3baa37128bd2f53c7eaf2d843d377bbb84f51925e26006a2ea850b10c78cf8af

Analysis

user interaction
yes
max time kernel
150s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VanishSetup.exe
Size 137.2MB
Sample260605-pt98cagy2k
SHA256 3baa37128bd2f53c7eaf2d843d377bbb84f51925e26006a2ea850b10c78cf8af
MD5 23a88a244e3266aad45929b7fb260eb1
SHA1 9b508ff165fe729f1dc1953cc3626e9dcc1f7d63
SHA512 81d5ed01afc689d0482f89595f28cdf27f8bac361270c7c824bc9ab6672e36a05aad9bfe71c1312eda5f8c75369bbc432b033178fd5bc832a1ddb38e844d1765
SSDEEP 3145728:jbQZij48zA6zntWj9iCfEg5Jhn1W1/HnZW7eeycbx3:jMZEjAmk3tJVaRSOK
TLSH
T1BC68332C0225CC1FC325FDB29A580F64B5DE7D702696D532E2B607F5E8BA9D3970A2D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 44 IoCs

pid	Process
1356	Update.exe
5200	Squirrel.exe
5240	Vanish.exe
3868	Update.exe
2852	Vanish.exe
2224	Vanish.exe
5444	Vanish.exe
5524	Update.exe
6092	Vanish.exe
5612	python.exe
5696	python.exe
5632	python.exe
5072	python.exe
1992	python.exe
5284	python.exe
1100	python.exe
3004	python.exe
2956	python.exe
3620	python.exe
4340	python.exe
3052	Vanish.exe
5912	Vanish.exe
5016	Vanish.exe
4980	Vanish.exe
2552	Update.exe
3216	python.exe
2304	python.exe
1620	python.exe
1616	python.exe
3000	python.exe
1008	python.exe
5852	python.exe
1796	python.exe
5792	python.exe
3324	python.exe
2652	python.exe
1876	python.exe
6124	python.exe
2412	python.exe
4224	python.exe
4700	python.exe
1032	python.exe
1752	python.exe
856	python.exe

Loads dropped DLL 64 IoCs

pid	Process
5240	Vanish.exe
2852	Vanish.exe
2224	Vanish.exe
5444	Vanish.exe
6092	Vanish.exe
2224	Vanish.exe
2224	Vanish.exe
2224	Vanish.exe
2224	Vanish.exe
2224	Vanish.exe
5612	python.exe
5612	python.exe
5696	python.exe
5696	python.exe
5612	python.exe
5612	python.exe
5612	python.exe
5612	python.exe
5696	python.exe
5696	python.exe
5696	python.exe
5696	python.exe
5612	python.exe
5612	python.exe
5612	python.exe
5696	python.exe
5696	python.exe
5696	python.exe
5612	python.exe
5696	python.exe
5696	python.exe
5696	python.exe
5696	python.exe
5696	python.exe
5696	python.exe
5696	python.exe
5632	python.exe
5632	python.exe
5632	python.exe
5632	python.exe
5632	python.exe
5632	python.exe
5632	python.exe
5632	python.exe
5632	python.exe
5612	python.exe
5612	python.exe
5612	python.exe
5612	python.exe
5696	python.exe
5696	python.exe
5696	python.exe
5632	python.exe
5632	python.exe
5632	python.exe
5632	python.exe
5612	python.exe
5612	python.exe
5632	python.exe
5632	python.exe
5632	python.exe
5612	python.exe
5612	python.exe
5612	python.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
1	raw.githubusercontent.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	Vanish.exe
File opened for modification	C:\Windows\SystemTemp	Vanish.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 14 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1984	powershell.exe
4928	powershell.exe
1748	powershell.exe
4968	powershell.exe
5724	powershell.exe
5484	powershell.exe
1852	powershell.exe
3736	powershell.exe
812	powershell.exe
3520	powershell.exe
904	powershell.exe
3620	powershell.exe
5640	powershell.exe
1536	powershell.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3400	sc.exe
3724	sc.exe
4792	sc.exe
3188	sc.exe
5672	sc.exe
3548	sc.exe
232	sc.exe
1976	sc.exe
2076	sc.exe
1924	sc.exe
5576	sc.exe
5536	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VanishSetup.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Vanish.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1356	Update.exe
1356	Update.exe
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
1748	powershell.exe
1748	powershell.exe
1748	powershell.exe
1852	powershell.exe
1852	powershell.exe
1852	powershell.exe
3736	powershell.exe
3736	powershell.exe
3736	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
812	powershell.exe
812	powershell.exe
812	powershell.exe
3520	powershell.exe
3520	powershell.exe
3520	powershell.exe
904	powershell.exe
904	powershell.exe
904	powershell.exe
3620	powershell.exe
3620	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5640	powershell.exe
5640	powershell.exe
5640	powershell.exe
1536	powershell.exe
1536	powershell.exe
1536	powershell.exe
5484	powershell.exe
5484	powershell.exe
5484	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	Update.exe
Token: SeShutdownPrivilege	2852	Vanish.exe
Token: SeCreatePagefilePrivilege	2852	Vanish.exe
Token: SeShutdownPrivilege	2852	Vanish.exe
Token: SeCreatePagefilePrivilege	2852	Vanish.exe
Token: SeDebugPrivilege	5524	Update.exe
Token: SeShutdownPrivilege	2852	Vanish.exe
Token: SeCreatePagefilePrivilege	2852	Vanish.exe
Token: SeShutdownPrivilege	2852	Vanish.exe
Token: SeCreatePagefilePrivilege	2852	Vanish.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeShutdownPrivilege	2852	Vanish.exe
Token: SeCreatePagefilePrivilege	2852	Vanish.exe
Token: SeShutdownPrivilege	2852	Vanish.exe
Token: SeCreatePagefilePrivilege	2852	Vanish.exe
Token: SeShutdownPrivilege	2852	Vanish.exe
Token: SeCreatePagefilePrivilege	2852	Vanish.exe
Token: SeShutdownPrivilege	2852	Vanish.exe
Token: SeCreatePagefilePrivilege	2852	Vanish.exe
Token: SeShutdownPrivilege	2852	Vanish.exe
Token: SeCreatePagefilePrivilege	2852	Vanish.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeShutdownPrivilege	2852	Vanish.exe
Token: SeCreatePagefilePrivilege	2852	Vanish.exe
Token: SeShutdownPrivilege	2852	Vanish.exe
Token: SeCreatePagefilePrivilege	2852	Vanish.exe
Token: SeIncreaseQuotaPrivilege	4928	powershell.exe
Token: SeSecurityPrivilege	4928	powershell.exe
Token: SeTakeOwnershipPrivilege	4928	powershell.exe
Token: SeLoadDriverPrivilege	4928	powershell.exe
Token: SeSystemProfilePrivilege	4928	powershell.exe
Token: SeSystemtimePrivilege	4928	powershell.exe
Token: SeProfSingleProcessPrivilege	4928	powershell.exe
Token: SeIncBasePriorityPrivilege	4928	powershell.exe
Token: SeCreatePagefilePrivilege	4928	powershell.exe
Token: SeBackupPrivilege	4928	powershell.exe
Token: SeRestorePrivilege	4928	powershell.exe
Token: SeShutdownPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeSystemEnvironmentPrivilege	4928	powershell.exe
Token: SeRemoteShutdownPrivilege	4928	powershell.exe
Token: SeUndockPrivilege	4928	powershell.exe
Token: SeManageVolumePrivilege	4928	powershell.exe
Token: 33	4928	powershell.exe
Token: 34	4928	powershell.exe
Token: 35	4928	powershell.exe
Token: 36	4928	powershell.exe
Token: SeShutdownPrivilege	2852	Vanish.exe
Token: SeCreatePagefilePrivilege	2852	Vanish.exe
Token: SeIncreaseQuotaPrivilege	4928	powershell.exe
Token: SeSecurityPrivilege	4928	powershell.exe
Token: SeTakeOwnershipPrivilege	4928	powershell.exe
Token: SeLoadDriverPrivilege	4928	powershell.exe
Token: SeSystemProfilePrivilege	4928	powershell.exe
Token: SeSystemtimePrivilege	4928	powershell.exe
Token: SeProfSingleProcessPrivilege	4928	powershell.exe
Token: SeIncBasePriorityPrivilege	4928	powershell.exe
Token: SeCreatePagefilePrivilege	4928	powershell.exe
Token: SeBackupPrivilege	4928	powershell.exe
Token: SeRestorePrivilege	4928	powershell.exe
Token: SeShutdownPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeSystemEnvironmentPrivilege	4928	powershell.exe
Token: SeRemoteShutdownPrivilege	4928	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1356	Update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1356	4584	VanishSetup.exe	83
PID 1356 wrote to memory of 5200	1356	Update.exe	84
PID 1356 wrote to memory of 5240	1356	Update.exe	85
PID 5240 wrote to memory of 3868	5240	Vanish.exe	86
PID 1356 wrote to memory of 2852	1356	Update.exe	87
PID 2852 wrote to memory of 2224	2852	Vanish.exe	88
PID 2852 wrote to memory of 2224	2852	Vanish.exe	88
PID 2852 wrote to memory of 5444	2852	Vanish.exe	90
PID 2852 wrote to memory of 5524	2852	Vanish.exe	92
PID 2852 wrote to memory of 6092	2852	Vanish.exe	91
PID 2852 wrote to memory of 6092	2852	Vanish.exe	91
PID 2852 wrote to memory of 5612	2852	Vanish.exe	93
PID 2852 wrote to memory of 5672	2852	Vanish.exe	94
PID 2852 wrote to memory of 5696	2852	Vanish.exe	95
PID 2852 wrote to memory of 5632	2852	Vanish.exe	96
PID 2852 wrote to memory of 1984	2852	Vanish.exe	101
PID 2852 wrote to memory of 2516	2852	Vanish.exe	106
PID 2852 wrote to memory of 5072	2852	Vanish.exe	108
PID 2516 wrote to memory of 3736	2516	net.exe	110
PID 2852 wrote to memory of 4928	2852	Vanish.exe	111
PID 5072 wrote to memory of 3944	5072	python.exe	113
PID 2852 wrote to memory of 1992	2852	Vanish.exe	114
PID 2852 wrote to memory of 5284	2852	Vanish.exe	116
PID 2852 wrote to memory of 5536	2852	Vanish.exe	118
PID 2852 wrote to memory of 1748	2852	Vanish.exe	120
PID 2852 wrote to memory of 1100	2852	Vanish.exe	123
PID 2852 wrote to memory of 3004	2852	Vanish.exe	128
PID 2852 wrote to memory of 3548	2852	Vanish.exe	130
PID 2852 wrote to memory of 1852	2852	Vanish.exe	132
PID 2852 wrote to memory of 2956	2852	Vanish.exe	134
PID 2852 wrote to memory of 3400	2852	Vanish.exe	136
PID 2852 wrote to memory of 3736	2852	Vanish.exe	138
PID 2852 wrote to memory of 3620	2852	Vanish.exe	140
PID 2852 wrote to memory of 4340	2852	Vanish.exe	142
PID 3052 wrote to memory of 5912	3052	Vanish.exe	146
PID 3052 wrote to memory of 5912	3052	Vanish.exe	146
PID 3052 wrote to memory of 5016	3052	Vanish.exe	147
PID 3052 wrote to memory of 4980	3052	Vanish.exe	148
PID 3052 wrote to memory of 4980	3052	Vanish.exe	148
PID 3052 wrote to memory of 2552	3052	Vanish.exe	149
PID 3052 wrote to memory of 1216	3052	Vanish.exe	150
PID 3052 wrote to memory of 3216	3052	Vanish.exe	153
PID 3052 wrote to memory of 3724	3052	Vanish.exe	154
PID 3052 wrote to memory of 2304	3052	Vanish.exe	155
PID 3052 wrote to memory of 1620	3052	Vanish.exe	156
PID 1216 wrote to memory of 1560	1216	net.exe	152
PID 3052 wrote to memory of 4968	3052	Vanish.exe	161
PID 3052 wrote to memory of 812	3052	Vanish.exe	163
PID 1620 wrote to memory of 1660	1620	python.exe	165
PID 3216 wrote to memory of 904	3216	python.exe	167
PID 2304 wrote to memory of 3252	2304	python.exe	166
PID 3052 wrote to memory of 1616	3052	Vanish.exe	168
PID 1616 wrote to memory of 5312	1616	python.exe	171
PID 3052 wrote to memory of 3000	3052	Vanish.exe	172
PID 3052 wrote to memory of 1008	3052	Vanish.exe	174
PID 3052 wrote to memory of 5852	3052	Vanish.exe	177
PID 3052 wrote to memory of 232	3052	Vanish.exe	179
PID 3052 wrote to memory of 3520	3052	Vanish.exe	181
PID 3052 wrote to memory of 1796	3052	Vanish.exe	186
PID 3052 wrote to memory of 1976	3052	Vanish.exe	188
PID 3052 wrote to memory of 904	3052	Vanish.exe	190
PID 3052 wrote to memory of 5792	3052	Vanish.exe	192
PID 3052 wrote to memory of 3324	3052	Vanish.exe	194
PID 3052 wrote to memory of 4792	3052	Vanish.exe	196

C:\Users\Admin\AppData\Local\Temp\VanishSetup.exe
"C:\Users\Admin\AppData\Local\Temp\VanishSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Squirrel.exe
    "C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:5200
- - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe
    "C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe" --squirrel-install 1.2.2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5240
  - - C:\Users\Admin\AppData\Local\vanish\Update.exe
      C:\Users\Admin\AppData\Local\vanish\Update.exe --createShortcut C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe --shortcut-locations Desktop,StartMenu
      4⤵
      Executes dropped EXE
      PID:3868
- - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe
    "C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe" --squirrel-firstrun
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe
      "C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Vanish" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1716,i,371410346248834179,10095448661646776852,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2224
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe
      "C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Vanish" --field-trial-handle=2348,i,371410346248834179,10095448661646776852,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5444
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe
      "C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Vanish" --app-user-model-id=com.squirrel.vanish.Vanish --app-path="C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2404,i,371410346248834179,10095448661646776852,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6092
  - - C:\Users\Admin\AppData\Local\vanish\Update.exe
      C:\Users\Admin\AppData\Local\vanish\Update.exe --checkForUpdate https://update.electronjs.org/bhavyakhunt/vanish-releases/win32-x64/1.2.2
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5524
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5612
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:5672
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5696
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1984
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3736
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5072
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' Remove-NetFirewallRule -Name 'Vanish-mDNS-Python' $null = New-NetFirewallRule ` -Name 'Vanish-mDNS-Python' ` -DisplayName 'Vanish mDNS for iPhone discovery' ` -Description 'Allow Vanish bundled python.exe to receive mDNS responses on UDP/5353 for wireless iPhone discovery.' ` -Direction Inbound ` -Action Allow ` -Program 'C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe' ` -Protocol UDP ` -LocalPort 5353 ` -Profile Public,Private,Domain ` -RemoteAddress LocalSubnet"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4928
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -c "import pymobiledevice3; print('ok')"
      4⤵
      Executes dropped EXE
      PID:1992
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:5284
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:5536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:1748
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:1100
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:3004
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:3548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:1852
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:2956
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:3400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:3736
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:3620
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:4340

C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe
"C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe
  "C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Vanish" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1644,i,3553290177107152939,6213889156932843839,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1636 /prefetch:2
  2⤵
  - Executes dropped EXE
  PID:5912
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe
  "C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Vanish" --field-trial-handle=2176,i,3553290177107152939,6213889156932843839,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe
  "C:\Users\Admin\AppData\Local\vanish\app-1.2.2\Vanish.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Vanish" --app-user-model-id=com.squirrel.vanish.Vanish --app-path="C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2428,i,3553290177107152939,6213889156932843839,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:1
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Users\Admin\AppData\Local\vanish\Update.exe
  C:\Users\Admin\AppData\Local\vanish\Update.exe --checkForUpdate https://update.electronjs.org/bhavyakhunt/vanish-releases/win32-x64/1.2.2
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1560
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:904
- C:\Windows\system32\sc.exe
  sc query "Apple Mobile Device Service"
  2⤵
  - Launches sc.exe
  PID:3724
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3252
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' Remove-NetFirewallRule -Name 'Vanish-mDNS-Python' $null = New-NetFirewallRule ` -Name 'Vanish-mDNS-Python' ` -DisplayName 'Vanish mDNS for iPhone discovery' ` -Description 'Allow Vanish bundled python.exe to receive mDNS responses on UDP/5353 for wireless iPhone discovery.' ` -Direction Inbound ` -Action Allow ` -Program 'C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe' ` -Protocol UDP ` -LocalPort 5353 ` -Profile Public,Private,Domain ` -RemoteAddress LocalSubnet"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:812
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5312
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -c "import pymobiledevice3; print('ok')"
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  PID:5852
- C:\Windows\system32\sc.exe
  sc query "Apple Mobile Device Service"
  2⤵
  - Launches sc.exe
  PID:232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3520
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\system32\sc.exe
  sc query "Apple Mobile Device Service"
  2⤵
  - Launches sc.exe
  PID:1976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:904
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  PID:5792
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\system32\sc.exe
  sc query "Apple Mobile Device Service"
  2⤵
  - Launches sc.exe
  PID:4792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3620
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\system32\sc.exe
  sc query "Apple Mobile Device Service"
  2⤵
  - Launches sc.exe
  PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5724
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  PID:6124
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\system32\sc.exe
  sc query "Apple Mobile Device Service"
  2⤵
  - Launches sc.exe
  PID:1924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5640
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\system32\sc.exe
  sc query "Apple Mobile Device Service"
  2⤵
  - Launches sc.exe
  PID:3188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  PID:1752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2500
- C:\Windows\system32\sc.exe
  sc query "Apple Mobile Device Service"
  2⤵
  - Launches sc.exe
  PID:5576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5484
- C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
  C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe -m pymobiledevice3 usbmux list
  2⤵
  - Executes dropped EXE
  PID:856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Update.exe.log
Size 1KB
SHA256 a2575cf61e66d6b0032cc832c80698cc53879e70fd9ebc9e0693947609443e2b
MD5 6884f06e5e48278e875c48434c7e7d69
SHA1 e95d5626f455f989a37e62dbb71fd1147a6a18dd
SHA512 a115434399f781f760fb4288c9b9cb0efc111f12ce4b17fde32439fa8fbfd61929c827f415856150e15501767d194c67cbbdac093a72d122e960a8fa75d8177a
TLSH
T19731C1722671B0C48D533F53197D268573EF4368BA005E18B568625EDA2E01B6F222F7
MD5 SHA1 SHA512 TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 77B
SHA256 b7ab41f860255f496648bfd4c0f02e43c27b732d51494be1324286685cdc5724
MD5 5297cf8f9cd415ffd9f8913390a5d6ef
SHA1 4d56f7f8339ad902ba898755043a7d2f89e5bcb8
SHA512 384dc1c2c3bbfc1b5a9a204b58e8b9578f4175ec53830981f7e638105d49d4830cba98e3d8b3b0a81a7a29f77ef0dc43b624124a45b89e99b9cb268a59cb28a9
TLSH
T1F3A0244C4040701CF4510140300144D3C51314FCD7F34105511CC30F55330535F1003F
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 76359cd4b0349a83337b941332ad042c90351c2bb0a4628307740324c97984cc
MD5 a560bad9e373ea5223792d60bede2b13
SHA1 82a0da9b52741d8994f28ad9ed6cbd3e6d3538fa
SHA512 58a1b4e1580273e1e5021dd2309b1841767d2a4be76ab4a7d4ff11b53fa9de068f6da67bf0dccfb19b4c91351387c0e6e200a2a864ec3fa737a1cb0970c8242c
SSDEEP 24576:pWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2:0t3UCiag6CKM2zCyZuOjJaxSS5qh
TLSH
T15A956C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 1.6MB
SHA256 b6c5cae16842ee494708785256284379ff275558eae0876ba0e06dced2565dc0
MD5 05b806c4c79b05a7d70f0a97f7a9cfcb
SHA1 1548f28e3412f31d8139606c1b274dff3b3e97f5
SHA512 85eaf630868b7edd72590c5e8c9478e2c8b131f49b72b44e0a96663e0c140c3b675781f0eeb15fdfd1073a104f8c47cce2eccaf9a74a46e802814dad8b2eae4e
SSDEEP 24576:uQLuPP4gR6lNR+J34RZd4RqMOYEuphYeT6LMuJp91zIs8om+v5JC8OEzU:uQLuPP41PhRT4AMOYNVRurjIl+yZEzU
TLSH
T133753389C952CB2CC90F57EB8A35F05FA52994EF27612AE2B849EC08C51B56D3C4C1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 196KB
SHA256 6701b16f852f6628a428fe5bd50612dd67bcb37dc6832ae369e02cd9776e7ca2
MD5 2283abbe5b07734ace976b12f7c22690
SHA1 61f3588ef93dd7ccc9a5dcab3e1a5dbf15d196e4
SHA512 d6233f496188d197b9b4d6845ac4216e9bb585eb1a25286f2e3093a69c23cd07055bed50f82c4d0fd7a8815ed654b466a23412212077fe811b039092d2e8f537
SSDEEP 1536:uqV6i3uYy7/qapipOIa1XbzH7KiIfntbCQadBHY+VxJIKLTBU:zeDipOIsvH7KJftPVKxJdu
TLSH
T13014DB6A5E3DAC8EE279C8F577131D81B4FA4C70294A7930E5F26CBD84F99D73182284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1u1llu1z.gvk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1u1llu1z.gvk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\chrome_100_percent.pak
Size 148KB
SHA256 7dd5485def22a53c0635efdf8ae900f147ec8c8a22b9ed71c24668075dd605d3
MD5 cb4f128469cd84711ed1c9c02212c7a8
SHA1 8ae60303be80b74163d5c4132de4a465a1eafc52
SHA512 0f0febe4ee321eb09d6a841fe3460d1f5b657b449058653111e7d0f7a9f36620b3d30369e367235948529409a6ce0ce625aede0c61b60926dec4d2c308306277
SSDEEP 3072:iz8JCGIdkwTPaNkx0auKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:iz81Idk8aqT5K18Gb0OV8ld0GecQ3Er2
TLSH
T1ADE3D0E773F4ED7DCAA756F7621600B1EDF3462D0691024A168ED8363A66B48DCC8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\chrome_200_percent.pak
Size 223KB
SHA256 2408969599d3953aae2fb36008e4d0711e30d0bc86fb4d03f8b0577d43c649fa
MD5 e9c1423fe5d139a4c88ba8b107573536
SHA1 46d3efe892044761f19844c4c4b8f9576f9ca43e
SHA512 abf8d4341c6de9c722168d0a9cf7d9bac5f491e1c9bedfe10b69096dcc2ef2cd08ff4d0e7c9b499c9d1f45fdb053eafc31add39d13c8287760f9304af0727bf4
SSDEEP 6144:3DQYajN6svyABnI86fTugx5GMRejnbdZnVE6YoppO4:cfjN6svyABOa6edhVELoXO4
TLSH
T1F124F1DB63F89D7DC9634AB3662601F1ECB2113955B6420B03DFEC357A95B8988C9383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\ffmpeg.dll
Size 2.6MB
SHA256 113ccc8e701157d0d59283baa5dc1fd3b0eae2571fd825084d7a4d58697a5ec2
MD5 64f3f2ae25b14f5d2d168ba6aae49ab6
SHA1 f43554aeb7a1b20b6e9dcbe5408cc004eb7db27a
SHA512 3ffb531da6ef1955f7b71c5f6e9e3322dafce78735aaf9b245c46bd5ccfa8a6a4b282b31b3aacb4e3b423412b9ab89f792ce37f3a9e6eb83983adfe7df38bfcf
SSDEEP 49152:R1nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYF:RJsf83Sn6Ox+tP5F
TLSH
T1F6C5AE12F6D640DDD02DC074879F9623F63038468B24AAEF16909A243F6BFD42E7E765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\libEGL.dll
Size 470KB
SHA256 01b8a8c2875ecb9979de339500ce0e0b7ecc3c5387053ce27bea51e6a09e2d72
MD5 b12e3c1e72935273492da1daee50eef1
SHA1 3f93237b71ee1328cf25f8223e685de97d01d773
SHA512 12346000331cde78ea08e9c0fef4635c77f6e85fb0e46706bbec1f23b0d7a7ef99e3930475324306ab4a46587d382ee3beb18d703e2765a8c1b7ece144c57983
SSDEEP 6144:Omi12qlTgeUDsnkcM2nDl83BgENhYCqNSfY24M:Omk2qxgeUDsNnDcgENhYRNSfU
TLSH
T1F4A48E1577E444A9E02BD134CA574642EA76B4820F65FBDF02A493392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\libGLESv2.dll
Size 7.7MB
SHA256 fb6ea924fbb9417e4695ce414cdcbc299f13451dbedd2d9adb55479bf1cbf57f
MD5 5082e41d7a57506fe6b4bd58f87276b4
SHA1 2842372c18f49c0e1fd8123891be8587cbf13146
SHA512 9e10d0d3269939f9a497f0b0937f0aeb9ec44627d5349cee589b676aaf95dde11c996e2eda158cf8e79778cfd948b10cb61538c9cc056f7b899a057e7e959f76
SSDEEP 98304:DPqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O:DP4m8TDyluKGugmO
TLSH
T1E5868B03F69680D9C04DD2B5975B9227FA35B8840B34B6CF265423253F77BE0AB7AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\locales\en-US.pak
Size 454KB
SHA256 41123d72bd8e289e85bd35227aabb4cc61fe1de02b5cd7a7834e5ec200bc2078
MD5 5c52a86b21633b55b383c20f16859b2f
SHA1 126585e68cb17f241351004e21c1d30e65de1cf6
SHA512 2a1b6a4becfb97d470cd7de74857edf2cc9cd4a77f377ccd9bf60c30539862ff1ac3ed6cc849632a3ed4ea0e5b92679f3cc5b4cb26cc7eaaa2bb2f4ae9974a6a
SSDEEP 6144:4U0NFUyUGhhA/4miMP9e2qDWfaYe1Vcg5xdxOng5H/thTwB:4jIy1hhYiM9qDvn5zxZTwB
TLSH
T152A44C1FF7441229069352A27F09A5A2FF32D06CA35112567CBD812C33B6B66C37B6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources.pak
Size 5.3MB
SHA256 a5908171bfbb738ac015e7c9903c838d93359ed12c3b7d86545514dc1f0e9d62
MD5 84df318c3fd9ab693dff15582132fc65
SHA1 6b436939d3dd3d5300af46c238c085276bbf1b55
SHA512 189fd83f008c29d9b38e5024975050c8e3dfd5e99a0c5eccec06fce54e865f0d8bef03a4bf3dc3564f2bb640f38259957f8f38e0d39599aec6ecba95eb21f848
SSDEEP 98304:5N9bNj3xZRkPe04srtXK5EmXJfnimTgK5M/AyrwreSjujBrTAVD:tbNTxTk1rlK9gKckreSjuxTK
TLSH
T1B346330677E1913EC82ED33C42494F76169CBA730665712B718C6269FF391AA4E4E0BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\app.asar
Size 6.2MB
SHA256 43e6c1d77fd9d5ba479230265b83655cced71f0bb55b67bfe4d7c7275bdc05a8
MD5 f986c484af88b0849e9e08bdc66eb98f
SHA1 dcc49cb782e89e2cf65843b4ba846330cb9998fb
SHA512 63b196a8002dabc07359b11f9ec9268c114a63dc2c9263ee2548c37e71cfa1d016c8f213409c934457a6a3d8452c2d788fb3a6804199df4fe745e933bdb193aa
SSDEEP 49152:YP5zVHjuSB7+gSbefpODTpYWUl8or8qxQDNavb7QTuAskoKTdJpwslDXJ7jJQfzK:YNcMayQDNavPQQKTdqcCEIRcE16so9hp
TLSH
T19F668D56B6AA393353B3A1B4552F0007F235851B210CD828F6FC96EC1F68566A1F7FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\_distutils_hack\__init__.py
Size 6KB
SHA256 df81e6bcba34ee3e3952f776551fb669143b9490fdd6c4caeb32609f97e985b4
MD5 e2e3608b836805d400aa2e133c18bf27
SHA1 82006d59dbfd9f8c35b758440e76825e977601e7
SHA512 49b0d63976100d5a808d7a083f2f2f0bfee52f49b5a6d4f21eca2bad6f83c1b6549a25b6bd635fbf5186f2e7acb64d5ea11ba99d78d246d3cae5869de9ab0c98
SSDEEP 96:cnuPveem/bGmdx9pJHPrGXwiLfXsfnCUy01LOq6LIrqCWPANPuqlTl7Frw:cuPGJ/ymdnppaEk0CNsrqoWel7lw
TLSH
T142D16333C8635CC247C7C0F45A86E431FBE558930AB06938BDAD81A82F995E0C9FB1E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\arrow-1.4.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

coloredlogs.pth

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\coloredlogs.pth
Size 147B
SHA256 dda83a855986efa5cd87f0248b0199c0086eb0e8e7fece7d6741959c5ce39536
MD5 d134d790be0a27af05d6d2fb600a7967
SHA1 c19c6c70715b2a9f93ec52b32d9704dd9a67d8bd
SHA512 1c69928c027d6825e508b96a5a0714158bc577e110af1f08d5424165f1b4888d167ecbce0d5915acf870ef8f7475cd88c0ebd89176c53024cb20a6732b612bd0
TLSH
T1D5C08CB04E091C171A16EB3C50268154026B90109FA0424058F0ABB1232232AC592A5A
MD5 SHA1 SHA512 TLSH

Submit Download

distutils-precedence.pth

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\distutils-precedence.pth
Size 151B
SHA256 2638ce9e2500e572a5e0de7faed6661eb569d1b696fcba07b0dd223da5f5d224
MD5 18d27e199b0d26ef9b718ce7ff5a8927
SHA1 ea9c9bfc82ad47e828f508742d7296e69d2226e4
SHA512 b8504949f3ddf0089164b0296e8371d7dcdd4c3761fb17478994f5e6943966528a45a226eba2d5286b9c799f0eb8c99bd20cbd8603a362532b3a65dd058fa42e
TLSH
T1B1C08CF28A022D104091A565CD19261BEDB88F203A567310C66046FE636261C2AD24B0
MD5 SHA1 SHA512 TLSH

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\ipsw_parser-1.7.0.dist-info\WHEEL
Size 91B
SHA256 69e6228a0d35958183cc1812f07c565ce837b95eb51bd8a33acba9fa4f68d6c9
MD5 0be2025a54a57ff313e1e195f0f36c31
SHA1 56fe5f173d8fd4262ef44b9dd48b1d5f49d84c35
SHA512 954357134d02734c367490733ee2cf2135e69bdfabb633f37dee965359bb115f2ede7feafaed3ab5266c21aca86f41023b36e1ffd527fe13cedf584e9a81ea20
TLSH
T1E7B01215454014F814E0EE138074A4202B6085455996507DB04512446559D4446CDD5E
MD5 SHA1 SHA512 TLSH

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\markdown_it_py-4.2.0.dist-info\WHEEL
Size 82B
SHA256 1b68144734c4b66791f27add5d425f3620775585718a03d0f9b110ba3a4d88db
MD5 eca1d2e32987c5c9fd85f21a0c92d672
SHA1 918c96cf4b87d846161401284f9bf811c56b5fcf
SHA512 c4256b480eefa97b455e5e0f716884b554edb99c7a3e4b116a46590c63acf14ea14ff52c5814f5c8bfca2b4a309bda65de07b72fe8731a235478eb7e5e7e2d7c
TLSH
T170A01218014004F80090FE034239A1281A308509646500B5948101445545D0802C8DBA
MD5 SHA1 SHA512 TLSH

Submit Download

__main__.py

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\pymobiledevice3\__main__.py
Size 16KB
SHA256 b4be3b458e5656d854152d5aeac98880cd4568a377ccbaee0de155e752f5f071
MD5 da75e7da0f406785f7b490ec5dae4d24
SHA1 a8779f3502196f329f0d58387b50796dd830fd64
SHA512 e1e830d96e02246b8960121c287157f20b74d6be118cc406ef098ed39d3ca6f1e3506870409ef197e3f79c2300aa23e93a4fc598b2b0e99919a7625727739259
SSDEEP 192:U3/WwmxnqR++TNIXx1/uHp3fAblYpf1rbvFm04jbigjyfN0iqCGByoWthuLi:U+wWnqRNI3/uJ3fAb+ptL+bi8kuByo9m
TLSH
T13B72B522C66A28675793C8A52C16E501633246431F147879B5FCA37C2F8E379C2FB79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\python_pcapng-2.1.1.dist-info\LICENSE
Size 11KB
SHA256 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30
MD5 3b83ef96387f14655fc854ddc3c6bd57
SHA1 2b8b815229aa8a61e483fb4ba0588b8b6c491890
SHA512 98f6b79b778f7b0a15415bd750c3a8a097d650511cb4ec8115188e115c47053fe700f578895c097051c9bc3dfb6197c2b13a15de203273e1a3218884f86e90e8
SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
TLSH
T11632623FBA48037706C20162BB9764CBF21E903F3B552568354CC1681F6BA6543FB6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywin32.pth

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\pywin32.pth
Size 185B
SHA256 d902584a2a0a5216ce12c712d1378fe07541d32c383d0cc5abcd68412144fe4d
MD5 71dc3efaad85e1fd19058e20e083c74f
SHA1 bd05ad717c31dfe5c19e0d35e43667ac84d47655
SHA512 9778e9d60038e42927946634e61570587115032c8df026cf2b7a54436f5618369e4b01b4dcf1b4711aab62f38abc82bb65fc13ca6dab5d33b154eb5ea5e5093f
TLSH
T1C9C0C0634E649391773B1D5CC47C90B2D075624E04D3300E41CDC7580F067131381410
MD5 SHA1 SHA512 TLSH

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\WHEEL
Size 91B
SHA256 ff309ddcdd65ebd02bc724dbf2bcc4a0ff53a5b61792a44548d383e4ebb19d3b
MD5 08dd01ac2afdbb287cc668d51c7056c8
SHA1 e7224da97ededfb9d0239cf7cade76ebe3997743
SHA512 917f7621e0d457d149964de3cddf50fe49be13388879f60ed818eaecdf5080864386c9cf2474dc2e514907935983d73dee1967b404f2941edced73856a1d6d1e
TLSH
T1B7B012150A4115F814A0EE134068A1201A70854799956079B14A03446549D1406CDC5E
MD5 SHA1 SHA512 TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\setuptools\_vendor\jaraco_context-6.1.0.dist-info\INSTALLER
Size 2B
SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
MD5 45210da832f9626829457a65e9e7c4d0
SHA1 ad5dd33dfa81a91517182f453879cc056a9f1230
SHA512 00a0bdd98e82b3077db4b7cf7746140c204af743c208484934d7cb46b1c55bd31c8a29bd756d3c1eab8737df20f565c0b2a1c4e19b7c9a2785ca091696761cbc
MD5 SHA1 SHA512

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\traitlets-5.15.0.dist-info\WHEEL
Size 87B
SHA256 41c708c5adba6e097513ab8ccb9f1d7865a2fb469e22491a9e01dcc64da459fc
MD5 7412a649a466b9dd567141f836b1e222
SHA1 c0469b77bdc66a90f54f6456522a384c7d92728c
SHA512 49119a9782509253afe7c6db60a607faa432c2aa4302f710f9dda77b713f3b3f627b97efe28bbe334df01a10d7f86bf2f975d539a5be456bfc56a0c384e1553a
TLSH
T125B01228014014F41810FF13402C70341720C105B4A52039D44601407507D1402EDC6A
MD5 SHA1 SHA512 TLSH

Submit Download

Conakry

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\Africa\Conakry
Size 130B
SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
MD5 796a57137d718e4fa3db8ef611f18e61
SHA1 23f0868c618aee82234605f5a0002356042e9349
SHA512 64a8de7d9e2e612a6e9438f2de598b11fecc5252052d92278c96dd6019abe7465e11c995e009dfbc76362080217e9df9091114bdbd1431828842348390cb997b
TLSH
T15FC00289B7080942C45063B90D8723A8DF15C009D53153B338187208CCAA9D42E145C5
MD5 SHA1 SHA512 TLSH

Submit Download

Djibouti

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\Africa\Djibouti
Size 191B
SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
MD5 fe54394a3dcf951bad3c293980109dd2
SHA1 4650b524081009959e8487ed97c07a331c13fd2d
SHA512 fe4cf1dd66ae0739f1051be91d729efebde5459967bbe41adbdd3330d84d167a7f8db6d4974225cb75e3b2d207480dfb3862f2b1dda717f33b9c11d33dcac418
TLSH
T105C02B886B10D0B0F08148348EF30606DE51C3B8032200F37C0C281003740602A460E0
MD5 SHA1 SHA512 TLSH

Submit Download

Kigali

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\Africa\Kigali
Size 131B
SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
MD5 9c92339423e915befec45cc4752a75ce
SHA1 d336e337b0cafc1205ba041fac447b8ae3074dbe
SHA512 e5a3a1ab74a2620743964583ab960be126448ed013b57393eca6b397ac020de0be5763b6d40443b1976e0d3e6a533e8c46123fcb0428e5e233b076cf9ba69667
TLSH
T1D5C02200F30C882AC00003FA0BAF0300AC0BC200CB0022B328203008CCCA0802E003C0
MD5 SHA1 SHA512 TLSH

Submit Download

Lagos

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\Africa\Lagos
Size 180B
SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
MD5 89de77d185e9a76612bd5f9fb043a9c2
SHA1 0c58600cb28c94c8642dedb01ac1c3ce84ee9acf
SHA512 e2fb974fa770639d56edc5f267306be7ee9b00b9b214a06739c0dad0403903d8432e1c7b9d4322a8c9c31bd1faa8083e262f9d851c29562883ca3933e01d018c
TLSH
T14FC012C073B00497CA50773C0FA32AD3DE018914CAAA37EB2954158C09790D07AAB9E8
MD5 SHA1 SHA512 TLSH

Submit Download

Curacao

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\America\Curacao
Size 177B
SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
MD5 92d3b867243120ea811c24c038e5b053
SHA1 ade39dfb24b20a67d3ac8cc7f59d364904934174
SHA512 1eee8298dffa70049439884f269f90c0babcc8e94c5ccb595f12c8cfe3ad12d52b2d82a5853d0ff4a0e4d6069458cc1517b7535278b2fdef145e024e3531daad
TLSH
T15AC01205BB415584E2E177B503F703D7CE1C80048C00DEABF907369508B88503FB0C80
MD5 SHA1 SHA512 TLSH

Submit Download

Toronto

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\America\Toronto
Size 1KB
SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
MD5 3fa8a9428d799763fa7ea205c02deb93
SHA1 222b74b3605024b3d9ed133a3a7419986adcc977
SHA512 107a4dbb64107f781e3ed17b505baea28d4ca6683c2b49d146dda41c28ca3f9c307809ed938e4152011e199a7be6913de6f7b78cafe8ef300dc3034397945238
TLSH
T1143183969418B8DFDF0145B90560C03CCB6431C30B2B91C6C74D67402578F5D89A5DF6
MD5 SHA1 SHA512 TLSH

Submit Download

EST

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\EST
Size 149B
SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
MD5 595e67b4c97fda031a90e5ef80813e7d
SHA1 7194eb1a70c1acc1749c19617601595d910b9744
SHA512 27925a87379552403a0960c2ec191994610bc05b2d67fb1fbbeeb6086a16091bdc69449bce3426b31a2775f3845ed8cc07d1882f8b3b4e63f437775a2eea5d76
TLSH
T1C3C01214B7480A16C55132BA2A410100CC044300A12202B36C4C231804585C26630182
MD5 SHA1 SHA512 TLSH

Submit Download

Greenwich

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\Etc\Greenwich
Size 111B
SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
MD5 e7577ad74319a942781e7153a97d7690
SHA1 91d9c2bf1cbb44214a808e923469d2153b3f9a3f
SHA512 b4bc0ddba238fcab00c99987ea7bd5d5fa15967eceba6a2455ecd1d81679b4c76182b5a9e10c004b55dc98abc68ce0912d4f42547b24a22b0f5f0f90117e2b55
MD5 SHA1 SHA512

Submit Download

London

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\Europe\London
Size 1KB
SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
MD5 d111147703d04769072d1b824d0ddc0c
SHA1 0c99c01cad245400194d78f9023bd92ee511fbb1
SHA512 21502d194dfd89ac66f3df6610cb7725936f69faafb6597d4c22cec9d5e40965d05dd7111de9089bc119ec2b701fea664d3cb291b20ae04d59bcbd79e681d07a
TLSH
T17631710B85868B0AD0FC277A3AF3A3056D584588D3AE8161F4ECC3E896FA3095D6D8C0
MD5 SHA1 SHA512 TLSH

Submit Download

Oslo

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\Europe\Oslo
Size 705B
SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
MD5 2577d6d2ba90616ca47c8ee8d9fbca20
SHA1 e8f7079796d21c70589f90d7682f730ed236afd4
SHA512 f228ca1ef2756f955566513d7480d779b10b74a8780f2c3f1768730a1a9ae54c5ac44890d0690b59df70c4194a414f276f59bb29389f6fa29719cb06cb946ceb
TLSH
T15E0120325142CA46D19C20F5077468D30F45168D4B9C02FF5739D12B77F03901D420D0
MD5 SHA1 SHA512 TLSH

Submit Download

Skopje

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\Europe\Skopje
Size 478B
SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
MD5 a4ac1780d547f4e4c41cab4c6cf1d76d
SHA1 9033138c20102912b7078149abc940ea83268587
SHA512 7fd5c4598f9d61a3888b4831b0c256ac8c07a5ae28123f969549ae3085a77fece562a09805c44eab7973765d850f6c58f9fcf42582bdd7fd0cdba6cd3d432469
TLSH
T175F0267651228F48D11C94BA1718A91B4FA4530ECB8C03B226A9A91E527CBE4EE060E4
MD5 SHA1 SHA512 TLSH

Submit Download

MET

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\MET
Size 1KB
SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
MD5 7a350885dea1ebe1bf630eb4254e9abc
SHA1 5036277ce20a4d75d228cf82a07ed8e56c22e197
SHA512 524ed4fb0c158a1d526dd9071df7111fb78940d468e964bf63ba5418f9b551ec28c38fa1dc2711415aa31f926d8729eac63d6b1e2946b7942ce822f09d00c5ae
TLSH
T18B11001AA1138BFAF86C74B53A605DC24745368C98BF516DD52C53E951B4F5499024F0
MD5 SHA1 SHA512 TLSH

Submit Download

PRC

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\PRC
Size 393B
SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
MD5 dff9cd919f10d25842d1381cdff9f7f7
SHA1 2aa2d896e8dde7bc74cb502cd8bff5a2a19b511f
SHA512 c6f4ef7e4961d9f5ae353a5a54d5263fea784255884f7c18728e05806d7c80247a2af5d9999d805f40b0cc86a580a3e2e81135fdd49d62876a15e1ab50e148b7
TLSH
T1EBE0C20C52681DCAD3ADF3FA265589A68B01E1838F52159B1446AA0DA57FB9618180F0
MD5 SHA1 SHA512 TLSH

Submit Download

Wallis

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\Pacific\Wallis
Size 134B
SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
MD5 ba8d62a6ed66f462087e00ad76f7354d
SHA1 584a5063b3f9c2c1159cebea8ea2813e105f3173
SHA512 9c5dba4f7c71d5c753895cbfdb01e18b9195f7aad971948eb8e8817b7aca9b7531ca250cdce0e01a5b97ba42c1c9049fd93a2f1ed886ef9779a54babd969f761
TLSH
T146C00280F71818D3C455577E058F17949D57D6418D0287B7398A34CDFD983916B288D0
MD5 SHA1 SHA512 TLSH

Submit Download

Yap

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\Pacific\Yap
Size 154B
SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
MD5 bcf8aa818432d7ae244087c7306bcb23
SHA1 5a91d56826d9fc9bc84c408c581a12127690ed11
SHA512 d5721c5bf8e1df68fbe2c83bb5cd1edea331f8be7f2a7ef7a6c45f1c656857f2f981adb2c82d8b380c88b1ddea6abb20d692c45403f9562448908637d70fa221
TLSH
T10AC0120162E70C0AC660023505494793DD48D50180062BDB24041199F47D78136000C2
MD5 SHA1 SHA512 TLSH

Submit Download

UCT

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\UCT
Size 111B
SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
MD5 51d8a0e68892ebf0854a1b4250ffb26b
SHA1 b3ea2db080cd92273d70a8795d1f6378ac1d2b74
SHA512 4d0def0cd33012754835b27078d64141503c8762e7fb0f74ac669b8e2768deeba14900feef6174f65b1c3dd2ea0ce9a73bba499275c1c75bcae91cd266262b78
MD5 SHA1 SHA512

Submit Download

Mountain

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\tzdata\zoneinfo\US\Mountain
Size 1KB
SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
MD5 c1b9655d5b1ce7fbc9ac213e921acc88
SHA1 064be7292142a188c73bf9438d382002c373c342
SHA512 2a188d7bcc48acc17b229e50e136b55dbc59058ae9be6ef217238cd1b6c0a59817954ab98817d2e2ff836a6f7d7461be5850ad73a9096d7a14ce9fd8c2a3c29a
TLSH
T1961120C9AAE1B575E15D543047B3D0800CAC48855F0FC98F20BEB52A8EF6B5936741A9
MD5 SHA1 SHA512 TLSH

Submit Download

pywin32_bootstrap.py

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\win32\lib\pywin32_bootstrap.py
Size 772B
SHA256 fd31f27bc85a6b9c974670838b6eefafb32991be4a9f840f96a4f5524df3b3c3
MD5 918671080b8627410234eaefefc7bd02
SHA1 c2e77a59fc774cb4fabe0e8a1af0cc0ce553afaa
SHA512 4b623c7b70bbcf9da11da64bcd5f029e7b4946ad95d609e07aecdaaf54f3a284738f36f0cb5f007aaa15404c6d4615f37b154466c67483c86c7dfff6a4d2fb88
TLSH
T11F01B1728645509707B19F1A685990B49BA1B2FBD641082873CCC7744F75B720F65D2A
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Lib\site-packages\win32comext\internet\__init__.py
Size 139B
SHA256 dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13
MD5 da92f5ad66e2a4e86379790c619c8732
SHA1 ae0b9ff8629a24c30b9a9444edb9d2c5105ae701
SHA512 03a60f8d8c8b02c508feb8836d2fd37517d75fc3afe02833c3a7279c06ab0401d575a2a234b0da01737d166e16c728c3f3ca8fdd4a76cd0d9c5a7da0075749d2
TLSH
T12BC02B104450224060336D5202320BE30B5EFCEF1067E0D1E31CC7142F1219844D7014
MD5 SHA1 SHA512 TLSH

Submit Download

idna.exe

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\Scripts\idna.exe
Size 105KB
SHA256 27f84831c0a79602cfd0c15a6a4e0057aa8e9dd4fb9d2c4d50fc56ac8cb2dc36
MD5 4434d7010eb10139c0d6109418bf0155
SHA1 8f367dc4cee525320ecb4f2b5374db8edcc974fd
SHA512 c53da84dfe70e8a53af249350e596d849736e7492d510c5c09ee698f60bbfff0b331a1be8ce0a628c896acbd7f5442e7c3905fd91dbbcb69c905f28214a6ceea
SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+G7P:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+4P
TLSH
T148B36A0A33D420FDD0675274CDB68A15D3B2BC2A4674934F27A47B6A1F733926D2E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\_socket.pyd
Size 81KB
SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
MD5 fe896371430bd9551717ef12a3e7e818
SHA1 e2a7716e9ce840e53e8fc79d50a77f40b353c954
SHA512 67ecd9a07df0a07edd010f7e3732f3d829f482d67869d6bce0c9a61c24c0fdc5ff4f4e4780b9211062a6371945121d8883ba2e9e2cf8eb07b628547312dfe4c9
SSDEEP 1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
TLSH
T141836C11A69050FADFB3C0B5C5675E23FBB4F4801395979F0166C66A1F33382BE7AA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python.exe

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python.exe
Size 101KB
SHA256 62ebc90a2884bb63a0cd67e789cafdd51e771eee043587e2354327b4ccc9bb05
MD5 c6ed974729d66dc7877bde3e966b460d
SHA1 d61806703f7b6d676bdd654e329c2e82348ac86c
SHA512 a865fda1b619674372871ee44a33d233f6025026295f6db896530bc6282dcc8f1f921c117570be7fce4b833a85dc02716d236a8688338e0bb2def256ed127bdb
SSDEEP 1536:Gj1hKbuEYE+9z2wp+FavGmhMn+IhzZtzc/sER47Syf58:GBhKbuAs0FNmhMn+IhNe/sER4L8
TLSH
T193A3E44A6A5F8190D4748471037B87F65B2C2E22A9C3C68DA7C57F16EA7C2C1F909B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313._pth

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python313._pth
Size 79B
SHA256 6f230f01e18429c383477763de66951745acda9c70aa5885eba4c4f0fb0fbb62
MD5 5388370a1de3a5a5b7997ca749aaa442
SHA1 0819c130b9f2b55bb009aeeb209605aa4ed05d39
SHA512 02046d21bc30af553a7547a6c46edd01a5cbacf4d532ec55b4036a0d0f5377a446fbdb367fa40b40db90f86783090f6bb2369bf625e012bbf76af628f759365e
TLSH
T142A0220208A30080002020A83FC022F88F323308BB002A0E88C22E380B00E30AAE202F
MD5 SHA1 SHA512 TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python313.dll
Size 5.8MB
SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
MD5 b9de917b925dd246b709bb4233777efd
SHA1 775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
SHA512 f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33
SSDEEP 49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
TLSH
T1E9568D16729D40ADC97B8078CA038A4BF7B27C417F60534B61A6BB5E2F733624B6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.zip

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\python313.zip
Size 3.6MB
SHA256 4141b13fe0ce35edfc1c819f1f3366e1476f99221ef042b270bd6f8ca6aaf35a
MD5 9f582bef4036eedd2cc9784bd4777f90
SHA1 705b523441ec740d231736f382ea1f0eab27880d
SHA512 ae072670a2831da80bd10c82fb972f584e881923db0b7e880499da63409ddce43e285146a749ac87356986194afb6255257ad97c4b90bf3b08f30b8895d998e7
SSDEEP 98304:LPOjM+CF0ivYa0SqUHaUdjarR6NWc7xhvvzckxh6FD7qqlc1:F/0ilf6VrR6NFhvvQkxhWHVO
TLSH
T1AD063321DD3D8106DDD3B7BCB231DD0A962C0F81B2149ABE1C4DDBA26D6E5A11F4F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\resources\python\vcruntime140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\squirrel.exe
Size 2.0MB
SHA256 06e8deb39630711baac76cf4aa0f5b57ede938d5ed2868633414adc0f3db9f5e
MD5 76fb8f654ab5bf56bc9048d0ce4f4a16
SHA1 82ee3019e269dd5065c091f5509b14460f8b731c
SHA512 72e9e2bb94507ba129335cb3cd605f7358e3d6a4c8fc9aee4a945c7fe6c968dd39c0b426fe4dc34b3eedc8c0488afeed643330567cc3d6214fef85850a8fb7c9
SSDEEP 24576:6WltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9mhR:Lt3UCiag6CKM2zCyZuOjJaxSS5qhK
TLSH
T1A8A58D05EBEC9F1BE16F9AB6A031094423F3E8917366F78BA688747D6AD37405D01393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\v8_context_snapshot.bin
Size 646KB
SHA256 a8bd22478c4f85afa836c89d3a7f52c606b17872fbbefce268b499bedede10ae
MD5 a62fbbb671bf975ed46b42d9cf437bcd
SHA1 408b595b1dc6658533e0db1d35f509ab9ee70525
SHA512 87c934670df70afcced0ea5c73449a17ad27d5b6a25cedad9eb61634aaff8a42b713f578e861c2efbc77593793bba240a1495822b69c99a8ecaef64b07b6a62c
SSDEEP 12288:f97k1vtORkeGWFDjesZeLEY4QUH7zRpA8W:f97k1v42eGWFDjZ427/RpAB
TLSH
T1A0E4B5A2B784EF56E1DA6EB0DDFAEB923234F5D99E0B419B7149036E323D7242D0450C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\vk_swiftshader.dll
Size 5.2MB
SHA256 7005598f9bb8559101458ddaac77e3a23f9876c0a1aaf7136a11f2d1d5173448
MD5 15d9ca6f1d87f15f5c67740df2bfa874
SHA1 6d84c52d33249b216223e02cb445b886bea6b45c
SHA512 24796d3aded0a49713489b285b9d38fd041a7376e900684053c1df106a509a315db9e646c7286fd59c79c664557e6d4e6843a55828abf04fc04d8b307829fc6f
SSDEEP 49152:IgQpJ5yZBtfCp00oSO8hCsDsbJQk/tJ4q0nLhII1ytiT45z+WEjNHsRLf7OFJOMZ:4n5yZBXLxkf5FJIaye
TLSH
T15D463903B2858099F05DD1B9474BA623F632F8801B72B6DF52A41F192E77FE06B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.2\vulkan-1.dll
Size 938KB
SHA256 45adc3dac19684ed3af159ae3914fbbf2426a879e5a4c1e678e3c9b451fab01a
MD5 8bd643a9f7ef2619b792cf2544f27a8c
SHA1 8d5aba34d852c9b9f62a4dca5ca138dbc458c931
SHA512 8a81c4edde9d20ee24d3390338915f096a27956bf57815c443a37f15bdb4072a0c959376721d2354fd565045efb3340922a9a22f3293bb3784cc6df6a0ac353b
SSDEEP 24576:gawxZ1onv5Sp+D9R6StDWb36Z5W1DYsHq6g3P0zAk7Mh:dSSApY90IDWb36Z5W1DYsHq6g3P0zAkw
TLSH
T163155B23AA94456AD476D034D9828603CAB178911726B9CF03B81708BF6FFF4777DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

3d8f9e55-395a-49b7-aa07-567d7fc509d2.tmp

Path C:\Users\Admin\AppData\Roaming\Vanish\3d8f9e55-395a-49b7-aa07-567d7fc509d2.tmp
Size 86B
SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
MD5 d11dedf80b85d8d9be3fec6bb292f64b
SHA1 aab8783454819cd66ddf7871e887abdba138aef3
SHA512 6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0
TLSH
T113A0124350152476150F2A2400474E5618E801301D1BF945C1E035A1756685C084700E
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Vanish\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Vanish\GPUCache\data_1
Size 264KB
SHA256 074075d87fd722acdec2a356e0cfd0d2c59c567ac1e70b9cf04fbfd4e216dbc2
MD5 6d8ae7fb5d089db669631cfdb5665140
SHA1 33ae7df96987157f3c6c89af093f8d73ed178b3d
SHA512 f683eb23cae919d7bdd8360a44e5402c044ded54cb67141f63ce1f62fe632ef55ea2bf2d533d4a2ce17fa2932852144a1eb45f592f54970f9e2af2f817725f68
SSDEEP 3:MsEllllkEthXllkl2zEklHat:/M/xT02znHat
TLSH
T1CA4404147FC50405C54051305011C3500370DC70071157433451CC73DDCD5440C01400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Vanish\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Vanish\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

3dfd9fb6-ba9f-4aa8-8d13-c508110d3d36.tmp

Path C:\Users\Admin\AppData\Roaming\Vanish\Network\3dfd9fb6-ba9f-4aa8-8d13-c508110d3d36.tmp
Size 840B
SHA256 7f2c45fbbfa43f1da843fa43194a3e9500e379975ae842dcdf4c9300d9ed375a
MD5 e77fd7b58ddf96d328bd34a8cd0b61c8
SHA1 c6273ba6614dd108a9435836cf595ef4f323c650
SHA512 838974cb4139df28460306680efe2bec817b14423594c1e3e08f14134045cbd666fccdd50c2110192f89d43d80de480b97e54a4fea2932beb2f1bd8fc7b9ebb3
TLSH
T1160148EBC3B80C7E4651D6F52B112EA3C9FE0418036C6D9789D49F8D4776873A50048E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Vanish\Network\Network Persistent State
Size 991B
SHA256 f1f19efaf907b2a8cd1f456fbf7236f7b28b2f215b89fd6f69cdba29741dd7e4
MD5 d6000a99d7dd95136eb11c40b03272b0
SHA1 50501fdf124d657d16cd0510580482e44c286343
SHA512 7c71f66a8d6caf2856485ded4257e4f47ba4b074cd3c0269e10749f6024f914ea6914a084f2c194967e91155f6a7f10bfbbd34ebe574c58381e19a61ee6b944e
TLSH
T1871138EBC3E8097E865296F52F213DA3C5FE0419036C7D9389D4AF8E47B2877A50154E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5915a1.TMP

Path C:\Users\Admin\AppData\Roaming\Vanish\Network\Network Persistent State~RFe5915a1.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Vanish\Network\TransportSecurity
Size 1024B
SHA256 c73a0e5c89c01e2dcbcdf2051888d877a78a0de55757a6b33cf4e19be093469e
MD5 c4e15f0b9459d3ae1f4cc3a668f430d5
SHA1 af36bf27e730d64af49f84ef0d8dd86ba368474e
SHA512 9b457c95863157f070b6f8919de3b1913b12af7f181436837cb51d48ff0ce5736a2ccbdaf040791ebb4fe55b2a47e81c179d1d729d981e12ed1484f719c6fc0e
TLSH
T181115CEB99BEB91731184D7B6A1278051E7AA4324582D4F8D94B823CB0C29F36A17412
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Vanish\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Vanish\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

memory/812-4759-0x000001C245F50000-0x000001C246A12000-memory.dmp

Download

memory/904-4798-0x000002146B660000-0x000002146B713000-memory.dmp

Download

memory/1356-3128-0x0000000020FB0000-0x0000000020FBE000-memory.dmp

Download

memory/1356-3123-0x0000000020FE0000-0x0000000021018000-memory.dmp

Download

memory/1356-8-0x0000000000070000-0x0000000000246000-memory.dmp

Download

memory/1536-4858-0x000001F3D0390000-0x000001F3D0443000-memory.dmp

Download

memory/1748-4594-0x0000022BC82F0000-0x0000022BC8DB2000-memory.dmp

Download

memory/1748-4592-0x0000022BE10B0000-0x0000022BE1163000-memory.dmp

Download

memory/1852-4610-0x00000280EBB60000-0x00000280EC622000-memory.dmp

Download

memory/1852-4608-0x00000280ECE10000-0x00000280ECEC3000-memory.dmp

Download

memory/1984-4547-0x00000246BCFF0000-0x00000246BCFFA000-memory.dmp

Download

memory/1984-4548-0x00000246BD390000-0x00000246BD3B6000-memory.dmp

Download

memory/1984-4546-0x00000246BD0F0000-0x00000246BD10C000-memory.dmp

Download

memory/1984-4544-0x00000246BCFF0000-0x00000246BD00C000-memory.dmp

Download

memory/1984-4545-0x00000246BD010000-0x00000246BD0C3000-memory.dmp

Download

memory/1984-4531-0x00000246A40A0000-0x00000246A40C2000-memory.dmp

Download

memory/3520-4783-0x00000168E7940000-0x00000168E79F3000-memory.dmp

Download

memory/3620-4813-0x00000163F37D0000-0x00000163F3883000-memory.dmp

Download

memory/3736-4624-0x000001FAB2120000-0x000001FAB21D3000-memory.dmp

Download

memory/3868-4395-0x0000000003170000-0x0000000003190000-memory.dmp

Download

memory/4928-4570-0x0000027A72B00000-0x0000027A72BB3000-memory.dmp

Download

memory/4928-4574-0x0000027A72E10000-0x0000027A72E2A000-memory.dmp

Download

memory/4928-4573-0x0000027A72880000-0x0000027A7288E000-memory.dmp

Download

memory/4928-4572-0x0000027A728A0000-0x0000027A728BC000-memory.dmp

Download

memory/4928-4571-0x0000027A72850000-0x0000027A7285A000-memory.dmp

Download

memory/4968-4749-0x000001D5D07A0000-0x000001D5D0853000-memory.dmp

Download

memory/4968-4757-0x000001D5B78A0000-0x000001D5B8362000-memory.dmp

Download

memory/4980-4765-0x00000173BE230000-0x00000173BE261000-memory.dmp

Download

memory/5200-4379-0x0000000000590000-0x0000000000796000-memory.dmp

Download

memory/5484-4873-0x0000018FE0CC0000-0x0000018FE0D73000-memory.dmp

Download

memory/5524-4512-0x000000001C6B0000-0x000000001CBD8000-memory.dmp

Download

memory/5640-4843-0x000001BC34900000-0x000001BC349B3000-memory.dmp

Download

memory/5724-4828-0x000001F1F9C40000-0x000001F1F9CF3000-memory.dmp

Download

memory/6092-4557-0x0000021235290000-0x00000212352C1000-memory.dmp

Download

memory/6092-4453-0x00007FFED8050000-0x00007FFED8051000-memory.dmp

Download

memory/6092-4452-0x00007FFED8260000-0x00007FFED8261000-memory.dmp

Download