Overview

overview

6

Static

static

3

wink-ai_se...er.exe

windows10-2004-x64

6

wink-ai_se...er.exe

windows11-ltsc_2024-x64

6

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...rt.exe

windows10-2004-x64

1

$PLUGINSDI...rt.exe

windows11-ltsc_2024-x64

1

$PLUGINSDI...64.dll

windows10-2004-x64

1

$PLUGINSDI...64.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...rl.dll

windows10-2004-x64

1

$PLUGINSDI...rl.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...rt.dll

windows10-2004-x64

1

$PLUGINSDI...rt.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...64.dll

windows10-2004-x64

1

$PLUGINSDI...64.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...40.dll

windows10-2004-x64

1

$PLUGINSDI...40.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...00.dll

windows10-2004-x64

1

$PLUGINSDI...00.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...b1.dll

windows10-2004-x64

1

$PLUGINSDI...b1.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...ne.dll

windows10-2004-x64

3

$PLUGINSDI...ne.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...pm.dll

windows10-2004-x64

3

$PLUGINSDI...pm.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI..._1.dll

windows10-2004-x64

3

$PLUGINSDI..._1.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...rl.dll

windows10-2004-x64

3

$PLUGINSDI...rl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI..._1.dll

windows10-2004-x64

3

$PLUGINSDI..._1.dll

windows11-ltsc_2024-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/06/2026, 00:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wink-ai_setup_installer.exe
  • Size 9.7MB
  • Sample260620-bbk9lsdy4s
  • SHA256 f84d509407226efe6fb63e77746f74404a527e12aa977453cb39878c7daa1ef7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
bootkitdiscoveryexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Writes to the Master Boot Record (MBR) 1 TTPs 6 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 24 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\wink-ai_setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\wink-ai_setup_installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\MTDataReport.exe
      "C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\MTDataReport.exe" "downloader_install_show" "3.8.0" "wink-ai_setup_installer.exe" "ai_setup" "downloader_version" 1.0.2.2
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:4172
      • C:\Windows\System32\Wbem\wmic.exe
        wmic csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:732
    • C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\MTDataReport.exe
      "C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\MTDataReport.exe" "downloader_install_start" "3.8.0" "wink-ai_setup_installer.exe" "ai_setup" "install_path" C:\Program Files (x86)\Meitu "downloader_version" 1.0.2.2
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:1004
      • C:\Windows\System32\Wbem\wmic.exe
        wmic csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5056
    • C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\MTDataReport.exe
      "C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\MTDataReport.exe" "downloader_install_start_download" "3.8.0" "wink-ai_setup_installer.exe" "ai_setup" "temp_path" C:\Program Files (x86)\Meitu "temp_name" wink-ai_setup.exe "downloader_version" 1.0.2.2
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Windows\System32\Wbem\wmic.exe
        wmic csproduct get uuid
        3⤵
          PID:596
      • C:\Program Files (x86)\Meitu\wink-ai_setup.exe
        "C:\Program Files (x86)\Meitu\wink-ai_setup.exe" 1 1 1 /S /D=C:\Program Files (x86)\Meitu
        2⤵
        • Checks computer location settings
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4476
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NonInteractive -NoProfile -Command "$p=[Environment]::GetEnvironmentVariable('Path','Machine');$a='C:\Program Files (x86)\Meitu\Wink\3.8.0\cli';$legacy='C:\Program Files (x86)\Meitu\Wink\3.8.0';$parts=$p -split ';' | Where-Object{$_ -and $_ -ne $a -and $_ -ne $legacy};$np=($parts + $a) -join ';';[Environment]::SetEnvironmentVariable('Path',$np,'Machine')"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4916
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" /e,Wink.exe
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4776
        • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTDataReport.exe
          "C:\Program Files (x86)\Meitu\Wink\3.8.0\MTDataReport.exe" "install_succeed" "3.8.0" "wink-ai_setup.exe" "ai_setup" "install_src" "1" "is_upgrade" "0"
          3⤵
          • Writes to the Master Boot Record (MBR)
          • Executes dropped EXE
          • Loads dropped DLL
          • Enumerates system info in registry
          • Suspicious use of WriteProcessMemory
          PID:3868
          • C:\Windows\System32\Wbem\wmic.exe
            wmic csproduct get uuid
            4⤵
              PID:1720
        • C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\MTDataReport.exe
          "C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\MTDataReport.exe" "downloader_install_success" "3.8.0" "wink-ai_setup_installer.exe" "ai_setup" "downloader_version" 1.0.2.2 "download_time" "49000" "install_time" "-3562000"
          2⤵
          • Writes to the Master Boot Record (MBR)
          • Executes dropped EXE
          • Enumerates system info in registry
          • Suspicious use of WriteProcessMemory
          PID:3160
          • C:\Windows\System32\Wbem\wmic.exe
            wmic csproduct get uuid
            3⤵
              PID:4584
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:5116
          • C:\Program Files (x86)\Meitu\Wink\3.8.0\Wink.exe
            "C:\Program Files (x86)\Meitu\Wink\3.8.0\Wink.exe"
            2⤵
            • Writes to the Master Boot Record (MBR)
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates system info in registry
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4340
            • C:\Program Files (x86)\Meitu\Wink\3.8.0\MtBugReport.exe
              "C:\Program Files (x86)\Meitu\Wink\3.8.0\MtBugReport.exe" 0 4340 00007FFDC7D3F840 00000000000005D4
              3⤵
              • Executes dropped EXE
              PID:4520
            • C:\Windows\System32\Wbem\wmic.exe
              wmic csproduct get uuid
              3⤵
                PID:2500
              • C:\Windows\System32\Wbem\wmic.exe
                wmic csproduct get uuid
                3⤵
                  PID:3992
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "Face" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:1632
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "Face" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:1056
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "BodyInOne" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:2256
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "BodyInOne" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:756
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "Interactive" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:1028
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "Interactive" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:1436
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoBody" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:4424
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoBody" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:4924
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoSkin" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:3256
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoSkin" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:3296
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoHair" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:4716
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoHair" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:4512
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoDenseHair" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:5044
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoDenseHair" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:3856
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "SpaceDepth" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:4720
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "SpaceDepth" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:688
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "Face" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:2060
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "Face" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:1808
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "BodyInOne" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:4724
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "BodyInOne" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:1872
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "Interactive" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:2860
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "Interactive" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:3604
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoBody" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:1776
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoBody" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:988
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoSkin" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:4416
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoSkin" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:5044
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoHair" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:2836
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoHair" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:4640
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoDenseHair" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:552
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "VideoDenseHair" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:4216
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "SpaceDepth" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:3852
                • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
                  MTLabEnvdetExe.exe "SpaceDepth" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
                  3⤵
                  • Executes dropped EXE
                  PID:4764

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  Config.ini
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\Config.ini
                  • Size 226B
                  • SHA256 93ece1dc978b6b8eb556da6f18a5ce85d5b5a381aa36063ee9aa851c1774bdde
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MTDataReport.exe
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\MTDataReport.exe
                  • Size 34KB
                  • SHA256 28298be91a900775308f8f18f8e9925f4b4d9ba5e2e3fd295d2e694eb367ae44
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  shadow.png
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\QtQuick3D\Materials\maps\shadow.png
                  • Size 334B
                  • SHA256 03003aa01026e944b75447078f5758d0ffab854d03e9ce80780a174411073f7f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  libcurl.dll
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\libcurl.dll
                  • Size 729KB
                  • SHA256 36fdfa7d93e2ca2a3b76c2b3dd519b3ed9ee3cd14b58ab4e935e088a7870c1d6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libdataReport.dll
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\libdataReport.dll
                  • Size 1.4MB
                  • SHA256 d8e3a7afce99ca89ca79c3fcd89f8c519632b6a1bd3f60810fe3b2e0a6439453
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msvcp140.dll
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\msvcp140.dll
                  • Size 559KB
                  • SHA256 3aa124022e86fbe72c11c2a334e35eb9f719572e15ac444dd722171cd69ae7ff
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendDissolve.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\Overlay\PSBlend\BlendDissolve.jpg
                  • Size 4KB
                  • SHA256 9b7df3a203640a6ff24f543aeec84ed0ae512671bfaf0bb9167a5e49ac9715ef
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MTFilter_WhiteTeethAnatta.vs
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\Shaders\Anatta\MTFilter_WhiteTeethAnatta.vs
                  • Size 294B
                  • SHA256 5bf4347b7c373cb9517d947e9808fe60fafa11463a8195ec700268fd529a77e9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MTSelectColor_Filter.vs
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\Shaders\Filter\MTSelectColor_Filter.vs
                  • Size 179B
                  • SHA256 635b5245391915faed2eea4afe432c5ed80d7ce21e45fe696b4a3f5d245219a9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MTFilter_Mix.vs
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\Shaders\HairSoft\MTFilter_Mix.vs
                  • Size 209B
                  • SHA256 c0115601846a37a92692a2b8cbcf9c55709fbeb4c110a7f76375b689a99276c5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MTGlassWaterDropfreezeobject.fs
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\Shaders\MTGlassWaterDropfreezeobject.fs
                  • Size 2KB
                  • SHA256 30995ea5265fa7bbed6acbdbddf3e19e9b817d56a4899bfdd01dd876eee98aa8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TextureWithAlpha.vs
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\Shaders\MVExtension\TextureWithAlpha.vs
                  • Size 207B
                  • SHA256 fb29e17ccfe803b7d0c85039e0f5899bb96dcdd64e973dac553f4a87e435dd5b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Kira10.vert.spv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\spirv\Kira10.vert.spv
                  • Size 920B
                  • SHA256 67f51ca43a41298436a09e8d295976a8823fea54e9da393960eee8dd5256ba47
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  filter_cube.vert.spv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\spirv\filter_cube.vert.spv
                  • Size 652B
                  • SHA256 7b98e23c92a75d23aad325d68c478b98b7f9dd3902fc8f33f70d6b7d4efce8e0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  segment_thresholding.vert.spv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\spirv\segment_thresholding.vert.spv
                  • Size 688B
                  • SHA256 802d18c503ad108aa041f43de38af2ecd35c79c59a71c94fc6622880565f610f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  cheekfillers.vs.spirv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\MTAurora.bundle\Shaders\cheekfillers.vs.spirv
                  • Size 992B
                  • SHA256 6f00e44a455cad45a8f7c63bf255aefb88bc355ebd43629cab1e33569f411572
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  eyepouchnew_box.fs.spirv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\MTAurora.bundle\Shaders\eyepouchnew_box.fs.spirv
                  • Size 1KB
                  • SHA256 b0aac1230d2a3cae4110491cfe7c149f0539f53fe5657d39894035b8d39374ac
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  shadow_smooth_video.vs.spirv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\MTAurora.bundle\Shaders\shadow_smooth_video.vs.spirv
                  • Size 992B
                  • SHA256 4c9ff60b2d4be9ebc675ccb4fb265555cc357e6253b29579256d5ba4c1356311
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  configuration.plist
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\6110\61100000177\packages\eyebrow\configuration.plist
                  • Size 676B
                  • SHA256 350b793f9d273301f8f0afc13db7c62b769fe13c5029b17bf52ac2856efa59dd
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  configuration.plist
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\6150\615000030\beauty\configuration.plist
                  • Size 398B
                  • SHA256 0853c3154d2bad6fb742e23b6f9b236e73025f80d5e5862281358d03343b344b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  part.vert
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\beautyBody\ar\res\segment\shaders\part.vert
                  • Size 310B
                  • SHA256 4745d5e59bf55052d63e0bbabc4fc25af93d47d7b5ee1262dc750881d731e933
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  bulge.vs
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\beautyBody\ar\res\shader\bulge.vs
                  • Size 199B
                  • SHA256 80cd4a917a9cd3af40b6a43a7d5504dc4c42c589432ab5c6e3e97fd83f2283f6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  getbody.vert
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\body3D\ar\res\ar3d\bodyMask\getbody.vert
                  • Size 159B
                  • SHA256 adf0b106f92b08ca3283f2c27cdc1a68b58b46355470391e401fd0b51c23411c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  mixTexture.vert
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\body3D\ar\res\ar3d\shaders\mixTexture.vert
                  • Size 424B
                  • SHA256 705b3c8fbe2e8be61c44a75ea5a20f45df19329871706f7929a777b250f767ec
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  configuration.plist
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\faceLift\smoothShape\ar\configuration.plist
                  • Size 452B
                  • SHA256 619a575e3ba90484eb26cb5af390a6732d312ebc40209d1847507c8f2f1a7907
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  configuration.plist
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\faceLift\smoothShape\configuration.plist
                  • Size 237B
                  • SHA256 48c8245b56d2b718251dcb36796a82b451557bb82092aacddca30e4cfe0e7f79
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  configuration.json
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\forehead\ar\res\Effect2\suit\res\ai\configuration.json
                  • Size 44B
                  • SHA256 e67d85de9e603727b035e984c17204987dc0abd717fc141ab391f6bd97350b88
                  • MD5 SHA1 SHA512
                  Submit Download

                  configuration.resources
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\hairFluffy\ar\configuration.resources
                  • Size 249B
                  • SHA256 d49222d6cd6f9a5fbdccb95fc3b8da6f9864b9aac2f643904998b1290071a6a6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  simple.ttf
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\hairFluffy\ar\res\simple.ttf
                  • Size 9KB
                  • SHA256 58dc0bbbd561769d6f7aa5deaa7fca1c1e94e18f9cdabc30ecfc2140f81d4302
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  trigger_ui.plist
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\hairFluffy\ar\trigger_ui.plist
                  • Size 238B
                  • SHA256 431cefa507c6f5b0ee42245dc01c32aac760d715b9f4b9ec38757503f2b3cf91
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MTFilter.lua
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\manualBeautyBody\ar\res\fill\modules\MTFilter\MTFilter.lua
                  • Size 2KB
                  • SHA256 2ebe54a11b8e95409a969e4daa75cdbbd2da4305e6dd191af3f80cea285a13b1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MTFramebuffer.lua
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\manualBeautyBody\ar\res\fill\modules\MTFramebuffer\MTFramebuffer.lua
                  • Size 1KB
                  • SHA256 02b12280f0f53e8f59a893b79fa4d0eb9f453745b74ddde60a1092c3caff2406
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  gaussianBlur.vert
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\manualBeautyBody\ar\res\fill\modules\MTGaussianBlur\shaders\gaussianBlur.vert
                  • Size 310B
                  • SHA256 3b63cb795d6f6af11065e18ef6ef67ad1d538def507c8ac648afd676d6bd13f8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  gaussianBlurH.frag
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\manualBeautyBody\ar\res\fill\modules\MTGaussianBlur\shaders\gaussianBlurH.frag
                  • Size 1KB
                  • SHA256 4f33794cb1627bcbefd97ceebe18d31b19017a119ad73cf82bb8c41b49363c18
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  gaussianBlurV.frag
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\manualBeautyBody\ar\res\fill\modules\MTGaussianBlur\shaders\gaussianBlurV.frag
                  • Size 1KB
                  • SHA256 0ecc3798a2c955e0ce485d2f7f6597d587ac99648cff4ac97a4de0aa815bf471
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  shoulder.vs
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\manualBeautyBody\ar\res\shoulder.vs
                  • Size 183B
                  • SHA256 0a26f328717a4e27aa492b2b2771e06a8d2781c09ac52b005c7c8f8fac95c913
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  warp3.vs
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printBeautyBodyPoint\ar\res\warp3.vs
                  • Size 431B
                  • SHA256 13a820c979ac01e1739674d011761a159b147dc964017376aff18bae224c16d1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  configuration.plist
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printBeautyBodyPoint\configuration.plist
                  • Size 247B
                  • SHA256 ac8627afaca4e9d40260469319fd044a047ba622c437f4fc691dfa62056c50ba
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  BlendColorBurn.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendColorBurn.jpg
                  • Size 4KB
                  • SHA256 66be41ca59f7a02971b23e56aa404810d8da6f4b2d0bf6ef88c8403b3ecc11fc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendColorDodge.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendColorDodge.jpg
                  • Size 4KB
                  • SHA256 4c4c032b0b1c3b2dc8eee5d4859c51005e1df6d06e10798e3b1ec4efdc4a8328
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendDarken.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendDarken.jpg
                  • Size 5KB
                  • SHA256 8c32cd378339f557d02257697a103943ebcab79feddecdddc141b0eb04d6b877
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendDarkerColor.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendDarkerColor.jpg
                  • Size 5KB
                  • SHA256 b6176985f866173816e9fb70b33397e5df16d1b021b3a8abdacaef259d0beb96
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendDifference.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendDifference.jpg
                  • Size 6KB
                  • SHA256 c563bff0961baf38a4973c7cf9464361137a72adbb791131892f4c055c608d58
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendDivide.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendDivide.jpg
                  • Size 4KB
                  • SHA256 5330369ddcead162dfc3b87e1f9f209393ff4055fd1d01776525a1a554806d05
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendExclusion.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendExclusion.jpg
                  • Size 4KB
                  • SHA256 1b27fde12a086b509ee31f9af75bcdc9962f509df3bc7eb3b10a17bd98ac9188
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendHardLight.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendHardLight.jpg
                  • Size 5KB
                  • SHA256 a72702c961c3ef49da6653c303f09c4ce7231549b3d5ee436a77f6b7956ee64a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendHardMix.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendHardMix.jpg
                  • Size 3KB
                  • SHA256 d6b94f1ee8cf012bd0b67a427e07d13dcc3f17ddeb4b2edff4927a38c02c7b43
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  BlendLighten.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendLighten.jpg
                  • Size 5KB
                  • SHA256 82a755f216e8ed978dd398f4a3df28f3c6402eb3988f9866228a6d59868a4f61
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendLighterColor.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendLighterColor.jpg
                  • Size 5KB
                  • SHA256 71459bdfd783b989f53de4fe3b002f2dc66376878a28d2045a070d85cf6ba940
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendLinearBurn.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendLinearBurn.jpg
                  • Size 4KB
                  • SHA256 8ec0220bffff26fe838dab6cf13eaba6e7327e3589815bd7c3f70436344caa2c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendLinearDodge.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendLinearDodge.jpg
                  • Size 4KB
                  • SHA256 a9a2a03dfba212841dee970bd4e6d2f5ab3de8e6560db3230867c778250ed86e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendLinearLight.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendLinearLight.jpg
                  • Size 4KB
                  • SHA256 2c3bb5e7a09bf7fb2da4ca00a0334d7c24a01b5cddcf1cbec662c7be285fd740
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendMultiply.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendMultiply.jpg
                  • Size 4KB
                  • SHA256 290cff0cd78534f7c6ef158a532efa64d789063b79b5e9b8b8a680a2b92fd011
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendOverlay.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendOverlay.jpg
                  • Size 5KB
                  • SHA256 639d12087a9e0302b95119ed71ece03784eb5bacfcfdd09019f6e2db4ce3207b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendPinLight.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendPinLight.jpg
                  • Size 5KB
                  • SHA256 04a7b9d7dad8ba5423da8b1128b11cbdce10d5ede457a4a75d404efe4d8db65f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendScreen.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendScreen.jpg
                  • Size 4KB
                  • SHA256 4278502539508c7bd4af856f5336042cfc35ed2ea4856a3c17b1b1885edb3d87
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendSoftLight.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendSoftLight.jpg
                  • Size 5KB
                  • SHA256 7eef994f9c2e3df17eca23a2277586036167b1dddeb26d9c55d4375fa7a8c638
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendSubtract.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendSubtract.jpg
                  • Size 4KB
                  • SHA256 8f015bff5b31a12d6a284a28a72b4be2a22f044b2e2b80a694ef984396efa676
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BlendVividLight.jpg
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendVividLight.jpg
                  • Size 5KB
                  • SHA256 c219e695b45935f5e9a35ab5382e7a3377cd1aa4754cc9a2dd9533a1462f1295
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  configuration.plist
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVConfig.bundle\Animation\PIP\configuration.plist
                  • Size 245B
                  • SHA256 af521c06025503647b6f8f18866140a2b95c476572605ac40f9d8579e53b5506
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  configuration.plist
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\printBeautyFacePoint\configuration.plist
                  • Size 255B
                  • SHA256 fe56361d36606cdcaf235a2c3d67d5e331b3a073882ea6c61c45fd895b088520
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MTFilter_Mean.vs
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\face\ar\res\light\gp\faceMask\MTFilter_Mean.vs
                  • Size 1KB
                  • SHA256 b278736e4a806f37177aef6351e959cc8a73fe3fa09e9ba1616ee2fbacc5381e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  fragment.fs
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\face\ar\res\light\gp\faceMask\fragment.fs
                  • Size 10KB
                  • SHA256 7f5c21f276156ba79d788afecb17a34d0406027928238f73937712aa5e6b4924
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  remap.vs
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\face\ar\res\light\gp\phong\remap.vs
                  • Size 171B
                  • SHA256 357622a9efe2975362715f95c0508f8634a35848ca272441dd1c43224877d36f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MTFilter_SegmentSourceErosion9H.vs
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\face\ar\res\light\gp\segment\MTFilter_SegmentSourceErosion9H.vs
                  • Size 892B
                  • SHA256 a77b7e2a42007da5e3821a62804cb597e6de9cb0b5a0bd7c7f60229299ebf1b4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MTFilter_SegmentSourceErosion9V.vs
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\face\ar\res\light\gp\segment\MTFilter_SegmentSourceErosion9V.vs
                  • Size 888B
                  • SHA256 9d23667be8f80669a2fda1b3d38bc839fd6804b90c91077404689d83de156c4c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  mask_00000.png
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\face\ar\res\light\gp\texture\mask\mask_00000.png
                  • Size 7KB
                  • SHA256 d4f066a524f80ef6caa5fa630cdefec5136c9c1731af53650aaed546316afbf2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  configuration.plist
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\face\configuration.plist
                  • Size 834B
                  • SHA256 a9de58b0c799978e404956a3023f652e099d56b8c125caa1a6826ec1dd144bc6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.plist
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\whole\config.plist
                  • Size 372B
                  • SHA256 d53a5df628463a6877ba82c9e5548f2f53ca7053d5e7d85b3fed9b880730b92f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  configuration.plist
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\whole\info\AR\AR\configuration.plist
                  • Size 992B
                  • SHA256 8f89cc4af7d5b140f6b79b1347ff22c1ff940ccd4da44cc729c7a84ad4102414
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  configuration.plist
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\whole\info\Filter\Filter\configuration.plist
                  • Size 805B
                  • SHA256 fbaafde11aaab79e9b982efbe0687b685a52d6409d1fcddf176d400a78c9512b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  data.json
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\whole\info\internalPublishInfo\data.json
                  • Size 29B
                  • SHA256 7e8442bc75b4c433aec48c6b2cade660d3c082bf956ad8d2f0ebcf584ecefc08
                  • MD5 SHA1 SHA512
                  Submit Download

                  light_100.png
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\tone\ar\res\light_100.png
                  • Size 6KB
                  • SHA256 32253be222808e7701c3272a9fae0a6b86c4bafefa217ca94d4e294597d1024f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  light_100_rever.png
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\tone\ar\res\light_100_rever.png
                  • Size 10KB
                  • SHA256 0612eed526a3b4a63119ecc08bbf1a3c03141c08a4b54ee59ccb0910b4ba2712
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  temperature_100.png
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\tone\ar\res\temperature_100.png
                  • Size 10KB
                  • SHA256 0c976eddd87879e63ed1514da412fc97199b8d9ecec449349c5e710c7a7de957
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  temperature_100_rever.png
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\tone\ar\res\temperature_100_rever.png
                  • Size 11KB
                  • SHA256 9ac7592d3f98e862311e2da1d97984e83073fc8c2dc5351ba97dbdda37e3141d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ShadowMap.png
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\AutoToning\ShadowMap.png
                  • Size 7KB
                  • SHA256 43192ab3751b933140f381bfbfd704804b597ddae142f65d7c7d15b8a9425f35
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  highlights_100_rever.png
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\AutoToning\highlights_100_rever.png
                  • Size 370B
                  • SHA256 dfdbf818641f9da5cda4cb56cf52b78a75f29ee86fd92cd9d78032f73b72f15c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  lookup_table_512_ambianceSkin.png
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\AutoToning\lookup_table_512_ambianceSkin.png
                  • Size 739KB
                  • SHA256 5564dafe0481cea550b7af7904af34a133850ed54cf27386ebd823b5d22fec04
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cheekfiller_mask.vs.spirv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\cheekfiller_mask.vs.spirv
                  • Size 876B
                  • SHA256 2c2ddfed76bfb54f0527c9220b0f558fe4d7c395804b7ab3eabf144b469447ea
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  eye_mask.vs.spirv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\eye_mask.vs.spirv
                  • Size 1KB
                  • SHA256 cc08d3d0dd4a11d85ff08156c4e9a9fb162f95b7bc729d57fb5f61b5d2a27aac
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  eyepouchnew_gauss.vs.spirv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\eyepouchnew_gauss.vs.spirv
                  • Size 3KB
                  • SHA256 c50db5b8c201c12e4c496dbb6ed606701a4690f2c66ec29e45c961aa3bcfcde8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  eyepouchnew_median.fs.spirv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\eyepouchnew_median.fs.spirv
                  • Size 17KB
                  • SHA256 c5251bccd62df2dbd6a1b71f8a39df2ee05da5f1807663e525165874deb1d3ca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  eyepouchnew_median_android.fs.spirv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\eyepouchnew_median_android.fs.spirv
                  • Size 1KB
                  • SHA256 b8e16c9c86091cd18af0b2fecf393aa4fe1a10bd517322f20c1b9b8f9402c0e1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  eyepouchnew_median_win.fs.spirv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\eyepouchnew_median_win.fs.spirv
                  • Size 51KB
                  • SHA256 22e84087c9545a17692523e26960981258b2ede9734ec340a84ac20927cdc192
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  eyepouchnew_variance.fs.spirv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\eyepouchnew_variance.fs.spirv
                  • Size 1024B
                  • SHA256 c376155cd04d12dd8a720653b7a9415c7888805ed3aca2b308d105f2acb39448
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  hairmatte_multi.fs.spirv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\hairmatte_multi.fs.spirv
                  • Size 780B
                  • SHA256 cfc6d7ad7d034377c280760db77033fdaf70a09f07822a11923767c11e0d020e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  render.fs.spirv
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\render.fs.spirv
                  • Size 512B
                  • SHA256 ed3c6b304705d8994110697e3c1b8c9c316a499f8d805bb13a18d2e9dcc51511
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TeethWhiteLut.png
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\TeethWhiteLut.png
                  • Size 4KB
                  • SHA256 9a74ecd6227b41f5f3da99280113078d5aa3d4bb7a0c5bee7c6083492f87f872
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vcruntime140.dll
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\vcruntime140.dll
                  • Size 116KB
                  • SHA256 bdf138419212f885be2db487f586a1b5b7efacdbe076a9be971e322b6a2c8fc3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vcruntime140_1.dll
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\vcruntime140_1.dll
                  • Size 48KB
                  • SHA256 b4ec274497a2981e660c89207e5bbb48265bb7d981631d00ce74ff1a26f9f62a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  zlib1.dll
                  • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\zlib1.dll
                  • Size 94KB
                  • SHA256 caecc0306d08971aee74c224b6a5269881b008a588fded5a968f7d6df0c08981
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Wink.exe
                  • Path C:\Program Files (x86)\Meitu\Wink\Wink.exe
                  • Size 742KB
                  • SHA256 f52720c504dd44317fec261a23057e996bddf5a1621546ef9f8d2b633ea7f381
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_ubxf21is.bas.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ubxf21is.bas.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  BgWorker.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\BgWorker.dll
                  • Size 2KB
                  • SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MTDataReport.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\MTDataReport.exe
                  • Size 36KB
                  • SHA256 2b27e97dae7527f740a33d426b2c462c6e9a0848012ba62f06b5b686be0b670c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libcrypto-1_1-x64.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\libcrypto-1_1-x64.dll
                  • Size 3.3MB
                  • SHA256 c16bd443c9c63dfefa31f594ffdc062d29ae557178b98151e018b662ff3696cf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libcurl.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\libcurl.dll
                  • Size 495KB
                  • SHA256 b64229ace277bd01dac475ed99418d43b42d6ca25cdf3ded33d818542562f4c1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libdataReport.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\libdataReport.dll
                  • Size 1.3MB
                  • SHA256 718267f05fae12d2f2686d83d9b00b46973eff786060b65ebc1a1cca52c93803
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libssl-1_1-x64.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\libssl-1_1-x64.dll
                  • Size 685KB
                  • SHA256 8e8cd9173a37dc6ca2171e92ee9e1d43c961bf310741f9c2319e2e165d7e2c94
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  mfc140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\mfc140.dll
                  • Size 5.4MB
                  • SHA256 97d6a39de327ccdfeca2bdca784eae72f0e698d022caa7248b2926059b6ffa95
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  zlib1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\DataReport\zlib1.dll
                  • Size 99KB
                  • SHA256 e4c7609ab7a33db2321d901f795be8ed72298d04255479e1890c5e131854efc3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SkinEngine.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\SkinEngine.dll
                  • Size 3.6MB
                  • SHA256 eb5ef4810170d5e6dc0eeaac0759a00e0b2a5c8f2ff8c9f0694e3a288068d15d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\System.dll
                  • Size 11KB
                  • SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bg2.jpg
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\bg2.jpg
                  • Size 47KB
                  • SHA256 95de3ab8ec0c0cee095fc0edab45505f83d19b84bf77ca879cc64b1291b62f08
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bg3.jpg
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\bg3.jpg
                  • Size 50KB
                  • SHA256 8d29010eae3612d581319c880ddaf01979f44d591477a9fd45568806a9b45c59
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dataReport.json
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\dataReport.json
                  • Size 223B
                  • SHA256 b7b4979ef2ba0c547439c73f775e88fc256adf665c0666acb125eaa7966b07aa
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  libapm.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\libapm.dll
                  • Size 112KB
                  • SHA256 830e35fb691d8beb9754e875dcbf35d9cc6a4e5bb6b9deefde2c875fedaa4578
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libcrypto-1_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\libcrypto-1_1.dll
                  • Size 2.3MB
                  • SHA256 53b122b5293956e2d4465ece8a1300ac9846c2e3a43a2a8d93d855636a832838
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libcurl.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\libcurl.dll
                  • Size 450KB
                  • SHA256 d82bded85e43536ea898cdb76a235c583c08d2dcd9611d563f8b341209ca196d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libssl-1_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\libssl-1_1.dll
                  • Size 507KB
                  • SHA256 92b09d331e0ebc95917370a47d37e2dc2c38e46781421c3b2110a00ca03af014
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libtortoisedl.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\libtortoisedl.dll
                  • Size 235KB
                  • SHA256 b603b134bbe08b380369526b179133d83dc56a2ef023f29f405c77374bccaf38
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msvcp140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\msvcp140.dll
                  • Size 430KB
                  • SHA256 36247a46134986dc3853a5f21cb2621881c36d6f6b2f6eab1b60365a39a4dccf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  setupConfig.ini
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\setupConfig.ini
                  • Size 13KB
                  • SHA256 fc154a4a3d6c06e217a44a6d38e7a3b60c976e7a7f2583a745730ae9b709dd76
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vcruntime140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\vcruntime140.dll
                  • Size 79KB
                  • SHA256 faefafa405df5d62099c646552dd4889d74ab4911b700c46055db8c5fa5d70e0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  zlib1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsf511A.tmp\zlib1.dll
                  • Size 83KB
                  • SHA256 d55f14306de0c753ce422cd1e57eb4a420d0ea06713058598317473375cc61ab
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SkinEngine.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsw208F.tmp\SkinEngine.dll
                  • Size 3.6MB
                  • SHA256 4d9ff3c74914a413a6545fa9a5ed2f9e7f90dbfa761e04e6dd321addc43e9062
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsw208F.tmp\System.dll
                  • Size 12KB
                  • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nsExec.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsw208F.tmp\nsExec.dll
                  • Size 7KB
                  • SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nsis7z.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsw208F.tmp\nsis7z.dll
                  • Size 391KB
                  • SHA256 66ac8bd1f273a73e17a3f31d6add739d3cb0330a6417faeda11a9cae00b62d8b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  setupConfig.ini
                  • Path C:\Users\Admin\AppData\Local\Temp\nsw208F.tmp\setupConfig.ini
                  • Size 10KB
                  • SHA256 3c1c3463133f6a07b6fdbf593d743ecf92b531e3f182825c4a1003a407fed328
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  mFjtADOw.png
                  • Path C:\Users\Admin\AppData\Local\Wink\User Data\Wink Cache\Cover\mFjtADOw.png
                  • Size 3.8MB
                  • SHA256 060505682cd64e1a37a71074400ad76caf0c0c72458888dbb99aac5f102bbfa0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cache.db
                  • Path C:\Users\Admin\AppData\Local\Wink\cache.db
                  • Size 24KB
                  • SHA256 2c859952674a51fe2c19e9035fc7483dd42c17b119be4dd6dda1244e4080dc0f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cache.db
                  • Path C:\Users\Admin\AppData\Local\Wink\cache.db
                  • Size 32KB
                  • SHA256 f186932c611842f1a9dedd5133e842cf91fe5ca65d6bdd86442e64f74a71d2d3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/4340-8218-0x00007FFDC64E0000-0x00007FFDC6777000-memory.dmp
                  Download

                  memory/4340-8219-0x00007FFDC3FA0000-0x00007FFDC44ED000-memory.dmp
                  Download

                  memory/4340-8225-0x00007FFDA29B0000-0x00007FFDA29C0000-memory.dmp
                  Download

                  memory/4340-8217-0x00007FF612CC0000-0x00007FF6143A9000-memory.dmp
                  Download

                  memory/4340-8220-0x0000014ABB3E0000-0x0000014ABB3E1000-memory.dmp
                  Download

                  memory/4520-8229-0x00007FFDA29B0000-0x00007FFDA29C0000-memory.dmp
                  Download

                  memory/4520-8228-0x00007FFDC3FA0000-0x00007FFDC44ED000-memory.dmp
                  Download

                  memory/4916-8171-0x0000000005DD0000-0x0000000005E36000-memory.dmp
                  Download

                  memory/4916-8172-0x0000000005E40000-0x0000000005EA6000-memory.dmp
                  Download

                  memory/4916-8180-0x0000000005EF0000-0x0000000006244000-memory.dmp
                  Download

                  memory/4916-8181-0x0000000006500000-0x000000000651E000-memory.dmp
                  Download

                  memory/4916-8182-0x0000000006530000-0x000000000657C000-memory.dmp
                  Download

                  memory/4916-8170-0x00000000055D0000-0x00000000055F2000-memory.dmp
                  Download

                  memory/4916-8169-0x00000000056B0000-0x0000000005CD8000-memory.dmp
                  Download

                  memory/4916-8168-0x0000000002EC0000-0x0000000002EF6000-memory.dmp
                  Download