Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/06/2026, 01:14

General

  • Target
    9xbuddy-3.4.3-x64.exe
  • Size 121.1MB
  • Sample260620-blq8lsdy7s
  • SHA256 940939c3d277b7883af523dcb659d7bafa684f523eb844d59905201022532d8c
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

  • Loads dropped DLL 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9xbuddy-3.4.3-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\9xbuddy-3.4.3-x64.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5916
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1180
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\9xbuddy', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5720
  • C:\Users\Admin\AppData\Local\Programs\9xbuddy\9xbuddy.exe
    "C:\Users\Admin\AppData\Local\Programs\9xbuddy\9xbuddy.exe"
    1⤵
    • Drops file in Windows directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Users\Admin\AppData\Local\Programs\9xbuddy\9xbuddy.exe
      "C:\Users\Admin\AppData\Local\Programs\9xbuddy\9xbuddy.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\9xbuddy" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1776,i,16472805056569173596,15001693991327828231,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1780,i,2498487074205735469,17601043374467619115,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1772 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2780
    • C:\Users\Admin\AppData\Local\Programs\9xbuddy\9xbuddy.exe
      "C:\Users\Admin\AppData\Local\Programs\9xbuddy\9xbuddy.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\9xbuddy" --field-trial-handle=1776,i,16472805056569173596,15001693991327828231,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1780,i,2498487074205735469,17601043374467619115,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2232 /prefetch:11
      2⤵
      • Executes dropped EXE
      PID:2844
    • C:\Users\Admin\AppData\Local\Programs\9xbuddy\9xbuddy.exe
      "C:\Users\Admin\AppData\Local\Programs\9xbuddy\9xbuddy.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\9xbuddy" --app-path="C:\Users\Admin\AppData\Local\Programs\9xbuddy\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1776,i,16472805056569173596,15001693991327828231,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1780,i,2498487074205735469,17601043374467619115,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2520 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3496
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Windows\System32\reg.exe
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        3⤵
          PID:256

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          StartupProfileData-NonInteractive

          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 ec3ae35f410732c4339ac26091ddc2673eb428d3ee3e0607e7e64f5e13ac8df8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          StartupProfileData-NonInteractive

          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 16KB
          • SHA256 e6384ee9601aa9e583ca7b094c05e63b01ff3aa3c7f8cd102d60e49e6da0d2a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          __PSScriptPolicyTest_fxl3qrbp.tza.ps1

          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fxl3qrbp.tza.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH

          LICENSE.electron.txt

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\LICENSE.electron.txt
          • Size 1KB
          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
          • MD5 SHA1 SHA512 TLSH

          LICENSES.chromium.html

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\LICENSES.chromium.html
          • Size 18.6MB
          • SHA256 c1bc6cfdd6c5844720e5e6332698a6131f5402e77abf1fdb9646740d38065a65
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_100_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\chrome_100_percent.pak
          • Size 113KB
          • SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_200_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\chrome_200_percent.pak
          • Size 183KB
          • SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          d3dcompiler_47.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\d3dcompiler_47.dll
          • Size 4.5MB
          • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          dxcompiler.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\dxcompiler.dll
          • Size 24.5MB
          • SHA256 db72abfc0de76ff1504e240da07c1dfd8646ce46aa30df9bf4fb2258161f97d1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          dxil.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\dxil.dll
          • Size 1.4MB
          • SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ffmpeg.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\ffmpeg.dll
          • Size 3.0MB
          • SHA256 ced08d56da30dc9671c088870f8cd0820fb5b43d568be5588d9934b883cce43a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icudtl.dat

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\icudtl.dat
          • Size 10.3MB
          • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libEGL.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\libEGL.dll
          • Size 508KB
          • SHA256 f158a8da0e8b6c56bcdac67ed95446df6f984ed192d895a5c8040a43e8343bef
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libGLESv2.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\libGLESv2.dll
          • Size 7.6MB
          • SHA256 c3e413e81f52f64415481daf16232e18ae19caa6b0cf2768a02a0a51d3436b60
          • MD5 SHA1 SHA512 SSDEEP TLSH

          af.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\af.pak
          • Size 595KB
          • SHA256 e91886ab2efa80ba17fb92ee8a6caacd4ed34ae8f16be9f7a43900f24c6af514
          • MD5 SHA1 SHA512 SSDEEP TLSH

          am.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\am.pak
          • Size 966KB
          • SHA256 0995da0a36c5bf89c56931acee91bf2c8cc4134fbee2bb662046e2f784397c3d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\ar.pak
          • Size 1.0MB
          • SHA256 01d9513381e17dae8697f6a04c2840956b814b104cbe3b8307e1a438e8967603
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bg.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\bg.pak
          • Size 1.1MB
          • SHA256 b2c5a13642446c60f580e2a526f63e46c0a14ea55d004b0cc0c0a31f2a2ece6a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\bn.pak
          • Size 1.4MB
          • SHA256 e2b805f0b26d0dcb42eb8de7f726bcee4897342e035b128c03232b94232778f6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ca.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\ca.pak
          • Size 670KB
          • SHA256 5c4adc1a394d6e985f089857c9c6f92d1832b2fdc4471140e543e277f07dec17
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cs.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\cs.pak
          • Size 696KB
          • SHA256 bf41c0e9ee98bceaf8d4cdd5982f42cd482f862cec5385ecc2afd911356ddb6f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          da.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\da.pak
          • Size 626KB
          • SHA256 d53590736444cdd4bb4a31bad9236205451ce70fc9b5865c38264d77ac9bf0a1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\de.pak
          • Size 671KB
          • SHA256 8554c585028234ddd70ef345c3a47b579c309b6e453d3e9ca673ba32b15f3841
          • MD5 SHA1 SHA512 SSDEEP TLSH

          el.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\el.pak
          • Size 1.2MB
          • SHA256 471570839cceb34a1db8f5b25fca6898194ba4784e82c8d72169885bb64a6216
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-GB.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\en-GB.pak
          • Size 542KB
          • SHA256 9637257dd7a936906b5e2c71d345f49a00225addedc1afddc1a06d906571ff49
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-US.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\en-US.pak
          • Size 548KB
          • SHA256 a15a41f74f809ae908b95645565c34b151483a5c04a94265b44aee12fd413b55
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es-419.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\es-419.pak
          • Size 661KB
          • SHA256 5ce9c791402daf80babb909649863480e9500537b1a12a752bf669df1915dd8a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\es.pak
          • Size 658KB
          • SHA256 68f0f80d95ff86941b60f82a72b9b994dca0603abc767a3036b0beedb50b29a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          et.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\et.pak
          • Size 601KB
          • SHA256 0b73460e50b8bbf3737160441571eba058ffd4ce358c268ed51be5555bf45ff0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fa.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\fa.pak
          • Size 995KB
          • SHA256 0efecdc9b5f248db99e104611d06308f7580e75b5d74c710a86eadd92204b7a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\fi.pak
          • Size 612KB
          • SHA256 db3640df151dd53cd8b48290eef15d2c1278918a16ef9551fa9d29986674c4ed
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fil.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\fil.pak
          • Size 694KB
          • SHA256 e6cd03f12ac45e96ae6fb55fbc3396a4f3367239d73e134056cc376b728652f9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\fr.pak
          • Size 715KB
          • SHA256 519d2c2c4edc344a74943db5849622dcc7d19efef9e2430d27426ed9ccca96e5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\gu.pak
          • Size 1.4MB
          • SHA256 d2a0b34fdf156de47bccd69f5d942e934b15faf90468eb8a5836eeee6a827efe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          he.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\he.pak
          • Size 871KB
          • SHA256 d945e14fefc77034090da57844f5b7d731183c81595da4ba666b36dfc6f07adb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\hi.pak
          • Size 1.5MB
          • SHA256 51c5bb6ab0a12b6c1b7a7e5792ab3a60bd2a07180cf9534fe38f2c1c5bceebb6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\hr.pak
          • Size 670KB
          • SHA256 e67b335f840e54947890f177d7ef1f3073bf070823ac85f36e0380dc5ee72869
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\hu.pak
          • Size 716KB
          • SHA256 5facf6dc1970a5f743191d2f1e031b42c06c66477612473017690b40484a6dd5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\id.pak
          • Size 592KB
          • SHA256 b27bc5757f7df301d106c56f98965f52bcbb35185e328561c3b717485a966ada
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\it.pak
          • Size 649KB
          • SHA256 192e40f475a710c4d99bb44bc081a1031c18aa5db673b0e119a4a24539e3ea07
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\ja.pak
          • Size 791KB
          • SHA256 e633be299fbdd0af03690a9ddbe3190075623b9e6a8e69179334107f1291c69d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          kn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\kn.pak
          • Size 1.6MB
          • SHA256 e66d9e990ff0132d5c523c9109d4bb5f9e91795e986cbc3c6f6210e278593e1e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\ko.pak
          • Size 670KB
          • SHA256 3d9ce2997479783fb05f36757376d89a9650c4a175d5176c01380744e8e3034e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lt.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\lt.pak
          • Size 729KB
          • SHA256 8d6476da7e1cf535cc188c87516ba59f8ab59947ce483c71559841adc194fb16
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\lv.pak
          • Size 726KB
          • SHA256 8605b0a2d4764ea046f5f59f240ed035efbe8635d3ce9e97ea9fa9e9a23c1450
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ml.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\ml.pak
          • Size 1.6MB
          • SHA256 0361761ec842b8d53cd088d906e32a65bc05d574945b5751397527efd6ba43c3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\mr.pak
          • Size 1.3MB
          • SHA256 1f0ca08f7ab7603d49209317412a874157352858a8baa648ed1859ddb28c81ea
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ms.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\ms.pak
          • Size 624KB
          • SHA256 e7c902b27b903de61592e82b2a27688afb82553063cb28b6ec63e39257790c5c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nb.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\nb.pak
          • Size 598KB
          • SHA256 e7fe21421e211fb1f84a810846cfe8c33e94e88764247f9f2023ffde812d21bc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\nl.pak
          • Size 623KB
          • SHA256 8e2b2b32861dd2efc143b0a0d075e6e38bc0d62ded2a2771d42deb6675e09305
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\pl.pak
          • Size 696KB
          • SHA256 20c71e146768f607c0a61335b80b26bb9f4acb5c1cc7060bdfa5b9c144b4827a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-BR.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\pt-BR.pak
          • Size 652KB
          • SHA256 21ed64cbdf74e46bf51e292f62208471c6fe20e1db45735a9c0c3b188f3b7576
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-PT.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\pt-PT.pak
          • Size 655KB
          • SHA256 78068ad5447b9994873519e9a2e221f37d87a92528bf591229753679367562a5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ro.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\ro.pak
          • Size 680KB
          • SHA256 39ba021557ddd98a693340cbbeac77f69641635b72ac6f427d4183c466e280f2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ru.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\ru.pak
          • Size 1.1MB
          • SHA256 1ed59f0b501d213ef40073a60a0ce27ddc6fdc01a65d6873fd2f7c51e80d02e4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\sk.pak
          • Size 708KB
          • SHA256 1065e8d31a48d8e36c7dc2f4c70b1692a4618894e637092bf9aade7af82de033
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\sl.pak
          • Size 678KB
          • SHA256 254f626f3daf5d6f8278b87d59a6bc259dc5bc9c192a2875ea25607f915a03ca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\sr.pak
          • Size 1.0MB
          • SHA256 383dca885a8e40efe87f713464207199f30dc933ddacf21f61a2b1e89ca944d5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\sv.pak
          • Size 605KB
          • SHA256 8844d78e1f2932fc230a59f2b8698a432ba26060b251281e10f8e98020b125d8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sw.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\sw.pak
          • Size 640KB
          • SHA256 bf86b4b75b827223632badfecdc8689497873c14b209c07fde825968d9f9d1c0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ta.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\ta.pak
          • Size 1.6MB
          • SHA256 0d630b4c27f0b8eb971381275ed9f64508420140b22070bb31581976a2ebfd11
          • MD5 SHA1 SHA512 SSDEEP TLSH

          te.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\te.pak
          • Size 1.5MB
          • SHA256 64a9888abb8bbecefe23a2195b555e1f8d9fd8435351b63c595a926dd123142c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          th.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\th.pak
          • Size 1.3MB
          • SHA256 12e6592199914b67c29cca512ea826e8eb478cca62bc67d336a94c72fb78e4b4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\tr.pak
          • Size 651KB
          • SHA256 1093a6f7c31f94641830902bfe1027145a42a3847ed8af0869f12cfa2db48587
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\uk.pak
          • Size 1.1MB
          • SHA256 d7a3dcd2b95dbf0809d47b61005ce5fdfb4417514ecfad543f4cd9b746bfc962
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ur.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\ur.pak
          • Size 980KB
          • SHA256 ba94f43cf5fa31982d1a559262dfc13d34ad028e2d23dc5a11813f1645842ae2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\vi.pak
          • Size 774KB
          • SHA256 90ac2cd4502f502edf5b9cce089763df623a608849bc381efb3a3c20801341f4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-CN.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\zh-CN.pak
          • Size 554KB
          • SHA256 da523b8e933ca98f571fe3ac398a53d362445410b3469288d43553d65d1bce3e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-TW.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\locales\zh-TW.pak
          • Size 547KB
          • SHA256 2ac36905c94b7d4fba0b3cc3841f14dbf5ba08766eecdd787b45ea736d1e0dcb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          resources.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources.pak
          • Size 6.4MB
          • SHA256 302671ba7bf6d6352773d34de852793027d389c4afde1db0977e1b76e39d5938
          • MD5 SHA1 SHA512 SSDEEP TLSH

          app-update.yml

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app-update.yml
          • Size 104B
          • SHA256 4876fc5f40622f73dc9090c7b4c76e39b22f7af6c399fe88ca5816ab9c16360d
          • MD5 SHA1 SHA512 TLSH

          app.asar

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar
          • Size 44.0MB
          • SHA256 672f29eb38e8948af2d661168b4380f70573cedd879490a4529a5a2c630cc689
          • MD5 SHA1 SHA512 SSDEEP TLSH

          LICENSE

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\LICENSE
          • Size 1KB
          • SHA256 09856b52897c91ab67e7456ef43067019f31dfd3b87fda72e655736b1ebdee55
          • MD5 SHA1 SHA512 TLSH

          better_sqlite3.node

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node
          • Size 1.8MB
          • SHA256 6cf467e31045b668e8c9fc0a0b65dbd5aca263ee5c20cd6847b8a4ccc0d79541
          • MD5 SHA1 SHA512 SSDEEP TLSH

          common.gypi

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\common.gypi
          • Size 1KB
          • SHA256 e71a565cd7733e05efc3a2792b54e260126f03f490325aa2a201202acbbdb315
          • MD5 SHA1 SHA512 TLSH

          copy.js

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\copy.js
          • Size 897B
          • SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
          • MD5 SHA1 SHA512 TLSH

          defines.gypi

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\defines.gypi
          • Size 1KB
          • SHA256 1ffa84b8af99780a293dcb7a9031c2dccc8b0d013aef434a35c283cc6c984f2e
          • MD5 SHA1 SHA512 TLSH

          download.sh

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\download.sh
          • Size 3KB
          • SHA256 dd195036c9b7e7fb420c7e9ee118b33a9be9a5e61266f66663cf7f14b9844257
          • MD5 SHA1 SHA512 TLSH

          1208.patch

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\patches\1208.patch
          • Size 597B
          • SHA256 5d1f22d69fee3551b70a7b7b9b14be43fcfd04dbc8683233667abfa75905011a
          • MD5 SHA1 SHA512 TLSH

          sqlite3.gyp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3.gyp
          • Size 2KB
          • SHA256 a009b8f80cf0a944eacaf71a84e590504f353fbd8f8b341138d0c3094e372d18
          • MD5 SHA1 SHA512 TLSH

          sqlite3.c

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.c
          • Size 9.0MB
          • SHA256 4845b2554eee2fd629fa305a599f80f5e8b989756ecb92fa323c2d38db41f4e8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sqlite3.h

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.h
          • Size 656KB
          • SHA256 19585c8b5230e9d4f223bf31b709ece7b6a0bb3faf00d8310625d8e58cda1b1d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sqlite3ext.h

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3ext.h
          • Size 37KB
          • SHA256 ea81fb7bd05882e0e0b92c4d60f677b205f7f1fbf085f218b12f0b5b3f0b9e48
          • MD5 SHA1 SHA512 SSDEEP TLSH

          test_extension.c

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\test_extension.c
          • Size 587B
          • SHA256 948af88dbf356835f5496c1a3d047fdbcc58f3717aa9bc94d0943d7de2b7cf5b
          • MD5 SHA1 SHA512 TLSH

          database.js

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
          • Size 4KB
          • SHA256 02ea23bdd23d7ac5de0675a2f32fc686e76d5c6a32bd3e3891f360e72e07f61f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          index.js

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
          • Size 110B
          • SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
          • MD5 SHA1 SHA512 TLSH

          aggregate.js

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
          • Size 1KB
          • SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
          • MD5 SHA1 SHA512 TLSH

          backup.js

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
          • Size 2KB
          • SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
          • MD5 SHA1 SHA512 TLSH

          function.js

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
          • Size 1KB
          • SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
          • MD5 SHA1 SHA512 TLSH

          inspect.js

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
          • Size 174B
          • SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
          • MD5 SHA1 SHA512 TLSH

          pragma.js

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
          • Size 536B
          • SHA256 8b1c54475bd4340b15e25c50d53d06308be65f8f919ecbe4aa9d285ca859ad5a
          • MD5 SHA1 SHA512 TLSH

          serialize.js

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
          • Size 625B
          • SHA256 7a10ee5c2735384b7f0c361811bc6d017db29f62b203fd3c68a35f667e2c2605
          • MD5 SHA1 SHA512 TLSH

          table.js

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
          • Size 6KB
          • SHA256 97c42d9ded1aa96c7d916b5b92f96b4e59581d50eaf629cd2c7afb78ff26a9ea
          • MD5 SHA1 SHA512 SSDEEP TLSH

          transaction.js

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
          • Size 2KB
          • SHA256 bc8624a3ef689d8f78e5669020ad121e17acbc93b1d5ee5afe26860b1084c66c
          • MD5 SHA1 SHA512 TLSH

          wrappers.js

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
          • Size 1KB
          • SHA256 a150a6271d23f4e5f8953b129f370ff096c7cdc4b812afbf080a6cf4ab741bcf
          • MD5 SHA1 SHA512 TLSH

          sqlite-error.js

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
          • Size 717B
          • SHA256 2582d61c27680dead168543f392eb102be621dfbef282a4ca4c7c21aa5e7c75d
          • MD5 SHA1 SHA512 TLSH

          util.js

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
          • Size 331B
          • SHA256 92b2e39e2151b43a2252e10b6d6de876ecaf0008336a4fa1dfe1317b20f1916f
          • MD5 SHA1 SHA512 TLSH

          package.json

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
          • Size 936B
          • SHA256 4b3c509b84a963c7a4bcf06bbc5f0d72cb74e828cd5502c076be169236c12823
          • MD5 SHA1 SHA512 TLSH

          addon.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\addon.cpp
          • Size 1KB
          • SHA256 20f19f480ce060900521cf9510922e5ca1c8e76936f07ac2916f316e549a0190
          • MD5 SHA1 SHA512 TLSH

          better_sqlite3.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\better_sqlite3.cpp
          • Size 2KB
          • SHA256 c343ae9a8c876ed62d620562ffe9acedcdb105f49ba196b4e79f9aab8ffe16fa
          • MD5 SHA1 SHA512 TLSH

          backup.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\backup.cpp
          • Size 4KB
          • SHA256 16a67102c49c9312eb1deecd08c27064325840df51d6957fe134b871f5d8798c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          backup.hpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\backup.hpp
          • Size 705B
          • SHA256 02d57e03a1a03b3f8bb2fc503fc1704d4143b76d939fe37230fbb3b44177c44a
          • MD5 SHA1 SHA512 TLSH

          database.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\database.cpp
          • Size 13KB
          • SHA256 081c514fb0a472a0e0962f0619149c187b6cf424e09baa7f39cc5246c17f75aa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          database.hpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\database.hpp
          • Size 3KB
          • SHA256 f47ab5d6bb775cadd0b2b73c4fcb6faf5cb2ae783a049ff4691fafc5d29a0bca
          • MD5 SHA1 SHA512 TLSH

          statement-iterator.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement-iterator.cpp
          • Size 3KB
          • SHA256 6ac791fbb786fc498450e843f2a043eddeb03093eb6b31012a04ae7b84a8d7ab
          • MD5 SHA1 SHA512 TLSH

          statement-iterator.hpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement-iterator.hpp
          • Size 1KB
          • SHA256 c064f10ad6bca99154d4f5325e187978d4c6d6cc6fedaa047a4d2f3b4b4f9655
          • MD5 SHA1 SHA512 TLSH

          statement.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement.cpp
          • Size 12KB
          • SHA256 4875a4d1942b89b1dc715b50f3f01e0899530a0772d0fef6f26c358d7e3d12a3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          statement.hpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement.hpp
          • Size 1KB
          • SHA256 3dca186418c62d81f4b9170904fdc02e624c3d76a0c0c61e6aa95486799808e9
          • MD5 SHA1 SHA512 TLSH

          bind-map.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\bind-map.cpp
          • Size 1KB
          • SHA256 7026e107a7f662b6460fbd05e91d9594f5114ffa69de7a8ddb082911f6e90876
          • MD5 SHA1 SHA512 TLSH

          binder.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\binder.cpp
          • Size 5KB
          • SHA256 64e2ebe910f2efc1d7a847672565745da2c4f5656d951033d99567e7593409d8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          constants.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\constants.cpp
          • Size 8KB
          • SHA256 bbf4a3f983631f01f723627ee0e897f92b12cd6ca3e8b8b965318931bba0f2b4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          custom-aggregate.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-aggregate.cpp
          • Size 3KB
          • SHA256 742d03187a7b8483c9f42bb7b77ed29d0f6877450584fba2662164d2b8dd11b6
          • MD5 SHA1 SHA512 TLSH

          custom-function.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-function.cpp
          • Size 1KB
          • SHA256 6a1f826df2cc2c402d8a3dd747a57dbcedb52fe9220a2bbda6a5e01f038b13d1
          • MD5 SHA1 SHA512 TLSH

          custom-table.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-table.cpp
          • Size 14KB
          • SHA256 7549b38f24b7e69e78d407534a5cde8814a8a08628a421b122644a43940e0aaf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          data-converter.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\data-converter.cpp
          • Size 460B
          • SHA256 3cb73d0911e92893abf840752e9cfd6baded604d49b39ec4000599eec7c8c594
          • MD5 SHA1 SHA512 TLSH

          data.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\data.cpp
          • Size 9KB
          • SHA256 74de42f9a0fa68277d8ea9cbaf8ee5f455bbd99cc41297696546c0ec8408c882
          • MD5 SHA1 SHA512 SSDEEP TLSH

          helpers.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\helpers.cpp
          • Size 4KB
          • SHA256 4d273c4ee67337fbe3440ec49058a2ee5cbe6a627b14917dc1e1c98fda8178f1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          macros.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\macros.cpp
          • Size 4KB
          • SHA256 c27bbcf3ac17bc0d729684bd06dbde2880e4f6e662b360e1bcd8ede8d373b9a0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          query-macros.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\query-macros.cpp
          • Size 4KB
          • SHA256 0dcf68c3ff527398ebe0a6b874b38aa23b3fb87f285b9701636c3b19282dde8c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          row-builder.cpp

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\row-builder.cpp
          • Size 1017B
          • SHA256 d5b352ac4959a07db22a825019286e085910310d6363c61fbdf037e3f32d56fc
          • MD5 SHA1 SHA512 TLSH

          icon.png

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\app.asar.unpacked\resources\icon.png
          • Size 22KB
          • SHA256 239131a85863ddbb62ba9556ec27614ea7f521ebe9231e6d002fabdd00bb8943
          • MD5 SHA1 SHA512 SSDEEP TLSH

          elevate.exe

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\resources\elevate.exe
          • Size 105KB
          • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
          • MD5 SHA1 SHA512 SSDEEP TLSH

          snapshot_blob.bin

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\snapshot_blob.bin
          • Size 333KB
          • SHA256 c6ea347fb4987014688f3b07ccf051ff21a81e30fa595aeb3e105cfb4ad27288
          • MD5 SHA1 SHA512 SSDEEP TLSH

          v8_context_snapshot.bin

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\v8_context_snapshot.bin
          • Size 698KB
          • SHA256 ef9f068c5a1494a02acff29f7c7cdde1a2d10d4ac46ca15b735124e8b48ddace
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\vk_swiftshader.dll
          • Size 5.4MB
          • SHA256 b200865044493fb316dc3d49bc23d559fbedae74c99f7b0cdc1ab8daeb31e4c5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader_icd.json

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\vk_swiftshader_icd.json
          • Size 106B
          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
          • MD5 SHA1 SHA512 TLSH

          vulkan-1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\7z-out\vulkan-1.dll
          • Size 930KB
          • SHA256 1bdcb5d3a2bad797dd3d35ffdf789be9fbcde24622853f9a112c7147f3d51a3e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          SpiderBanner.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\SpiderBanner.dll
          • Size 9KB
          • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
          • MD5 SHA1 SHA512 SSDEEP TLSH

          StdUtils.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\StdUtils.dll
          • Size 100KB
          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          System.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\System.dll
          • Size 12KB
          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          WinShell.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\WinShell.dll
          • Size 3KB
          • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
          • MD5 SHA1 SHA512 TLSH

          nsExec.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\nsExec.dll
          • Size 6KB
          • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsis7z.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\nsis7z.dll
          • Size 424KB
          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Preferences

          • Path C:\Users\Admin\AppData\Roaming\9xbuddy\Preferences
          • Size 93B
          • SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
          • MD5 SHA1 SHA512 TLSH

          config.json

          • Path C:\Users\Admin\AppData\Roaming\9xbuddy\config.json
          • Size 219B
          • SHA256 9114f4f2d55cca360cee17407fa38019fb571a49e70cab9181c0d6abd7f38777
          • MD5 SHA1 SHA512 TLSH

          config.json.tmp-19185087104a89e7

          • Path C:\Users\Admin\AppData\Roaming\9xbuddy\config.json.tmp-19185087104a89e7
          • Size 342B
          • SHA256 58727e4603fb51d97ecb5e4c878f169603f3a8320db2afa85d76aa568d8c0626
          • MD5 SHA1 SHA512 TLSH

          config.json.tmp-19185088214d9e6f

          • Path C:\Users\Admin\AppData\Roaming\9xbuddy\config.json.tmp-19185088214d9e6f
          • Size 634B
          • SHA256 93b08f0b3fe70d14b612d976e572bfffc16e0180bc72db049d12fd02f4debe74
          • MD5 SHA1 SHA512 TLSH

          default.exc

          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512

          memory/1180-59-0x0000000007590000-0x0000000007626000-memory.dmp

          memory/1180-62-0x0000000073550000-0x0000000073D0C000-memory.dmp

          memory/1180-60-0x00000000074F0000-0x0000000007501000-memory.dmp

          memory/1180-50-0x0000000073550000-0x0000000073D0C000-memory.dmp

          memory/1180-56-0x000000006FEF0000-0x000000006FF3C000-memory.dmp

          memory/1180-52-0x00000000059F0000-0x0000000005D4B000-memory.dmp

          memory/1180-51-0x0000000073550000-0x0000000073D0C000-memory.dmp

          memory/5720-69-0x0000000006040000-0x000000000639B000-memory.dmp

          memory/5720-70-0x000000006FEF0000-0x000000006FF3C000-memory.dmp

          memory/5720-73-0x0000000070070000-0x00000000703CB000-memory.dmp

          memory/5916-27-0x0000000006590000-0x00000000068EB000-memory.dmp

          memory/5916-30-0x0000000007990000-0x00000000079C6000-memory.dmp

          memory/5916-41-0x0000000007D80000-0x0000000007D8A000-memory.dmp

          memory/5916-42-0x0000000007F20000-0x0000000007F4A000-memory.dmp

          memory/5916-43-0x0000000007F50000-0x0000000007F74000-memory.dmp

          memory/5916-44-0x00000000700C0000-0x000000007041B000-memory.dmp

          memory/5916-46-0x0000000073550000-0x0000000073D0C000-memory.dmp

          memory/5916-39-0x0000000008390000-0x0000000008A0C000-memory.dmp

          memory/5916-38-0x0000000073550000-0x0000000073D0C000-memory.dmp

          memory/5916-37-0x0000000073550000-0x0000000073D0C000-memory.dmp

          memory/5916-36-0x0000000007A60000-0x0000000007B03000-memory.dmp

          memory/5916-35-0x0000000006F90000-0x0000000006FB0000-memory.dmp

          memory/5916-32-0x000000006FEF0000-0x000000006FF3C000-memory.dmp

          memory/5916-40-0x0000000007D10000-0x0000000007D2A000-memory.dmp

          memory/5916-31-0x0000000073550000-0x0000000073D0C000-memory.dmp

          memory/5916-29-0x00000000069D0000-0x0000000006A1C000-memory.dmp

          memory/5916-28-0x0000000006990000-0x00000000069AE000-memory.dmp

          memory/5916-23-0x0000000005C70000-0x0000000005CD6000-memory.dmp

          memory/5916-24-0x0000000005CE0000-0x0000000005D46000-memory.dmp

          memory/5916-22-0x0000000005BC0000-0x0000000005BE2000-memory.dmp

          memory/5916-21-0x0000000073550000-0x0000000073D0C000-memory.dmp

          memory/5916-20-0x0000000005F40000-0x000000000658A000-memory.dmp

          memory/5916-19-0x0000000073550000-0x0000000073D0C000-memory.dmp

          memory/5916-18-0x0000000003140000-0x0000000003176000-memory.dmp

          memory/5916-17-0x0000000073562000-0x0000000073563000-memory.dmp