Overview

overview

10

Static

static

10

Ultimate Tweaks.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDIR/UAC.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows11-21h2-x64

3

Ultimate Tweaks.exe

windows11-21h2-x64

7

d3dcompiler_47.dll

windows11-21h2-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows11-21h2-x64

1

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

$R0/Uninst...ks.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDIR/UAC.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

Analysis

  • max time kernel
    90s
  • max time network
    159s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21/09/2024, 00:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Ultimate Tweaks.exe
  • Size 168.2MB
  • Sample240921-a1trlswhrd
  • SHA256 3b47e84d5ca6ad15d2e8916d6cbd6af9ab943a42e84241e0517eaab66b5ef214
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 18 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Windows directory 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 56 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4884
    • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
      "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1648 --field-trial-handle=1652,i,6877940030108540874,15200404983816394743,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      2⤵
        PID:3468
      • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
        "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --mojo-platform-channel-handle=2032 --field-trial-handle=1652,i,6877940030108540874,15200404983816394743,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
        2⤵
          PID:3412
        • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
          "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2276 --field-trial-handle=1652,i,6877940030108540874,15200404983816394743,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
          2⤵
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:4048
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "chcp"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1368
            • C:\Windows\system32\chcp.com
              chcp
              4⤵
                PID:3880
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2744
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1232
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2140
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3900
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1424
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:788
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4980
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4976
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1156
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1672
          • C:\Users\Admin\AppData\Local\ultimate-tweaks-updater\pending\Ultimate-Tweaks-Setup-1.0.2.exe
            C:\Users\Admin\AppData\Local\ultimate-tweaks-updater\pending\Ultimate-Tweaks-Setup-1.0.2.exe --updated /S --force-run
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2368
        • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe
          "C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe" --updated
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2568
          • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe
            "C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,6837327000004650852,4352409165519580444,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:768
          • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe
            "C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --mojo-platform-channel-handle=1816 --field-trial-handle=1752,i,6837327000004650852,4352409165519580444,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3304
          • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe
            "C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --app-path="C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2236 --field-trial-handle=1752,i,6837327000004650852,4352409165519580444,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks processor information in registry
            PID:720
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "chcp"
              3⤵
                PID:3288
                • C:\Windows\system32\chcp.com
                  chcp
                  4⤵
                    PID:2668
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:892
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4432
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:724
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4424
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4756
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2524
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4348
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2156
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2256
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4884
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1968
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:424
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3472
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1672
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4892
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    4⤵
                      PID:2156
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1544
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2992
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    PID:896
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2196
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2752
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4432
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4272
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:892
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:1944
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3648
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:1188
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:2184
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3708
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4308
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4088
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3404
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:2140
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:1444
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4444
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:2408
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:1704
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4172
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4864
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4664
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3144
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3816
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3800
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3160
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:1404
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4156
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4996
                • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe
                  "C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --app-path="C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3200 --field-trial-handle=1752,i,6837327000004650852,4352409165519580444,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4296

              Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    powershell.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                    • Size 3KB
                    • SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 1KB
                    • SHA256 ffda9233d24b63e14924cddc16d3885111c7cf09abe840547c0a266c2000687f
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 1KB
                    • SHA256 e78da2269cc7c277fde179e8f4390fc2dd24a21b02d388b4544727afc15ef4ff
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 1KB
                    • SHA256 7afad63c1d91e7112c6c843241ca23ffa1ab9c3724888971b90691d67fdc718a
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 1KB
                    • SHA256 f45f515077ddc5e6df0ba7e12e8934d9f4971010ee71ff5073734fc10055ff93
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 1KB
                    • SHA256 2bebea6754acf5e5c4c10f2cca3e57362cef9d46684dd8eca4e2a1e48c5f44a9
                    • MD5 SHA1 SHA512
                    Submit Download

                    ro.pak
                    • Path C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\locales\ro.pak
                    • Size 546KB
                    • SHA256 6343589863bdd2ae81ec9c33e335048fd8792d2c2e8872f91f7a325a1f0d97ac
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    __PSScriptPolicyTest_humh3g5i.di4.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_humh3g5i.di4.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512
                    Submit Download

                    LICENSE.electron.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\LICENSE.electron.txt
                    • Size 1KB
                    • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                    • MD5 SHA1 SHA512
                    Submit Download

                    LICENSES.chromium.html
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\LICENSES.chromium.html
                    • Size 8.7MB
                    • SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    chrome_100_percent.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\chrome_100_percent.pak
                    • Size 150KB
                    • SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    chrome_200_percent.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\chrome_200_percent.pak
                    • Size 229KB
                    • SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    d3dcompiler_47.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\d3dcompiler_47.dll
                    • Size 4.7MB
                    • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    ffmpeg.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\ffmpeg.dll
                    • Size 2.7MB
                    • SHA256 450d5e6a11dc31dc6e1a7af472cd08b7e7a78976b1f0aa1c62055a0a720f5080
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    icudtl.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\icudtl.dat
                    • Size 10.2MB
                    • SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    libEGL.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\libEGL.dll
                    • Size 467KB
                    • SHA256 afef052c621f72ba986d917a9e090d23a13f4ab6bc09f158eeb73fd671b94219
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    libGLESv2.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\libGLESv2.dll
                    • Size 7.3MB
                    • SHA256 3a39137dcee6cb6663ae9cca424b6b05cf56c0ad7e32fb72cb94549ea9dbcae8
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    af.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\af.pak
                    • Size 478KB
                    • SHA256 f402c0d8494c9a2fceedcd7845ddf43b62e7d01ddb1d9c8e132efea83b724824
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    am.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\am.pak
                    • Size 776KB
                    • SHA256 325dd137903fc0d9e5010a62a314d9c6984ff82afbdff2254f7c48bd03dda06a
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    ar.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\ar.pak
                    • Size 851KB
                    • SHA256 3bb407fa588fb801ab241e8dda018461b54010a38648c3acc1e3550c0dfbd75a
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    bg.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\bg.pak
                    • Size 885KB
                    • SHA256 5947f567ce1f4ab945dc6dab1599422d412f4417b9097905150d669122e43f7d
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    bn.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\bn.pak
                    • Size 1.1MB
                    • SHA256 a45279ccc13390e0d93cfe1e33a7f276a5d9e97f6aefa6b6e14ecc4289703bda
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    ca.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\ca.pak
                    • Size 538KB
                    • SHA256 1dca9a7fcd850aecd48288999b436ff7e70cd4a96f47b40319759a800fb8eefa
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    cs.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\cs.pak
                    • Size 555KB
                    • SHA256 2964edcdcb27b2edf73515615501d8af28ad94b5dd31d2794f2624808c74de38
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    da.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\da.pak
                    • Size 501KB
                    • SHA256 318a9ec9e9fbe35d5d8cb9b719ecfbe1ecba9d8f246876c949c082107b439ddb
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    de.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\de.pak
                    • Size 536KB
                    • SHA256 d5746f48800efbff7db9d1bb8d6e5a5102eb7d79ae136e0485fd427be1ca63a1
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    el.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\el.pak
                    • Size 971KB
                    • SHA256 c0434492be64b08f9ad00bc7cff65314822406dfb0c591fea0df6af9b6fc89c5
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    en-GB.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\en-GB.pak
                    • Size 436KB
                    • SHA256 e0df967ffdf872f0a9589a0d74d68a742fa9b956add7a6736b82aebd9e8f02d3
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    en-US.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\en-US.pak
                    • Size 440KB
                    • SHA256 02b97817b6eebd7caeaaff750f6462abc68911c398ddf0571b7900ff9b4ea9a2
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    es-419.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\es-419.pak
                    • Size 530KB
                    • SHA256 0c816f00b15d59809d30b6611aa455ea1bf8b022d2f887137f1c9d7a5600d5d9
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    es.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\es.pak
                    • Size 530KB
                    • SHA256 54f85551269c8b5f3985a09d313fdc04c4595e5058163cf147ede049b8faa605
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    et.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\et.pak
                    • Size 481KB
                    • SHA256 8021814965878c4913d1f9f9d226da49cc2a37746d976f3b84aad7fe096fd14f
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    fa.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\fa.pak
                    • Size 789KB
                    • SHA256 9b5334e4883a716c5616c859889aacd7b179b30ac65e5657198eb4e877700f81
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    fi.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\fi.pak
                    • Size 492KB
                    • SHA256 4bf099ac8a76449bf597caf005790f5c02efd533b9a329c5fdc460d38f77607e
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    fil.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\fil.pak
                    • Size 556KB
                    • SHA256 00b8cfe6131499a8a67a51dd8560a965a2abb863d52635dd3931df0479c3f5ee
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    fr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\fr.pak
                    • Size 574KB
                    • SHA256 7169684ff44f342b98648839b8963916f7323115dead332c2471baed6264b80e
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    gu.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\gu.pak
                    • Size 1.1MB
                    • SHA256 8c762963cca8eef2cbd39bd7bcd8b809f3b57a75353e687743894add9c19440f
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    he.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\he.pak
                    • Size 691KB
                    • SHA256 9e5544340da0e0aa28298e68765716a3960a28e50d86146b5324fd70fd756b41
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    hi.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\hi.pak
                    • Size 1.2MB
                    • SHA256 8dae029a489f1bd7530650a9cb1be1f03741e1d7018503feb3c78759da8af531
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    hr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\hr.pak
                    • Size 535KB
                    • SHA256 6dcc7d5d771475874471b78ee84db0230341f8634f4b38a9cb90c37226d70b00
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    hu.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\hu.pak
                    • Size 576KB
                    • SHA256 61854ab102bc57a7ad7b85a4fa008c3f071306838ba1a0491f68c19153decd49
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    id.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\id.pak
                    • Size 475KB
                    • SHA256 64a8a25717ffae1855114d84b02223ad5b3963c1c6a21c826636146726d0a8a2
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    it.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\it.pak
                    • Size 523KB
                    • SHA256 9395bf9a547561df6cd20d8e076452369cb72184f215448d1acd802dccf3a47d
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    ja.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\ja.pak
                    • Size 639KB
                    • SHA256 8de18410e38f4036367113bd4ed253a4957709d87e0aeb11134742bc89e16d62
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    kn.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\kn.pak
                    • Size 1.3MB
                    • SHA256 01250aec7310bb59e0e847382325f940ea2cdab00369c1c7efe2f340d01ff806
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    ko.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\ko.pak
                    • Size 540KB
                    • SHA256 ff88b56be0614232947bfb07e6beb88327a18ebec98cece17caa9b7cd8e6dd24
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    lt.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\lt.pak
                    • Size 580KB
                    • SHA256 f87b2baacdde69b2b24dc7859d47bad0844cf4d275072812aaf4eedb10318450
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    lv.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\lv.pak
                    • Size 579KB
                    • SHA256 dbc860a35ad08e4f502b8784ca1548110d3c7334478f6c392db42f52cb3074f2
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    ml.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\ml.pak
                    • Size 1.3MB
                    • SHA256 878e268428ec7aa51105c921740931c545d4ba6a274b367c52675c90741d23bf
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    mr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\mr.pak
                    • Size 1.1MB
                    • SHA256 362df1aa112a0a521617c0496087b3547a242eb79a5416b8414c5798f31e187d
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    ms.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\ms.pak
                    • Size 498KB
                    • SHA256 e5e77421c5fca5b1eaef96fbf33c345c63119015986163cb43d65075df6265d0
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    nb.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\nb.pak
                    • Size 483KB
                    • SHA256 67d997fff8a24eaa030eadede7f5345fff5e954e96bc8f36d399839bed998774
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    nl.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\nl.pak
                    • Size 499KB
                    • SHA256 d88b02d74e01b9350d3ac9c48fe08333ca9c68e3e3824d64fae86c5b8b531feb
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    pl.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\pl.pak
                    • Size 557KB
                    • SHA256 03258ecf731487231cc7eab8f6cb96e92b7ede4cc5b63c3def6ba08e0f16da10
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    pt-BR.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\pt-BR.pak
                    • Size 524KB
                    • SHA256 952234ef1d2792204f4e65cc814e9fc6dc007610668ceffb980c74fc0167ba0b
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    pt-PT.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\pt-PT.pak
                    • Size 527KB
                    • SHA256 72ca754dcb34c54b72087ab7fd5a4a3fa03e09cd1ced906d99d6525c7a19ee9c
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    ru.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\ru.pak
                    • Size 897KB
                    • SHA256 8c169d6995d97feae8b8ec947be27697ca0ff731b593fff36163e4f31969a6fd
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    sk.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\sk.pak
                    • Size 563KB
                    • SHA256 441155d63257beaac9e2998afa1a9e65957286ed1cd9e0670072a63e24ff3f8b
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    sl.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\sl.pak
                    • Size 541KB
                    • SHA256 26e29cd70c4143d7e9fb65e86e02c9173997f2fc062633a5edb2b7df55942157
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    sr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\sr.pak
                    • Size 833KB
                    • SHA256 ac09005a83d4ac8f61855c7e301e48a753d2f3558a04cdb94f23b539e2086e54
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    sv.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\sv.pak
                    • Size 486KB
                    • SHA256 ca34ee1c147358b5e32b5829acc0c355708925dc8df91c21d8e495c7485fa5c7
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    sw.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\sw.pak
                    • Size 512KB
                    • SHA256 51482431411be2d89bfc026b9acf9ce1a0fb971376468a47829a15392b47178a
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    ta.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\ta.pak
                    • Size 1.3MB
                    • SHA256 75638ac7fdb226c0840d5c2edf763bae35afa1f47e89199d9724ff46c003a2c2
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    te.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\te.pak
                    • Size 1.2MB
                    • SHA256 caeba6c853a0ee12a802fb9f610a95c676071414c1d8407d18b05f2fe8ce6bb7
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    th.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\th.pak
                    • Size 1.0MB
                    • SHA256 d01ecd4edecf1809d5c2133366df2502a4621e88d894817e80b913f3a0926fa4
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    tr.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\tr.pak
                    • Size 523KB
                    • SHA256 026fc65ed90fe356ce2b5e2b459a4487512d89e48f0ff8b044d6739ef51c1658
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    uk.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\uk.pak
                    • Size 896KB
                    • SHA256 e33b1a611feca93d105dee7c867521b5fbf27da38532ea3ca0aec61bec7f6108
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    ur.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\ur.pak
                    • Size 782KB
                    • SHA256 b551a93a300ab78ee6da5087ea417584c4fd3941fbac99c84c9c58be2c88a7e8
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    vi.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\vi.pak
                    • Size 619KB
                    • SHA256 d435c4c7154c24982185842a09cacd343cea77a5eb7fb859c4d38973cf240a42
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    zh-CN.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\zh-CN.pak
                    • Size 447KB
                    • SHA256 cc5a411d3bf0ddfba9e5041dfeeaed70265ba949f7b7ccba0170b88e3e14ceb0
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    zh-TW.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\locales\zh-TW.pak
                    • Size 442KB
                    • SHA256 58753d4313ed7f548df16a9cd9aa1f0e30cebee675a76b8359ed23fc95825574
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    resources.pak
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\resources.pak
                    • Size 5.0MB
                    • SHA256 5d63acd4034f7771ca346d138d7478014abf1f3f4386d07fc025dbc2c2bc0bff
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    app-update.yml
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\resources\app-update.yml
                    • Size 106B
                    • SHA256 897dac554968a2c49044a5e601cfcaf7c24d41599a58c03e91c62bd664b60ecf
                    • MD5 SHA1 SHA512
                    Submit Download

                    app.asar
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\resources\app.asar
                    • Size 36.6MB
                    • SHA256 e0abebd549f6705666f056ac69cfa9989ffc9ea19eb86a562ac99ccacd8bee45
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    elevate.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\resources\elevate.exe
                    • Size 105KB
                    • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    snapshot_blob.bin
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\snapshot_blob.bin
                    • Size 298KB
                    • SHA256 0976145cc8c02f3e64ddbf51dc983bdbb456be7fcf3ce54608e218981671ac12
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    v8_context_snapshot.bin
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\v8_context_snapshot.bin
                    • Size 663KB
                    • SHA256 875515af4e7254458c17a98bed087fc609d45fbc8ebf60663e112c37204f6840
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    vk_swiftshader.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\vk_swiftshader.dll
                    • Size 5.1MB
                    • SHA256 08e34bc25653f9357a4ccf62966d698b7cc6265dc668046a28403ae5786132ee
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    vk_swiftshader_icd.json
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\vk_swiftshader_icd.json
                    • Size 106B
                    • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                    • MD5 SHA1 SHA512
                    Submit Download

                    vulkan-1.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\7z-out\vulkan-1.dll
                    • Size 932KB
                    • SHA256 419488597ea255ec61f028aeecd36572d072dfe49b7ab716cd2c0a8e186f24e6
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    StdUtils.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\StdUtils.dll
                    • Size 100KB
                    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    System.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\System.dll
                    • Size 12KB
                    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    UAC.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\UAC.dll
                    • Size 14KB
                    • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    WinShell.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\WinShell.dll
                    • Size 3KB
                    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                    • MD5 SHA1 SHA512
                    Submit Download

                    nsExec.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\nsExec.dll
                    • Size 6KB
                    • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    nsis7z.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nszF780.tmp\nsis7z.dll
                    • Size 424KB
                    • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    default.dic
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                    • Size 2B
                    • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                    • MD5 SHA1 SHA512
                    Submit Download

                    data_0
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\data_0
                    • Size 44KB
                    • SHA256 e56b291b0f59d72686dd826b9dd0453f6ad41aacf47b8122fc527d571af98b4e
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_1
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\data_1
                    • Size 264KB
                    • SHA256 1f801719dd64f744b22c27d311938bb0fd10dc227d48a2405081a5c2ea417006
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_2
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\data_2
                    • Size 1.0MB
                    • SHA256 678c772e77ec843f917cb3b32538420bd4ea66398e72b72d452510710c3bec02
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_3
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\data_3
                    • Size 4.0MB
                    • SHA256 1e8a99ab820b3dba912647312ebc96e15157ae01606cf924f107e1e82fe59d8e
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    f_000001
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\f_000001
                    • Size 32KB
                    • SHA256 bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    index
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\index
                    • Size 256KB
                    • SHA256 ae0585ffeb2398f0228302fc511514a716c631eac75e5029ed20bbf3f383d55f
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    the-real-index
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Code Cache\js\index-dir\the-real-index
                    • Size 72B
                    • SHA256 c55c6d8f5a4721a89ff4c769c33a449f645ce5b17dd516043503b6948166ac58
                    • MD5 SHA1 SHA512
                    Submit Download

                    index
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Code Cache\wasm\index
                    • Size 24B
                    • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                    • MD5 SHA1 SHA512
                    Submit Download

                    the-real-index
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Code Cache\wasm\index-dir\the-real-index
                    • Size 48B
                    • SHA256 0c53229ed54d4567631e97c470f5fb14565341334d8492c3a1bf7b29b3022b06
                    • MD5 SHA1 SHA512
                    Submit Download

                    data_0
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\DawnCache\data_0
                    • Size 8KB
                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_2
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\DawnCache\data_2
                    • Size 8KB
                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_3
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\DawnCache\data_3
                    • Size 8KB
                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    index
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\DawnCache\index
                    • Size 256KB
                    • SHA256 fdb2ef1f1cbd3c2f970176b3c725162b27ad178d7edd9e460ffe156746a1c122
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_0
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\GPUCache\data_0
                    • Size 44KB
                    • SHA256 c54bf3ab72b6cc56e6ceaf757a51609c8e669a5e7c845031fe607824bf245852
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_1
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\GPUCache\data_1
                    • Size 264KB
                    • SHA256 4ff60826bc5a699bd5f8220b14409cbd8451e742a0571563c2ea53ddd484b6f3
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_2
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\GPUCache\data_2
                    • Size 1.0MB
                    • SHA256 c9e6ee396622bafc09f2703c4054c521161462e81f095051555c0866ffce7e61
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_3
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\GPUCache\data_3
                    • Size 4.0MB
                    • SHA256 8858cb44349606d9a5a6d6acff3318d6051554536a49ab1a96f16106c577bf26
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    index
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\GPUCache\index
                    • Size 256KB
                    • SHA256 8d2ff1444b049a920bc93e5a57cee0240da4e3a434e46afc79e0e187c903c49d
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Local State
                    • Size 434B
                    • SHA256 36c0be74d19f86cca9aacb6a7a1be9bb9aa1be4b5b43f7d3f3cec9ad633fadc4
                    • MD5 SHA1 SHA512
                    Submit Download

                    LOG
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Local Storage\leveldb\LOG
                    • Size 261B
                    • SHA256 e9a0f9052e723dcc5c291af4eaadda7adde430580f8661de79cde2363fc1ea38
                    • MD5 SHA1 SHA512
                    Submit Download

                    Cookies
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Cookies
                    • Size 20KB
                    • SHA256 ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Network Persistent State
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Network Persistent State
                    • Size 859B
                    • SHA256 c5e7c66a351ad6a16cd2cecb9e6a3ca5c64edcde2169963c84bcc0d010317b61
                    • MD5 SHA1 SHA512
                    Submit Download

                    Network Persistent State
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Network Persistent State
                    • Size 1KB
                    • SHA256 6f7dc4c2dcafdb22604cba1f7670f6f3040e636871b7336b0928c879398b5a5f
                    • MD5 SHA1 SHA512
                    Submit Download

                    Network Persistent State~RFe57f58b.TMP
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Network Persistent State~RFe57f58b.TMP
                    • Size 59B
                    • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                    • MD5 SHA1 SHA512
                    Submit Download

                    TransportSecurity
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\TransportSecurity
                    • Size 524B
                    • SHA256 75d726a03e415c5dcca63a9251df1ff4b20872f5171774bd26d506f98c172e14
                    • MD5 SHA1 SHA512
                    Submit Download

                    TransportSecurity
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\TransportSecurity
                    • Size 524B
                    • SHA256 6ba8b061bf2117d4565967a9543b0f27895fa7a3f14449aa844c1c09bff03456
                    • MD5 SHA1 SHA512
                    Submit Download

                    Trust Tokens
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Trust Tokens
                    • Size 36KB
                    • SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Preferences
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Preferences
                    • Size 57B
                    • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
                    • MD5 SHA1 SHA512
                    Submit Download

                    Preferences~RFe57bf1a.TMP
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Preferences~RFe57bf1a.TMP
                    • Size 86B
                    • SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
                    • MD5 SHA1 SHA512
                    Submit Download

                    CURRENT
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Session Storage\CURRENT
                    • Size 16B
                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                    • MD5 SHA1 SHA512
                    Submit Download

                    MANIFEST-000001
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Session Storage\MANIFEST-000001
                    • Size 41B
                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                    • MD5 SHA1 SHA512
                    Submit Download

                    the-real-index
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Shared Dictionary\cache\index-dir\the-real-index
                    • Size 48B
                    • SHA256 c1c78a280d56133a9fa82531b3904cb0bbbe0f8a6b9213fc001b14273b7655b7
                    • MD5 SHA1 SHA512
                    Submit Download

                    db
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Shared Dictionary\db
                    • Size 44KB
                    • SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    main.log
                    • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\logs\main.log
                    • Size 4KB
                    • SHA256 629ba700802dbb5d25bd84a1049a71c709688b7fc3a75466fa361b60b25c1561
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    memory/1232-86-0x00000284FE040000-0x00000284FE062000-memory.dmp
                    Download

                    memory/1232-90-0x00000284FE070000-0x00000284FE09A000-memory.dmp
                    Download

                    memory/1232-91-0x00000284FE070000-0x00000284FE094000-memory.dmp
                    Download

                    memory/2744-87-0x000002176A0C0000-0x000002176A106000-memory.dmp
                    Download

                    memory/4296-1166-0x00007FFEAA160000-0x00007FFEAA161000-memory.dmp
                    Download

                    memory/4296-1165-0x00007FFEAAFC0000-0x00007FFEAAFC1000-memory.dmp
                    Download