Resubmissions

13/11/2026, 22:09

261113-126qnshs9w

13/11/2026, 21:51

261113-1q1ehsg1717

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/11/2026, 21:51

General

  • Target
    YA-Setup.exe
  • Size 97.8MB
  • Sample261113-1q1ehsg171
  • SHA256 ae57c14b309795509a16299eeff4e33c5d37768d3b4ace464e244d9bee840ee6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 20 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to get system information.

  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\YA-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\YA-Setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:544
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2196
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3132
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\RAZE', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4640
  • C:\Users\Admin\AppData\Local\Programs\RAZE\RAZE.exe
    "C:\Users\Admin\AppData\Local\Programs\RAZE\RAZE.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:420
    • C:\Users\Admin\AppData\Local\Programs\RAZE\RAZE.exe
      "C:\Users\Admin\AppData\Local\Programs\RAZE\RAZE.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ya-library-hub" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1728,i,2721502759527445388,13048223648089450787,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1028
    • C:\Users\Admin\AppData\Local\Programs\RAZE\RAZE.exe
      "C:\Users\Admin\AppData\Local\Programs\RAZE\RAZE.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ya-library-hub" --field-trial-handle=1728,i,2721502759527445388,13048223648089450787,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:2796
    • C:\Users\Admin\AppData\Local\Programs\RAZE\RAZE.exe
      "C:\Users\Admin\AppData\Local\Programs\RAZE\RAZE.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ya-library-hub" --app-path="C:\Users\Admin\AppData\Local\Programs\RAZE\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1728,i,2721502759527445388,13048223648089450787,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4864

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log

        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 c03c91dd74498cc33a32d616fb3050ad954ed4f57e671e2e9651aedb7b128ff3
        • MD5 SHA1 SHA512 TLSH

        StartupProfileData-NonInteractive

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 16KB
        • SHA256 2e8e270ff9918049d802ef6c7158b0997acf6310b8826079748c61ad9b264edf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StartupProfileData-NonInteractive

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 16KB
        • SHA256 46f535392dfb5ca70e5c92ad7c4058f8c58d216f25bbea0c2f634451dfacfa63
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\LICENSES.chromium.html
        • Size 14.6MB
        • SHA256 6965e1b04dc81a012981508299e28542abff2bc7f418071c264f0b53e0c63f34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\chrome_200_percent.pak
        • Size 252KB
        • SHA256 3e815b1223026c0bdfffcee62a58885e0ccd99d77f0b950778d109832e38e9cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\d3dcompiler_47.dll
        • Size 4.7MB
        • SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxcompiler.dll

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\dxcompiler.dll
        • Size 24.7MB
        • SHA256 6bf9d1e2befc53a95b7b7c374def814af0e1a21ddeb617779397e3e6ccd3b497
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxil.dll

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\dxil.dll
        • Size 1.4MB
        • SHA256 473f5e853120a5b6ca583ac51f453664abae15c0db1d307f29c8bf7a7b89f96c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\ffmpeg.dll
        • Size 2.9MB
        • SHA256 67f37568031d61040ae13022a8ec933f7d4ca7faecbb71a701f0b36489c5a330
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\icudtl.dat
        • Size 10.0MB
        • SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\libEGL.dll
        • Size 493KB
        • SHA256 4e33a8b0632cdab12c0fab456a7d76c3c608fc9940746acd158effc493ba49c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\libGLESv2.dll
        • Size 7.7MB
        • SHA256 1a606ebb09bc8bcb64edefffe3fccecf720b557b9f23ba2aa4331b58106d9991
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\af.pak
        • Size 546KB
        • SHA256 5f3f662f860d0f319027e68d4fb1e68933b2bc3d1beff05bbcfd13f490623bab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\am.pak
        • Size 886KB
        • SHA256 ca2e31cb035c8f48758c1181078edfce56127ee782198f8765cfd16b5163bf16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\ar.pak
        • Size 980KB
        • SHA256 a9bc6ec0e5d458468e0659e19641b52ca371f03daa92b84c63bab38e4ce3bdcd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\bg.pak
        • Size 1011KB
        • SHA256 5907a91c11524603f87bf474825d2f30562a89fd9a8e2595f2fb9003106e6201
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\bn.pak
        • Size 1.3MB
        • SHA256 0a88efecf87d216bbb081d3d26f8ac91656642ab52a66ff9d91ee8e61673d7c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\ca.pak
        • Size 615KB
        • SHA256 74c25c05829be034b1ae6469205f07830f9733e28989a3e500322493536f0279
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\cs.pak
        • Size 636KB
        • SHA256 efb45cc491a3df934aee0eef9eeb147643823784d696a53036ff9c9c2eefeb47
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\da.pak
        • Size 574KB
        • SHA256 6380dcf390f08fba53019aede4b5b26754eeaaf6968147780d8f085a9f8c2631
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\el.pak
        • Size 1.1MB
        • SHA256 5e5f96c79a23c8c2a00efc76918594fa3c13d93d75effe5ff7df4cf78d820396
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\en-GB.pak
        • Size 498KB
        • SHA256 2565bfd2216dd922c6d099e276c9c098cbbc0bb65d089c191b253ba592e74cec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\en-US.pak
        • Size 503KB
        • SHA256 b9a2cccc13d7dac53210e37248dd70df32dbec43bd33d2c663c6290155fb751e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\es-419.pak
        • Size 606KB
        • SHA256 6cee6e9e899e7ee46dfacfc21ef78533e1b98907570d82fd58f1065e1efb645e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\es.pak
        • Size 604KB
        • SHA256 cf47d64bad26d12f6f39f56c4cef093aaec2ee4a1f7b4e88f6b08d34034865bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\et.pak
        • Size 551KB
        • SHA256 20c0c24314c9e49011220ab545441efdb49780d9966285e48c79a9512665b7d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\fa.pak
        • Size 907KB
        • SHA256 9f687b6e3ab82e33ac72f866c101558aa49923ac98ca6e49c0daf5d2220b130b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\fi.pak
        • Size 562KB
        • SHA256 e8ee33a17b25b64ba25c55d688eabb90f49d8f3ca29daed0d54ef693bab9bca0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\fil.pak
        • Size 636KB
        • SHA256 5c2ec565f41cf4b2664054d52dfdf8db1782a13b97b5e227917941e7c5ae8887
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\fr.pak
        • Size 656KB
        • SHA256 a33c1812a95c46fd03317620211bf1f2212b6f089d2520df30ffb1c116de95b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\gu.pak
        • Size 1.3MB
        • SHA256 89ce115c7b2c5c4eba2640fcd5b11355224e1faaf3950d7a16de203db4b8ae08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\he.pak
        • Size 796KB
        • SHA256 e91cc42a2e369914e6bd3535b5c15bcc95334974b6a059c585b995ee92143df9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\hi.pak
        • Size 1.3MB
        • SHA256 b7b9c280c81b6e3ee3e5a8f7884602814740cf72983faaa57b43f6e369b240b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\hr.pak
        • Size 613KB
        • SHA256 bb05be3c417bbda1662a5fbb0ad411e5016b5be59e28ce466be6294908c6c961
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\hu.pak
        • Size 658KB
        • SHA256 484a56e14cd1fdc0933f6c1b94a57af6f5fd774c729e100f10ff3406740d5184
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\id.pak
        • Size 543KB
        • SHA256 91cb6812b4e995189b1e2b61ae0565b92dac4ab3c34efd6e0920591dc005d82a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\it.pak
        • Size 596KB
        • SHA256 a71cbb5cc0336c0732e9781e6965b9080ff2f160be1696724da27d78b470262f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\ja.pak
        • Size 727KB
        • SHA256 30a10162ef5b90e31fe708e7de992622b659c13e5fc4b7c691142fb3d959cc7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\kn.pak
        • Size 1.4MB
        • SHA256 dfb1512aff3d9622b8f46be89d05d7927a74b984eb0213e84f27d248f75bcee4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\ko.pak
        • Size 615KB
        • SHA256 aa78a00d77318d70a356f83ee5e9a0cbd579a560f8b8ffd05f9959ecb965b6a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\lt.pak
        • Size 666KB
        • SHA256 3e9afca6cb3cf70dce1c3b5a0becd2714aab49c9ceb5bbec39f313a063fb3d05
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\lv.pak
        • Size 664KB
        • SHA256 28115981e00562f3028fb55dc0ebf6d9d2bdf4735bb0d4d2d90aea589d24c822
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\ml.pak
        • Size 1.5MB
        • SHA256 3415158190b1d8880811a4f54a3998fb1f3f9f71ed913e1d3452f15f1495facf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\mr.pak
        • Size 1.2MB
        • SHA256 c0b1cdf0bba3e2762fc5afc89ac7d443f53f6c1079f40b7683ceedbe2ba58e65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\ms.pak
        • Size 571KB
        • SHA256 cd9a68fc1b1348b29e6c43adf5c94b9f6238146b8ec7d551e1e1997ae1773e8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\nb.pak
        • Size 551KB
        • SHA256 40277ff47002ca9e7a64c692c2e6b39667bae45ea3a411daaba16cb892e8dad0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\nl.pak
        • Size 572KB
        • SHA256 114a11236f70de85330ed374e9658a4dfd21721f7e7cee80e746451bc68a5250
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\pl.pak
        • Size 637KB
        • SHA256 d5179295319698755b51af402731a34b75b32b76b99ad92640319b65c4c52992
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\pt-BR.pak
        • Size 597KB
        • SHA256 b111cb265d59d861c8dac2ec37733bbb2df6c923236c79d99452535215fef58b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\pt-PT.pak
        • Size 601KB
        • SHA256 252ae86b97ed89e0cac7b9f581dbbae78e7041b28dd6b8be836048ea905dafd5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\ro.pak
        • Size 623KB
        • SHA256 5094807f7e9fa04fb9eeb451c09542587e48ec432dde00c13ed3135b72df2309
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\ru.pak
        • Size 1.0MB
        • SHA256 cc4307b19d0832b86cff809367f23346e9da41e3fc1155aa723b29542aea015b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\sk.pak
        • Size 647KB
        • SHA256 12b0f67bff228cf65c6f9f5a410c0758e4d52f0cdb9abbd4dd9ef828f99e07c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\sl.pak
        • Size 620KB
        • SHA256 bf4846b38adeae6794d2565faeee093e9ea77febe1c2db3ac18193cc1e0e8d2f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\sr.pak
        • Size 956KB
        • SHA256 ae56d881a0f06647dbfe173f3cabedc734a8353d6183099c734570276f38e104
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\sv.pak
        • Size 555KB
        • SHA256 5e44c6ff9d4f432696c747fda111a7ad99df0b818254bbf251e578952ae06d36
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\sw.pak
        • Size 586KB
        • SHA256 bd6ab24cd929d6809dca3ea0a5105cc567e9c9c2bf65f8814b480def6cf1992e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\ta.pak
        • Size 1.5MB
        • SHA256 ca560534ff3ca837cbcbbfc240af7dae12a82466bc16e99e7b79376cd102e342
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\te.pak
        • Size 1.4MB
        • SHA256 11a1d2d935b401bc9b24f158774310d73c31b1616bacc61a054c7ef4661618b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\th.pak
        • Size 1.2MB
        • SHA256 d8f5800cb99e227287bdbed8d807380185e20d166901917b6b58dedc5fdafbf6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\tr.pak
        • Size 597KB
        • SHA256 71b1b037ab44e6ed3f954b2c6318063d29e708dd87306c9051f1e48e43714322
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\uk.pak
        • Size 1.0MB
        • SHA256 fff206f5f631d0dda9579cf806cde4de5848a7474bb1ac2b1239ab967a8ca88c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\ur.pak
        • Size 898KB
        • SHA256 0f3cc59fd6c706ae8d84a0cc50301a4929ea1f0204ad5e48250f1a354d6613e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\vi.pak
        • Size 709KB
        • SHA256 f7df08dbb5ca133109ad809bdd89be82cc956a0518e6dee7e02fe4f65118d77d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\zh-CN.pak
        • Size 508KB
        • SHA256 e27395a6c73ac592f05e0de00f4c17efe181a4900c1f649e69d3a21dbb87cde5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\locales\zh-TW.pak
        • Size 503KB
        • SHA256 aee4d9c6230c5ae8257fecbccaba6b8668e5a34d6c44ef06e4574e12fed7fd8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\resources.pak
        • Size 5.8MB
        • SHA256 13d24097d2c5684f4a893c42beef385927d522ea94f77f470ce11270ffa22231
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app.asar

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\resources\app.asar
        • Size 10.1MB
        • SHA256 f0ae3583e91bdf0fe1a034b762c1401dda9cc26a10120f7bb5e9a0e6b83be27a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\snapshot_blob.bin
        • Size 314KB
        • SHA256 4bef4ff989a5e7f3f138b315e26e0cfea65487d2845b59508dc12b6f6e574778
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\v8_context_snapshot.bin
        • Size 683KB
        • SHA256 cfa255a0c61f2926ead15f4d049d5e439d3745291058687c231cef3de56dbfc2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\vk_swiftshader.dll
        • Size 5.3MB
        • SHA256 176adce81d9f0f1aac302806be3dbb67abda46e13355bb85c4868057c6e3a223
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Programs\RAZE\vulkan-1.dll
        • Size 900KB
        • SHA256 d5acc73241b46dcfd7ea5f970eab9fdc2ac5a3dc737e23d5947980972ed0a2b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __PSScriptPolicyTest_2kxixeyo.u3y.ps1

        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2kxixeyo.u3y.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsnFE80.tmp\7z-out\chrome_100_percent.pak
        • Size 163KB
        • SHA256 4474d496b4eb082073fb439133728eed72da35f4519505c1c246ef2b9552cf49
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsnFE80.tmp\7z-out\locales\de.pak
        • Size 615KB
        • SHA256 ae28e9e71aaf424c0323f2949f7426405ccf7509a2568c93bfe29690a7302094
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsnFE80.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsnFE80.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UAC.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsnFE80.tmp\UAC.dll
        • Size 14KB
        • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WinShell.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsnFE80.tmp\WinShell.dll
        • Size 3KB
        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
        • MD5 SHA1 SHA512 TLSH

        nsDialogs.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsnFE80.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsExec.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsnFE80.tmp\nsExec.dll
        • Size 6KB
        • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsnFE80.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default.dic

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512

        temp-index

        • Path C:\Users\Admin\AppData\Roaming\ya-library-hub\Code Cache\js\index-dir\temp-index
        • Size 48B
        • SHA256 ea928f61a6e3f0b7d26fac5824a5c9c4b8b1089c9c451b0154339baea2049de0
        • MD5 SHA1 SHA512

        index

        • Path C:\Users\Admin\AppData\Roaming\ya-library-hub\DawnGraphiteCache\index
        • Size 256KB
        • SHA256 24cc9dca109b12aada1bb8efbcb8aab873e50dd9238ea44b7bb14b3432cb93f0
        • MD5 SHA1 SHA512 SSDEEP

        data_0

        • Path C:\Users\Admin\AppData\Roaming\ya-library-hub\GPUCache\data_0
        • Size 8KB
        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
        • MD5 SHA1 SHA512 SSDEEP

        data_1

        • Path C:\Users\Admin\AppData\Roaming\ya-library-hub\GPUCache\data_1
        • Size 264KB
        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
        • MD5 SHA1 SHA512 SSDEEP

        data_2

        • Path C:\Users\Admin\AppData\Roaming\ya-library-hub\GPUCache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP

        data_3

        • Path C:\Users\Admin\AppData\Roaming\ya-library-hub\GPUCache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP

        CURRENT

        • Path C:\Users\Admin\AppData\Roaming\ya-library-hub\Local Storage\leveldb\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512

        memory/1028-882-0x000001BB9A5D0000-0x000001BB9BE8E000-memory.dmp

        memory/1028-887-0x000001BB9A5D0000-0x000001BB9BE8E000-memory.dmp

        memory/2196-41-0x000000006FCF0000-0x000000006FD3C000-memory.dmp

        memory/2196-51-0x0000000007A40000-0x0000000007AE3000-memory.dmp

        memory/2196-40-0x0000000006E30000-0x0000000006E62000-memory.dmp

        memory/2196-39-0x000000007F150000-0x000000007F160000-memory.dmp

        memory/2196-38-0x00000000068A0000-0x00000000068EC000-memory.dmp

        memory/2196-37-0x0000000006870000-0x000000000688E000-memory.dmp

        memory/2196-34-0x0000000006270000-0x00000000065C4000-memory.dmp

        memory/2196-50-0x0000000006E10000-0x0000000006E2E000-memory.dmp

        memory/2196-28-0x0000000006200000-0x0000000006266000-memory.dmp

        memory/2196-27-0x0000000006190000-0x00000000061F6000-memory.dmp

        memory/2196-26-0x0000000005FF0000-0x0000000006012000-memory.dmp

        memory/2196-25-0x0000000005990000-0x0000000005FB8000-memory.dmp

        memory/2196-24-0x0000000005350000-0x0000000005360000-memory.dmp

        memory/2196-23-0x00000000052E0000-0x0000000005316000-memory.dmp

        memory/2196-22-0x0000000005350000-0x0000000005360000-memory.dmp

        memory/2196-42-0x0000000005350000-0x0000000005360000-memory.dmp

        memory/2196-52-0x0000000008200000-0x000000000887A000-memory.dmp

        memory/2196-53-0x0000000007BB0000-0x0000000007BCA000-memory.dmp

        memory/2196-54-0x0000000007C20000-0x0000000007C2A000-memory.dmp

        memory/2196-55-0x0000000007DA0000-0x0000000007DCA000-memory.dmp

        memory/2196-56-0x0000000007DD0000-0x0000000007DF4000-memory.dmp

        memory/2196-57-0x0000000070470000-0x00000000707C4000-memory.dmp

        memory/3132-65-0x00000000048F0000-0x0000000004900000-memory.dmp

        memory/3132-64-0x00000000048F0000-0x0000000004900000-memory.dmp

        memory/3132-74-0x000000006FCF0000-0x000000006FD3C000-memory.dmp

        memory/3132-82-0x0000000007380000-0x0000000007416000-memory.dmp

        memory/3132-83-0x00000000072F0000-0x0000000007301000-memory.dmp

        memory/4640-93-0x0000000005D20000-0x0000000006074000-memory.dmp

        memory/4640-97-0x000000006FCF0000-0x000000006FD3C000-memory.dmp

        memory/4640-105-0x00000000703F0000-0x0000000070744000-memory.dmp

        memory/4864-834-0x00007FFAFB670000-0x00007FFAFB671000-memory.dmp

        memory/4864-833-0x00007FFAF9F10000-0x00007FFAF9F11000-memory.dmp