Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

02/03/2023, 09:20

230302-lax7wscc44 7

27/02/2023, 12:30

230227-ppk3nadd8s 7

Analysis

  • max time kernel
    114s
  • max time network
    221s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    27/02/2023, 12:30

General

  • Target

    ChatGPT For Windows Setup 1.0.0.exe

  • Size

    165.9MB

  • MD5

    ab99ccd02b6681210cfccb6b381fdfda

  • SHA1

    e1f277ac2f304a6c0744fe0c151f471766728a54

  • SHA256

    0e5f0493fdaeb5cb2ed35e6bc92f14ea8bdb566dd1240e9481f6dcfeeb9bbf23

  • SHA512

    29b2e8faf4dd0f7d56e31d2c99aa1a696d5f82c9c408607c3a5275a32d6388ff44d9359d9283cb9f80085ff1173ecdde8746d5b8db92566f61d416532c4febff

  • SSDEEP

    3145728:xnd3Ke4rAjBuqvah8YhlSyIGGu40mGgNiqfslqLOUGgByv1EwOWAW6cmCfitnAT:xdae4kdaiY7SyVHvggWsl2OUHyNEwOWP

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ChatGPT For Windows Setup 1.0.0.exe
    "C:\Users\Admin\AppData\Local\Temp\ChatGPT For Windows Setup 1.0.0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1716
  • C:\Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe
    "C:\Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Programs\vbloks\resources\resource\ChatGPTSupport.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Users\Admin\AppData\Local\Programs\vbloks\resources\resource\ChatGPTSupport.exe
        C:\Users\Admin\AppData\Local\Programs\vbloks\resources\resource\ChatGPTSupport.exe
        3⤵
        • Executes dropped EXE
        PID:1644
    • C:\Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe
      "C:\Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe" --type=renderer --no-sandbox --service-pipe-token=C04E5E340349C63A5C922FB19FE0A714 --lang=en-US --app-user-model-id="electron.app.ChatGPT For Windows" --app-path="C:\Users\Admin\AppData\Local\Programs\vbloks\resources\app.asar" --node-integration=true --webview-tag=true --no-sandbox --background-color=#fff --context-id=2 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=C04E5E340349C63A5C922FB19FE0A714 --renderer-client-id=3 --mojo-platform-channel-handle=1364 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:436
    • C:\Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe
      "C:\Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe" --type=renderer --no-sandbox --service-pipe-token=00EACB4480141B9CA6D6266A9A11A331 --lang=en-US --app-user-model-id="electron.app.ChatGPT For Windows" --app-path="C:\Users\Admin\AppData\Local\Programs\vbloks\resources\app.asar" --node-integration=true --webview-tag=true --no-sandbox --background-color=#fff --context-id=2 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=00EACB4480141B9CA6D6266A9A11A331 --renderer-client-id=5 --mojo-platform-channel-handle=576 /prefetch:1
      2⤵
      • Executes dropped EXE
      PID:572
    • C:\Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe
      "C:\Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe" --type=renderer --no-sandbox --service-pipe-token=E3C42CD6E2FA88882D383B66888CE393 --lang=en-US --app-user-model-id="electron.app.ChatGPT For Windows" --app-path="C:\Users\Admin\AppData\Local\Programs\vbloks\resources\app.asar" --node-integration=true --webview-tag=true --no-sandbox --background-color=#fff --context-id=1 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=E3C42CD6E2FA88882D383B66888CE393 --renderer-client-id=6 --mojo-platform-channel-handle=2088 /prefetch:1
      2⤵
      • Executes dropped EXE
      PID:1040
    • C:\Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe
      "C:\Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe" --type=renderer --no-sandbox --service-pipe-token=190768D0D0AA104AD3CDC14B08507083 --lang=en-US --app-user-model-id="electron.app.ChatGPT For Windows" --app-path="C:\Users\Admin\AppData\Local\Programs\vbloks\resources\app.asar" --node-integration=true --webview-tag=true --no-sandbox --background-color=#fff --context-id=1 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=190768D0D0AA104AD3CDC14B08507083 --renderer-client-id=7 --mojo-platform-channel-handle=1412 /prefetch:1
      2⤵
      • Executes dropped EXE
      PID:1700
    • C:\Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe
      "C:\Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe" --type=renderer --no-sandbox --service-pipe-token=850E3B38F46C0A727FC77926EEC4E283 --lang=en-US --app-user-model-id="electron.app.ChatGPT For Windows" --app-path="C:\Users\Admin\AppData\Local\Programs\vbloks\resources\app.asar" --node-integration=true --webview-tag=true --no-sandbox --background-color=#fff --context-id=1 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=850E3B38F46C0A727FC77926EEC4E283 --renderer-client-id=8 --mojo-platform-channel-handle=2360 /prefetch:1
      2⤵
      • Executes dropped EXE
      PID:1644

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe

    Filesize

    64.6MB

    MD5

    986920d8ab6c83d99ab92d4e3aaea1b1

    SHA1

    a2e5220db567a0f10b437e46c485be0571eb870c

    SHA256

    2ab7a1c0accddd712b18f78d3ff0e5585a4288079ef3bd7c3e1b87768a1c2d55

    SHA512

    024e763d6ffb0b961ab27c6d44020f0bda4c1f688ace012d51518df12757f29456f1508601f7c4f16f3f41d2b6bb8b55958d5fc35043e933bf0826acd274325e

  • C:\Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe

    Filesize

    64.6MB

    MD5

    986920d8ab6c83d99ab92d4e3aaea1b1

    SHA1

    a2e5220db567a0f10b437e46c485be0571eb870c

    SHA256

    2ab7a1c0accddd712b18f78d3ff0e5585a4288079ef3bd7c3e1b87768a1c2d55

    SHA512

    024e763d6ffb0b961ab27c6d44020f0bda4c1f688ace012d51518df12757f29456f1508601f7c4f16f3f41d2b6bb8b55958d5fc35043e933bf0826acd274325e

  • C:\Users\Admin\AppData\Local\Programs\vbloks\MSVCP140.dll

    Filesize

    618KB

    MD5

    9ff712c25312821b8aec84c4f8782a34

    SHA1

    1a7a250d92a59c3af72a9573cffec2fcfa525f33

    SHA256

    517cd3aac2177a357cca6032f07ad7360ee8ca212a02dd6e1301bf6cfade2094

    SHA512

    5a65da337e64ea42bcc461b411ae622ce4dec1036638b1e5de4757b366875d7f13c1290f2ee345f358994f648c5941db35aa5d2313f547605508fd2bcc047e33

  • C:\Users\Admin\AppData\Local\Programs\vbloks\VCRUNTIME140.dll

    Filesize

    85KB

    MD5

    edf9d5c18111d82cf10ec99f6afa6b47

    SHA1

    d247f5b9d4d3061e3d421e0e623595aa40d9493c

    SHA256

    d89c7b863fc1ac3a179d45d5fe1b9fd35fb6fbd45171ca68d0d68ab1c1ad04fb

    SHA512

    bf017aa8275c5b6d064984a606c5d40852aa70047759468395fe520f7f68b5452befc3145efaa7c51f8ec3bf71d9e32dbd5633637f040d58ff9a4b6953bf1cbf

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-core-file-l1-2-0.dll

    Filesize

    18KB

    MD5

    31e207b01e67b6563d2cf9110d06a1d2

    SHA1

    f12832e055c0f0d70fc44b4cb0215c17aa948332

    SHA256

    6b31a206c051815be9f7b366d2a9d2464747a56888a7307a924ecdac558271e1

    SHA512

    8a19324c8719ad6e7509de44fe79c6614c064daa47c4206a2b6ba4124b45bc4d8785cd51b8877c9ae5a1e0768ee1bba8f98e8d8c17b700aa8dadbd2801035a92

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-core-file-l2-1-0.dll

    Filesize

    18KB

    MD5

    f2d12342c68e51aa748d4937f3ec7ded

    SHA1

    22368cebce89feb929004f73bd0f7236f7050e36

    SHA256

    6ba964ad55822f55eea14f73a48deb164b337639a82da677fc6efc1c539fe81e

    SHA512

    1e1440c97237716a6ac63e038d932edd0e7962230bfd6956b8aafa378b344daf92da696f0d1a57b0d71fef3722296b0d02f59b0fc9551e7944c445cc6b2b26a4

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    20KB

    MD5

    9b43f5733a98e5c6095996916f889987

    SHA1

    01ba4d84cb2adf3536c31b1c41375d141dcd2ba1

    SHA256

    2b7e6b54ebc2b9556e2f75e7372d4b2d16758f928b79395b8a55c7acdca93341

    SHA512

    b3497f31c155049c68b18d2f28383843bd8b8c078db119c07d63ec1900a6204e266a3bc1503734fd85c3766bddb25029880291e4f6060afe5df82717af6ae092

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    18KB

    MD5

    95b0eb891b1e869568a2bf9ab67eab0f

    SHA1

    09cf1cbb3089fc418eb933d1b4611cca0d4ad327

    SHA256

    5129795d6e0aeca2fa56aaa56d71d2e9809c2ad77c14265abcb51fe832105e00

    SHA512

    7b2a74278fb7e51242006dc1e60d0e7cc3ed763eb4e7ed7e9da87797ea81fdb05857de838b745fac03468f85c755fe86331746466c30f87f127172de5524f057

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-core-synch-l1-2-0.dll

    Filesize

    18KB

    MD5

    215c5909343c6eef550c5bfb9859a542

    SHA1

    48174742989e4886c123157952f966528a4be963

    SHA256

    d95346a16d088e510def0eff7cbdcb71d70adf335d0a88a7838c9476590c8f8c

    SHA512

    ec00cf8ce3d74bee680b96418f3fe75bcfd2de54441d7818fb62fad73034b07bef0aae36dd0ac34fc85a9669636cdfa0d647e21a871a676feba09251a5f0fe15

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    18KB

    MD5

    69d1c46b9927d1c7cad8dfb5e18ab7ab

    SHA1

    1917be91adb466085678ebe036643cb187a7f4d5

    SHA256

    23f035627abed3460e6dbe8436e5b608c7c30f69091011f655f10ee49ebfd282

    SHA512

    365dbc3811b9bc2417937e433b7b748080c3ca1f4fc1b361117db46fd9dcfe49d948407dca33ca75d307b0e7f7919cc3550caa16e6950f10b0f46d16cbd36172

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-conio-l1-1-0.dll

    Filesize

    19KB

    MD5

    3f14aadfaf34257f399ddb6c554d8a51

    SHA1

    695f7a5d42fd16109ad744a2b215dbd4543e2b84

    SHA256

    edf658d7655b524f5158b69a189d9715f87ceac701a055acc23ce608e4ea0774

    SHA512

    002a34bb9210401270f321eb973afd1fd807a3dc395fcd69adbcabca413d77ea748f78f70c61818da52902a74d38ffc9a5b655887d9336a02355072b421cae22

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    22KB

    MD5

    e3495c380c381670908355181787d7ea

    SHA1

    30b2d379cf483e3394a462a5824092e555974f26

    SHA256

    b353bd22b97fd3704557a99359c9ea0b4e0ad8b7e43b5e21700dabd1a1d84923

    SHA512

    be973074be09fb0e11d4819c0a04d07daad5bf82d3b2c689ab9a5a6d74d39bd24cf526bcfd926f69f5986f0dbfce2d3b4e21a2449ad8e6e9a8a2cfd52b572868

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-environment-l1-1-0.dll

    Filesize

    18KB

    MD5

    5746d1dc01f0a069f009ecd7f8738c41

    SHA1

    5d8696c5cfab3b9c91806a95c9a84d539a4500a3

    SHA256

    325e7bb5c8a3c7f9db8698a570b7d9d9424a028d51f937a2dff3dc5ff0b6e457

    SHA512

    c73d63216f0bfda185928172b737aa652ba30d88471b22c5161b162bd5d68d7b60c3b90af648cc7c1c2b409af416383db106abf8366733ba4c61f3f104c8db41

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-filesystem-l1-1-0.dll

    Filesize

    20KB

    MD5

    c8211d9a8f2595c9ee6f75c9b6d5cb29

    SHA1

    f90ee7350a2d922f5ab614a43c81a42604a86306

    SHA256

    b78607f566599e92bfa8ff5de0f28c439207abf17f274a045500a0d107287d41

    SHA512

    846583349a448d2df8b4a9957a72b6734b0e394135cef6b03bdf197c6752c9e688e47c7d51ce4825f20f47d933ff9133b481b4daec6b0ec729a739b157617377

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    19KB

    MD5

    28579ca40c9e19cc6dc23dfb8b6871cd

    SHA1

    804cdccdb65ad15e016072b5d6f9843096140864

    SHA256

    a57d8275c34c1094f6a4535e23c7bee4759532e08776ff84c5fe487c0f925eb4

    SHA512

    9489cdc3d5df75dd2686ea82dd689aae0a4fd503d2831091c10bc53820320b4947cd9f321501448d258b219516e5d9aaf6790f13189248835ba20b2f86674b9c

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    18KB

    MD5

    4140ee5c6ea9f933c483615141fd54fe

    SHA1

    3ef9da0df943f56f1838853fc5406280b2823516

    SHA256

    29abdc8c5396132b004e6751464641b8f0562249333b2257a1d2eb4aecc8d9dc

    SHA512

    1cc86a050dcd1619e9e2cc9aa37c76da21e4a4d8f1700916c5ff6ed883d3c4218df17b1980a4875c803f5a5de5b80b45ebe5f0fd20b38726fe6cd8d8039d49a2

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    26KB

    MD5

    6c7d9c87af17330357fdb7f39751080b

    SHA1

    3a1dd4a6290d0c9764e43f430bb447ae4cce674d

    SHA256

    6a9dd5a4e52c1aa0e341e35e9dc1a6fbf476ebacd64add3a53c146f019a9a4c6

    SHA512

    d03b8c177b81dd7d55cb1c2dc76301d52ff6d0cbef61398bffd9d113814fa64801196414abefb2f635cbc3e28de3960a47f4b6d6170fe252ac0642701de75d27

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-multibyte-l1-1-0.dll

    Filesize

    26KB

    MD5

    0cad941678316da4f162c2d65600f578

    SHA1

    b14d054e8f787e22b352aefbec819b381a64010c

    SHA256

    acb97f64896cb96cea09c2a2e691a8e2302885150a0699aa0ac0593bcdc89e9f

    SHA512

    2d505027a60b4d2964d869a69756242e537f064633df63a4ffc45aa2df0bfc9ac483aa4455aceb7afa8ebb30d5b685955ad4a14170c891cbdee693c9cb601886

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    21KB

    MD5

    f576fd38085005b4ab2ff1dacd293c48

    SHA1

    75074cfc7543b34f0bcace916370413055dee2ae

    SHA256

    6e794d0fad29cc5bdd5d0511fd923d3434ed122cff0ed697903900c93c807582

    SHA512

    3887ba832965e3bbe248002e926b0ea8374b4755e6b736c25850088287790e20052d3334000eb7afc2c86fd2a14ba05d5e564c1bd811d8baa8e524f4f7fcfc25

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    24KB

    MD5

    1cec55e31418a818093c73e96bd41973

    SHA1

    69a57fb9c17ccfd607749d8e9c8e80792904ea44

    SHA256

    513bb1dd16be7491ced8fa2494b604257285f76062525685c2991391d0c048c3

    SHA512

    31f0e1f4ec0e8b94f4fe403f182596839c916f5d810b8d81c1f399868d18c68192a1362f03f9983d92cb7b7c8575421da12c345838321c95d056c20517ee9b55

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    24KB

    MD5

    e730cd977ac7f60f0824775e39c8fd2c

    SHA1

    fdfaf759a360293687bd2838b7d9feb628edaf5b

    SHA256

    63de06332e8ff15a5bff699e70ed2537a9d273ba62463fa16265d261f3c5bb31

    SHA512

    d6a30e82a061f7e5f27aaa928819ebefff2bb5963ab7d4be33d41e0099576b1e7d0c671082fa08ce0e1bd8e89c4dc8ae427a22f0162ac05b8a0259392bb50fe8

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    20KB

    MD5

    090027e2a3ef8d8ebf9ced36fdc7b492

    SHA1

    bc75462090e7b95a44c9d22ddec394da30d4b6e4

    SHA256

    803b6f86f178e71f462dfdd6521c9f4791059c1fab5dc86de17c34c25e55f8bd

    SHA512

    4ba291e44be86ab8e2f3619155ad503d68e65f84eab0870844c23893b5c169a1fe85fb1feb6cd0ba692373d84b40db3e8fcec3ad231899a0f3ffbecc971fe48b

  • C:\Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    18KB

    MD5

    6bc85715c6a0006cdeff1b3d7ffd796f

    SHA1

    fac4bdf44990b06c7a1c2ffed214ebd710264b3f

    SHA256

    7a578dd2ceb4387ae8f67f6a82ab553ca1570d1588ab6645859e5625585af95c

    SHA512

    a8ed5d78d973efd248971795dc1e3a6e27421746d2c7d47740e846a7e19f3153e7a7e508327a20edf9a2354dbc82da6985e1e212474a066c905a00a32de99bc7

  • C:\Users\Admin\AppData\Local\Programs\vbloks\ffmpeg.dll

    Filesize

    1.9MB

    MD5

    b6fb618728926017ee8c9509ce2f67fa

    SHA1

    82632736becff2f089cdbaf443b06a77353efade

    SHA256

    70261a9b27668b88a6c82350067b9eef2f2f4bc48a98e1495f38bc49d8c79047

    SHA512

    cf8f5f42a558ba27a7b7abe2c29878ad9c22a887de22f9d384226c81994f422f8bccb76c52ad1b5bb7505f2a4c8581f421e197dc8c4fb96b543de219f62b3198

  • C:\Users\Admin\AppData\Local\Programs\vbloks\node.dll

    Filesize

    17.0MB

    MD5

    18d3b17c5008b0e021651f13a1aa255d

    SHA1

    1fbaa3c6cebdc76ce041c986b4f49f80c11dd9fa

    SHA256

    77dc18092a56886a5236cd0927585c7045eff2abe03b6c38235cab135dd14235

    SHA512

    841e38d88cadea44126f7bbff2bdc302a02182f85977389b786a0f23b061d3ec9ce9ebdf086c29c18955f6e92692da142af6284947e0ca69c1a46aae6b7a6156

  • C:\Users\Admin\AppData\Local\Programs\vbloks\ucrtbase.DLL

    Filesize

    977KB

    MD5

    5b1c91b53ac3c3026d50de8c05aba139

    SHA1

    b9c2d160b1ce856d9904a340362236473a3d559c

    SHA256

    d804ea40eacfc22a5e029b66d6d4f83d81f76a7ead80313b33839253f90af6b7

    SHA512

    8e01056830e65320d684245bf055305e03ef136545efb51aad484a5b1b006f7d534c30b7973da8628f49c31710ae23d3420f941156c941172b97efe9e1ef9a1f

  • C:\Users\Admin\AppData\Local\Temp\nsy2741.tmp\SpiderBanner.dll

    Filesize

    9KB

    MD5

    17309e33b596ba3a5693b4d3e85cf8d7

    SHA1

    7d361836cf53df42021c7f2b148aec9458818c01

    SHA256

    996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    SHA512

    1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

  • C:\Users\Admin\AppData\Local\Temp\nsy2741.tmp\StdUtils.dll

    Filesize

    101KB

    MD5

    33b4e69e7835e18b9437623367dd1787

    SHA1

    53afa03edaf931abdc2d828e5a2c89ad573d926c

    SHA256

    72d38ef115e71fc73dc5978987c583fc8c6b50ff12e4a5d30649a4d164a8b6ae

    SHA512

    ca890e785d1a0a7e0b4a748416fba417826ae66b46e600f407d4e795b444612a8b830f579f2cf5b6e051bea800604f34f8801cc3daf05c8d29ad05bcda454a77

  • C:\Users\Admin\AppData\Local\Temp\nsy2741.tmp\System.dll

    Filesize

    11KB

    MD5

    75ed96254fbf894e42058062b4b4f0d1

    SHA1

    996503f1383b49021eb3427bc28d13b5bbd11977

    SHA256

    a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

    SHA512

    58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

  • C:\Users\Admin\AppData\Local\Temp\nsy2741.tmp\WinShell.dll

    Filesize

    3KB

    MD5

    1cc7c37b7e0c8cd8bf04b6cc283e1e56

    SHA1

    0b9519763be6625bd5abce175dcc59c96d100d4c

    SHA256

    9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    SHA512

    7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

  • C:\Users\Admin\AppData\Local\Temp\nsy2741.tmp\nsProcess.dll

    Filesize

    4KB

    MD5

    f0438a894f3a7e01a4aae8d1b5dd0289

    SHA1

    b058e3fcfb7b550041da16bf10d8837024c38bf6

    SHA256

    30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

    SHA512

    f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

  • C:\Users\Admin\AppData\Local\Temp\nsy2741.tmp\nsis7z.dll

    Filesize

    391KB

    MD5

    c6a070b3e68b292bb0efc9b26e85e9cc

    SHA1

    5a922b96eda6595a68fd0a9051236162ff2e2ada

    SHA256

    66ac8bd1f273a73e17a3f31d6add739d3cb0330a6417faeda11a9cae00b62d8b

    SHA512

    8eff8fc16f5bb574bd9483e3b217b67a8986e31497368c06fdaa3a1e93a40aee94a5b31729d01905157b0ae1e556a402f43cd29a4d30a0587e1ec334458a44e8

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_000003

    Filesize

    29KB

    MD5

    4cdba6465ab9fac5d3833c6cdba7a8c3

    SHA1

    f69a36250eae6e8a02173a9909aa628428ba2060

    SHA256

    c76c5d696297d51b9cb1639c7da4334f0e7dec81b42b11213b5e25ef671bb822

    SHA512

    f941865e7e1faa24c8e63f6f6c72bba4683502b4723f52a3335d2d4f24637445d45e5f15612f1516e29c666ed363348051b282c8c44ea4c6abcc23cd761c1460

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_000004

    Filesize

    21KB

    MD5

    b539291298d38521e2fad18dacb59e5a

    SHA1

    d0854475cca0f484d52ab2d38e1ada3f729e82e9

    SHA256

    6a21890e1fa24346df6328d9cd119ea43e5f35355fb22e73afadb78c081513c4

    SHA512

    4c2b7a3f7474244ebb380767114029447c165a0705fc4964a45b15c0518049a2cdfbddafbf8ba7bd3f5acd0fee6ee9e05bd1252b65e156b329aed2801f9cfe3f

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_000005

    Filesize

    16KB

    MD5

    3c2bdde347ed981522b228561e806f9e

    SHA1

    9d196c60ceac42f373aeb009256fd3da1de329d9

    SHA256

    b2584c5c91ebb4fc041b7b39784a1b4453af672567d4d99b61013c1ffcd8dbfa

    SHA512

    fde1d1386ab480693dad86b2e53df5ff53739738768e5714f871f6903ffd803a85a9bb825e886a5ff2a49e92b43731f508a5b1dcb424902be301a4962f955142

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_000006

    Filesize

    95KB

    MD5

    bfb01efd8197db24444d6a660c869b2b

    SHA1

    abc41f80028fd833bc2b6530f3bb9711f2c05619

    SHA256

    a111fb71432a53739bb74c3557fe85c3d79af2cac292b84d840529c6a5acabda

    SHA512

    d1f38a304e0962e71f81428b2a2a23659e969113783df623290d4412fca6d40ce59e2dacc95d3357dd8b21f994349d5631f766f802a48cb43130005df9faf5cb

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_000007

    Filesize

    134KB

    MD5

    abdf67286bc064fbb722958a6ce6c4f4

    SHA1

    e5a5256842b4373b7ca6cc08b1260c1582fc13ef

    SHA256

    f8ce94ff06fbef66d413161466ab20fbea62d9d17d2993977299819c31e26a11

    SHA512

    ba542e0acf079cdf880dcc30f36a658c5d5aabdfcd8a41f346c8c39306652bc74cca4a519cbe195b244faa5d5f49e3ac946e25d418f1b1c0b93daebd285326f6

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_000008

    Filesize

    21KB

    MD5

    53e224ee69abe4be1b0b444a060aa58a

    SHA1

    b19d458f68af95a8f41fff8516bc5986d7e67dd9

    SHA256

    44460b29b5211891aeeffddc7f8b3f57f4a6a5b9be5880436d60f621847c28f6

    SHA512

    237b0c5a00dc7f85c8f70504d34589286996211933371f55a46b712ffc1b45d785e66ab5724fb3bcfa2a811e1747008fb2ea9f823d88bf8b01be6dc1a7acf88c

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_000009

    Filesize

    18KB

    MD5

    5f875f986a9bce1264e8c42417b56f74

    SHA1

    038bbdc8887a9730ad94147fc57c6ff4dfb48411

    SHA256

    a6f7ec0d846ac7ad975adb8959c37ed49b94acbc4ae436db9ce9e20287e4a64c

    SHA512

    01740167b08510f9948531260f6f746b06b2d4232c5c6fba07533673490a7b0405839ca7c087bf16bc97ab874dbdc4e1e828ede0fa8c32cb3ca22f799348ad4b

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_00000a

    Filesize

    19KB

    MD5

    8ffd28f6390231548ead99d7835887fa

    SHA1

    7c8589213bc7003e2c2334b51ca4152858987abd

    SHA256

    f1d6ef86f3b11a528bd5185199bd2443ecb2b0dead96d88674b5a2c12be24bdf

    SHA512

    3a39963134880e54dfd591a1390899b19010d5cc92a38122ce1aac853bdbbaa66481b52d574dbdd610bf40dfa8e3e54573b381c5a29661a2608c546cce9427b8

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_00000b

    Filesize

    18KB

    MD5

    48155e43d9a284b54753e50e4ba586dc

    SHA1

    d54e6480d6d4046c6a5619aa383baa5971fb8a0c

    SHA256

    850c0af5c2238497febaf5e461d880bf458c341f42f4f330f1b1ab5698b1998e

    SHA512

    bce52e5abb56aecc2aa3a6f2697a5d2975322550108d9768bf18d732ab7677ad3bee13973f86ee0fdf82106ce088974538b5e0572b7aeb7420db857ab6aeead2

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_00000c

    Filesize

    30KB

    MD5

    f1cdb692ee31c10b37262caffced5271

    SHA1

    fdcae54ba1d4635ee85a5462cc1c97e521cfd515

    SHA256

    c6368d87e8a1a3a5d337623d83d8dc4b868f242a9ad476237d6f8d1e0f168cdc

    SHA512

    7bf47a13f931a5efd924ea1e94413f529d65b88f931a09d993bb2a0f95848199e2de64fb4ae2485de83e4ddb3a690556dc453939daf3910832ed22af82697037

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_00000d

    Filesize

    102KB

    MD5

    e546040b1562655c729a7cdfcc086653

    SHA1

    8343f7f9cb8f69aa408f6c1c5654cbf3340b3ac9

    SHA256

    f88aec8d36564ec48c961d8257fddbda3c8fc2956d7016187ba77cab3d29928d

    SHA512

    ec320ea272f8718ee74f5731ef7070ce9062d0a0debe5a626a861c86afdcf0fe129f1cca0c65039da32d2d239487db7519497c3ee3f48f5ff26535aa0e0ab280

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_00000e

    Filesize

    18KB

    MD5

    ed7aea12d765f9e2d0f9bc7fa2be626c

    SHA1

    1c1b48739e1cb4be13ddd8c0bc279dde851bdba0

    SHA256

    8a8d244581371912b8f3f5a23e2437cb2a59cd9bcaebb0346e722c05737a2571

    SHA512

    4d4cb5eecf613e0b0ad217b7689c44b69bb8b5dad7220030491d3026792be1bd0134a48401aa75a2b87b300d90813fca395e686fa64e58eec7a9bc3043d19572

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_00000f

    Filesize

    30KB

    MD5

    f0c3b9fd4fd4437dd3f151cc26049ea8

    SHA1

    f4c6d0229e8eab82665a3d1fd1f999a36220aec5

    SHA256

    f935c694a0c447f74cbf51fa6412f5e394559f1492735e14d56c8223adaf69c7

    SHA512

    646b7f07df6da277259245f94791e7c056eecc2c0f9e7a6c12c7e33ff28b1d1df0ecfa9d56c0515b919505c47c9f355575b63251a42ffaee3ac75345ea908fcf

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_000010

    Filesize

    89KB

    MD5

    6f0b018266ccd74bd3f2fe843ca077bb

    SHA1

    11882c0eb306b102076f3ad924f44d4d2faf1b58

    SHA256

    7958ff4634f60a974ff6f667fa210945de3654185852b3e1fd898960667f5129

    SHA512

    e553b3bed93aa79207b0ea668ac8ba85d8609a47ef1d414e9eda8ac99e994cb6a7cbcb75c86ddc31479df81dc703177f1a555cee497c7f682ecfcb6f7cb8e693

  • C:\Users\Admin\AppData\Roaming\vbloks\Cache\f_000011

    Filesize

    44KB

    MD5

    7a56d78afffc6732da4d6b7dcdbf0831

    SHA1

    3d8dc7c0a5d2e1cac86b5ec39278d0da2ba3a7d8

    SHA256

    37506ebb2a53b01d89eedd354d77ea5c29870846b8a34417a0d6cd7e7de673bc

    SHA512

    cd3d19b1f67c227f40133fab4701b5807a05caa23b22ec1d46d525ae7600b3509b9f3073a174eef5522665c20ca6a02612d78cb78b09a95712b498992d605ec2

  • \Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe

    Filesize

    64.6MB

    MD5

    986920d8ab6c83d99ab92d4e3aaea1b1

    SHA1

    a2e5220db567a0f10b437e46c485be0571eb870c

    SHA256

    2ab7a1c0accddd712b18f78d3ff0e5585a4288079ef3bd7c3e1b87768a1c2d55

    SHA512

    024e763d6ffb0b961ab27c6d44020f0bda4c1f688ace012d51518df12757f29456f1508601f7c4f16f3f41d2b6bb8b55958d5fc35043e933bf0826acd274325e

  • \Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe

    Filesize

    64.6MB

    MD5

    986920d8ab6c83d99ab92d4e3aaea1b1

    SHA1

    a2e5220db567a0f10b437e46c485be0571eb870c

    SHA256

    2ab7a1c0accddd712b18f78d3ff0e5585a4288079ef3bd7c3e1b87768a1c2d55

    SHA512

    024e763d6ffb0b961ab27c6d44020f0bda4c1f688ace012d51518df12757f29456f1508601f7c4f16f3f41d2b6bb8b55958d5fc35043e933bf0826acd274325e

  • \Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe

    Filesize

    64.6MB

    MD5

    986920d8ab6c83d99ab92d4e3aaea1b1

    SHA1

    a2e5220db567a0f10b437e46c485be0571eb870c

    SHA256

    2ab7a1c0accddd712b18f78d3ff0e5585a4288079ef3bd7c3e1b87768a1c2d55

    SHA512

    024e763d6ffb0b961ab27c6d44020f0bda4c1f688ace012d51518df12757f29456f1508601f7c4f16f3f41d2b6bb8b55958d5fc35043e933bf0826acd274325e

  • \Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe

    Filesize

    64.6MB

    MD5

    986920d8ab6c83d99ab92d4e3aaea1b1

    SHA1

    a2e5220db567a0f10b437e46c485be0571eb870c

    SHA256

    2ab7a1c0accddd712b18f78d3ff0e5585a4288079ef3bd7c3e1b87768a1c2d55

    SHA512

    024e763d6ffb0b961ab27c6d44020f0bda4c1f688ace012d51518df12757f29456f1508601f7c4f16f3f41d2b6bb8b55958d5fc35043e933bf0826acd274325e

  • \Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe

    Filesize

    64.6MB

    MD5

    986920d8ab6c83d99ab92d4e3aaea1b1

    SHA1

    a2e5220db567a0f10b437e46c485be0571eb870c

    SHA256

    2ab7a1c0accddd712b18f78d3ff0e5585a4288079ef3bd7c3e1b87768a1c2d55

    SHA512

    024e763d6ffb0b961ab27c6d44020f0bda4c1f688ace012d51518df12757f29456f1508601f7c4f16f3f41d2b6bb8b55958d5fc35043e933bf0826acd274325e

  • \Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe

    Filesize

    64.6MB

    MD5

    986920d8ab6c83d99ab92d4e3aaea1b1

    SHA1

    a2e5220db567a0f10b437e46c485be0571eb870c

    SHA256

    2ab7a1c0accddd712b18f78d3ff0e5585a4288079ef3bd7c3e1b87768a1c2d55

    SHA512

    024e763d6ffb0b961ab27c6d44020f0bda4c1f688ace012d51518df12757f29456f1508601f7c4f16f3f41d2b6bb8b55958d5fc35043e933bf0826acd274325e

  • \Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe

    Filesize

    64.6MB

    MD5

    986920d8ab6c83d99ab92d4e3aaea1b1

    SHA1

    a2e5220db567a0f10b437e46c485be0571eb870c

    SHA256

    2ab7a1c0accddd712b18f78d3ff0e5585a4288079ef3bd7c3e1b87768a1c2d55

    SHA512

    024e763d6ffb0b961ab27c6d44020f0bda4c1f688ace012d51518df12757f29456f1508601f7c4f16f3f41d2b6bb8b55958d5fc35043e933bf0826acd274325e

  • \Users\Admin\AppData\Local\Programs\vbloks\ChatGPT For Windows.exe

    Filesize

    64.6MB

    MD5

    986920d8ab6c83d99ab92d4e3aaea1b1

    SHA1

    a2e5220db567a0f10b437e46c485be0571eb870c

    SHA256

    2ab7a1c0accddd712b18f78d3ff0e5585a4288079ef3bd7c3e1b87768a1c2d55

    SHA512

    024e763d6ffb0b961ab27c6d44020f0bda4c1f688ace012d51518df12757f29456f1508601f7c4f16f3f41d2b6bb8b55958d5fc35043e933bf0826acd274325e

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-core-file-l1-2-0.dll

    Filesize

    18KB

    MD5

    31e207b01e67b6563d2cf9110d06a1d2

    SHA1

    f12832e055c0f0d70fc44b4cb0215c17aa948332

    SHA256

    6b31a206c051815be9f7b366d2a9d2464747a56888a7307a924ecdac558271e1

    SHA512

    8a19324c8719ad6e7509de44fe79c6614c064daa47c4206a2b6ba4124b45bc4d8785cd51b8877c9ae5a1e0768ee1bba8f98e8d8c17b700aa8dadbd2801035a92

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-core-file-l2-1-0.dll

    Filesize

    18KB

    MD5

    f2d12342c68e51aa748d4937f3ec7ded

    SHA1

    22368cebce89feb929004f73bd0f7236f7050e36

    SHA256

    6ba964ad55822f55eea14f73a48deb164b337639a82da677fc6efc1c539fe81e

    SHA512

    1e1440c97237716a6ac63e038d932edd0e7962230bfd6956b8aafa378b344daf92da696f0d1a57b0d71fef3722296b0d02f59b0fc9551e7944c445cc6b2b26a4

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    20KB

    MD5

    9b43f5733a98e5c6095996916f889987

    SHA1

    01ba4d84cb2adf3536c31b1c41375d141dcd2ba1

    SHA256

    2b7e6b54ebc2b9556e2f75e7372d4b2d16758f928b79395b8a55c7acdca93341

    SHA512

    b3497f31c155049c68b18d2f28383843bd8b8c078db119c07d63ec1900a6204e266a3bc1503734fd85c3766bddb25029880291e4f6060afe5df82717af6ae092

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    18KB

    MD5

    95b0eb891b1e869568a2bf9ab67eab0f

    SHA1

    09cf1cbb3089fc418eb933d1b4611cca0d4ad327

    SHA256

    5129795d6e0aeca2fa56aaa56d71d2e9809c2ad77c14265abcb51fe832105e00

    SHA512

    7b2a74278fb7e51242006dc1e60d0e7cc3ed763eb4e7ed7e9da87797ea81fdb05857de838b745fac03468f85c755fe86331746466c30f87f127172de5524f057

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-core-synch-l1-2-0.dll

    Filesize

    18KB

    MD5

    215c5909343c6eef550c5bfb9859a542

    SHA1

    48174742989e4886c123157952f966528a4be963

    SHA256

    d95346a16d088e510def0eff7cbdcb71d70adf335d0a88a7838c9476590c8f8c

    SHA512

    ec00cf8ce3d74bee680b96418f3fe75bcfd2de54441d7818fb62fad73034b07bef0aae36dd0ac34fc85a9669636cdfa0d647e21a871a676feba09251a5f0fe15

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    18KB

    MD5

    69d1c46b9927d1c7cad8dfb5e18ab7ab

    SHA1

    1917be91adb466085678ebe036643cb187a7f4d5

    SHA256

    23f035627abed3460e6dbe8436e5b608c7c30f69091011f655f10ee49ebfd282

    SHA512

    365dbc3811b9bc2417937e433b7b748080c3ca1f4fc1b361117db46fd9dcfe49d948407dca33ca75d307b0e7f7919cc3550caa16e6950f10b0f46d16cbd36172

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-conio-l1-1-0.dll

    Filesize

    19KB

    MD5

    3f14aadfaf34257f399ddb6c554d8a51

    SHA1

    695f7a5d42fd16109ad744a2b215dbd4543e2b84

    SHA256

    edf658d7655b524f5158b69a189d9715f87ceac701a055acc23ce608e4ea0774

    SHA512

    002a34bb9210401270f321eb973afd1fd807a3dc395fcd69adbcabca413d77ea748f78f70c61818da52902a74d38ffc9a5b655887d9336a02355072b421cae22

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    22KB

    MD5

    e3495c380c381670908355181787d7ea

    SHA1

    30b2d379cf483e3394a462a5824092e555974f26

    SHA256

    b353bd22b97fd3704557a99359c9ea0b4e0ad8b7e43b5e21700dabd1a1d84923

    SHA512

    be973074be09fb0e11d4819c0a04d07daad5bf82d3b2c689ab9a5a6d74d39bd24cf526bcfd926f69f5986f0dbfce2d3b4e21a2449ad8e6e9a8a2cfd52b572868

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-environment-l1-1-0.dll

    Filesize

    18KB

    MD5

    5746d1dc01f0a069f009ecd7f8738c41

    SHA1

    5d8696c5cfab3b9c91806a95c9a84d539a4500a3

    SHA256

    325e7bb5c8a3c7f9db8698a570b7d9d9424a028d51f937a2dff3dc5ff0b6e457

    SHA512

    c73d63216f0bfda185928172b737aa652ba30d88471b22c5161b162bd5d68d7b60c3b90af648cc7c1c2b409af416383db106abf8366733ba4c61f3f104c8db41

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-filesystem-l1-1-0.dll

    Filesize

    20KB

    MD5

    c8211d9a8f2595c9ee6f75c9b6d5cb29

    SHA1

    f90ee7350a2d922f5ab614a43c81a42604a86306

    SHA256

    b78607f566599e92bfa8ff5de0f28c439207abf17f274a045500a0d107287d41

    SHA512

    846583349a448d2df8b4a9957a72b6734b0e394135cef6b03bdf197c6752c9e688e47c7d51ce4825f20f47d933ff9133b481b4daec6b0ec729a739b157617377

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    19KB

    MD5

    28579ca40c9e19cc6dc23dfb8b6871cd

    SHA1

    804cdccdb65ad15e016072b5d6f9843096140864

    SHA256

    a57d8275c34c1094f6a4535e23c7bee4759532e08776ff84c5fe487c0f925eb4

    SHA512

    9489cdc3d5df75dd2686ea82dd689aae0a4fd503d2831091c10bc53820320b4947cd9f321501448d258b219516e5d9aaf6790f13189248835ba20b2f86674b9c

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    18KB

    MD5

    4140ee5c6ea9f933c483615141fd54fe

    SHA1

    3ef9da0df943f56f1838853fc5406280b2823516

    SHA256

    29abdc8c5396132b004e6751464641b8f0562249333b2257a1d2eb4aecc8d9dc

    SHA512

    1cc86a050dcd1619e9e2cc9aa37c76da21e4a4d8f1700916c5ff6ed883d3c4218df17b1980a4875c803f5a5de5b80b45ebe5f0fd20b38726fe6cd8d8039d49a2

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    26KB

    MD5

    6c7d9c87af17330357fdb7f39751080b

    SHA1

    3a1dd4a6290d0c9764e43f430bb447ae4cce674d

    SHA256

    6a9dd5a4e52c1aa0e341e35e9dc1a6fbf476ebacd64add3a53c146f019a9a4c6

    SHA512

    d03b8c177b81dd7d55cb1c2dc76301d52ff6d0cbef61398bffd9d113814fa64801196414abefb2f635cbc3e28de3960a47f4b6d6170fe252ac0642701de75d27

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-multibyte-l1-1-0.dll

    Filesize

    26KB

    MD5

    0cad941678316da4f162c2d65600f578

    SHA1

    b14d054e8f787e22b352aefbec819b381a64010c

    SHA256

    acb97f64896cb96cea09c2a2e691a8e2302885150a0699aa0ac0593bcdc89e9f

    SHA512

    2d505027a60b4d2964d869a69756242e537f064633df63a4ffc45aa2df0bfc9ac483aa4455aceb7afa8ebb30d5b685955ad4a14170c891cbdee693c9cb601886

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    21KB

    MD5

    f576fd38085005b4ab2ff1dacd293c48

    SHA1

    75074cfc7543b34f0bcace916370413055dee2ae

    SHA256

    6e794d0fad29cc5bdd5d0511fd923d3434ed122cff0ed697903900c93c807582

    SHA512

    3887ba832965e3bbe248002e926b0ea8374b4755e6b736c25850088287790e20052d3334000eb7afc2c86fd2a14ba05d5e564c1bd811d8baa8e524f4f7fcfc25

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    24KB

    MD5

    1cec55e31418a818093c73e96bd41973

    SHA1

    69a57fb9c17ccfd607749d8e9c8e80792904ea44

    SHA256

    513bb1dd16be7491ced8fa2494b604257285f76062525685c2991391d0c048c3

    SHA512

    31f0e1f4ec0e8b94f4fe403f182596839c916f5d810b8d81c1f399868d18c68192a1362f03f9983d92cb7b7c8575421da12c345838321c95d056c20517ee9b55

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    24KB

    MD5

    e730cd977ac7f60f0824775e39c8fd2c

    SHA1

    fdfaf759a360293687bd2838b7d9feb628edaf5b

    SHA256

    63de06332e8ff15a5bff699e70ed2537a9d273ba62463fa16265d261f3c5bb31

    SHA512

    d6a30e82a061f7e5f27aaa928819ebefff2bb5963ab7d4be33d41e0099576b1e7d0c671082fa08ce0e1bd8e89c4dc8ae427a22f0162ac05b8a0259392bb50fe8

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    20KB

    MD5

    090027e2a3ef8d8ebf9ced36fdc7b492

    SHA1

    bc75462090e7b95a44c9d22ddec394da30d4b6e4

    SHA256

    803b6f86f178e71f462dfdd6521c9f4791059c1fab5dc86de17c34c25e55f8bd

    SHA512

    4ba291e44be86ab8e2f3619155ad503d68e65f84eab0870844c23893b5c169a1fe85fb1feb6cd0ba692373d84b40db3e8fcec3ad231899a0f3ffbecc971fe48b

  • \Users\Admin\AppData\Local\Programs\vbloks\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    18KB

    MD5

    6bc85715c6a0006cdeff1b3d7ffd796f

    SHA1

    fac4bdf44990b06c7a1c2ffed214ebd710264b3f

    SHA256

    7a578dd2ceb4387ae8f67f6a82ab553ca1570d1588ab6645859e5625585af95c

    SHA512

    a8ed5d78d973efd248971795dc1e3a6e27421746d2c7d47740e846a7e19f3153e7a7e508327a20edf9a2354dbc82da6985e1e212474a066c905a00a32de99bc7

  • \Users\Admin\AppData\Local\Programs\vbloks\ffmpeg.dll

    Filesize

    1.9MB

    MD5

    b6fb618728926017ee8c9509ce2f67fa

    SHA1

    82632736becff2f089cdbaf443b06a77353efade

    SHA256

    70261a9b27668b88a6c82350067b9eef2f2f4bc48a98e1495f38bc49d8c79047

    SHA512

    cf8f5f42a558ba27a7b7abe2c29878ad9c22a887de22f9d384226c81994f422f8bccb76c52ad1b5bb7505f2a4c8581f421e197dc8c4fb96b543de219f62b3198

  • \Users\Admin\AppData\Local\Programs\vbloks\msvcp140.dll

    Filesize

    618KB

    MD5

    9ff712c25312821b8aec84c4f8782a34

    SHA1

    1a7a250d92a59c3af72a9573cffec2fcfa525f33

    SHA256

    517cd3aac2177a357cca6032f07ad7360ee8ca212a02dd6e1301bf6cfade2094

    SHA512

    5a65da337e64ea42bcc461b411ae622ce4dec1036638b1e5de4757b366875d7f13c1290f2ee345f358994f648c5941db35aa5d2313f547605508fd2bcc047e33

  • \Users\Admin\AppData\Local\Programs\vbloks\node.dll

    Filesize

    17.0MB

    MD5

    18d3b17c5008b0e021651f13a1aa255d

    SHA1

    1fbaa3c6cebdc76ce041c986b4f49f80c11dd9fa

    SHA256

    77dc18092a56886a5236cd0927585c7045eff2abe03b6c38235cab135dd14235

    SHA512

    841e38d88cadea44126f7bbff2bdc302a02182f85977389b786a0f23b061d3ec9ce9ebdf086c29c18955f6e92692da142af6284947e0ca69c1a46aae6b7a6156

  • \Users\Admin\AppData\Local\Programs\vbloks\ucrtbase.dll

    Filesize

    977KB

    MD5

    5b1c91b53ac3c3026d50de8c05aba139

    SHA1

    b9c2d160b1ce856d9904a340362236473a3d559c

    SHA256

    d804ea40eacfc22a5e029b66d6d4f83d81f76a7ead80313b33839253f90af6b7

    SHA512

    8e01056830e65320d684245bf055305e03ef136545efb51aad484a5b1b006f7d534c30b7973da8628f49c31710ae23d3420f941156c941172b97efe9e1ef9a1f

  • \Users\Admin\AppData\Local\Programs\vbloks\vcruntime140.dll

    Filesize

    85KB

    MD5

    edf9d5c18111d82cf10ec99f6afa6b47

    SHA1

    d247f5b9d4d3061e3d421e0e623595aa40d9493c

    SHA256

    d89c7b863fc1ac3a179d45d5fe1b9fd35fb6fbd45171ca68d0d68ab1c1ad04fb

    SHA512

    bf017aa8275c5b6d064984a606c5d40852aa70047759468395fe520f7f68b5452befc3145efaa7c51f8ec3bf71d9e32dbd5633637f040d58ff9a4b6953bf1cbf

  • \Users\Admin\AppData\Local\Temp\nsy2741.tmp\SpiderBanner.dll

    Filesize

    9KB

    MD5

    17309e33b596ba3a5693b4d3e85cf8d7

    SHA1

    7d361836cf53df42021c7f2b148aec9458818c01

    SHA256

    996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    SHA512

    1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

  • \Users\Admin\AppData\Local\Temp\nsy2741.tmp\StdUtils.dll

    Filesize

    101KB

    MD5

    33b4e69e7835e18b9437623367dd1787

    SHA1

    53afa03edaf931abdc2d828e5a2c89ad573d926c

    SHA256

    72d38ef115e71fc73dc5978987c583fc8c6b50ff12e4a5d30649a4d164a8b6ae

    SHA512

    ca890e785d1a0a7e0b4a748416fba417826ae66b46e600f407d4e795b444612a8b830f579f2cf5b6e051bea800604f34f8801cc3daf05c8d29ad05bcda454a77

  • \Users\Admin\AppData\Local\Temp\nsy2741.tmp\System.dll

    Filesize

    11KB

    MD5

    75ed96254fbf894e42058062b4b4f0d1

    SHA1

    996503f1383b49021eb3427bc28d13b5bbd11977

    SHA256

    a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

    SHA512

    58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

  • \Users\Admin\AppData\Local\Temp\nsy2741.tmp\WinShell.dll

    Filesize

    3KB

    MD5

    1cc7c37b7e0c8cd8bf04b6cc283e1e56

    SHA1

    0b9519763be6625bd5abce175dcc59c96d100d4c

    SHA256

    9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    SHA512

    7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

  • \Users\Admin\AppData\Local\Temp\nsy2741.tmp\WinShell.dll

    Filesize

    3KB

    MD5

    1cc7c37b7e0c8cd8bf04b6cc283e1e56

    SHA1

    0b9519763be6625bd5abce175dcc59c96d100d4c

    SHA256

    9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    SHA512

    7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

  • \Users\Admin\AppData\Local\Temp\nsy2741.tmp\nsProcess.dll

    Filesize

    4KB

    MD5

    f0438a894f3a7e01a4aae8d1b5dd0289

    SHA1

    b058e3fcfb7b550041da16bf10d8837024c38bf6

    SHA256

    30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

    SHA512

    f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

  • \Users\Admin\AppData\Local\Temp\nsy2741.tmp\nsis7z.dll

    Filesize

    391KB

    MD5

    c6a070b3e68b292bb0efc9b26e85e9cc

    SHA1

    5a922b96eda6595a68fd0a9051236162ff2e2ada

    SHA256

    66ac8bd1f273a73e17a3f31d6add739d3cb0330a6417faeda11a9cae00b62d8b

    SHA512

    8eff8fc16f5bb574bd9483e3b217b67a8986e31497368c06fdaa3a1e93a40aee94a5b31729d01905157b0ae1e556a402f43cd29a4d30a0587e1ec334458a44e8

  • memory/1672-646-0x0000000002FC0000-0x0000000002FC1000-memory.dmp

    Filesize

    4KB

  • memory/1672-628-0x000000013FB70000-0x0000000143C4C000-memory.dmp

    Filesize

    64.9MB

  • memory/1716-574-0x00000000038E0000-0x00000000038E2000-memory.dmp

    Filesize

    8KB