Overview

overview

6

Static

static

3

wink-ai_se...er.exe

windows10-2004-x64

6

wink-ai_se...er.exe

windows11-ltsc_2024-x64

6

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...rt.exe

windows10-2004-x64

1

$PLUGINSDI...rt.exe

windows11-ltsc_2024-x64

1

$PLUGINSDI...64.dll

windows10-2004-x64

1

$PLUGINSDI...64.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...rl.dll

windows10-2004-x64

1

$PLUGINSDI...rl.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...rt.dll

windows10-2004-x64

1

$PLUGINSDI...rt.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...64.dll

windows10-2004-x64

1

$PLUGINSDI...64.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...40.dll

windows10-2004-x64

1

$PLUGINSDI...40.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...00.dll

windows10-2004-x64

1

$PLUGINSDI...00.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...b1.dll

windows10-2004-x64

1

$PLUGINSDI...b1.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...ne.dll

windows10-2004-x64

3

$PLUGINSDI...ne.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...pm.dll

windows10-2004-x64

3

$PLUGINSDI...pm.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI..._1.dll

windows10-2004-x64

3

$PLUGINSDI..._1.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...rl.dll

windows10-2004-x64

3

$PLUGINSDI...rl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI..._1.dll

windows10-2004-x64

3

$PLUGINSDI..._1.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/06/2026, 00:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wink-ai_setup_installer.exe
  • Size 9.7MB
  • Sample260620-bbk9lsdy4s
  • SHA256 f84d509407226efe6fb63e77746f74404a527e12aa977453cb39878c7daa1ef7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
bootkitdiscoveryexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Writes to the Master Boot Record (MBR) 1 TTPs 6 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 24 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\wink-ai_setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\wink-ai_setup_installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6108
    • C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\MTDataReport.exe
      "C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\MTDataReport.exe" "downloader_install_show" "3.8.0" "wink-ai_setup_installer.exe" "ai_setup" "downloader_version" 1.0.2.2
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:1532
      • C:\Windows\System32\Wbem\wmic.exe
        wmic csproduct get uuid
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4492
    • C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\MTDataReport.exe
      "C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\MTDataReport.exe" "downloader_install_start" "3.8.0" "wink-ai_setup_installer.exe" "ai_setup" "install_path" C:\Program Files (x86)\Meitu "downloader_version" 1.0.2.2
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:6152
      • C:\Windows\System32\Wbem\wmic.exe
        wmic csproduct get uuid
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:688
    • C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\MTDataReport.exe
      "C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\MTDataReport.exe" "downloader_install_start_download" "3.8.0" "wink-ai_setup_installer.exe" "ai_setup" "temp_path" C:\Program Files (x86)\Meitu "temp_name" wink-ai_setup.exe "downloader_version" 1.0.2.2
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:6016
      • C:\Windows\System32\Wbem\wmic.exe
        wmic csproduct get uuid
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5616
    • C:\Program Files (x86)\Meitu\wink-ai_setup.exe
      "C:\Program Files (x86)\Meitu\wink-ai_setup.exe" 1 1 1 /S /D=C:\Program Files (x86)\Meitu
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2348
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NonInteractive -NoProfile -Command "$p=[Environment]::GetEnvironmentVariable('Path','Machine');$a='C:\Program Files (x86)\Meitu\Wink\3.8.0\cli';$legacy='C:\Program Files (x86)\Meitu\Wink\3.8.0';$parts=$p -split ';' | Where-Object{$_ -and $_ -ne $a -and $_ -ne $legacy};$np=($parts + $a) -join ';';[Environment]::SetEnvironmentVariable('Path',$np,'Machine')"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2316
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\System32\explorer.exe" /e,Wink.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3192
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTDataReport.exe
        "C:\Program Files (x86)\Meitu\Wink\3.8.0\MTDataReport.exe" "install_succeed" "3.8.0" "wink-ai_setup.exe" "ai_setup" "install_src" "1" "is_upgrade" "0"
        3⤵
        • Writes to the Master Boot Record (MBR)
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:5388
        • C:\Windows\System32\Wbem\wmic.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:6824
    • C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\MTDataReport.exe
      "C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\MTDataReport.exe" "downloader_install_success" "3.8.0" "wink-ai_setup_installer.exe" "ai_setup" "downloader_version" 1.0.2.2 "download_time" "33000" "install_time" "-3562000"
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Executes dropped EXE
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:6860
      • C:\Windows\System32\Wbem\wmic.exe
        wmic csproduct get uuid
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:7044
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:6552
    • C:\Program Files (x86)\Meitu\Wink\3.8.0\Wink.exe
      "C:\Program Files (x86)\Meitu\Wink\3.8.0\Wink.exe"
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5880
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MtBugReport.exe
        "C:\Program Files (x86)\Meitu\Wink\3.8.0\MtBugReport.exe" 0 5880 00007FFF44C4F840 0000000000000650
        3⤵
        • Executes dropped EXE
        PID:3356
      • C:\Windows\System32\Wbem\wmic.exe
        wmic csproduct get uuid
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1168
      • C:\Windows\System32\Wbem\wmic.exe
        wmic csproduct get uuid
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3172
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "Face" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:7108
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "Face" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:3808
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "BodyInOne" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:4704
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "BodyInOne" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:2296
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "Interactive" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:6944
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "Interactive" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:2768
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoBody" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:6452
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoBody" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:1588
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoSkin" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:1356
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoSkin" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:2028
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoHair" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:6700
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoHair" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:6764
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoDenseHair" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:2632
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoDenseHair" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:6068
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "SpaceDepth" "OPENCL" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:4456
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "SpaceDepth" "DIRECTX" "CheckRepeatCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:4560
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "Face" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:1460
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "Face" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:1228
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "BodyInOne" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:5336
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "BodyInOne" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:1204
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "Interactive" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:1272
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "Interactive" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:1896
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoBody" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:5408
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoBody" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:788
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoSkin" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:6480
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoSkin" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:6424
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoHair" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:3936
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoHair" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:1432
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoDenseHair" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:4676
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "VideoDenseHair" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:3080
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "SpaceDepth" "OPENCL" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:4572
      • C:\Program Files (x86)\Meitu\Wink\3.8.0\MTLabEnvdetExe.exe
        MTLabEnvdetExe.exe "SpaceDepth" "DIRECTX" "SaveCache" "C:/Users/Admin/AppData/Local/Wink/cache/" "C:/Program Files (x86)/Meitu/Wink/3.8.0/resource/models"
        3⤵
        • Executes dropped EXE
        PID:1320

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Config.ini
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\Config.ini
        • Size 172B
        • SHA256 aa97769e912cdbc8a8c021f242819776e2af8975800d04680d4f958eded7d621
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Config.ini
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\Config.ini
        • Size 226B
        • SHA256 93ece1dc978b6b8eb556da6f18a5ce85d5b5a381aa36063ee9aa851c1774bdde
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSVCP140.dll
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\MSVCP140.dll
        • Size 559KB
        • SHA256 3aa124022e86fbe72c11c2a334e35eb9f719572e15ac444dd722171cd69ae7ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MTDataReport.exe
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\MTDataReport.exe
        • Size 34KB
        • SHA256 28298be91a900775308f8f18f8e9925f4b4d9ba5e2e3fd295d2e694eb367ae44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shadow.png
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\QtQuick3D\Materials\maps\shadow.png
        • Size 334B
        • SHA256 03003aa01026e944b75447078f5758d0ffab854d03e9ce80780a174411073f7f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 bdf138419212f885be2db487f586a1b5b7efacdbe076a9be971e322b6a2c8fc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcurl.dll
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\libcurl.dll
        • Size 729KB
        • SHA256 36fdfa7d93e2ca2a3b76c2b3dd519b3ed9ee3cd14b58ab4e935e088a7870c1d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libdataReport.dll
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\libdataReport.dll
        • Size 1.4MB
        • SHA256 d8e3a7afce99ca89ca79c3fcd89f8c519632b6a1bd3f60810fe3b2e0a6439453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendDissolve.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\Overlay\PSBlend\BlendDissolve.jpg
        • Size 4KB
        • SHA256 9b7df3a203640a6ff24f543aeec84ed0ae512671bfaf0bb9167a5e49ac9715ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MTFilter_WhiteTeethAnatta.vs
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\Shaders\Anatta\MTFilter_WhiteTeethAnatta.vs
        • Size 294B
        • SHA256 5bf4347b7c373cb9517d947e9808fe60fafa11463a8195ec700268fd529a77e9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MTSelectColor_Filter.vs
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\Shaders\Filter\MTSelectColor_Filter.vs
        • Size 179B
        • SHA256 635b5245391915faed2eea4afe432c5ed80d7ce21e45fe696b4a3f5d245219a9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MTFilter_Mix.vs
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\Shaders\HairSoft\MTFilter_Mix.vs
        • Size 209B
        • SHA256 c0115601846a37a92692a2b8cbcf9c55709fbeb4c110a7f76375b689a99276c5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MTGlassWaterDropfreezeobject.fs
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\Shaders\MTGlassWaterDropfreezeobject.fs
        • Size 2KB
        • SHA256 30995ea5265fa7bbed6acbdbddf3e19e9b817d56a4899bfdd01dd876eee98aa8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        TextureWithAlpha.vs
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\Shaders\MVExtension\TextureWithAlpha.vs
        • Size 207B
        • SHA256 fb29e17ccfe803b7d0c85039e0f5899bb96dcdd64e973dac553f4a87e435dd5b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Kira10.vert.spv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\spirv\Kira10.vert.spv
        • Size 920B
        • SHA256 67f51ca43a41298436a09e8d295976a8823fea54e9da393960eee8dd5256ba47
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        filter_cube.vert.spv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\spirv\filter_cube.vert.spv
        • Size 652B
        • SHA256 7b98e23c92a75d23aad325d68c478b98b7f9dd3902fc8f33f70d6b7d4efce8e0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        segment_thresholding.vert.spv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\ARKernel3Builtin\spirv\segment_thresholding.vert.spv
        • Size 688B
        • SHA256 802d18c503ad108aa041f43de38af2ecd35c79c59a71c94fc6622880565f610f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        cheekfillers.vs.spirv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\MTAurora.bundle\Shaders\cheekfillers.vs.spirv
        • Size 992B
        • SHA256 6f00e44a455cad45a8f7c63bf255aefb88bc355ebd43629cab1e33569f411572
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        eyepouchnew_box.fs.spirv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\MTAurora.bundle\Shaders\eyepouchnew_box.fs.spirv
        • Size 1KB
        • SHA256 b0aac1230d2a3cae4110491cfe7c149f0539f53fe5657d39894035b8d39374ac
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        shadow_smooth_video.vs.spirv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\MTAurora.bundle\Shaders\shadow_smooth_video.vs.spirv
        • Size 992B
        • SHA256 4c9ff60b2d4be9ebc675ccb4fb265555cc357e6253b29579256d5ba4c1356311
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        configuration.plist
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\6110\61100000177\packages\eyebrow\configuration.plist
        • Size 676B
        • SHA256 350b793f9d273301f8f0afc13db7c62b769fe13c5029b17bf52ac2856efa59dd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        configuration.plist
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\6150\615000030\beauty\configuration.plist
        • Size 398B
        • SHA256 0853c3154d2bad6fb742e23b6f9b236e73025f80d5e5862281358d03343b344b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        part.vert
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\beautyBody\ar\res\segment\shaders\part.vert
        • Size 310B
        • SHA256 4745d5e59bf55052d63e0bbabc4fc25af93d47d7b5ee1262dc750881d731e933
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bulge.vs
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\beautyBody\ar\res\shader\bulge.vs
        • Size 199B
        • SHA256 80cd4a917a9cd3af40b6a43a7d5504dc4c42c589432ab5c6e3e97fd83f2283f6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        getbody.vert
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\body3D\ar\res\ar3d\bodyMask\getbody.vert
        • Size 159B
        • SHA256 adf0b106f92b08ca3283f2c27cdc1a68b58b46355470391e401fd0b51c23411c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        mixTexture.vert
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\body3D\ar\res\ar3d\shaders\mixTexture.vert
        • Size 424B
        • SHA256 705b3c8fbe2e8be61c44a75ea5a20f45df19329871706f7929a777b250f767ec
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        configuration.plist
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\faceLift\smoothShape\ar\configuration.plist
        • Size 452B
        • SHA256 619a575e3ba90484eb26cb5af390a6732d312ebc40209d1847507c8f2f1a7907
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        configuration.plist
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\faceLift\smoothShape\configuration.plist
        • Size 237B
        • SHA256 48c8245b56d2b718251dcb36796a82b451557bb82092aacddca30e4cfe0e7f79
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        configuration.json
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\forehead\ar\res\Effect2\suit\res\ai\configuration.json
        • Size 44B
        • SHA256 e67d85de9e603727b035e984c17204987dc0abd717fc141ab391f6bd97350b88
        • MD5 SHA1 SHA512
        Submit Download

        configuration.resources
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\hairFluffy\ar\configuration.resources
        • Size 249B
        • SHA256 d49222d6cd6f9a5fbdccb95fc3b8da6f9864b9aac2f643904998b1290071a6a6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        simple.ttf
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\hairFluffy\ar\res\simple.ttf
        • Size 9KB
        • SHA256 58dc0bbbd561769d6f7aa5deaa7fca1c1e94e18f9cdabc30ecfc2140f81d4302
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        trigger_ui.plist
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\hairFluffy\ar\trigger_ui.plist
        • Size 238B
        • SHA256 431cefa507c6f5b0ee42245dc01c32aac760d715b9f4b9ec38757503f2b3cf91
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MTFilter.lua
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\manualBeautyBody\ar\res\fill\modules\MTFilter\MTFilter.lua
        • Size 2KB
        • SHA256 2ebe54a11b8e95409a969e4daa75cdbbd2da4305e6dd191af3f80cea285a13b1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MTFramebuffer.lua
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\manualBeautyBody\ar\res\fill\modules\MTFramebuffer\MTFramebuffer.lua
        • Size 1KB
        • SHA256 02b12280f0f53e8f59a893b79fa4d0eb9f453745b74ddde60a1092c3caff2406
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        gaussianBlur.vert
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\manualBeautyBody\ar\res\fill\modules\MTGaussianBlur\shaders\gaussianBlur.vert
        • Size 310B
        • SHA256 3b63cb795d6f6af11065e18ef6ef67ad1d538def507c8ac648afd676d6bd13f8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        gaussianBlurH.frag
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\manualBeautyBody\ar\res\fill\modules\MTGaussianBlur\shaders\gaussianBlurH.frag
        • Size 1KB
        • SHA256 4f33794cb1627bcbefd97ceebe18d31b19017a119ad73cf82bb8c41b49363c18
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        gaussianBlurV.frag
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\manualBeautyBody\ar\res\fill\modules\MTGaussianBlur\shaders\gaussianBlurV.frag
        • Size 1KB
        • SHA256 0ecc3798a2c955e0ce485d2f7f6597d587ac99648cff4ac97a4de0aa815bf471
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        shoulder.vs
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\manualBeautyBody\ar\res\shoulder.vs
        • Size 183B
        • SHA256 0a26f328717a4e27aa492b2b2771e06a8d2781c09ac52b005c7c8f8fac95c913
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        warp3.vs
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printBeautyBodyPoint\ar\res\warp3.vs
        • Size 431B
        • SHA256 13a820c979ac01e1739674d011761a159b147dc964017376aff18bae224c16d1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        configuration.plist
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printBeautyBodyPoint\configuration.plist
        • Size 247B
        • SHA256 ac8627afaca4e9d40260469319fd044a047ba622c437f4fc691dfa62056c50ba
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BlendColorBurn.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendColorBurn.jpg
        • Size 4KB
        • SHA256 66be41ca59f7a02971b23e56aa404810d8da6f4b2d0bf6ef88c8403b3ecc11fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendColorDodge.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendColorDodge.jpg
        • Size 4KB
        • SHA256 4c4c032b0b1c3b2dc8eee5d4859c51005e1df6d06e10798e3b1ec4efdc4a8328
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendDarken.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendDarken.jpg
        • Size 5KB
        • SHA256 8c32cd378339f557d02257697a103943ebcab79feddecdddc141b0eb04d6b877
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendDarkerColor.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendDarkerColor.jpg
        • Size 5KB
        • SHA256 b6176985f866173816e9fb70b33397e5df16d1b021b3a8abdacaef259d0beb96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendDifference.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendDifference.jpg
        • Size 6KB
        • SHA256 c563bff0961baf38a4973c7cf9464361137a72adbb791131892f4c055c608d58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendDivide.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendDivide.jpg
        • Size 4KB
        • SHA256 5330369ddcead162dfc3b87e1f9f209393ff4055fd1d01776525a1a554806d05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendExclusion.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendExclusion.jpg
        • Size 4KB
        • SHA256 1b27fde12a086b509ee31f9af75bcdc9962f509df3bc7eb3b10a17bd98ac9188
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendHardLight.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendHardLight.jpg
        • Size 5KB
        • SHA256 a72702c961c3ef49da6653c303f09c4ce7231549b3d5ee436a77f6b7956ee64a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendHardMix.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendHardMix.jpg
        • Size 3KB
        • SHA256 d6b94f1ee8cf012bd0b67a427e07d13dcc3f17ddeb4b2edff4927a38c02c7b43
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BlendLighten.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendLighten.jpg
        • Size 5KB
        • SHA256 82a755f216e8ed978dd398f4a3df28f3c6402eb3988f9866228a6d59868a4f61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendLighterColor.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendLighterColor.jpg
        • Size 5KB
        • SHA256 71459bdfd783b989f53de4fe3b002f2dc66376878a28d2045a070d85cf6ba940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendLinearBurn.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendLinearBurn.jpg
        • Size 4KB
        • SHA256 8ec0220bffff26fe838dab6cf13eaba6e7327e3589815bd7c3f70436344caa2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendLinearDodge.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendLinearDodge.jpg
        • Size 4KB
        • SHA256 a9a2a03dfba212841dee970bd4e6d2f5ab3de8e6560db3230867c778250ed86e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendLinearLight.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendLinearLight.jpg
        • Size 4KB
        • SHA256 2c3bb5e7a09bf7fb2da4ca00a0334d7c24a01b5cddcf1cbec662c7be285fd740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendMultiply.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendMultiply.jpg
        • Size 4KB
        • SHA256 290cff0cd78534f7c6ef158a532efa64d789063b79b5e9b8b8a680a2b92fd011
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendOverlay.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendOverlay.jpg
        • Size 5KB
        • SHA256 639d12087a9e0302b95119ed71ece03784eb5bacfcfdd09019f6e2db4ce3207b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendPinLight.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendPinLight.jpg
        • Size 5KB
        • SHA256 04a7b9d7dad8ba5423da8b1128b11cbdce10d5ede457a4a75d404efe4d8db65f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendScreen.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendScreen.jpg
        • Size 4KB
        • SHA256 4278502539508c7bd4af856f5336042cfc35ed2ea4856a3c17b1b1885edb3d87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendSoftLight.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendSoftLight.jpg
        • Size 5KB
        • SHA256 7eef994f9c2e3df17eca23a2277586036167b1dddeb26d9c55d4375fa7a8c638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendSubtract.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendSubtract.jpg
        • Size 4KB
        • SHA256 8f015bff5b31a12d6a284a28a72b4be2a22f044b2e2b80a694ef984396efa676
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlendVividLight.jpg
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVBeauty.bundle\printSkinSegmentData\ar\res\template\modules\MTShadowBaseRender\textures\PSBlend\BlendVividLight.jpg
        • Size 5KB
        • SHA256 c219e695b45935f5e9a35ab5382e7a3377cd1aa4754cc9a2dd9533a1462f1295
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        configuration.plist
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\MTVConfig.bundle\Animation\PIP\configuration.plist
        • Size 245B
        • SHA256 af521c06025503647b6f8f18866140a2b95c476572605ac40f9d8579e53b5506
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        configuration.plist
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\beauty\printBeautyFacePoint\configuration.plist
        • Size 255B
        • SHA256 fe56361d36606cdcaf235a2c3d67d5e331b3a073882ea6c61c45fd895b088520
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MTFilter_Mean.vs
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\face\ar\res\light\gp\faceMask\MTFilter_Mean.vs
        • Size 1KB
        • SHA256 b278736e4a806f37177aef6351e959cc8a73fe3fa09e9ba1616ee2fbacc5381e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        fragment.fs
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\face\ar\res\light\gp\faceMask\fragment.fs
        • Size 10KB
        • SHA256 7f5c21f276156ba79d788afecb17a34d0406027928238f73937712aa5e6b4924
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        remap.vs
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\face\ar\res\light\gp\phong\remap.vs
        • Size 171B
        • SHA256 357622a9efe2975362715f95c0508f8634a35848ca272441dd1c43224877d36f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MTFilter_SegmentSourceErosion9H.vs
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\face\ar\res\light\gp\segment\MTFilter_SegmentSourceErosion9H.vs
        • Size 892B
        • SHA256 a77b7e2a42007da5e3821a62804cb597e6de9cb0b5a0bd7c7f60229299ebf1b4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MTFilter_SegmentSourceErosion9V.vs
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\face\ar\res\light\gp\segment\MTFilter_SegmentSourceErosion9V.vs
        • Size 888B
        • SHA256 9d23667be8f80669a2fda1b3d38bc839fd6804b90c91077404689d83de156c4c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        mask_00000.png
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\face\ar\res\light\gp\texture\mask\mask_00000.png
        • Size 7KB
        • SHA256 d4f066a524f80ef6caa5fa630cdefec5136c9c1731af53650aaed546316afbf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        configuration.plist
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\face\configuration.plist
        • Size 834B
        • SHA256 a9de58b0c799978e404956a3023f652e099d56b8c125caa1a6826ec1dd144bc6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        config.plist
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\whole\config.plist
        • Size 372B
        • SHA256 d53a5df628463a6877ba82c9e5548f2f53ca7053d5e7d85b3fed9b880730b92f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        configuration.plist
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\whole\info\AR\AR\configuration.plist
        • Size 992B
        • SHA256 8f89cc4af7d5b140f6b79b1347ff22c1ff940ccd4da44cc729c7a84ad4102414
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        configuration.plist
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\whole\info\Filter\Filter\configuration.plist
        • Size 805B
        • SHA256 fbaafde11aaab79e9b982efbe0687b685a52d6409d1fcddf176d400a78c9512b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        data.json
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\fillLight\whole\info\internalPublishInfo\data.json
        • Size 29B
        • SHA256 7e8442bc75b4c433aec48c6b2cade660d3c082bf956ad8d2f0ebcf584ecefc08
        • MD5 SHA1 SHA512
        Submit Download

        light_100.png
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\tone\ar\res\light_100.png
        • Size 6KB
        • SHA256 32253be222808e7701c3272a9fae0a6b86c4bafefa217ca94d4e294597d1024f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        light_100_rever.png
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\tone\ar\res\light_100_rever.png
        • Size 10KB
        • SHA256 0612eed526a3b4a63119ecc08bbf1a3c03141c08a4b54ee59ccb0910b4ba2712
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        temperature_100.png
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\tone\ar\res\temperature_100.png
        • Size 10KB
        • SHA256 0c976eddd87879e63ed1514da412fc97199b8d9ecec449349c5e710c7a7de957
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        temperature_100_rever.png
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\tone\ar\res\temperature_100_rever.png
        • Size 11KB
        • SHA256 9ac7592d3f98e862311e2da1d97984e83073fc8c2dc5351ba97dbdda37e3141d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ShadowMap.png
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\AutoToning\ShadowMap.png
        • Size 7KB
        • SHA256 43192ab3751b933140f381bfbfd704804b597ddae142f65d7c7d15b8a9425f35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        highlights_100_rever.png
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\AutoToning\highlights_100_rever.png
        • Size 370B
        • SHA256 dfdbf818641f9da5cda4cb56cf52b78a75f29ee86fd92cd9d78032f73b72f15c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        lookup_table_512_ambianceSkin.png
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\AutoToning\lookup_table_512_ambianceSkin.png
        • Size 739KB
        • SHA256 5564dafe0481cea550b7af7904af34a133850ed54cf27386ebd823b5d22fec04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cheekfiller_mask.vs.spirv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\cheekfiller_mask.vs.spirv
        • Size 876B
        • SHA256 2c2ddfed76bfb54f0527c9220b0f558fe4d7c395804b7ab3eabf144b469447ea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        eye_mask.vs.spirv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\eye_mask.vs.spirv
        • Size 1KB
        • SHA256 cc08d3d0dd4a11d85ff08156c4e9a9fb162f95b7bc729d57fb5f61b5d2a27aac
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        eyepouchnew_gauss.vs.spirv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\eyepouchnew_gauss.vs.spirv
        • Size 3KB
        • SHA256 c50db5b8c201c12e4c496dbb6ed606701a4690f2c66ec29e45c961aa3bcfcde8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        eyepouchnew_median.fs.spirv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\eyepouchnew_median.fs.spirv
        • Size 17KB
        • SHA256 c5251bccd62df2dbd6a1b71f8a39df2ee05da5f1807663e525165874deb1d3ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        eyepouchnew_median_android.fs.spirv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\eyepouchnew_median_android.fs.spirv
        • Size 1KB
        • SHA256 b8e16c9c86091cd18af0b2fecf393aa4fe1a10bd517322f20c1b9b8f9402c0e1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        eyepouchnew_median_win.fs.spirv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\eyepouchnew_median_win.fs.spirv
        • Size 51KB
        • SHA256 22e84087c9545a17692523e26960981258b2ede9734ec340a84ac20927cdc192
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        eyepouchnew_variance.fs.spirv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\eyepouchnew_variance.fs.spirv
        • Size 1024B
        • SHA256 c376155cd04d12dd8a720653b7a9415c7888805ed3aca2b308d105f2acb39448
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        hairmatte_multi.fs.spirv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\hairmatte_multi.fs.spirv
        • Size 780B
        • SHA256 cfc6d7ad7d034377c280760db77033fdaf70a09f07822a11923767c11e0d020e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        render.fs.spirv
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\Shaders\render.fs.spirv
        • Size 512B
        • SHA256 ed3c6b304705d8994110697e3c1b8c9c316a499f8d805bb13a18d2e9dcc51511
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        TeethWhiteLut.png
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\resource\webp\MTAurora.bundle\TeethWhiteLut.png
        • Size 4KB
        • SHA256 9a74ecd6227b41f5f3da99280113078d5aa3d4bb7a0c5bee7c6083492f87f872
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\vcruntime140_1.dll
        • Size 48KB
        • SHA256 b4ec274497a2981e660c89207e5bbb48265bb7d981631d00ce74ff1a26f9f62a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Program Files (x86)\Meitu\Wink\3.8.0\zlib1.dll
        • Size 94KB
        • SHA256 caecc0306d08971aee74c224b6a5269881b008a588fded5a968f7d6df0c08981
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wink.exe
        • Path C:\Program Files (x86)\Meitu\Wink\Wink.exe
        • Size 742KB
        • SHA256 f52720c504dd44317fec261a23057e996bddf5a1621546ef9f8d2b633ea7f381
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_1pwut4z0.3tz.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1pwut4z0.3tz.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SkinEngine.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4955.tmp\SkinEngine.dll
        • Size 3.6MB
        • SHA256 4d9ff3c74914a413a6545fa9a5ed2f9e7f90dbfa761e04e6dd321addc43e9062
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4955.tmp\System.dll
        • Size 12KB
        • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4955.tmp\nsExec.dll
        • Size 7KB
        • SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsis7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4955.tmp\nsis7z.dll
        • Size 391KB
        • SHA256 66ac8bd1f273a73e17a3f31d6add739d3cb0330a6417faeda11a9cae00b62d8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setupConfig.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4955.tmp\setupConfig.ini
        • Size 10KB
        • SHA256 3c1c3463133f6a07b6fdbf593d743ecf92b531e3f182825c4a1003a407fed328
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BgWorker.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\BgWorker.dll
        • Size 2KB
        • SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MTDataReport.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\MTDataReport.exe
        • Size 36KB
        • SHA256 2b27e97dae7527f740a33d426b2c462c6e9a0848012ba62f06b5b686be0b670c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\libcrypto-1_1-x64.dll
        • Size 3.3MB
        • SHA256 c16bd443c9c63dfefa31f594ffdc062d29ae557178b98151e018b662ff3696cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcurl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\libcurl.dll
        • Size 495KB
        • SHA256 b64229ace277bd01dac475ed99418d43b42d6ca25cdf3ded33d818542562f4c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libdataReport.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\libdataReport.dll
        • Size 1.3MB
        • SHA256 718267f05fae12d2f2686d83d9b00b46973eff786060b65ebc1a1cca52c93803
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\libssl-1_1-x64.dll
        • Size 685KB
        • SHA256 8e8cd9173a37dc6ca2171e92ee9e1d43c961bf310741f9c2319e2e165d7e2c94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mfc140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\mfc140.dll
        • Size 5.4MB
        • SHA256 97d6a39de327ccdfeca2bdca784eae72f0e698d022caa7248b2926059b6ffa95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\DataReport\zlib1.dll
        • Size 99KB
        • SHA256 e4c7609ab7a33db2321d901f795be8ed72298d04255479e1890c5e131854efc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SkinEngine.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\SkinEngine.dll
        • Size 3.6MB
        • SHA256 eb5ef4810170d5e6dc0eeaac0759a00e0b2a5c8f2ff8c9f0694e3a288068d15d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\System.dll
        • Size 11KB
        • SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bg1.jpg
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\bg1.jpg
        • Size 41KB
        • SHA256 9a46d8866c83a540992035bbc06bfb840d6379aecf2dc42055eec7c6b85d4ce0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bg2.jpg
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\bg2.jpg
        • Size 47KB
        • SHA256 95de3ab8ec0c0cee095fc0edab45505f83d19b84bf77ca879cc64b1291b62f08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bg3.jpg
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\bg3.jpg
        • Size 50KB
        • SHA256 8d29010eae3612d581319c880ddaf01979f44d591477a9fd45568806a9b45c59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dataReport.json
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\dataReport.json
        • Size 223B
        • SHA256 b7b4979ef2ba0c547439c73f775e88fc256adf665c0666acb125eaa7966b07aa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        libapm.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\libapm.dll
        • Size 112KB
        • SHA256 830e35fb691d8beb9754e875dcbf35d9cc6a4e5bb6b9deefde2c875fedaa4578
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\libcrypto-1_1.dll
        • Size 2.3MB
        • SHA256 53b122b5293956e2d4465ece8a1300ac9846c2e3a43a2a8d93d855636a832838
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcurl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\libcurl.dll
        • Size 450KB
        • SHA256 d82bded85e43536ea898cdb76a235c583c08d2dcd9611d563f8b341209ca196d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\libssl-1_1.dll
        • Size 507KB
        • SHA256 92b09d331e0ebc95917370a47d37e2dc2c38e46781421c3b2110a00ca03af014
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libtortoisedl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\libtortoisedl.dll
        • Size 235KB
        • SHA256 b603b134bbe08b380369526b179133d83dc56a2ef023f29f405c77374bccaf38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\msvcp140.dll
        • Size 430KB
        • SHA256 36247a46134986dc3853a5f21cb2621881c36d6f6b2f6eab1b60365a39a4dccf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setupConfig.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\setupConfig.ini
        • Size 13KB
        • SHA256 fc154a4a3d6c06e217a44a6d38e7a3b60c976e7a7f2583a745730ae9b709dd76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\vcruntime140.dll
        • Size 79KB
        • SHA256 faefafa405df5d62099c646552dd4889d74ab4911b700c46055db8c5fa5d70e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsn57A2.tmp\zlib1.dll
        • Size 83KB
        • SHA256 d55f14306de0c753ce422cd1e57eb4a420d0ea06713058598317473375cc61ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TbbtUdXW.png
        • Path C:\Users\Admin\AppData\Local\Wink\User Data\Wink Cache\Cover\TbbtUdXW.png
        • Size 3.8MB
        • SHA256 060505682cd64e1a37a71074400ad76caf0c0c72458888dbb99aac5f102bbfa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cache.db
        • Path C:\Users\Admin\AppData\Local\Wink\cache.db
        • Size 24KB
        • SHA256 84873b842aa2bf206a295562de53e97fcebab2f7ed445cb2b41cdfa2bb5bd1ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2316-8184-0x0000000006430000-0x000000000644E000-memory.dmp
        Download

        memory/2316-8173-0x00000000057A0000-0x0000000005DEA000-memory.dmp
        Download

        memory/2316-8183-0x0000000005F40000-0x000000000629B000-memory.dmp
        Download

        memory/2316-8172-0x0000000002F50000-0x0000000002F86000-memory.dmp
        Download

        memory/2316-8176-0x0000000005ED0000-0x0000000005F36000-memory.dmp
        Download

        memory/2316-8174-0x0000000005650000-0x0000000005672000-memory.dmp
        Download

        memory/2316-8185-0x0000000006480000-0x00000000064CC000-memory.dmp
        Download

        memory/2316-8175-0x0000000005E60000-0x0000000005EC6000-memory.dmp
        Download

        memory/3356-8239-0x00007FFF22400000-0x00007FFF22410000-memory.dmp
        Download

        memory/3356-8238-0x00007FFF3E980000-0x00007FFF3EECD000-memory.dmp
        Download

        memory/5880-8223-0x00007FFF3E980000-0x00007FFF3EECD000-memory.dmp
        Download

        memory/5880-8235-0x00007FFF22400000-0x00007FFF22410000-memory.dmp
        Download

        memory/5880-8226-0x00007FF70C090000-0x00007FF70D779000-memory.dmp
        Download

        memory/5880-8227-0x0000021111610000-0x0000021111611000-memory.dmp
        Download

        memory/5880-8225-0x00007FFF40550000-0x00007FFF407E7000-memory.dmp
        Download

        memory/5880-8224-0x00007FFF3E320000-0x00007FFF3E723000-memory.dmp
        Download