesCaptureSvc.exe" | find /i "SteelSeriesCaptureSvc.exe"
                            4⤵
                            • Executes a command shell one-liner
                            PID:3612
                            • C:\Windows\SysWOW64\tasklist.exe
                              tasklist /nh /fi "imagename eq SteelSeriesCaptureSvc.exe"
                              5⤵
                              • Discovers running processes
                              PID:2100
                            • C:\Windows\SysWOW64\find.exe
                              find /i "SteelSeriesCaptureSvc.exe"
                              5⤵
                                PID:2084
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c tasklist /nh /fi "imagename eq SteelSeriesMoments.exe" | find /i "SteelSeriesMoments.exe"
                              4⤵
                              • Executes a command shell one-liner
                              PID:900
                              • C:\Windows\SysWOW64\tasklist.exe
                                tasklist /nh /fi "imagename eq SteelSeriesMoments.exe"
                                5⤵
                                • Discovers running processes
                                • System Location Discovery: System Language Discovery
                                PID:4656
                              • C:\Windows\SysWOW64\find.exe
                                find /i "SteelSeriesMoments.exe"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:3304
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c tasklist /nh /fi "imagename eq moments.exe" | find /i "moments.exe"
                              4⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              PID:2492
                              • C:\Windows\SysWOW64\tasklist.exe
                                tasklist /nh /fi "imagename eq moments.exe"
                                5⤵
                                • Discovers running processes
                                • System Location Discovery: System Language Discovery
                                PID:652
                              • C:\Windows\SysWOW64\find.exe
                                find /i "moments.exe"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:3944
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c tasklist /nh /fi "imagename eq SteelSeriesCVGameSense.exe" | find /i "SteelSeriesCVGameSense.exe"
                              4⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              PID:4156
                              • C:\Windows\SysWOW64\tasklist.exe
                                tasklist /nh /fi "imagename eq SteelSeriesCVGameSense.exe"
                                5⤵
                                • Discovers running processes
                                PID:3992
                              • C:\Windows\SysWOW64\find.exe
                                find /i "SteelSeriesCVGameSense.exe"
                                5⤵
                                  PID:2608
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c tasklist /nh /fi "imagename eq SteelSeriesSonar.exe" | find /i "SteelSeriesSonar.exe"
                                4⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                PID:2096
                                • C:\Windows\SysWOW64\tasklist.exe
                                  tasklist /nh /fi "imagename eq SteelSeriesSonar.exe"
                                  5⤵
                                  • Discovers running processes
                                  • System Location Discovery: System Language Discovery
                                  PID:3564
                                • C:\Windows\SysWOW64\find.exe
                                  find /i "SteelSeriesSonar.exe"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4080
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c tasklist /nh /fi "imagename eq SteelSeriesPrism.exe" | find /i "SteelSeriesPrism.exe"
                                4⤵
                                • Executes a command shell one-liner
                                PID:4792
                                • C:\Windows\SysWOW64\tasklist.exe
                                  tasklist /nh /fi "imagename eq SteelSeriesPrism.exe"
                                  5⤵
                                  • Discovers running processes
                                  • System Location Discovery: System Language Discovery
                                  PID:2244
                                • C:\Windows\SysWOW64\find.exe
                                  find /i "SteelSeriesPrism.exe"
                                  5⤵
                                    PID:1140
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c tasklist /nh /fi "imagename eq SteelSeriesPrismSync.exe" | find /i "SteelSeriesPrismSync.exe"
                                  4⤵
                                  • Executes a command shell one-liner
                                  PID:3388
                                  • C:\Windows\SysWOW64\tasklist.exe
                                    tasklist /nh /fi "imagename eq SteelSeriesPrismSync.exe"
                                    5⤵
                                    • Discovers running processes
                                    • System Location Discovery: System Language Discovery
                                    PID:3148
                                  • C:\Windows\SysWOW64\find.exe
                                    find /i "SteelSeriesPrismSync.exe"
                                    5⤵
                                      PID:3916
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c tasklist /nh /fi "imagename eq SteelSeries3DATLauncher.exe" | find /i "SteelSeries3DATLauncher.exe"
                                    4⤵
                                    • Executes a command shell one-liner
                                    PID:448
                                    • C:\Windows\SysWOW64\tasklist.exe
                                      tasklist /nh /fi "imagename eq SteelSeries3DATLauncher.exe"
                                      5⤵
                                      • Discovers running processes
                                      PID:904
                                    • C:\Windows\SysWOW64\find.exe
                                      find /i "SteelSeries3DATLauncher.exe"
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1152
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c tasklist /nh /fi "imagename eq 3dat.exe" | find /i "3dat.exe"
                                    4⤵
                                    • Executes a command shell one-liner
                                    • System Location Discovery: System Language Discovery
                                    PID:2024
                                    • C:\Windows\SysWOW64\tasklist.exe
                                      tasklist /nh /fi "imagename eq 3dat.exe"
                                      5⤵
                                      • Discovers running processes
                                      PID:2740
                                    • C:\Windows\SysWOW64\find.exe
                                      find /i "3dat.exe"
                                      5⤵
                                        PID:1952
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd /c tasklist /nh /fi "imagename eq SteelSeriesSensitivityFinder.exe" | find /i "SteelSeriesSensitivityFinder.exe"
                                      4⤵
                                      • Executes a command shell one-liner
                                      PID:1168
                                      • C:\Windows\SysWOW64\tasklist.exe
                                        tasklist /nh /fi "imagename eq SteelSeriesSensitivityFinder.exe"
                                        5⤵
                                        • Discovers running processes
                                        PID:5036
                                      • C:\Windows\SysWOW64\find.exe
                                        find /i "SteelSeriesSensitivityFinder.exe"
                                        5⤵
                                          PID:2208
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc stop SteelSeriesUpdateService
                                        4⤵
                                        • Launches sc.exe
                                        PID:4780
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc delete SteelSeriesUpdateService
                                        4⤵
                                        • Launches sc.exe
                                        PID:4856
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc stop SteelSeriesGGUpdateServiceProxy
                                        4⤵
                                        • Launches sc.exe
                                        • System Location Discovery: System Language Discovery
                                        PID:1428
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc delete SteelSeriesGGUpdateServiceProxy
                                        4⤵
                                        • Launches sc.exe
                                        PID:1792
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\GenerateSelfSignedCertificate.ps1" -Thumbprint ""
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1520
                                      • C:\Windows\SysWOW64\robocopy.exe
                                        robocopy /e /copy:DATSO "C:\Program Files\SteelSeries\GG\apps\engine\html" "C:\Program Files\SteelSeries\GG\apps\moments\html"
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3732
                                      • C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\steelseriesengine-dxredist\dxsetup.exe
                                        "C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\steelseriesengine-dxredist\dxsetup.exe" /silent
                                        4⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:5056
                                        • C:\Users\Admin\AppData\Local\Temp\DX7773.tmp\infinst.exe
                                          C:\Users\Admin\AppData\Local\Temp\DX7773.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
                                          5⤵
                                          • Executes dropped EXE
                                          • Drops file in Windows directory
                                          PID:6320
                                        • C:\Users\Admin\AppData\Local\Temp\DX7773.tmp\infinst.exe
                                          C:\Users\Admin\AppData\Local\Temp\DX7773.tmp\infinst.exe d3dx11_43_x64.inf
                                          5⤵
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • Drops file in Windows directory
                                          PID:4112
                                        • C:\Users\Admin\AppData\Local\Temp\DX7773.tmp\infinst.exe
                                          C:\Users\Admin\AppData\Local\Temp\DX7773.tmp\infinst.exe D3DCompiler_43_x64.inf
                                          5⤵
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • Drops file in Windows directory
                                          PID:3296
                                      • C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\steelseriesengine-vcredist-2022\vcredist_x86.exe
                                        "C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\steelseriesengine-vcredist-2022\vcredist_x86.exe" /install /quiet /norestart
                                        4⤵
                                        • Executes dropped EXE
                                        PID:6232
                                        • C:\Windows\Temp\{A99297CA-2131-44CC-9206-587872605989}\.cr\vcredist_x86.exe
                                          "C:\Windows\Temp\{A99297CA-2131-44CC-9206-587872605989}\.cr\vcredist_x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\steelseriesengine-vcredist-2022\vcredist_x86.exe" -burn.filehandle.attached=584 -burn.filehandle.self=720 /install /quiet /norestart
                                          5⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          PID:6196
                                          • C:\Windows\Temp\{336D6466-DEA8-4450-8F89-5EDC683B62F3}\.be\VC_redist.x86.exe
                                            "C:\Windows\Temp\{336D6466-DEA8-4450-8F89-5EDC683B62F3}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{17AB5AE4-CCD7-42BB-A375-4ECBB2800765} {43051709-ABA4-4EDA-98E7-50AEFE3CB115} 6196
                                            6⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            PID:5956
                                            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1092 -burn.embedded BurnPipe.{D1699F28-D741-4B9C-8F90-6622C1C1E3B7} {0C9801B8-9185-47DB-8670-505DA1AF2E86} 5956
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1724
                                              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1092 -burn.embedded BurnPipe.{D1699F28-D741-4B9C-8F90-6622C1C1E3B7} {0C9801B8-9185-47DB-8670-505DA1AF2E86} 5956
                                                8⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:6268
                                                • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                                  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{9745541F-978B-498A-A69A-5E4008E5CD73} {44D90993-2DFE-43FC-9FDA-F1AB45446E18} 6268
                                                  9⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  PID:6668
                                      • C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\steelseriesengine-vcredist-2022\vcredist_x64.exe
                                        "C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\steelseriesengine-vcredist-2022\vcredist_x64.exe" /install /quiet /norestart
                                        4⤵
                                        • Executes dropped EXE
                                        PID:6796
                                        • C:\Windows\Temp\{0F4B7BA1-B069-4A41-8390-FC01FA55E56F}\.cr\vcredist_x64.exe
                                          "C:\Windows\Temp\{0F4B7BA1-B069-4A41-8390-FC01FA55E56F}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\steelseriesengine-vcredist-2022\vcredist_x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=696 /install /quiet /norestart
                                          5⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:6440
                                          • C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.be\VC_redist.x64.exe
                                            "C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{048E5D8D-4C34-40E6-B0FD-5FBEAC1BF3B9} {105CD2D0-DC4B-422C-AE06-3C795CCB0D65} 6440
                                            6⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Modifies registry class
                                            PID:6888
                                            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1188 -burn.embedded BurnPipe.{0D0D19FC-7B79-4D64-AC62-31E906356B6B} {A5B59A2B-D642-4C5C-8409-5CA7BCBDB918} 6888
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:6172
                                              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1188 -burn.embedded BurnPipe.{0D0D19FC-7B79-4D64-AC62-31E906356B6B} {A5B59A2B-D642-4C5C-8409-5CA7BCBDB918} 6888
                                                8⤵
                                                  PID:6152
                                                  • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{601A7C8E-9D6A-400E-932B-273285988732} {C76DAA26-CE6E-494D-B82C-D873AE4C04A0} 6152
                                                    9⤵
                                                    • Modifies registry class
                                                    PID:2288
                                        • C:\Program Files\SteelSeries\GG\shared\InstallUtil.exe
                                          "C:\Program Files\SteelSeries\GG\shared\InstallUtil.exe" "C:\Program Files\SteelSeries\GG\updateService\SteelSeriesGGUpdateServiceProxy.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          PID:5792
                                        • C:\Program Files\SteelSeries\GG\apps\engine\driver\win_driver_installer.exe
                                          "C:\Program Files\SteelSeries\GG\apps\engine\driver\win_driver_installer" -installPath="C:\Program Files\SteelSeries\GG\apps\engine" -u -new -progressStart=45 -progressEnd=55
                                          4⤵
                                          • Executes dropped EXE
                                          • Drops file in Windows directory
                                          PID:5500
                                          • C:\Program Files\SteelSeries\GG\apps\engine\driver\computerhardwareids.exe
                                            "C:\Program Files\SteelSeries\GG\apps\engine\driver\computerhardwareids.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            PID:5436
                                          • C:\Windows\system32\pnputil.exe
                                            pnputil /enum-drivers
                                            5⤵
                                              PID:5292
                                            • C:\Windows\system32\pnputil.exe
                                              pnputil /enum-drivers
                                              5⤵
                                                PID:5260
                                            • C:\Program Files\SteelSeries\GG\apps\engine\driver\win_driver_installer.exe
                                              "C:\Program Files\SteelSeries\GG\apps\engine\driver\win_driver_installer.exe" -installPath="C:\Program Files\SteelSeries\GG\apps\engine" -v -new -progressStart=55 -progressEnd=85
                                              4⤵
                                              • Executes dropped EXE
                                              • Drops file in Windows directory
                                              • Checks SCSI registry key(s)
                                              PID:5224
                                              • C:\Program Files\SteelSeries\GG\apps\engine\driver\computerhardwareids.exe
                                                "C:\Program Files\SteelSeries\GG\apps\engine\driver\computerhardwareids.exe"
                                                5⤵
                                                • Executes dropped EXE
                                                PID:5156
                                            • C:\Program Files\SteelSeries\GG\apps\sonar\driver\apoDriverPackage\Sonar.AgsSetup.exe
                                              "C:\Program Files\SteelSeries\GG\apps\sonar\driver\apoDriverPackage\Sonar.AgsSetup.exe" "Game" "ChatRender" "ChatCapture" "Media" "Aux"
                                              4⤵
                                              • Executes dropped EXE
                                              PID:6472
                                            • C:\Program Files\SteelSeries\GG\shared\Steelseries.AudioDeviceInstaller.exe
                                              "C:\Program Files\SteelSeries\GG\shared\Steelseries.AudioDeviceInstaller.exe" add --device-hwid "ROOT\VEN_SSGG&DEV_0001" --inf "C:\Program Files\SteelSeries\GG\apps\sonar\driver\vad\SteelSeries-Sonar-VAD.inf" --inf "C:\Program Files\SteelSeries\GG\apps\sonar\driver\apoDriverPackage\Sonar.Apo.inf" --inf "C:\Program Files\SteelSeries\GG\apps\sonar\driver\vad\SteelSeries-Sonar-VAD-Extension.inf"
                                              4⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              • Checks SCSI registry key(s)
                                              PID:6536
                                            • C:\Program Files\SteelSeries\GG\shared\Steelseries.AudioDeviceInstaller.exe
                                              "C:\Program Files\SteelSeries\GG\shared\Steelseries.AudioDeviceInstaller.exe" register --cat="sonar.apo.cat" --com="Sonar.APO.dll" --com="Sonar.APOAPI.dll" --inf "C:\Program Files\SteelSeries\GG\apps\sonar\driver\apoDriverPackage\Sonar.Apo.inf"
                                              4⤵
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              PID:5652
                                            • C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe
                                              "C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe" --dbPath="C:\ProgramData\SteelSeries\GG\apps\engine\db\database.db" --dbMigration="C:\Program Files\SteelSeries\GG\apps\engine\db\migrations" --dbDriver="sqlite3" up --outOfOrder
                                              4⤵
                                              • Executes dropped EXE
                                              PID:1820
                                            • C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe
                                              "C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe" --dbPath="C:\ProgramData\SteelSeries\GG\db\database.db" --dbMigration="C:\Program Files\SteelSeries\GG\db\migratedTables\migrations" --dbDriver="sqlite3" up --outOfOrder
                                              4⤵
                                              • Executes dropped EXE
                                              PID:6688
                                            • C:\ProgramData\SteelSeries\GG\GGTableMigrations.exe
                                              "GGTableMigrations.exe" -dbEnv="$DBENV" -ggDbPath="C:\ProgramData\SteelSeries\GG\db" -engineDbPath="C:\ProgramData\SteelSeries\GG\apps\engine\db"
                                              4⤵
                                              • Executes dropped EXE
                                              PID:2072
                                            • C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe
                                              "C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe" --dbPath="C:\ProgramData\SteelSeries\GG\apps\moments\db\database.db" -dbMigration="C:\Program Files\SteelSeries\GG\apps\moments\db\migrations" --dbDriver="sqlite3" up
                                              4⤵
                                              • Executes dropped EXE
                                              PID:6520
                                            • C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe
                                              "C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe" --dbPath="C:\ProgramData\SteelSeries\GG\db\database.db" --dbMigration="C:\Program Files\SteelSeries\GG\db\migrations" --dbDriver="sqlite3" up
                                              4⤵
                                              • Executes dropped EXE
                                              PID:7032
                                            • C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe
                                              "C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe" --dbPath="C:\ProgramData\SteelSeries\GG\db\ggez.db" --dbMigration="C:\Program Files\SteelSeries\GG\db-ggez\migratedTables\migrations" --dbDriver="sqlite3" up --outOfOrder
                                              4⤵
                                              • Executes dropped EXE
                                              PID:4812
                                            • C:\ProgramData\SteelSeries\GG\GGTableMigrations.exe
                                              "GGTableMigrations.exe" -dbEnv="$DBENV" -ggDbPath="C:\ProgramData\SteelSeries\GG\db" -ggezDbPath="C:\ProgramData\SteelSeries\GG\db" -type ggToGGEZ
                                              4⤵
                                              • Executes dropped EXE
                                              PID:3296
                                            • C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe
                                              "C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe" --dbPath="C:\ProgramData\SteelSeries\GG\db\ggez.db" --dbMigration="C:\Program Files\SteelSeries\GG\db-ggez\migrations" --dbDriver="sqlite3" up
                                              4⤵
                                              • Executes dropped EXE
                                              PID:2852
                                            • C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe
                                              "C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe" --dbPath="C:\ProgramData\SteelSeries\GG\apps\sonar\db\database.db" --dbMigration="C:\Program Files\SteelSeries\GG\apps\sonar\db-migrations" --dbDriver="sqlite3" up
                                              4⤵
                                              • Executes dropped EXE
                                              PID:4356
                                            • C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe
                                              "C:\Program Files\SteelSeries\GG\shared\goose-sqlite.exe" --dbPath="C:\ProgramData\SteelSeries\GG\apps\engine\prism\db\database.db" --dbMigration="C:\Program Files\SteelSeries\GG\apps\engine\prism\db\migrations" --dbDriver="sqlite3" up
                                              4⤵
                                              • Executes dropped EXE
                                              PID:2144
                                            • C:\Program Files\SteelSeries\GG\apps\engine\SteelSeriesEngine.exe
                                              "SteelSeriesEngine.exe" -init=true -dataPath="C:\ProgramData\SteelSeries\GG\apps\engine" -installPath="C:\Program Files\SteelSeries\GG\apps\engine" -sharedDataPath="C:\ProgramData\SteelSeries\GG\shared" -dbEnv=production -setlocale="system_default"
                                              4⤵
                                              • Executes dropped EXE
                                              PID:5872
                                          • C:\Users\Admin\AppData\Local\Temp\KS AMK GDAR.exe
                                            "C:\Users\Admin\AppData\Local\Temp\KS AMK GDAR.exe"
                                            3⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Enumerates video capture drivers
                                            • Reads the TCP/IP host and domain name from the registry
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:1696
                                            • C:\Windows\System32\schtasks.exe
                                              "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "KS AMK GDAR" /tr "C:\Users\Admin\AppData\Roaming\KS AMK GDAR.exe"
                                              4⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2896
                                          • C:\Users\Admin\AppData\Local\Temp\Grabber.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Grabber.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Reads the TCP/IP host and domain name from the registry
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:2128
                                            • C:\Windows\System32\Wbem\wmic.exe
                                              "wmic.exe" csproduct get uuid
                                              4⤵
                                              • Queries system WMI classes for hardware identifiers
                                              • Reads the TCP/IP host and domain name from the registry
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5104
                                      • C:\Users\Admin\AppData\Roaming\KS AMK GDAR.exe
                                        "C:\Users\Admin\AppData\Roaming\KS AMK GDAR.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1488
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                        1⤵
                                          PID:4120
                                        • C:\Windows\system32\vssvc.exe
                                          C:\Windows\system32\vssvc.exe
                                          1⤵
                                          • Checks SCSI registry key(s)
                                          PID:4236
                                        • C:\Windows\system32\srtasks.exe
                                          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                          1⤵
                                            PID:5024
                                          • C:\Windows\system32\msiexec.exe
                                            C:\Windows\system32\msiexec.exe /V
                                            1⤵
                                            • Enumerates connected drives
                                            • Drops file in System32 directory
                                            • Drops file in Windows directory
                                            • Modifies data under HKEY_USERS
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5844
                                          • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
                                            "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce
                                            1⤵
                                            • Executes dropped EXE
                                            PID:5708
                                            • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
                                              "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261104165551.log" /install
                                              2⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:5688
                                              • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
                                                "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261104165551.log" /install
                                                3⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:5668
                                                • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
                                                  "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{E28FCB5F-6270-4E64-86D2-7B3449761974} {FD525730-2E89-45EB-81F8-12F791C86CF0} 5668
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • System Location Discovery: System Language Discovery
                                                  PID:972
                                          • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                            "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
                                            1⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:7036
                                            • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                              "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261104165559.log" /install
                                              2⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:7052
                                              • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                                "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261104165559.log" /install
                                                3⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                PID:7076
                                                • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                                  "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1F175613-6EFF-4BE0-84AC-DE0B9B5F7D34} {D5ADED93-0BF1-48D1-A327-F8055AF3F5F6} 7076
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  PID:6448
                                          • C:\Program Files\SteelSeries\GG\updateService\SteelSeriesGGUpdateServiceProxy.exe
                                            "C:\Program Files\SteelSeries\GG\updateService\SteelSeriesGGUpdateServiceProxy.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:5284
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                            1⤵
                                            • Drops file in Windows directory
                                            • Checks SCSI registry key(s)
                                            PID:6400
                                            • C:\Windows\system32\DrvInst.exe
                                              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2547f812-f2b0-5f41-832a-c34832e66964}\ssdevfactory.inf" "9" "47433c933" "00000000000001C8" "WinSta0\Default" "00000000000001D8" "208" "c:\program files\steelseries\gg\apps\engine\driver\win10\amd64"
                                              2⤵
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              • Checks SCSI registry key(s)
                                              • Modifies data under HKEY_USERS
                                              PID:880
                                            • C:\Windows\system32\DrvInst.exe
                                              DrvInst.exe "2" "11" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce88427b98aea:ssdevfactory_Device:1.3.3.0:root\ssdevfactory," "47433c933" "00000000000001C8"
                                              2⤵
                                              • Drops file in Drivers directory
                                              • Drops file in Windows directory
                                              • Checks SCSI registry key(s)
                                              PID:6720
                                            • C:\Windows\system32\DrvInst.exe
                                              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0545f816-c6cd-a040-81bf-2add37e34793}\sshid.inf" "9" "474ae3643" "00000000000001F8" "WinSta0\Default" "00000000000001E4" "208" "C:\Program Files\SteelSeries\GG\apps\engine\driver\Win10\amd64"
                                              2⤵
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              • Checks SCSI registry key(s)
                                              • Modifies data under HKEY_USERS
                                              PID:6848
                                            • C:\Windows\system32\DrvInst.exe
                                              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{605c2de1-4e20-474b-ae00-f2245b3fc4f3}\ssbthid.inf" "9" "4e1795d83" "00000000000001E4" "WinSta0\Default" "00000000000001E0" "208" "C:\Program Files\SteelSeries\GG\apps\engine\driver\Win10\amd64"
                                              2⤵
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              • Checks SCSI registry key(s)
                                              • Modifies data under HKEY_USERS
                                              PID:5920
                                            • C:\Windows\system32\DrvInst.exe
                                              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{9e0b694f-a774-c84e-baf4-3e6374977fc6}\SteelSeries-Sonar-VAD.inf" "9" "4a207103b" "00000000000001E0" "WinSta0\Default" "00000000000001C8" "208" "C:\Program Files\SteelSeries\GG\apps\sonar\driver\vad"
                                              2⤵
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              • Checks SCSI registry key(s)
                                              • Modifies data under HKEY_USERS
                                              PID:6628
                                            • C:\Windows\system32\DrvInst.exe
                                              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c840bb8a-42c9-4646-ae08-5e6c67cc46ad}\Sonar.Apo.inf" "9" "4c36a1233" "00000000000001C8" "WinSta0\Default" "00000000000001DC" "208" "C:\Program Files\SteelSeries\GG\apps\sonar\driver\apoDriverPackage"
                                              2⤵
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              • Checks SCSI registry key(s)
                                              • Modifies data under HKEY_USERS
                                              PID:7160
                                            • C:\Windows\system32\DrvInst.exe
                                              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3ba6cea4-debe-af47-9165-2de138d7f971}\SteelSeries-Sonar-VAD-Extension.inf" "9" "4d200db6f" "00000000000001DC" "WinSta0\Default" "00000000000001E4" "208" "C:\Program Files\SteelSeries\GG\apps\sonar\driver\vad"
                                              2⤵
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              • Checks SCSI registry key(s)
                                              • Modifies data under HKEY_USERS
                                              PID:7112
                                            • C:\Windows\system32\DrvInst.exe
                                              DrvInst.exe "2" "11" "ROOT\MEDIA\0000" "C:\Windows\INF\oem6.inf" "oem6.inf:ed86ca11e3ffeac2:SteelSeries_Sonar_VAD_SA:15.7.9.759:root\ven_ssgg&dev_0001,oem8.inf:ed86ca1120eead08:DeviceExtension_Install:15.7.9.637:root\ven_ssgg&dev_0001" "42f70be7b" "00000000000001F8"
                                              2⤵
                                              • Drops file in Drivers directory
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              • Checks SCSI registry key(s)
                                              • Modifies registry class
                                              PID:4160
                                            • C:\Windows\system32\DrvInst.exe
                                              DrvInst.exe "1" "0" "SWD\DRIVERENUM\{e83b603a-aba0-4d94-bf87-3bba62f4b383}#APOSwc&1&2a215b38&0" "" "" "4d322eb4f" "0000000000000000"
                                              2⤵
                                              • Drops file in Windows directory
                                              PID:2820

                                          Network

                                                MITRE ATT&CK Enterprise v16

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Command and Scripting Interpreter

                                                2
                                                T1059

                                                PowerShell

                                                1
                                                T1059.001

                                                Windows Command Shell

                                                1
                                                T1059.003

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                System Services

                                                1
                                                T1569

                                                Service Execution

                                                1
                                                T1569.002

                                                Windows Management Instrumentation

                                                1
                                                T1047

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Create or Modify System Process

                                                1
                                                T1543

                                                Windows Service

                                                1
                                                T1543.003

                                                Event Triggered Execution

                                                1
                                                T1546

                                                Component Object Model Hijacking

                                                1
                                                T1546.015

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Privilege Escalation

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Create or Modify System Process

                                                1
                                                T1543

                                                Windows Service

                                                1
                                                T1543.003

                                                Event Triggered Execution

                                                1
                                                T1546

                                                Component Object Model Hijacking

                                                1
                                                T1546.015

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Defense Evasion

                                                Impair Defenses

                                                1
                                                T1562

                                                Modify Registry

                                                1
                                                T1112

                                                Credential Access

                                                Discovery

                                                Peripheral Device Discovery

                                                3
                                                T1120

                                                Process Discovery

                                                1
                                                T1057

                                                Query Registry

                                                5
                                                T1012

                                                System Information Discovery

                                                5
                                                T1082

                                                System Location Discovery

                                                1
                                                T1614

                                                System Language Discovery

                                                1
                                                T1614.001

                                                System Network Configuration Discovery

                                                2
                                                T1016

                                                Internet Connection Discovery

                                                1
                                                T1016.001

                                                Lateral Movement

                                                Collection

                                                Video Capture

                                                1
                                                T1125

                                                Command and Control

                                                Web Service

                                                1
                                                T1102

                                                Exfiltration

                                                Impact

                                                Service Stop

                                                1
                                                T1489

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                e5a8b00.rbs
                                                • Path C:\Config.Msi\e5a8b00.rbs
                                                • Size 16KB
                                                • SHA256 1da09fbea178c7144fc5125d16ffa64f534423b412fcdaa14eee952675ab0d6e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                e5a8b05.rbs
                                                • Path C:\Config.Msi\e5a8b05.rbs
                                                • Size 18KB
                                                • SHA256 0f7a9373ee4cc6621b35084f6f958796cf86170b02c7dab188b31816319d6268
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                e5a8b12.rbs
                                                • Path C:\Config.Msi\e5a8b12.rbs
                                                • Size 20KB
                                                • SHA256 8195dda8326dbe0ec70112f9ba29e5ba34c99ed6ca21b9b5f90b9fcfc716c3cd
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                e5a8b21.rbs
                                                • Path C:\Config.Msi\e5a8b21.rbs
                                                • Size 19KB
                                                • SHA256 ebdbb26bc4d6d214707dcce43412f3bfa9dc696646ec501f4c901c0ee83bd0a6
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                e5a8b28.rbs
                                                • Path C:\Config.Msi\e5a8b28.rbs
                                                • Size 19KB
                                                • SHA256 b50a2287df1d680ea03fb0c6f6894b826fc2458b4850023eabc996e81ae33926
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                e5a8b34.rbs
                                                • Path C:\Config.Msi\e5a8b34.rbs
                                                • Size 19KB
                                                • SHA256 b18fd110bab785fb86bfc23e29bfe441aea263abae839e63cf60ed78840818db
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                e5a8b3b.rbs
                                                • Path C:\Config.Msi\e5a8b3b.rbs
                                                • Size 21KB
                                                • SHA256 6826f92afeda3efe688d8f5257e539b7672a3d5b109022e0c954885ab1791fca
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                e5a8b4a.rbs
                                                • Path C:\Config.Msi\e5a8b4a.rbs
                                                • Size 21KB
                                                • SHA256 cb1e9933345ea1b8661933bf9f135275f190cd0ee58fd48c433ec122c4512aa6
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                SteelSeriesGGEZ.exe
                                                • Path C:\Program Files\SteelSeries\GG\SteelSeriesGGEZ.exe
                                                • Size 191KB
                                                • SHA256 60ca26f23ac2ccb430bc512d1148563dadc2eacebe24a8d8de3bf18aa0f0f4a3
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                firmware_arctis_nova_pro_wireless_xbox_tx_dsp_v0.3.82.bin
                                                • Path C:\Program Files\SteelSeries\GG\apps\engine\firmware\272110309\firmware_arctis_nova_pro_wireless_xbox_tx_dsp_v0.3.82.bin
                                                • Size 1024KB
                                                • SHA256 5a77f7dd5eed1c842d7c1e6b61c83dfd14afa814484e769698f4375ea0093942
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                firmware-world-of-tanks-V114.bin
                                                • Path C:\Program Files\SteelSeries\GG\apps\engine\firmware\272110464\firmware-world-of-tanks-V114.bin
                                                • Size 13KB
                                                • SHA256 a2197debbae3d33ab38b4e4a270cad9adaccde9f32803d8fffef51fe7f9ee831
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                firmware-qck_prism_cloth_4xl-1.2.bin
                                                • Path C:\Program Files\SteelSeries\GG\apps\engine\firmware\272110872\firmware-qck_prism_cloth_4xl-1.2.bin
                                                • Size 16KB
                                                • SHA256 3b48f0d368016fe8d736a56604386dbecf76578a1fd27574e5282337b076df90
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                firmware-apex-7-tkl-v4.16.8.bin
                                                • Path C:\Program Files\SteelSeries\GG\apps\engine\firmware\272111128\firmware-apex-7-tkl-v4.16.8.bin
                                                • Size 1024KB
                                                • SHA256 176b203f28db689957ed1d62a2b3e4349461cd110010caa9382c25fb6e70e2e7
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                layout.bin
                                                • Path C:\Program Files\SteelSeries\GG\apps\engine\firmware\272111128\layout.bin
                                                • Size 1024B
                                                • SHA256 add6333f1aa90dd30a3b442f7ebf28ee538d0e0ea33733f4811f765948106cd8
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                secondary-firmware-rival-650-wireless-1.24-B308.bin
                                                • Path C:\Program Files\SteelSeries\GG\apps\engine\firmware\272111398\secondary-firmware-rival-650-wireless-1.24-B308.bin
                                                • Size 3KB
                                                • SHA256 5ed8294c32dac12b2a5afe916c23fdd3627571cf6152347a9336cb965b2ee50a
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                firmware_arctis_nova_7_diablo_iv_rx_bt_2.29.bin
                                                • Path C:\Program Files\SteelSeries\GG\apps\engine\firmware\272114232\firmware_arctis_nova_7_diablo_iv_rx_bt_2.29.bin
                                                • Size 1.3MB
                                                • SHA256 e988a2008bcbe41bae61bcf9c0322f805bcb9be1894f696e11b2098da7e27199
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                firmware_arctis_nova_7x_white_upgrade_rx_mcu_2.31.bin
                                                • Path C:\Program Files\SteelSeries\GG\apps\engine\firmware\272114348\firmware_arctis_nova_7x_white_upgrade_rx_mcu_2.31.bin
                                                • Size 231KB
                                                • SHA256 87283a2ec0ff3c5ee8c72419ebba54231e89676d3cc09a41c93d7fc892225622
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                firmware_arctis_nova_7x_white_upgrade_tx_mcu_2.31.bin
                                                • Path C:\Program Files\SteelSeries\GG\apps\engine\firmware\272114349\firmware_arctis_nova_7x_white_upgrade_tx_mcu_2.31.bin
                                                • Size 231KB
                                                • SHA256 acbfa5c92aa41cfe487c1d34cc93e64b80aa93e79ac9b5efe6bac1b797cc22ae
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                fw_arctis_gamebuds_right_headset_2.9.0.bin
                                                • Path C:\Program Files\SteelSeries\GG\apps\engine\firmware\272114444\fw_arctis_gamebuds_right_headset_2.9.0.bin
                                                • Size 1.4MB
                                                • SHA256 8a32aed0d1b4755fb8e17a2e7b620f799d427ce65c24b29bbd0d339d4c720d9f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                install.log
                                                • Path C:\Program Files\SteelSeries\GG\install.log
                                                • Size 2.0MB
                                                • SHA256 e3576febebdd270c807ab254cd7d52bed78af7b5645f2fa2700f97fb75b73dc3
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                version.json
                                                • Path C:\Program Files\SteelSeries\GG\version.json
                                                • Size 30B
                                                • SHA256 335298acb4dad86068a41bb30e5ea433e66745d3c071d18b10605a9e0fc6f799
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                version.json.old
                                                • Path C:\Program Files\SteelSeries\GG\version.json.old
                                                • Size 40B
                                                • SHA256 f8eec6b1d07b392cb37fb4deb789f210fb2c10de89a1ce2aee093e8d5786cd60
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                vc_runtimeMinimum_x86.msi
                                                • Path C:\ProgramData\Package Cache\{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}v14.44.35211\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi
                                                • Size 200KB
                                                • SHA256 c5ff4d6cd4be9f4965f93af273dd364948fbe44d40b123f34f82bcbcf64c8df4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                dbconf.yml
                                                • Path C:\ProgramData\SteelSeries\GG\apps\engine\db\dbconf.yml
                                                • Size 70B
                                                • SHA256 ac873a3afbb84d3d8c7e617f7d91a9b14fe1edb36ea49798503cdf914680857c
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                dbconf.yml
                                                • Path C:\ProgramData\SteelSeries\GG\apps\engine\db\dbconf.yml
                                                • Size 106B
                                                • SHA256 c48edb347a94f6da2979f63dcd748fae59af84a84351b18f909b81b4684a1fd8
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                dbconf.yml
                                                • Path C:\ProgramData\SteelSeries\GG\apps\moments\db\dbconf.yml
                                                • Size 99B
                                                • SHA256 54824b5e72e18145eec512759c25227b1bc343c64179e464d2af09d491eae04f
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                dbconf.yml
                                                • Path C:\ProgramData\SteelSeries\GG\apps\moments\db\dbconf.yml
                                                • Size 62B
                                                • SHA256 314f2dd90cc8162cb55f2a36566363793590df5616dab891f21e05dcda07dc08
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                dbconf.yml
                                                • Path C:\ProgramData\SteelSeries\GG\db\dbconf.yml
                                                • Size 94B
                                                • SHA256 c6f87e613f4b47893972bf3f7d85d49f80d5c102c898c44932076a4b97982a1c
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                JUN2010_D3DCompiler_43_x64.inf
                                                • Path C:\Users\Admin\AppData\Local\Temp\DX7773.tmp\JUN2010_D3DCompiler_43_x64.inf
                                                • Size 830B
                                                • SHA256 3e779533a273e3395109c7efac13ba1c804c01b3ddb16938406fbdf90d851216
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                JUN2010_d3dx11_43_x64.inf
                                                • Path C:\Users\Admin\AppData\Local\Temp\DX7773.tmp\JUN2010_d3dx11_43_x64.inf
                                                • Size 815B
                                                • SHA256 2c4cf75b76203cba6378693668c8c00b564871c8bfd7fbda01e1e841477b2a3b
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                apr2007_xinput_x64.inf
                                                • Path C:\Users\Admin\AppData\Local\Temp\DX7773.tmp\apr2007_xinput_x64.inf
                                                • Size 860B
                                                • SHA256 0d6e1c0e961d878b319ac30d3439056883448dcf26774003b73920f3377ecac8
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                dxupdate.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\DX7773.tmp\dxupdate.dll
                                                • Size 173KB
                                                • SHA256 fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                dxupdate.inf
                                                • Path C:\Users\Admin\AppData\Local\Temp\DX7773.tmp\dxupdate.inf
                                                • Size 12KB
                                                • SHA256 93f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                infinst.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\DX7773.tmp\infinst.exe
                                                • Size 81KB
                                                • SHA256 8c62fe8466d9a24a0f1924de37b05d672a826454804086cddc7ed87c020e67ff
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Grabber.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\Grabber.exe
                                                • Size 233KB
                                                • SHA256 aa9b0d8f374a57c5d376c589e24bc73fde7223d27f60ca011467b0ef7167af03
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                KS AMK GDAR.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\KS AMK GDAR.exe
                                                • Size 49KB
                                                • SHA256 d02b5c1f1bdb516df251ea8465aab5bcd32715149ad9367e58a72a0016ac6864
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                __PSScriptPolicyTest_qaiote2v.sxs.ps1
                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qaiote2v.sxs.ps1
                                                • Size 60B
                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                AccessControl.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\AccessControl.dll
                                                • Size 19KB
                                                • SHA256 941322a98820d73533bdfd8376db8567dfb9758e92867d36be5b9b1d08327b63
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ApplicationID.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\ApplicationID.dll
                                                • Size 210KB
                                                • SHA256 f31f06faeaf3628016d28245fb9a24cc89fee6a77807bf8a750b01811d0c90a1
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ExecDos.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\ExecDos.dll
                                                • Size 18KB
                                                • SHA256 d61a8d29ff9965c48d7a59cc6d97a21044721ead839613156f9ac768e93450c7
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                LangDLL.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\LangDLL.dll
                                                • Size 5KB
                                                • SHA256 09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                LinkerCb.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\LinkerCb.dll
                                                • Size 19KB
                                                • SHA256 98b847c4abfbdacde5d1e4127dde630409135927a54dd01314775ca8728f09d5
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Processes.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\Processes.dll
                                                • Size 61KB
                                                • SHA256 5f0c517734dfdcd5ea26088d59dcce8dbe5bc625a0027cbd1846566c9a52b447
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                System.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\System.dll
                                                • Size 12KB
                                                • SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                modern-wizard.bmp
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\modern-wizard.bmp
                                                • Size 201KB
                                                • SHA256 561bf9700aecb25be446652e55499912fa5b157016c537d930b082ebe7534b2b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                nsDialogs.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\nsDialogs.dll
                                                • Size 9KB
                                                • SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                nsExec.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsl2BCB.tmp\nsExec.dll
                                                • Size 7KB
                                                • SHA256 5e66489393f159aa0fd30b630bb345d03418e9324e7d834b2e4195865a637cfe
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                oem0.PNF
                                                • Path C:\Windows\INF\oem0.PNF
                                                • Size 5KB
                                                • SHA256 77d0b81ca873318d950ddc2871d642d0e2238ec21b202748cf48b55be6114a63
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                oem1.PNF
                                                • Path C:\Windows\INF\oem1.PNF
                                                • Size 5KB
                                                • SHA256 755b1cde3756813de017dff8e1b0a24793f651e6075e188f90f6455283f60493
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                oem2.PNF
                                                • Path C:\Windows\INF\oem2.PNF
                                                • Size 6KB
                                                • SHA256 63a4d032a327ce0c66adca2870a2264e81491fbfa99c72cefd9041d89518d3b8
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                oem4.PNF
                                                • Path C:\Windows\INF\oem4.PNF
                                                • Size 83KB
                                                • SHA256 b1416b40ba2811fdc7f0cb3796271c61f26c3f7a81a1376586072da1d8e8e4e7
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                oem5.PNF
                                                • Path C:\Windows\INF\oem5.PNF
                                                • Size 9KB
                                                • SHA256 2563e720558ea9e21048cf6ddf89f8ec75617bebccc44e79b0b07c786780e10b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                oem6.PNF
                                                • Path C:\Windows\INF\oem6.PNF
                                                • Size 38KB
                                                • SHA256 dc3a22bee58c7871cd44f1e59f589c654210635fb676343ef5771a0f43ed01e5
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                oem7.PNF
                                                • Path C:\Windows\INF\oem7.PNF
                                                • Size 20KB
                                                • SHA256 c630da87f6bc6b1c6adbc43bd9261032453b3a85606a5e9529c74f8d4c6f8206
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                oem8.PNF
                                                • Path C:\Windows\INF\oem8.PNF
                                                • Size 11KB
                                                • SHA256 cde7877c1246be1bb344a41dfc53d148def66f86da142d007b7e30d17c2e569f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                DirectX.log
                                                • Path C:\Windows\Logs\DirectX.log
                                                • Size 474B
                                                • SHA256 27dcdbc2ba21dcdddd951c392452befa5fa5a0f40b8cba15acff2904973bdd96
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                DirectX.log
                                                • Path C:\Windows\Logs\DirectX.log
                                                • Size 1KB
                                                • SHA256 b8c646387fd29a186a92a52fbb454bc87dbfff2542584bc2970710a3430bc270
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                DirectX.log
                                                • Path C:\Windows\Logs\DirectX.log
                                                • Size 2KB
                                                • SHA256 45b53e9533a1035b2f918aa819276515bec8e2456e484486a5b40c94575c430a
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                DirectX.log
                                                • Path C:\Windows\Logs\DirectX.log
                                                • Size 11KB
                                                • SHA256 1ab72b10f7942bf155a15ac1027e6d45ab9a4e6ddeb2eb185f018083395022c9
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                DirectX.log
                                                • Path C:\Windows\Logs\DirectX.log
                                                • Size 12KB
                                                • SHA256 95a8386c2c6612229c244a525c3df1b043e51136fd3780061c852e3ecacc458b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                dberr.txt
                                                • Path C:\Windows\System32\catroot2\dberr.txt
                                                • Size 51KB
                                                • SHA256 08372f0825f7ebdc9ad6f65794d0614677711211230042298b276b61e0faca0e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                BootstrapperApplicationData.xml
                                                • Path C:\Windows\Temp\{0E3C3B82-F4F9-457F-939F-E3CBE092A360}\.ba\BootstrapperApplicationData.xml
                                                • Size 14KB
                                                • SHA256 8c81100f594e3d0bc51e5571e0046f016086207c1c382d45708c30e1d732b648
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                logo.png
                                                • Path C:\Windows\Temp\{336D6466-DEA8-4450-8F89-5EDC683B62F3}\.ba\logo.png
                                                • Size 1KB
                                                • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                wixstdba.dll
                                                • Path C:\Windows\Temp\{336D6466-DEA8-4450-8F89-5EDC683B62F3}\.ba\wixstdba.dll
                                                • Size 215KB
                                                • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                VC_redist.x86.exe
                                                • Path C:\Windows\Temp\{336D6466-DEA8-4450-8F89-5EDC683B62F3}\.be\VC_redist.x86.exe
                                                • Size 669KB
                                                • SHA256 4a6e1044ff0f49d2e3b12f7c40352c7e573e0c58f3b3cc0b55b63c95ede87828
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1028\license.rtf
                                                • Size 17KB
                                                • SHA256 44c76290f7a2e45940e8338912feb49bcf4e071cfa85d2d34762857743acbc8d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1028\thm.wxl
                                                • Size 2KB
                                                • SHA256 8e2e660dfb66cb453e17f1b6991799678b1c8b350a55f9ebe2ba0028018a15ad
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1029\license.rtf
                                                • Size 12KB
                                                • SHA256 503c433dcde2f3a9e7d388a5ff2b0612e7d8f90f5188d5b2b60228db33044fde
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1029\thm.wxl
                                                • Size 3KB
                                                • SHA256 07fb3ec174f25dfbe532d9d739234d9dfda8e9d34f01fe660c5b4d56989fa779
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1031\license.rtf
                                                • Size 12KB
                                                • SHA256 28f63bad9c2960395106011761993049546607f8a850d344d6a54042176bf03f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1031\thm.wxl
                                                • Size 3KB
                                                • SHA256 8e0dca6e085744bfcbff46f7dcbcfa6fbd722dfa52013ee8ceeaf682d7509581
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1036\license.rtf
                                                • Size 12KB
                                                • SHA256 5c13a65870d770d1642a4259eecb436257ca39016a0500f747be9c79be0c7009
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1036\thm.wxl
                                                • Size 3KB
                                                • SHA256 704ddf2e60c1f292be95c7c79ee48fe8ba8534ceb7ccf9a9ea68b1ad788ae9d4
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1040\license.rtf
                                                • Size 11KB
                                                • SHA256 70ecf23c03b66a2b18e173332586afa8f00f91e02a80628f4f9cb2521e27f6ac
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1040\thm.wxl
                                                • Size 3KB
                                                • SHA256 0c57f40cc2091554307aa8a7c35dd38e4596e9513e9efae00ac30498ef4e9bc2
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1041\license.rtf
                                                • Size 29KB
                                                • SHA256 c3061a334bfd5f02b7085f8f454d5d3d97d477af14bab497bf31a7887bc90c5b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1041\thm.wxl
                                                • Size 3KB
                                                • SHA256 6b9bbf90d75cfa7d943f036c01602945fe2fa786c6173e22acb7afe18375c7ea
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1042\license.rtf
                                                • Size 27KB
                                                • SHA256 3d4e9c165cbeab829d608106f0e96450f839ffa8adbd755f0b51867e89da2ae0
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1042\thm.wxl
                                                • Size 3KB
                                                • SHA256 ad7608b87a7135f408abf54a897a0f0920080f76013314b00d301d6264ae90b2
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1045\license.rtf
                                                • Size 13KB
                                                • SHA256 6f94a99072061012c5626a6dd069809ec841d6e3102b48394d522a0c2e3aa2b5
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1045\thm.wxl
                                                • Size 3KB
                                                • SHA256 440b309fcdf61ffc03b269fe3815c60cb52c6ae3fc6acad14eac04d057b6d6ea
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1046\license.rtf
                                                • Size 10KB
                                                • SHA256 27891eec899be859e3b4d3b29247fc6b535d7e836def0329111c48741ec6e701
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1046\thm.wxl
                                                • Size 3KB
                                                • SHA256 f52b54a0e0d0e8f12cba9823d88e9fd6822b669074dd1dc69dad6553f7cb8913
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1049\license.rtf
                                                • Size 31KB
                                                • SHA256 1bb3fb55b8a13fa3bafffe72f5b1ed8b57a63bd4d8654bb6dc5b9011ce803b44
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1049\thm.wxl
                                                • Size 4KB
                                                • SHA256 7333bc8e52548821d82b53dbd7d7c4aa1703c85155480cb83cefd78380c95661
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1055\license.rtf
                                                • Size 13KB
                                                • SHA256 f80926604e503697247353f56856b31de0b3fc1319f1c94068363952549cc9b1
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\1055\thm.wxl
                                                • Size 3KB
                                                • SHA256 e5abe3cb3bf84207dac4e6f5bba1e693341d01aea076dd2d91eaa21c6a6cb925
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\2052\license.rtf
                                                • Size 17KB
                                                • SHA256 a808b4933ce3b3e0893504dbef43ebf90b8b567f94bd6481b6315ed9141e1b11
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\2052\thm.wxl
                                                • Size 2KB
                                                • SHA256 2ac8b7c19a5189662de36a0581c90dbad96df259ec00a28f609b644c3f39f9ca
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\3082\license.rtf
                                                • Size 10KB
                                                • SHA256 abc11bb2b04dff6afe2d4d4f40d95a7d62e5af352928af90daa3dade58dd59bd
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.ba\3082\thm.wxl
                                                • Size 3KB
                                                • SHA256 9cbb2b312c100b309a1b1495e84e2228b937612885f7a642fbbd67969b632c3a
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                VC_redist.x64.exe
                                                • Path C:\Windows\Temp\{5924EC25-880A-455E-9032-DAFA276C373E}\.be\VC_redist.x64.exe
                                                • Size 670KB
                                                • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{60AA18A8-5A53-475F-B1AB-CE97C7815623}\.ba\license.rtf
                                                • Size 9KB
                                                • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{60AA18A8-5A53-475F-B1AB-CE97C7815623}\.ba\thm.wxl
                                                • Size 2KB
                                                • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                thm.xml
                                                • Path C:\Windows\Temp\{60AA18A8-5A53-475F-B1AB-CE97C7815623}\.ba\thm.xml
                                                • Size 8KB
                                                • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                wixstdba.dll
                                                • Path C:\Windows\Temp\{60AA18A8-5A53-475F-B1AB-CE97C7815623}\.ba\wixstdba.dll
                                                • Size 191KB
                                                • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                BootstrapperApplicationData.xml
                                                • Path C:\Windows\Temp\{DE216F2A-927C-4E81-8C4A-FE8CE4118541}\.ba\BootstrapperApplicationData.xml
                                                • Size 12KB
                                                • SHA256 ea38da67f3785623f4c70335b51a11df7bb27528170c39ad8cbc6b15a8902744
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                memory/1520-444-0x00000000076B0000-0x00000000076EE000-memory.dmp
                                                Download

                                                memory/1520-415-0x00000000051C0000-0x00000000051E2000-memory.dmp
                                                Download

                                                memory/1520-443-0x0000000007660000-0x0000000007671000-memory.dmp
                                                Download

                                                memory/1520-425-0x0000000005AF0000-0x0000000005E47000-memory.dmp
                                                Download

                                                memory/1520-445-0x0000000007880000-0x00000000078A2000-memory.dmp
                                                Download

                                                memory/1520-446-0x0000000008550000-0x0000000008AF6000-memory.dmp
                                                Download

                                                memory/1520-417-0x0000000005A80000-0x0000000005AE6000-memory.dmp
                                                Download

                                                memory/1520-413-0x0000000004AF0000-0x0000000004B26000-memory.dmp
                                                Download

                                                memory/1520-414-0x0000000005290000-0x000000000595A000-memory.dmp
                                                Download

                                                memory/1520-427-0x0000000006190000-0x00000000061DC000-memory.dmp
                                                Download

                                                memory/1520-441-0x0000000007510000-0x000000000751A000-memory.dmp
                                                Download

                                                memory/1520-440-0x0000000007410000-0x00000000074B3000-memory.dmp
                                                Download

                                                memory/1520-439-0x00000000073E0000-0x00000000073FE000-memory.dmp
                                                Download

                                                memory/1520-431-0x0000000070850000-0x000000007089C000-memory.dmp
                                                Download

                                                memory/1520-416-0x0000000005A10000-0x0000000005A76000-memory.dmp
                                                Download

                                                memory/1520-442-0x0000000007750000-0x00000000077E6000-memory.dmp
                                                Download

                                                memory/1520-426-0x00000000060E0000-0x00000000060FE000-memory.dmp
                                                Download

                                                memory/1520-430-0x00000000073A0000-0x00000000073D2000-memory.dmp
                                                Download

                                                memory/1520-429-0x00000000066A0000-0x00000000066BA000-memory.dmp
                                                Download

                                                memory/1520-428-0x0000000007920000-0x0000000007F9A000-memory.dmp
                                                Download

                                                memory/1696-45-0x0000000000060000-0x0000000000072000-memory.dmp
                                                Download

                                                memory/1724-4761-0x0000000000B00000-0x0000000000B77000-memory.dmp
                                                Download

                                                memory/1820-5518-0x0000000140000000-0x0000000140498000-memory.dmp
                                                Download

                                                memory/2072-5559-0x00007FF782B90000-0x00007FF782FB1000-memory.dmp
                                                Download

                                                memory/2128-63-0x000002B006210000-0x000002B006250000-memory.dmp
                                                Download

                                                memory/2144-5855-0x0000000140000000-0x0000000140498000-memory.dmp
                                                Download

                                                memory/2288-5020-0x0000000000670000-0x00000000006E7000-memory.dmp
                                                Download

                                                memory/2480-48-0x000000001A260000-0x000000001A270000-memory.dmp
                                                Download

                                                memory/2480-15-0x00000000007B0000-0x00000000017B0000-memory.dmp
                                                Download

                                                memory/2480-16-0x000000001A260000-0x000000001A270000-memory.dmp
                                                Download

                                                memory/2852-5699-0x0000000140000000-0x0000000140498000-memory.dmp
                                                Download

                                                memory/3296-5693-0x00007FF782B90000-0x00007FF782FB1000-memory.dmp
                                                Download

                                                memory/3956-477-0x0000000074850000-0x000000007485B000-memory.dmp
                                                Download

                                                memory/3956-5826-0x0000000074850000-0x000000007485B000-memory.dmp
                                                Download

                                                memory/3956-5716-0x0000000074850000-0x000000007485B000-memory.dmp
                                                Download

                                                memory/3956-5715-0x0000000074850000-0x000000007485B000-memory.dmp
                                                Download

                                                memory/3956-5825-0x0000000074850000-0x000000007485B000-memory.dmp
                                                Download

                                                memory/3956-506-0x0000000074850000-0x000000007485B000-memory.dmp
                                                Download

                                                memory/3956-5239-0x0000000074850000-0x000000007485B000-memory.dmp
                                                Download

                                                memory/3956-456-0x0000000074850000-0x000000007485B000-memory.dmp
                                                Download

                                                memory/3956-462-0x0000000074850000-0x000000007485B000-memory.dmp
                                                Download

                                                memory/4356-5818-0x0000000140000000-0x0000000140498000-memory.dmp
                                                Download

                                                memory/4812-5683-0x0000000140000000-0x0000000140498000-memory.dmp
                                                Download

                                                memory/5224-5118-0x00007FF647350000-0x00007FF647904000-memory.dmp
                                                Download

                                                memory/5284-5064-0x0000000000A00000-0x0000000000B88000-memory.dmp
                                                Download

                                                memory/5284-5073-0x0000000002D40000-0x0000000002D4C000-memory.dmp
                                                Download

                                                memory/5284-5074-0x0000000002DE0000-0x0000000002DF2000-memory.dmp
                                                Download

                                                memory/5284-5075-0x0000000005660000-0x00000000056F2000-memory.dmp
                                                Download

                                                memory/5500-5076-0x00007FF647350000-0x00007FF647904000-memory.dmp
                                                Download

                                                memory/5792-5044-0x0000027A25920000-0x0000027A25932000-memory.dmp
                                                Download

                                                memory/5792-5030-0x0000027A23D60000-0x0000027A23D6A000-memory.dmp
                                                Download

                                                memory/5792-5031-0x0000027A3E420000-0x0000027A3E5A8000-memory.dmp
                                                Download

                                                memory/5792-5045-0x0000027A3E1A0000-0x0000027A3E1DC000-memory.dmp
                                                Download

                                                memory/5872-5895-0x00007FF6F0770000-0x00007FF6F1752000-memory.dmp
                                                Download

                                                memory/6152-5022-0x0000000000670000-0x00000000006E7000-memory.dmp
                                                Download

                                                memory/6172-5023-0x0000000000670000-0x00000000006E7000-memory.dmp
                                                Download

                                                memory/6268-4760-0x0000000000B00000-0x0000000000B77000-memory.dmp
                                                Download

                                                memory/6520-5615-0x0000000140000000-0x0000000140498000-memory.dmp
                                                Download

                                                memory/6668-4758-0x0000000000B00000-0x0000000000B77000-memory.dmp
                                                Download

                                                memory/6688-5535-0x0000000140000000-0x0000000140498000-memory.dmp
                                                Download

                                                memory/7032-5669-0x0000000140000000-0x0000000140498000-memory.dmp
                                                Download