Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2024, 17:27

General

  • Target
    Ultimate Tweaks.exe
  • Size 168.2MB
  • Sample240921-v1devatgqg
  • SHA256 3b47e84d5ca6ad15d2e8916d6cbd6af9ab943a42e84241e0517eaab66b5ef214
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 17 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
      "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1728,i,6224985324855650228,11352602902650706583,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      2⤵
        PID:3216
      • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
        "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --mojo-platform-channel-handle=2164 --field-trial-handle=1728,i,6224985324855650228,11352602902650706583,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
        2⤵
          PID:2976
        • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
          "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2436 --field-trial-handle=1728,i,6224985324855650228,11352602902650706583,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
          2⤵
          • Checks computer location settings
          PID:3856
        • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
          "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2336 --field-trial-handle=1728,i,6224985324855650228,11352602902650706583,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:624
        • C:\Users\Admin\AppData\Local\ultimate-tweaks-updater\pending\Ultimate-Tweaks-Setup-1.0.5.exe
          C:\Users\Admin\AppData\Local\ultimate-tweaks-updater\pending\Ultimate-Tweaks-Setup-1.0.5.exe --updated /S --force-run
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4296
      • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe
        "C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe" --updated
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4756
        • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe
          "C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1892 --field-trial-handle=1896,i,4161499268208987736,6878990263319875107,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3724
        • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe
          "C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --mojo-platform-channel-handle=1928 --field-trial-handle=1896,i,4161499268208987736,6878990263319875107,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4064
        • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe
          "C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --app-path="C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2336 --field-trial-handle=1896,i,4161499268208987736,6878990263319875107,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4888

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            chrome_100_percent.pak

            • Path C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\chrome_100_percent.pak
            • Size 150KB
            • SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
            • MD5 SHA1 SHA512 SSDEEP

            libGLESv2.dll

            • Path C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\libGLESv2.dll
            • Size 7.3MB
            • SHA256 3a39137dcee6cb6663ae9cca424b6b05cf56c0ad7e32fb72cb94549ea9dbcae8
            • MD5 SHA1 SHA512 SSDEEP

            LICENSE.electron.txt

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\LICENSE.electron.txt
            • Size 1KB
            • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
            • MD5 SHA1 SHA512

            LICENSES.chromium.html

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\LICENSES.chromium.html
            • Size 8.7MB
            • SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
            • MD5 SHA1 SHA512 SSDEEP

            chrome_200_percent.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\chrome_200_percent.pak
            • Size 229KB
            • SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
            • MD5 SHA1 SHA512 SSDEEP

            d3dcompiler_47.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\d3dcompiler_47.dll
            • Size 4.7MB
            • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
            • MD5 SHA1 SHA512 SSDEEP

            ffmpeg.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\ffmpeg.dll
            • Size 2.7MB
            • SHA256 450d5e6a11dc31dc6e1a7af472cd08b7e7a78976b1f0aa1c62055a0a720f5080
            • MD5 SHA1 SHA512 SSDEEP

            icudtl.dat

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\icudtl.dat
            • Size 10.2MB
            • SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
            • MD5 SHA1 SHA512 SSDEEP

            libEGL.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\libEGL.dll
            • Size 467KB
            • SHA256 afef052c621f72ba986d917a9e090d23a13f4ab6bc09f158eeb73fd671b94219
            • MD5 SHA1 SHA512 SSDEEP

            af.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\af.pak
            • Size 478KB
            • SHA256 f402c0d8494c9a2fceedcd7845ddf43b62e7d01ddb1d9c8e132efea83b724824
            • MD5 SHA1 SHA512 SSDEEP

            am.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\am.pak
            • Size 776KB
            • SHA256 325dd137903fc0d9e5010a62a314d9c6984ff82afbdff2254f7c48bd03dda06a
            • MD5 SHA1 SHA512 SSDEEP

            ar.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\ar.pak
            • Size 851KB
            • SHA256 3bb407fa588fb801ab241e8dda018461b54010a38648c3acc1e3550c0dfbd75a
            • MD5 SHA1 SHA512 SSDEEP

            bg.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\bg.pak
            • Size 885KB
            • SHA256 5947f567ce1f4ab945dc6dab1599422d412f4417b9097905150d669122e43f7d
            • MD5 SHA1 SHA512 SSDEEP

            bn.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\bn.pak
            • Size 1.1MB
            • SHA256 a45279ccc13390e0d93cfe1e33a7f276a5d9e97f6aefa6b6e14ecc4289703bda
            • MD5 SHA1 SHA512 SSDEEP

            ca.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\ca.pak
            • Size 538KB
            • SHA256 1dca9a7fcd850aecd48288999b436ff7e70cd4a96f47b40319759a800fb8eefa
            • MD5 SHA1 SHA512 SSDEEP

            cs.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\cs.pak
            • Size 555KB
            • SHA256 2964edcdcb27b2edf73515615501d8af28ad94b5dd31d2794f2624808c74de38
            • MD5 SHA1 SHA512 SSDEEP

            da.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\da.pak
            • Size 501KB
            • SHA256 318a9ec9e9fbe35d5d8cb9b719ecfbe1ecba9d8f246876c949c082107b439ddb
            • MD5 SHA1 SHA512 SSDEEP

            de.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\de.pak
            • Size 536KB
            • SHA256 d5746f48800efbff7db9d1bb8d6e5a5102eb7d79ae136e0485fd427be1ca63a1
            • MD5 SHA1 SHA512 SSDEEP

            el.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\el.pak
            • Size 971KB
            • SHA256 c0434492be64b08f9ad00bc7cff65314822406dfb0c591fea0df6af9b6fc89c5
            • MD5 SHA1 SHA512 SSDEEP

            en-GB.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\en-GB.pak
            • Size 436KB
            • SHA256 e0df967ffdf872f0a9589a0d74d68a742fa9b956add7a6736b82aebd9e8f02d3
            • MD5 SHA1 SHA512 SSDEEP

            en-US.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\en-US.pak
            • Size 440KB
            • SHA256 02b97817b6eebd7caeaaff750f6462abc68911c398ddf0571b7900ff9b4ea9a2
            • MD5 SHA1 SHA512 SSDEEP

            es-419.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\es-419.pak
            • Size 530KB
            • SHA256 0c816f00b15d59809d30b6611aa455ea1bf8b022d2f887137f1c9d7a5600d5d9
            • MD5 SHA1 SHA512 SSDEEP

            es.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\es.pak
            • Size 530KB
            • SHA256 54f85551269c8b5f3985a09d313fdc04c4595e5058163cf147ede049b8faa605
            • MD5 SHA1 SHA512 SSDEEP

            et.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\et.pak
            • Size 481KB
            • SHA256 8021814965878c4913d1f9f9d226da49cc2a37746d976f3b84aad7fe096fd14f
            • MD5 SHA1 SHA512 SSDEEP

            fa.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\fa.pak
            • Size 789KB
            • SHA256 9b5334e4883a716c5616c859889aacd7b179b30ac65e5657198eb4e877700f81
            • MD5 SHA1 SHA512 SSDEEP

            fi.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\fi.pak
            • Size 492KB
            • SHA256 4bf099ac8a76449bf597caf005790f5c02efd533b9a329c5fdc460d38f77607e
            • MD5 SHA1 SHA512 SSDEEP

            fil.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\fil.pak
            • Size 556KB
            • SHA256 00b8cfe6131499a8a67a51dd8560a965a2abb863d52635dd3931df0479c3f5ee
            • MD5 SHA1 SHA512 SSDEEP

            fr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\fr.pak
            • Size 574KB
            • SHA256 7169684ff44f342b98648839b8963916f7323115dead332c2471baed6264b80e
            • MD5 SHA1 SHA512 SSDEEP

            gu.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\gu.pak
            • Size 1.1MB
            • SHA256 8c762963cca8eef2cbd39bd7bcd8b809f3b57a75353e687743894add9c19440f
            • MD5 SHA1 SHA512 SSDEEP

            he.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\he.pak
            • Size 691KB
            • SHA256 9e5544340da0e0aa28298e68765716a3960a28e50d86146b5324fd70fd756b41
            • MD5 SHA1 SHA512 SSDEEP

            hi.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\hi.pak
            • Size 1.2MB
            • SHA256 8dae029a489f1bd7530650a9cb1be1f03741e1d7018503feb3c78759da8af531
            • MD5 SHA1 SHA512 SSDEEP

            hr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\hr.pak
            • Size 535KB
            • SHA256 6dcc7d5d771475874471b78ee84db0230341f8634f4b38a9cb90c37226d70b00
            • MD5 SHA1 SHA512 SSDEEP

            hu.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\hu.pak
            • Size 576KB
            • SHA256 61854ab102bc57a7ad7b85a4fa008c3f071306838ba1a0491f68c19153decd49
            • MD5 SHA1 SHA512 SSDEEP

            id.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\id.pak
            • Size 475KB
            • SHA256 64a8a25717ffae1855114d84b02223ad5b3963c1c6a21c826636146726d0a8a2
            • MD5 SHA1 SHA512 SSDEEP

            it.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\it.pak
            • Size 523KB
            • SHA256 9395bf9a547561df6cd20d8e076452369cb72184f215448d1acd802dccf3a47d
            • MD5 SHA1 SHA512 SSDEEP

            ja.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\ja.pak
            • Size 639KB
            • SHA256 8de18410e38f4036367113bd4ed253a4957709d87e0aeb11134742bc89e16d62
            • MD5 SHA1 SHA512 SSDEEP

            kn.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\kn.pak
            • Size 1.3MB
            • SHA256 01250aec7310bb59e0e847382325f940ea2cdab00369c1c7efe2f340d01ff806
            • MD5 SHA1 SHA512 SSDEEP

            ko.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\ko.pak
            • Size 540KB
            • SHA256 ff88b56be0614232947bfb07e6beb88327a18ebec98cece17caa9b7cd8e6dd24
            • MD5 SHA1 SHA512 SSDEEP

            lt.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\lt.pak
            • Size 580KB
            • SHA256 f87b2baacdde69b2b24dc7859d47bad0844cf4d275072812aaf4eedb10318450
            • MD5 SHA1 SHA512 SSDEEP

            lv.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\lv.pak
            • Size 579KB
            • SHA256 dbc860a35ad08e4f502b8784ca1548110d3c7334478f6c392db42f52cb3074f2
            • MD5 SHA1 SHA512 SSDEEP

            ml.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\ml.pak
            • Size 1.3MB
            • SHA256 878e268428ec7aa51105c921740931c545d4ba6a274b367c52675c90741d23bf
            • MD5 SHA1 SHA512 SSDEEP

            mr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\mr.pak
            • Size 1.1MB
            • SHA256 362df1aa112a0a521617c0496087b3547a242eb79a5416b8414c5798f31e187d
            • MD5 SHA1 SHA512 SSDEEP

            ms.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\ms.pak
            • Size 498KB
            • SHA256 e5e77421c5fca5b1eaef96fbf33c345c63119015986163cb43d65075df6265d0
            • MD5 SHA1 SHA512 SSDEEP

            nb.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\nb.pak
            • Size 483KB
            • SHA256 67d997fff8a24eaa030eadede7f5345fff5e954e96bc8f36d399839bed998774
            • MD5 SHA1 SHA512 SSDEEP

            nl.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\nl.pak
            • Size 499KB
            • SHA256 d88b02d74e01b9350d3ac9c48fe08333ca9c68e3e3824d64fae86c5b8b531feb
            • MD5 SHA1 SHA512 SSDEEP

            pl.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\pl.pak
            • Size 557KB
            • SHA256 03258ecf731487231cc7eab8f6cb96e92b7ede4cc5b63c3def6ba08e0f16da10
            • MD5 SHA1 SHA512 SSDEEP

            pt-BR.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\pt-BR.pak
            • Size 524KB
            • SHA256 952234ef1d2792204f4e65cc814e9fc6dc007610668ceffb980c74fc0167ba0b
            • MD5 SHA1 SHA512 SSDEEP

            pt-PT.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\pt-PT.pak
            • Size 527KB
            • SHA256 72ca754dcb34c54b72087ab7fd5a4a3fa03e09cd1ced906d99d6525c7a19ee9c
            • MD5 SHA1 SHA512 SSDEEP

            ro.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\ro.pak
            • Size 546KB
            • SHA256 6343589863bdd2ae81ec9c33e335048fd8792d2c2e8872f91f7a325a1f0d97ac
            • MD5 SHA1 SHA512 SSDEEP

            ru.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\ru.pak
            • Size 897KB
            • SHA256 8c169d6995d97feae8b8ec947be27697ca0ff731b593fff36163e4f31969a6fd
            • MD5 SHA1 SHA512 SSDEEP

            sk.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\sk.pak
            • Size 563KB
            • SHA256 441155d63257beaac9e2998afa1a9e65957286ed1cd9e0670072a63e24ff3f8b
            • MD5 SHA1 SHA512 SSDEEP

            sl.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\sl.pak
            • Size 541KB
            • SHA256 26e29cd70c4143d7e9fb65e86e02c9173997f2fc062633a5edb2b7df55942157
            • MD5 SHA1 SHA512 SSDEEP

            sr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\sr.pak
            • Size 833KB
            • SHA256 ac09005a83d4ac8f61855c7e301e48a753d2f3558a04cdb94f23b539e2086e54
            • MD5 SHA1 SHA512 SSDEEP

            sv.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\sv.pak
            • Size 486KB
            • SHA256 ca34ee1c147358b5e32b5829acc0c355708925dc8df91c21d8e495c7485fa5c7
            • MD5 SHA1 SHA512 SSDEEP

            sw.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\sw.pak
            • Size 512KB
            • SHA256 51482431411be2d89bfc026b9acf9ce1a0fb971376468a47829a15392b47178a
            • MD5 SHA1 SHA512 SSDEEP

            ta.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\ta.pak
            • Size 1.3MB
            • SHA256 75638ac7fdb226c0840d5c2edf763bae35afa1f47e89199d9724ff46c003a2c2
            • MD5 SHA1 SHA512 SSDEEP

            te.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\te.pak
            • Size 1.2MB
            • SHA256 caeba6c853a0ee12a802fb9f610a95c676071414c1d8407d18b05f2fe8ce6bb7
            • MD5 SHA1 SHA512 SSDEEP

            th.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\th.pak
            • Size 1.0MB
            • SHA256 d01ecd4edecf1809d5c2133366df2502a4621e88d894817e80b913f3a0926fa4
            • MD5 SHA1 SHA512 SSDEEP

            tr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\tr.pak
            • Size 523KB
            • SHA256 026fc65ed90fe356ce2b5e2b459a4487512d89e48f0ff8b044d6739ef51c1658
            • MD5 SHA1 SHA512 SSDEEP

            uk.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\uk.pak
            • Size 896KB
            • SHA256 e33b1a611feca93d105dee7c867521b5fbf27da38532ea3ca0aec61bec7f6108
            • MD5 SHA1 SHA512 SSDEEP

            ur.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\ur.pak
            • Size 782KB
            • SHA256 b551a93a300ab78ee6da5087ea417584c4fd3941fbac99c84c9c58be2c88a7e8
            • MD5 SHA1 SHA512 SSDEEP

            vi.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\vi.pak
            • Size 619KB
            • SHA256 d435c4c7154c24982185842a09cacd343cea77a5eb7fb859c4d38973cf240a42
            • MD5 SHA1 SHA512 SSDEEP

            zh-CN.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\zh-CN.pak
            • Size 447KB
            • SHA256 cc5a411d3bf0ddfba9e5041dfeeaed70265ba949f7b7ccba0170b88e3e14ceb0
            • MD5 SHA1 SHA512 SSDEEP

            zh-TW.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\locales\zh-TW.pak
            • Size 442KB
            • SHA256 58753d4313ed7f548df16a9cd9aa1f0e30cebee675a76b8359ed23fc95825574
            • MD5 SHA1 SHA512 SSDEEP

            resources.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\resources.pak
            • Size 5.0MB
            • SHA256 5d63acd4034f7771ca346d138d7478014abf1f3f4386d07fc025dbc2c2bc0bff
            • MD5 SHA1 SHA512 SSDEEP

            app-update.yml

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\resources\app-update.yml
            • Size 108B
            • SHA256 35a17df859da48ac7add7419ad3eaa4963a40e7797ac72236acc3927009686d1
            • MD5 SHA1 SHA512

            app.asar

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\resources\app.asar
            • Size 20.7MB
            • SHA256 20ba9996c2fbd5f06db03358e995e39b33b9d110c811d5628853d8fc2202db04
            • MD5 SHA1 SHA512 SSDEEP

            elevate.exe

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\resources\elevate.exe
            • Size 105KB
            • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
            • MD5 SHA1 SHA512 SSDEEP

            snapshot_blob.bin

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\snapshot_blob.bin
            • Size 298KB
            • SHA256 0976145cc8c02f3e64ddbf51dc983bdbb456be7fcf3ce54608e218981671ac12
            • MD5 SHA1 SHA512 SSDEEP

            v8_context_snapshot.bin

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\v8_context_snapshot.bin
            • Size 663KB
            • SHA256 875515af4e7254458c17a98bed087fc609d45fbc8ebf60663e112c37204f6840
            • MD5 SHA1 SHA512 SSDEEP

            vk_swiftshader.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\vk_swiftshader.dll
            • Size 5.1MB
            • SHA256 08e34bc25653f9357a4ccf62966d698b7cc6265dc668046a28403ae5786132ee
            • MD5 SHA1 SHA512 SSDEEP

            vk_swiftshader_icd.json

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\vk_swiftshader_icd.json
            • Size 106B
            • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
            • MD5 SHA1 SHA512

            vulkan-1.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\7z-out\vulkan-1.dll
            • Size 932KB
            • SHA256 419488597ea255ec61f028aeecd36572d072dfe49b7ab716cd2c0a8e186f24e6
            • MD5 SHA1 SHA512 SSDEEP

            StdUtils.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\StdUtils.dll
            • Size 100KB
            • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
            • MD5 SHA1 SHA512 SSDEEP

            System.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\System.dll
            • Size 12KB
            • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
            • MD5 SHA1 SHA512 SSDEEP

            UAC.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\UAC.dll
            • Size 14KB
            • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
            • MD5 SHA1 SHA512 SSDEEP

            WinShell.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\WinShell.dll
            • Size 3KB
            • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
            • MD5 SHA1 SHA512

            nsExec.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\nsExec.dll
            • Size 6KB
            • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
            • MD5 SHA1 SHA512 SSDEEP

            nsis7z.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsaA8AB.tmp\nsis7z.dll
            • Size 424KB
            • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
            • MD5 SHA1 SHA512 SSDEEP

            default.dic

            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
            • Size 2B
            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
            • MD5 SHA1 SHA512

            data_0

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\data_0
            • Size 44KB
            • SHA256 bed9ab2e5c717535fa1bc8f642bf884efbb61ce4c5d6cf00f5bcbb8064982c66
            • MD5 SHA1 SHA512 SSDEEP

            data_1

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\data_1
            • Size 264KB
            • SHA256 05e8a196981d26bb9514f88d0bfc156a9fcb2179e2fb59373d2d1e6a7af19ad6
            • MD5 SHA1 SHA512 SSDEEP

            data_2

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\data_2
            • Size 1.0MB
            • SHA256 0466a3adcd2a314a136c0c123bcb753cd2180f422e1ab5ab78baf623ed4aa2aa
            • MD5 SHA1 SHA512 SSDEEP

            data_3

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\data_3
            • Size 4.0MB
            • SHA256 cb8ec5b8e223a0706085e99a0b769b0bbc6ec710dbc79f6451c1b736e79c4e46
            • MD5 SHA1 SHA512 SSDEEP

            f_000001

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\f_000001
            • Size 32KB
            • SHA256 bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
            • MD5 SHA1 SHA512 SSDEEP

            index

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\index
            • Size 256KB
            • SHA256 e444c29c6707c1987b09f485b63142bb56a152580f83484026031f5795280c45
            • MD5 SHA1 SHA512 SSDEEP

            index

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Code Cache\wasm\index
            • Size 24B
            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
            • MD5 SHA1 SHA512

            the-real-index

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Code Cache\wasm\index-dir\the-real-index
            • Size 48B
            • SHA256 887e908fa927e5a6aed7cca8926aaaae1c811b3f983119888303d7b639521c6c
            • MD5 SHA1 SHA512

            data_0

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\DawnCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP

            data_1

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\DawnCache\data_1
            • Size 264KB
            • SHA256 bc88ce491d5dd269aaa7a9fde7ff1299da0f761b1656f8f12e0a7c4d8da29b31
            • MD5 SHA1 SHA512 SSDEEP

            data_2

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\DawnCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP

            data_3

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\DawnCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP

            index

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\DawnCache\index
            • Size 256KB
            • SHA256 897171cd5cf940cdf9d59bc30271a1014287e28853ae5fb3ec1853cfc5f2b332
            • MD5 SHA1 SHA512 SSDEEP

            data_0

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\GPUCache\data_0
            • Size 44KB
            • SHA256 7aaef2f4df392662ac119886ccc394c61a8cab7a224edecc211c0806ff36d259
            • MD5 SHA1 SHA512 SSDEEP

            data_1

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\GPUCache\data_1
            • Size 264KB
            • SHA256 a023fc97a6cdd4480dcb194c5e3a285852e2815985793388097f14d14e43e1d9
            • MD5 SHA1 SHA512 SSDEEP

            data_2

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\GPUCache\data_2
            • Size 1.0MB
            • SHA256 aa9eb3ee7fbe0bd268090ada7618a030423611ef613e5210667c8d42b0df3235
            • MD5 SHA1 SHA512 SSDEEP

            data_3

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\GPUCache\data_3
            • Size 4.0MB
            • SHA256 615aa8de7b6e75742b22010f95c029f00bdb7c24b22077bb95bded4a3a5971ef
            • MD5 SHA1 SHA512 SSDEEP

            index

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\GPUCache\index
            • Size 256KB
            • SHA256 45f5ed3ac974d77d5d3cd1ee3790cf2d6ad45ad136efb8dc7e9a81243d3f3558
            • MD5 SHA1 SHA512 SSDEEP

            Local State

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Local State
            • Size 434B
            • SHA256 bf3f1e018419a0ac18b5eb03224a27de8e0126967d215eee674b0d6bcd2eb426
            • MD5 SHA1 SHA512

            LOG

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Local Storage\leveldb\LOG
            • Size 261B
            • SHA256 7b59dc132288d30e19b8f3bd410118197124bf4133cb7755698bcc5e3613327a
            • MD5 SHA1 SHA512

            Cookies

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Cookies
            • Size 20KB
            • SHA256 ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7
            • MD5 SHA1 SHA512 SSDEEP

            Network Persistent State

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Network Persistent State
            • Size 880B
            • SHA256 e77eaa1e289e3d88dabf6f61cc6f13b506d68701f48a7d7eab4b4215869e6b43
            • MD5 SHA1 SHA512

            Network Persistent State~RFe58c5eb.TMP

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Network Persistent State~RFe58c5eb.TMP
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512

            TransportSecurity

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\TransportSecurity
            • Size 524B
            • SHA256 a72e38cbb6eb107ef9731583141c30fe8565b9f3bb9dc407126180cbdd5e5cec
            • MD5 SHA1 SHA512

            Trust Tokens

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Trust Tokens
            • Size 36KB
            • SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
            • MD5 SHA1 SHA512 SSDEEP

            Preferences

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Preferences
            • Size 57B
            • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
            • MD5 SHA1 SHA512

            Preferences~RFe57c62e.TMP

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Preferences~RFe57c62e.TMP
            • Size 86B
            • SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
            • MD5 SHA1 SHA512

            CURRENT

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Session Storage\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512

            MANIFEST-000001

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Session Storage\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512

            the-real-index

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Shared Dictionary\cache\index-dir\the-real-index
            • Size 48B
            • SHA256 9f76838b83fe49b8efaff38fad9be97ac19a19e865857c83d1deded989df30ca
            • MD5 SHA1 SHA512

            db

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Shared Dictionary\db
            • Size 44KB
            • SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
            • MD5 SHA1 SHA512 SSDEEP

            main.log

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\logs\main.log
            • Size 4KB
            • SHA256 54f8026eaa07a063f27be017546f4eac4dd749c7d5ee7f985f3846313b5ae247
            • MD5 SHA1 SHA512 SSDEEP

            main.log

            • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\logs\main.log
            • Size 13KB
            • SHA256 a85087e543082e560854cfa52986dbdcc6d6cd572b4ef5f0a843d43d20a86a91
            • MD5 SHA1 SHA512 SSDEEP

            memory/624-205-0x00000188B5AF0000-0x00000188B5AF1000-memory.dmp

            memory/624-214-0x00000188B5AF0000-0x00000188B5AF1000-memory.dmp

            memory/624-215-0x00000188B5AF0000-0x00000188B5AF1000-memory.dmp

            memory/624-213-0x00000188B5AF0000-0x00000188B5AF1000-memory.dmp

            memory/624-212-0x00000188B5AF0000-0x00000188B5AF1000-memory.dmp

            memory/624-211-0x00000188B5AF0000-0x00000188B5AF1000-memory.dmp

            memory/624-210-0x00000188B5AF0000-0x00000188B5AF1000-memory.dmp

            memory/624-216-0x00000188B5AF0000-0x00000188B5AF1000-memory.dmp

            memory/624-203-0x00000188B5AF0000-0x00000188B5AF1000-memory.dmp

            memory/624-204-0x00000188B5AF0000-0x00000188B5AF1000-memory.dmp