Overview

overview

9

Static

static

3

ProjectLoad.exe

windows10-2004-x64

9

ProjectLoad.exe

windows10-ltsc_2021-x64

9

ProjectLoad.exe

windows11-21h2-x64

9

Resubmissions

29/04/2026, 16:48

260429-vbcf9ahw4p9

29/04/2026, 16:22

260429-tvqmjshv4m7

Analysis

  • user interaction
    yes
  • max time kernel
    299s
  • max time network
    300s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    29/04/2026, 16:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ProjectLoad.exe
  • Size 64.5MB
  • Sample260429-vbcf9ahw4p
  • SHA256 f86352ecaf34773e85d979220b9825f6c1ec45b5c93d5ecca9998dc2b49cf3a8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionspywarethemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 9 IoCs
  • Themida packer 18 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    defense_evasiontrojan
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ProjectLoad.exe
    "C:\Users\Admin\AppData\Local\Temp\ProjectLoad.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\GitHub Files Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\GitHub Files Installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3208
      • C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\GitHub Files Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\GitHub Files Installer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1668 --field-trial-handle=1672,i,17742131220697537669,8112041648006913257,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4276
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Windows\system32\tasklist.exe
          tasklist /FO CSV /NH
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:6080
      • C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\GitHub Files Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\GitHub Files Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec" --mojo-platform-channel-handle=1984 --field-trial-handle=1672,i,17742131220697537669,8112041648006913257,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2972
      • C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\GitHub Files Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\GitHub Files Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec" --app-path="C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2752 --field-trial-handle=1672,i,17742131220697537669,8112041648006913257,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4584
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\edf28279.vbs""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Windows\system32\wscript.exe
          wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\edf28279.vbs"
          4⤵
            PID:5456
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\GitHub Files Installer.exe" /t REG_DWORD /d 0 /f"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3172
          • C:\Windows\system32\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\GitHub Files Installer.exe" /t REG_DWORD /d 0 /f
            4⤵
              PID:1488
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116" /t REG_DWORD /d 0 /f"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2028
            • C:\Windows\system32\reg.exe
              reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116" /t REG_DWORD /d 0 /f
              4⤵
                PID:2432
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe" /t REG_DWORD /d 0 /f"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3720
              • C:\Windows\system32\reg.exe
                reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe" /t REG_DWORD /d 0 /f
                4⤵
                  PID:1376
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "mshta.exe "C:\Users\Admin\AppData\Local\Temp\580d17.hta""
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4280
                • C:\Windows\system32\mshta.exe
                  mshta.exe "C:\Users\Admin\AppData\Local\Temp\580d17.hta"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:232
                  • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe
                    "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:5572
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe""
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5340
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5824
                  • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe
                    "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:324
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\a7eacc.vbs""
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1196
                • C:\Windows\system32\wscript.exe
                  wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\a7eacc.vbs"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5648
                  • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe
                    "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:5564
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe""
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5192
                • C:\Windows\explorer.exe
                  explorer.exe "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe"
                  4⤵
                    PID:4136
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -W Hidden -E UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEcAaQB0AEgAdQBiAFwAYwBhAGMAaABlAFwAMQA3ADcANwA0ADgAMQAzADMANgAxADEANgBcAEcAaQB0AEgAdQBiAEQAZQBzAGsAdABvAHAASABlAGwAcABlAHIALgBlAHgAZQAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA="
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1596
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoP -NonI -W Hidden -E UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEcAaQB0AEgAdQBiAFwAYwBhAGMAaABlAFwAMQA3ADcANwA0ADgAMQAzADMANgAxADEANgBcAEcAaQB0AEgAdQBiAEQAZQBzAGsAdABvAHAASABlAGwAcABlAHIALgBlAHgAZQAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3364
                    • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe
                      "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe"
                      5⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:1428
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:5480
              • C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe
                "C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe"
                2⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:3300

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  580d17.hta
                  • Path C:\Users\Admin\AppData\Local\Temp\580d17.hta
                  • Size 163B
                  • SHA256 1931d6cb60e3f726a71fde335045eeeb70e28386dfc2fd887e1ecf71d2a1e896
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  chrome_100_percent.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\chrome_100_percent.pak
                  • Size 150KB
                  • SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_200_percent.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\chrome_200_percent.pak
                  • Size 229KB
                  • SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  d3dcompiler_47.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\d3dcompiler_47.dll
                  • Size 4.7MB
                  • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ffmpeg.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\ffmpeg.dll
                  • Size 2.7MB
                  • SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icudtl.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\icudtl.dat
                  • Size 10.2MB
                  • SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libEGL.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\libEGL.dll
                  • Size 468KB
                  • SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libglesv2.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\libglesv2.dll
                  • Size 7.3MB
                  • SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  en-US.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\locales\en-US.pak
                  • Size 440KB
                  • SHA256 20be1732675fedf380010b09936ed65c71bb761d0a05732215ef0795b5aba606
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\resources.pak
                  • Size 5.0MB
                  • SHA256 1efdd507bb6f4fb07329ec7ec29ee00c952d6390bd5cfe3b41fb307c5caeab6c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  app.asar
                  • Path C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\resources\app.asar
                  • Size 72KB
                  • SHA256 afb5a6ac8c5a0996c277827c67e2be455221e0266ad75113303db2380ea3c801
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  v8_context_snapshot.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\v8_context_snapshot.bin
                  • Size 663KB
                  • SHA256 83a8345ea197020e07fe2cf53e74f31d0cc632ca1537f5c9c1db2fb2665ab04f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\vk_swiftshader.dll
                  • Size 5.1MB
                  • SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader_icd.json
                  • Path C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\vk_swiftshader_icd.json
                  • Size 106B
                  • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  vulkan-1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z7E14B5AC\vulkan-1.dll
                  • Size 932KB
                  • SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  GitHubDesktopHelper.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\GitHub\cache\1777481336116\GitHubDesktopHelper.exe
                  • Size 3.5MB
                  • SHA256 a7949ce82225d83acf961ec8d4bc085758660600e4c4f965d265cc32cc6b31b4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_wdxmxatx.2z5.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wdxmxatx.2z5.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  a7eacc.vbs
                  • Path C:\Users\Admin\AppData\Local\Temp\a7eacc.vbs
                  • Size 140B
                  • SHA256 a0fa75184d20c73202faba2010ebb36b1cf0987d72a11bff99e7af4e1b05d728
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  edf28279.vbs
                  • Path C:\Users\Admin\AppData\Local\Temp\edf28279.vbs
                  • Size 533B
                  • SHA256 0a9eb219d20de8951bce1a91bc2d6b8b5e3ebc7fda426527b2b7a7f5e785272d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  default.dic
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                  • Size 2B
                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                  • MD5 SHA1 SHA512
                  Submit Download

                  temp-index
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\Code Cache\wasm\index-dir\temp-index
                  • Size 48B
                  • SHA256 e3ed7a39af7e576da4ab6f748ef8415b4cc65f0ae21918831c4f5733bb60c197
                  • MD5 SHA1 SHA512
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\DawnCache\data_1
                  • Size 264KB
                  • SHA256 aac5aa3f6094f6e56668e6313ecee829f8493a509a96f41726bfa341cf4f8e6b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\GPUCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\GPUCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\GPUCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\Network\Network Persistent State
                  • Size 496B
                  • SHA256 a76ec5e2077859f8fa390fe823c1842f8625122703c78e87432bf3cd869f7d72
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Network Persistent State~RFe58db28.TMP
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\Network\Network Persistent State~RFe58db28.TMP
                  • Size 59B
                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\Session Storage\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Roaming\gh-installer-2c3c4ed119ec\Session Storage\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  memory/324-267-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/324-298-0x0000000000760000-0x00000000007FE000-memory.dmp
                  Download

                  memory/324-296-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/324-266-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/1428-290-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/1428-415-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/1428-416-0x00000000007A0000-0x000000000083E000-memory.dmp
                  Download

                  memory/1428-292-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3300-413-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3300-414-0x0000000000510000-0x00000000005AE000-memory.dmp
                  Download

                  memory/3300-277-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3300-276-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/3364-284-0x000001AB353D0000-0x000001AB353F2000-memory.dmp
                  Download

                  memory/3364-291-0x000001AB35550000-0x000001AB355BF000-memory.dmp
                  Download

                  memory/3364-289-0x000001AB353A0000-0x000001AB353B2000-memory.dmp
                  Download

                  memory/3364-288-0x000001AB352A0000-0x000001AB352AC000-memory.dmp
                  Download

                  memory/4584-185-0x00007FFD92740000-0x00007FFD92741000-memory.dmp
                  Download

                  memory/4584-186-0x00007FFD91CC0000-0x00007FFD91CC1000-memory.dmp
                  Download

                  memory/5456-254-0x0000026FE3D90000-0x0000026FE3E2E000-memory.dmp
                  Download

                  memory/5456-255-0x0000026FE5A30000-0x0000026FE5A3C000-memory.dmp
                  Download

                  memory/5564-410-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/5564-412-0x0000000000760000-0x00000000007FE000-memory.dmp
                  Download

                  memory/5564-271-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/5564-274-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/5572-264-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/5572-263-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/5572-295-0x0000000000710000-0x00000000007AE000-memory.dmp
                  Download

                  memory/5572-293-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/5572-617-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/5572-627-0x0000000140000000-0x000000014097B000-memory.dmp
                  Download

                  memory/5648-272-0x000001B376DC0000-0x000001B376E5E000-memory.dmp
                  Download

                  memory/5648-273-0x000001B377030000-0x000001B37703C000-memory.dmp
                  Download

                  memory/6080-177-0x000001C0AFA40000-0x000001C0AFAAF000-memory.dmp
                  Download