Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/07/2026, 01:00

General

  • Target
    Install Mullvad VPN.exe
  • Size 2.7MB
  • Sample260719-bctmdabv2s
  • SHA256 253323fd74dc963eb545505b04bc2616d0cd486fb46377f4d1e521f284950e67
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

  • Stops running service(s) 4 TTPs
  • Drops file in System32 directory 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 29 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Install Mullvad VPN.exe
    "C:\Users\Admin\AppData\Local\Temp\Install Mullvad VPN.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:988
    • C:\Users\Admin\AppData\Local\Temp\mullvad-updates\mullvad-2026.3.exe
      "C:\Users\Admin\AppData\Local\Temp\mullvad-updates\mullvad-2026.3.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /f /t /im "Mullvad VPN.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5624
      • C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\mullvad-setup.exe
        "C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\mullvad-setup.exe" driver remove wintun-abandoned-device
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4284
      • C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\mullvad-setup.exe
        "C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\mullvad-setup.exe" driver remove split-tunnel
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2860
      • C:\Program Files\Mullvad VPN\resources\mullvad-daemon.exe
        "C:\Program Files\Mullvad VPN\resources\mullvad-daemon.exe" --register-service
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3932
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\system32\sc.exe" start mullvadvpn
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1308
    • C:\Users\Admin\AppData\Local\Temp\mullvad-updates\mullvad-2026.3.exe
      "C:\Users\Admin\AppData\Local\Temp\mullvad-updates\mullvad-2026.3.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1060
    • C:\Users\Admin\AppData\Local\Temp\mullvad-updates\mullvad-2026.3.exe
      "C:\Users\Admin\AppData\Local\Temp\mullvad-updates\mullvad-2026.3.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5296
      • C:\Users\Admin\AppData\Local\Temp\nsv1ACE.tmp\old-uninstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\nsv1ACE.tmp\old-uninstaller.exe" /S /KEEP_APP_DATA /allusers --keep-shortcuts --updated _?=C:\Program Files\Mullvad VPN
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5244
        • C:\Users\Admin\AppData\Local\Temp\nsh1EB6.tmp\mullvad-setup.exe
          "C:\Users\Admin\AppData\Local\Temp\nsh1EB6.tmp\mullvad-setup.exe" is-older-version /S /KEEP_APP_DATA /allusers --keep-shortcuts --updated
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5512
        • C:\Windows\SysWOW64\taskkill.exe
          "C:\Windows\system32\taskkill.exe" /t /im "Mullvad VPN.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:572
        • C:\Windows\SysWOW64\taskkill.exe
          "C:\Windows\system32\taskkill.exe" /f /t /im "Mullvad VPN.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5868
        • C:\Users\Admin\AppData\Local\Temp\nsh1EB6.tmp\mullvad-setup.exe
          "C:\Users\Admin\AppData\Local\Temp\nsh1EB6.tmp\mullvad-setup.exe" prepare-restart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3280
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\system32\sc.exe" query mullvadvpn
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4932
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" stop mullvadvpn
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2244
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop mullvadvpn
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2852
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\system32\sc.exe" delete mullvadvpn
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:5288
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\system32\sc.exe" query mullvadvpn
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4088
        • C:\Users\Admin\AppData\Local\Temp\nsh1EB6.tmp\mullvad-setup.exe
          "C:\Users\Admin\AppData\Local\Temp\nsh1EB6.tmp\mullvad-setup.exe" driver remove split-tunnel
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3724
      • C:\Users\Admin\AppData\Local\Temp\nsv1ACE.tmp\mullvad-setup.exe
        "C:\Users\Admin\AppData\Local\Temp\nsv1ACE.tmp\mullvad-setup.exe" driver remove wintun-abandoned-device
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:6096
      • C:\Users\Admin\AppData\Local\Temp\nsv1ACE.tmp\mullvad-setup.exe
        "C:\Users\Admin\AppData\Local\Temp\nsv1ACE.tmp\mullvad-setup.exe" driver remove split-tunnel
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1544
      • C:\Program Files\Mullvad VPN\resources\mullvad-daemon.exe
        "C:\Program Files\Mullvad VPN\resources\mullvad-daemon.exe" --register-service
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5700
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\system32\sc.exe" start mullvadvpn
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4348
  • C:\Program Files\Mullvad VPN\resources\mullvad-daemon.exe
    "C:\Program Files\Mullvad VPN\resources\mullvad-daemon.exe" --run-as-service -vv
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3512
  • C:\Program Files\Mullvad VPN\resources\mullvad-daemon.exe
    "C:\Program Files\Mullvad VPN\resources\mullvad-daemon.exe" --run-as-service -vv
    1⤵
    • Drops file in System32 directory
    • Executes dropped EXE
    • Loads dropped DLL
    PID:1852
  • C:\Program Files\Mullvad VPN\resources\mullvad-split-tunnel.sys
    "C:\Program Files\Mullvad VPN\resources\mullvad-split-tunnel.sys"
    1⤵
    • Executes dropped EXE
    PID:3136
  • C:\Program Files\Mullvad VPN\Mullvad VPN.exe
    "C:\Program Files\Mullvad VPN\Mullvad VPN.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3744
    • C:\Program Files\Mullvad VPN\Mullvad VPN.exe
      "C:\Program Files\Mullvad VPN\Mullvad VPN.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Mullvad VPN" --enable-sandbox --field-trial-handle=1892,i,8347067128404192510,1767034196716963115,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1940 /prefetch:11
      2⤵
      • Executes dropped EXE
      PID:2556
    • C:\Program Files\Mullvad VPN\Mullvad VPN.exe
      "C:\Program Files\Mullvad VPN\Mullvad VPN.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Mullvad VPN" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,8347067128404192510,1767034196716963115,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1888 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5364
    • C:\Program Files\Mullvad VPN\Mullvad VPN.exe
      "C:\Program Files\Mullvad VPN\Mullvad VPN.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Mullvad VPN" --enable-sandbox --app-user-model-id=net.mullvad.vpn --app-path="C:\Program Files\Mullvad VPN\resources\app.asar" --enable-sandbox --force-color-profile=srgb --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1892,i,8347067128404192510,1767034196716963115,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2672 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4256
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\ /v SystemUsesLightTheme"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6108
      • C:\Windows\system32\reg.exe
        reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\ /v SystemUsesLightTheme
        3⤵
          PID:1040
    • C:\Program Files\Mullvad VPN\resources\mullvad-daemon.exe
      "C:\Program Files\Mullvad VPN\resources\mullvad-daemon.exe" --run-as-service -vv
      1⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1172
    • C:\Program Files\Mullvad VPN\Mullvad VPN.exe
      "C:\Program Files\Mullvad VPN\Mullvad VPN.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Program Files\Mullvad VPN\Mullvad VPN.exe
        "C:\Program Files\Mullvad VPN\Mullvad VPN.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Mullvad VPN" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1872,i,7181543639319007231,10806740473173212887,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1868 /prefetch:2
        2⤵
        • Executes dropped EXE
        PID:476
      • C:\Program Files\Mullvad VPN\Mullvad VPN.exe
        "C:\Program Files\Mullvad VPN\Mullvad VPN.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Mullvad VPN" --enable-sandbox --field-trial-handle=1872,i,7181543639319007231,10806740473173212887,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2040 /prefetch:11
        2⤵
        • Executes dropped EXE
        PID:5852
      • C:\Program Files\Mullvad VPN\Mullvad VPN.exe
        "C:\Program Files\Mullvad VPN\Mullvad VPN.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Mullvad VPN" --enable-sandbox --app-user-model-id=net.mullvad.vpn --app-path="C:\Program Files\Mullvad VPN\resources\app.asar" --enable-sandbox --force-color-profile=srgb --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1872,i,7181543639319007231,10806740473173212887,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2736 /prefetch:1
        2⤵
        • Executes dropped EXE
        PID:3608
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\ /v SystemUsesLightTheme"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1112
        • C:\Windows\system32\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\ /v SystemUsesLightTheme
          3⤵
            PID:1396
        • C:\Program Files\Mullvad VPN\Mullvad VPN.exe
          "C:\Program Files\Mullvad VPN\Mullvad VPN.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --user-data-dir="C:\Users\Admin\AppData\Local\Mullvad VPN" --enable-sandbox --field-trial-handle=1872,i,7181543639319007231,10806740473173212887,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3008 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:4456
        • C:\Program Files\Mullvad VPN\Mullvad VPN.exe
          "C:\Program Files\Mullvad VPN\Mullvad VPN.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --user-data-dir="C:\Users\Admin\AppData\Local\Mullvad VPN" --enable-sandbox --field-trial-handle=1872,i,7181543639319007231,10806740473173212887,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2916 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:2088
        • C:\Program Files\Mullvad VPN\Mullvad VPN.exe
          "C:\Program Files\Mullvad VPN\Mullvad VPN.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --user-data-dir="C:\Users\Admin\AppData\Local\Mullvad VPN" --enable-sandbox --field-trial-handle=1872,i,7181543639319007231,10806740473173212887,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3028 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:3396
        • C:\Program Files\Mullvad VPN\Mullvad VPN.exe
          "C:\Program Files\Mullvad VPN\Mullvad VPN.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --user-data-dir="C:\Users\Admin\AppData\Local\Mullvad VPN" --enable-sandbox --field-trial-handle=1872,i,7181543639319007231,10806740473173212887,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4024 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:3168

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Uninstall Mullvad VPN.exe

            • Path C:\Program Files\Mullvad VPN\Uninstall Mullvad VPN.exe
            • Size 3.6MB
            • SHA256 41c2c00092e0022528129ed5f221cb8f2185dd93be9d11c4d9185661eb2218e8
            • MD5 SHA1 SHA512 SSDEEP TLSH

            Mullvad VPN.lnk

            • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mullvad VPN.lnk
            • Size 1KB
            • SHA256 1f16f309d4431f531eb91de97de42d91f78213f315d6342cce64d55f92391ee6
            • MD5 SHA1 SHA512 TLSH

            daemon.log

            • Path C:\ProgramData\Mullvad VPN\daemon.log
            • Size 6KB
            • SHA256 a902bd309504c72692e7549c1aa070aa33c6f84d0774dcf88113e382d2627f34
            • MD5 SHA1 SHA512 SSDEEP TLSH

            install.log

            • Path C:\ProgramData\Mullvad VPN\install.log
            • Size 1KB
            • SHA256 75da3848b5f566abd3ae3543e999d28a276a6ba4e5456b8ca21a249537a8dc97
            • MD5 SHA1 SHA512 TLSH

            install.log

            • Path C:\ProgramData\Mullvad VPN\install.log
            • Size 881B
            • SHA256 17ac7a7a49539974e81e04d7dcee98899f7709278854bc461d5edce022ace4cd
            • MD5 SHA1 SHA512 TLSH

            data_0

            • Path C:\Users\Admin\AppData\Local\Mullvad VPN\GPUCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP

            data_1

            • Path C:\Users\Admin\AppData\Local\Mullvad VPN\GPUCache\data_1
            • Size 264KB
            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
            • MD5 SHA1 SHA512 SSDEEP

            data_2

            • Path C:\Users\Admin\AppData\Local\Mullvad VPN\GPUCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP

            data_3

            • Path C:\Users\Admin\AppData\Local\Mullvad VPN\GPUCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP

            LICENSE.electron.txt

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\LICENSE.electron.txt
            • Size 1KB
            • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
            • MD5 SHA1 SHA512 TLSH

            LICENSES.chromium.html

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\LICENSES.chromium.html
            • Size 14.4MB
            • SHA256 f9c475876b01bb4d654b8f630f11219cc96198efe91d7f2602a97f0f3c86c3cb
            • MD5 SHA1 SHA512 SSDEEP TLSH

            chrome_100_percent.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\chrome_100_percent.pak
            • Size 112KB
            • SHA256 45d14a4278b1e152b363197401a5604aa5a3cee6512a6b52df978038fa521a0f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            chrome_200_percent.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\chrome_200_percent.pak
            • Size 182KB
            • SHA256 aafc61b89748d17fcbc9fecd9844a77be2c584529a81714c98e0c4d453ea9496
            • MD5 SHA1 SHA512 SSDEEP TLSH

            d3dcompiler_47.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\d3dcompiler_47.dll
            • Size 4.5MB
            • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            dxcompiler.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\dxcompiler.dll
            • Size 24.9MB
            • SHA256 17afc13607ffd6b7f8df79cb744c3e4deda388efcfe9faa43fec36c8971450cf
            • MD5 SHA1 SHA512 SSDEEP TLSH

            dxil.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\dxil.dll
            • Size 1.4MB
            • SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ffmpeg.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\ffmpeg.dll
            • Size 2.9MB
            • SHA256 254b008debcba0a3d4b728dd7fd256576ba2373a94bb4534a8f4b255f3f19532
            • MD5 SHA1 SHA512 SSDEEP TLSH

            icudtl.dat

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\icudtl.dat
            • Size 10.0MB
            • SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            libEGL.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\libEGL.dll
            • Size 492KB
            • SHA256 6b9f036b3f9fb96c1941a9871ec84b319be1b773de2ec2b0dc66855080d7e77d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            libGLESv2.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\libGLESv2.dll
            • Size 8.0MB
            • SHA256 083f5ee786a4f24c01085605deffa59e5b06811e6dc69cb07c75b406110f9cfd
            • MD5 SHA1 SHA512 SSDEEP TLSH

            af.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\af.pak
            • Size 568KB
            • SHA256 ca253121434ef430661c30672e1097e6d238e42821585b700776b56977c05d97
            • MD5 SHA1 SHA512 SSDEEP TLSH

            am.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\am.pak
            • Size 921KB
            • SHA256 1f126a64a58ece296209d24c36ae416e3187996765027b1198ee01dead17394c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ar.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\ar.pak
            • Size 1016KB
            • SHA256 cf46d1687d01d8ba58512ea7082aedbaa14ff0e748eae295fbcdae464b271b77
            • MD5 SHA1 SHA512 SSDEEP TLSH

            bg.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\bg.pak
            • Size 1.0MB
            • SHA256 f2a46c4ee04330ef49f6acc62c26ed7ec57dfe124aa386e08c5b582832c4000e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            bn.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\bn.pak
            • Size 1.3MB
            • SHA256 b4ada9665be5c9d9fe4254bff291978dfb50c2b22a7149faf9b9c3f470f0d32f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ca.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\ca.pak
            • Size 640KB
            • SHA256 252c097b90fc3ba9096c519a6ab2e91b441f11cce65c7c47777542959dbf6c34
            • MD5 SHA1 SHA512 SSDEEP TLSH

            cs.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\cs.pak
            • Size 663KB
            • SHA256 5e9385505f9507d4a57f7a5960ceb35b5fba92c662b53bda4e4dc0d63245059a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            da.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\da.pak
            • Size 598KB
            • SHA256 054849037db8f9672ab80606dd7163f25b18710ee7f777e7eeaa68d24447aee6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            de.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\de.pak
            • Size 640KB
            • SHA256 404975e6b3af1f4e40be3905da1850c3e87e29bd03d0866185ff85c06861ba68
            • MD5 SHA1 SHA512 SSDEEP TLSH

            el.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\el.pak
            • Size 1.1MB
            • SHA256 dc27d24e9afd24124abca6dca1a362462851267902fe6493ff3165a1c5aab69f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            en-GB.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\en-GB.pak
            • Size 518KB
            • SHA256 ee6fc979d1fff0c1a4d6bca929691733665c5df7e7a43cc54f1165ea14cffa67
            • MD5 SHA1 SHA512 SSDEEP TLSH

            en-US.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\en-US.pak
            • Size 524KB
            • SHA256 bfa782c9efae2c9cd2c0214dae1bbb3c259d4d4c38d920b06677b9c4cf4f813d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            es-419.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\es-419.pak
            • Size 631KB
            • SHA256 2b728123b590c5570a46ec2da7d4e620cb81559629f933ee5d71386fa142e02b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            es.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\es.pak
            • Size 628KB
            • SHA256 4801312dd5d7e3d62db05b8fe326d982f3887c65ac9faa7621009853c0d3b0b1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            et.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\et.pak
            • Size 573KB
            • SHA256 488a91b53d17ca8b52e25f143197875aef7dd50e1bd51bad749f559c17f52aec
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fa.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\fa.pak
            • Size 946KB
            • SHA256 cfd05fb194e5c43c2c65e7803eca72fde4f5629e849cf2dbb8f6f62156485aba
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fi.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\fi.pak
            • Size 584KB
            • SHA256 c04f5e2b7f30e8e350feefd6cc45f266dbeacf11837cc774c977bf76e9b403a7
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fil.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\fil.pak
            • Size 662KB
            • SHA256 48884f90e800b0b0803ddaa0bbebbea1292bf8e1bb5ee8f035a79371bef7ac2b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\fr.pak
            • Size 682KB
            • SHA256 e311ebdf49828d313760453a01ad1335bac955b4b8b291accf038714c91ebc03
            • MD5 SHA1 SHA512 SSDEEP TLSH

            gu.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\gu.pak
            • Size 1.3MB
            • SHA256 11e4ab3cfa421ea0d4d0971b038a6e7a254094fa6dfe9b8f65fd1572f36bcabb
            • MD5 SHA1 SHA512 SSDEEP TLSH

            he.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\he.pak
            • Size 829KB
            • SHA256 30409b7264418b9b9852b2419669bb8da6f489b58d4eeb1007b39d5cc978621d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            hi.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\hi.pak
            • Size 1.4MB
            • SHA256 59ae1278d1b58da7c0a11e5a23bf69ea31c674aebbc24fcd537a84769efe9d69
            • MD5 SHA1 SHA512 SSDEEP TLSH

            hr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\hr.pak
            • Size 639KB
            • SHA256 36d9939cd9d89baae124fc930cc050e386df2b8fd0eda0fb48882a2929b94a76
            • MD5 SHA1 SHA512 SSDEEP TLSH

            hu.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\hu.pak
            • Size 684KB
            • SHA256 501569c5e74285231b41d067e0ea28972ef0ab7b269886485cf1b42cd78cbd1d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            id.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\id.pak
            • Size 565KB
            • SHA256 09d4dd7cbe4eb1b7730a80a3a3cd0606139f4b9647b0a04b49314638680b0a31
            • MD5 SHA1 SHA512 SSDEEP TLSH

            it.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\it.pak
            • Size 619KB
            • SHA256 901a28a4cd0b1d545f0c2e4aa54914029adc03801859761db30c81947de63f92
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ja.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\ja.pak
            • Size 754KB
            • SHA256 8250b4783dcc389fa96fdf79e8188e439ffe5fc01325f32ab8c322c4d27f20a4
            • MD5 SHA1 SHA512 SSDEEP TLSH

            kn.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\kn.pak
            • Size 1.5MB
            • SHA256 847c5e6abcddf120b4dbc34e28dcd1c2e93f94ab1d6f016d0c1504a58cfd5b93
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ko.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\ko.pak
            • Size 640KB
            • SHA256 b8ecd18ce8601686ef64129c77f5307d0c60656d27eede7a23b4f3947647b302
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lt.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\lt.pak
            • Size 694KB
            • SHA256 6d648211ff3a6801e049c9a3931afaf3007857b2872e55ae11e19849180d19da
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lv.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\lv.pak
            • Size 692KB
            • SHA256 0c0663909339a1f4edf09355a67eea0fcfe821c78d4891604eee31695ce20b37
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ml.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\ml.pak
            • Size 1.5MB
            • SHA256 2bc35d18af85b3c7004a6e1e02591f5db4430a2f334f5c4be3c0a0e04837d9ae
            • MD5 SHA1 SHA512 SSDEEP TLSH

            mr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\mr.pak
            • Size 1.3MB
            • SHA256 5dee369e9366bfcc4fc95aec6c58b915933efd72c718d56802e35e8af5a880a0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ms.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\ms.pak
            • Size 595KB
            • SHA256 5af99080b311e15a19f9988779a1cdd939a7fb9b98bf093fca324eeb58b39602
            • MD5 SHA1 SHA512 SSDEEP TLSH

            nb.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\nb.pak
            • Size 572KB
            • SHA256 11e798ef612a1d22b90450c547998bf0b23ccc4ca5265f27f1924c8b09f22937
            • MD5 SHA1 SHA512 SSDEEP TLSH

            nl.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\nl.pak
            • Size 594KB
            • SHA256 bf2a7d52d8c061b5f5543e7c4e20b4eac96e65e02a967752af873c3ec30034b2
            • MD5 SHA1 SHA512 SSDEEP TLSH

            pl.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\pl.pak
            • Size 663KB
            • SHA256 7a464e196878d304c7358e7ea457e5d2a17e3065ab02f29b8402803c401d747f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            pt-BR.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\pt-BR.pak
            • Size 621KB
            • SHA256 6cb59658b372d605c4dac61711b56abf5555ed69e7b9ab0916f9185af48e66ec
            • MD5 SHA1 SHA512 SSDEEP TLSH

            pt-PT.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\pt-PT.pak
            • Size 625KB
            • SHA256 b727b377a6ccf25952189c59ef175c213dd1e29e896b6b5fdfacd024c711ac93
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ro.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\ro.pak
            • Size 648KB
            • SHA256 205ea8cc0b368426f06c533b636a2845e66e3f7932aa6a680645e79de15edff3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ru.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\ru.pak
            • Size 1.0MB
            • SHA256 54f1bc4ffc72547a655d4737d2c7260a71794dda56fbffd13e6e8cc313c5520c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            sk.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\sk.pak
            • Size 675KB
            • SHA256 eb91fe27fd087433da4d21dc1c387a816bed0de3e6a140b4597caa90f4921fda
            • MD5 SHA1 SHA512 SSDEEP TLSH

            sl.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\sl.pak
            • Size 646KB
            • SHA256 52426fb8fc82d1ed28797ccb62b7fe14f123cddf011f5d5875b076cdb0c33695
            • MD5 SHA1 SHA512 SSDEEP TLSH

            sr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\sr.pak
            • Size 993KB
            • SHA256 92dc15bac0e96ede33a7055994f3558605b3147b890ee0414314274216dbaf80
            • MD5 SHA1 SHA512 SSDEEP TLSH

            sv.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\sv.pak
            • Size 577KB
            • SHA256 51f5cfc915aef54ffa11077d00021c99aac1c86f04076ba70f43608b11486199
            • MD5 SHA1 SHA512 SSDEEP TLSH

            sw.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\sw.pak
            • Size 610KB
            • SHA256 e3bf553f18a0008dc5ac86e001a0ffb190f885260a7bf06feaf34822f0dde36a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ta.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\ta.pak
            • Size 1.5MB
            • SHA256 d3849b163ddca28155194a3b68583e115943d087a4d0bdb90ea815eff618cb73
            • MD5 SHA1 SHA512 SSDEEP TLSH

            te.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\te.pak
            • Size 1.4MB
            • SHA256 4038e8dda796e26e5101da4af24a2a9c212637fec1e7633458b821d38023751b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            th.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\th.pak
            • Size 1.2MB
            • SHA256 e4e627969668d8672cc5212b9b3a1f3c42fe0c5d90d15ee893ff0bce8cf7c2c3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            tr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\tr.pak
            • Size 621KB
            • SHA256 eafa2065b5dc4a3c95e5f0207fc31dc54f63aee65a8fe79925ac62a15161ee68
            • MD5 SHA1 SHA512 SSDEEP TLSH

            uk.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\uk.pak
            • Size 1.1MB
            • SHA256 4b65c4e32609f29eebe8fefa25b0fa861c05cfb51131d5ba64e1878666a0bd24
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ur.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\ur.pak
            • Size 933KB
            • SHA256 c0d81e0446bae6d62b496f5268222ad53fe5e6f7325c19bdb7685974967beb3b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            vi.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\vi.pak
            • Size 737KB
            • SHA256 3db088338da5890b390d6bdc047bd038ef2b2f3d982c74f546784895dd0d9b18
            • MD5 SHA1 SHA512 SSDEEP TLSH

            zh-CN.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\zh-CN.pak
            • Size 529KB
            • SHA256 e0eb2457c1edb82ab19f484e45d3e029ad0c5b5cc07d68a82faf6bab55f52e52
            • MD5 SHA1 SHA512 SSDEEP TLSH

            zh-TW.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\locales\zh-TW.pak
            • Size 523KB
            • SHA256 a5847062b32872a9a9b77361aa1a1e7f8734f6547adaa62f312a78baf20ef5c4
            • MD5 SHA1 SHA512 SSDEEP TLSH

            resources.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources.pak
            • Size 6.0MB
            • SHA256 40af4117b0bd35da141aa599255b879013bfda5968401feccb5c43cb372cdae6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            CHANGELOG.md

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\CHANGELOG.md
            • Size 136KB
            • SHA256 04d382ac77fb8087c07e4bc7f4bce698882cb040c20792e1f9bf7b60c901cfdf
            • MD5 SHA1 SHA512 SSDEEP TLSH

            app.asar

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar
            • Size 35.4MB
            • SHA256 8f4f066f277fbe6998c0145edec113bd71c0550acc263bbacbed815f3fc076c7
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-1.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-1.ico
            • Size 44KB
            • SHA256 aed3e508b486742fd6eedce95b5128eaf24ad792155b4c16f455f96922080f7f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-10.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-10.ico
            • Size 44KB
            • SHA256 1c8cd57cf7d603b41729ea44922b052d74111397eebfc8e456620b9346d1907f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-10_black.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-10_black.ico
            • Size 44KB
            • SHA256 035dc4a44020eac4f4d7ad8faab5fb1fdb65069e5b6606ab94bf9c37b5c06b0c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-10_black_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-10_black_notification.ico
            • Size 44KB
            • SHA256 f3a377ce9104594ca7d01b0247daa8ddbd2809b800c0f3710713b7dd6f569cf6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-10_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-10_notification.ico
            • Size 44KB
            • SHA256 da89304c4aa1dffd7ff5ec2593ec70a4baecaf06882558d48e30b82d152981bf
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-10_white.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-10_white.ico
            • Size 44KB
            • SHA256 1fa5e87b1e82ec83442de8c14034c0ee9bffc7d2b6402209095b6f53eb46bb8b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-10_white_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-10_white_notification.ico
            • Size 44KB
            • SHA256 ef2ccbdd3efc0e2ba10fb9398456e7de7ba78089ebfb2c256007f2e748e3d2a4
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-1_black.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-1_black.ico
            • Size 44KB
            • SHA256 fc31484a045fcb91cfd54de763aa9d7a6a225a8947f8420ff1e3a45ad1efd713
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-1_black_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-1_black_notification.ico
            • Size 44KB
            • SHA256 202a66e13ab49275c9f4f051e1f404a757b86712a8b99606a5f3fe52b7930122
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-1_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-1_notification.ico
            • Size 44KB
            • SHA256 2a996d6311d9fdf83f8498e3e6758249ecd2c4769bd95b4b24c290730a0cb749
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-1_white.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-1_white.ico
            • Size 44KB
            • SHA256 760ce5040c4e3ca4877c58eec51e76773a1673c37573b80c38658de8bb5a3c5d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-1_white_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-1_white_notification.ico
            • Size 44KB
            • SHA256 cbff6262f069741febf105bd548590bc7be0f8957eb295bf6045c10cf305b1d5
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-2.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-2.ico
            • Size 44KB
            • SHA256 3dc68d7d624183567febbe8410afc1d14ec376ce2d718b2c7f11f5ff262a3e97
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-2_black.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-2_black.ico
            • Size 44KB
            • SHA256 6bbf6d385201793dcefe09b2660b105e63e444bb2812839dbeebd1654135bc85
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-2_black_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-2_black_notification.ico
            • Size 44KB
            • SHA256 7698f47d8bcabc51552284ebb2a45bd5c6ab4d22ccf9d2a049293426f921322a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-2_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-2_notification.ico
            • Size 44KB
            • SHA256 875e35037ffaf16049330e41204a084ddf2d2ba563641cb54dc0ff51bd16fe1d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-2_white.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-2_white.ico
            • Size 44KB
            • SHA256 fdcf2536cd5dcff81833796a81ea93c42844dea65229bb7a09049a132b3072e6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-2_white_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-2_white_notification.ico
            • Size 44KB
            • SHA256 0f4c13f6bd57b47f1c724865347f3c32f766fab583b5e70dd9e65f442eee4511
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-3.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-3.ico
            • Size 44KB
            • SHA256 746f16709a3aa269f6ed144ad029c770157c34847223421d151c572d4507594d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-3_black.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-3_black.ico
            • Size 44KB
            • SHA256 e8f3874feccdaa1dcc6598df228e4213ee7e85743764c432200c3180daa23c81
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-3_black_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-3_black_notification.ico
            • Size 44KB
            • SHA256 271ee031248c5041a54ea5aefc9adba7b9ddcffa976293d7b4462ec1000d6f55
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-3_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-3_notification.ico
            • Size 44KB
            • SHA256 9df78d867a83f68509a732eada2de0558b4395e86fd8aa49e8a99973f382327c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-3_white.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-3_white.ico
            • Size 44KB
            • SHA256 7854306e4f34643979b4910b6951a74c9daf9eb3ac5011805c04194f5997f9ae
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-3_white_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-3_white_notification.ico
            • Size 44KB
            • SHA256 c7864f330a7519898322dbb8309d3bee7a1ec879107bae29eb417f73a620ed99
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-4.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-4.ico
            • Size 44KB
            • SHA256 c0cf549d0072397af6c677c619adc39eb22435f31bc646617b7a6e0ef18bfb56
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-4_black.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-4_black.ico
            • Size 44KB
            • SHA256 29c2e35ff664c1cdf30756d3df199478ddd3465fee9d161a0ced1d084f954d04
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-4_black_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-4_black_notification.ico
            • Size 44KB
            • SHA256 35d0641c38944694d8d6dd703729a31618d24e1ba1389f94d9a3863f4756cd44
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-4_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-4_notification.ico
            • Size 44KB
            • SHA256 31b184f4783251c19d8a00c27479c56a4abae4b8f3c1db3d1f8e7a8c3c55e8b4
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-4_white.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-4_white.ico
            • Size 44KB
            • SHA256 2ff534e0b3919293ad7271ea604ec6f336946d15d948356e9b2e28bd8cb6c0f8
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-4_white_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-4_white_notification.ico
            • Size 44KB
            • SHA256 4a9fc6ed96c67753ab615da96cde8d0d205edae074ee3a8abdcab449e118870b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-5.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-5.ico
            • Size 44KB
            • SHA256 42860ba89acb468f273d5e7c81717f0dc465c6201bdee2fe4665cbf638201ab9
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-5_black.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-5_black.ico
            • Size 44KB
            • SHA256 15b61167e1994a477a17bb0e2c2f44784bdfa0e2959b3b7a2612cb98565df058
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-5_black_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-5_black_notification.ico
            • Size 44KB
            • SHA256 c46a1c877863ec8ec28eaa3c08cd3868804ad91793b21b1d5c5befaaeb0f6705
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-5_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-5_notification.ico
            • Size 44KB
            • SHA256 2ca2e802543fde697d2ec37e6d9f5a2b7785757e808fd9ad4ba126e665f47bbf
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-5_white.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-5_white.ico
            • Size 44KB
            • SHA256 4069017689d0dc068b16617273477b9b1455c97988b314b53f09cc8c65e96695
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-5_white_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-5_white_notification.ico
            • Size 44KB
            • SHA256 d2d3b5e8dddd5b6905032e8351991c964441c912d97cb3d4ff76792470233565
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-6.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-6.ico
            • Size 44KB
            • SHA256 553f2767549296ee516066f1e49015a5b8061e13487b33d514f6421d3b76c447
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-6_black.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-6_black.ico
            • Size 44KB
            • SHA256 d61c4eefb946a723a56bd74123ae719c0dd8d53a6c80e1d189cd31ef38b8b91a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-6_black_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-6_black_notification.ico
            • Size 44KB
            • SHA256 636f2a28129467e15ddf3524866df053cb12b621cc95df6ca909b272280e7dbf
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-6_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-6_notification.ico
            • Size 44KB
            • SHA256 c7d9a579cbf70963a1beea420ac8c8696da2bacff53d3aa1d39f0fa69d93bd42
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-6_white.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-6_white.ico
            • Size 44KB
            • SHA256 b33a3cd9af7550095de887557b643cbfedb344411c0f3e18ae103f0f4075587b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-6_white_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-6_white_notification.ico
            • Size 44KB
            • SHA256 294392240db88d20722494f4b2d3019199caa88bdd76ec453605da0c5f51735d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-7.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-7.ico
            • Size 44KB
            • SHA256 04f3c2d0ee884f01931ea1d96ba7fd7908b97930e22209b057c1c186965f7cfb
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-7_black.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-7_black.ico
            • Size 44KB
            • SHA256 056133085de811431a7fe886616bb6584dc2cd457fed225e7774103b235bf61f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-7_black_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-7_black_notification.ico
            • Size 44KB
            • SHA256 7976b6a4ae9070f2c0c93571dd3b6a8969ec09734e4b74cff290dbb6ff2dd923
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-7_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-7_notification.ico
            • Size 44KB
            • SHA256 e0bf75bf75197f45fd227e4b13ff17270add9fc9c90a8b03d768d257741e05ed
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-7_white.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-7_white.ico
            • Size 44KB
            • SHA256 df4a46cd449819c2a0e6efd4f32913063171968badbf5ddce8b1df1bf752ec3c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-7_white_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-7_white_notification.ico
            • Size 44KB
            • SHA256 e2eeaa7d5d0d57e2a4c0800b851b1c6b64d0e8aa59179a393f7e3d2ce8deb2d7
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-8.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-8.ico
            • Size 44KB
            • SHA256 c969e4d044d5c01a8d1d565ceacd5baf2a09e01098760bf3d81939db944d5d7f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-8_black.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-8_black.ico
            • Size 44KB
            • SHA256 53ebb88cc17955e2934affebe5296aa705e817b1fc5941ba330f210c7abc18f6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-8_black_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-8_black_notification.ico
            • Size 44KB
            • SHA256 898803bfef82fd573d5b683ce364d7f75ef21ef4f6b593274409a7d332b689cb
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-8_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-8_notification.ico
            • Size 44KB
            • SHA256 1c4575800a0e8af0a90fad02dc63aa7cadb7ae83caa9d819c71f392be0836685
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-8_white.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-8_white.ico
            • Size 44KB
            • SHA256 3afc3bed984d3e67bcc9ba355b216c3423fd03df87a3d938e7b00cdc80392a48
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-8_white_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-8_white_notification.ico
            • Size 44KB
            • SHA256 a23a5d46abb77b12fd38da4a9003c7d74d6e16795e6e7b4eff3e2b7515895437
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-9.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-9.ico
            • Size 44KB
            • SHA256 35fac7b86c394825a3ec21d88fc634ea0b194270fd9d2fd70666f2bf726468a4
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-9_black.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-9_black.ico
            • Size 44KB
            • SHA256 2e199b6ca00b80a514b2ffad04bd8c088f5eb0e3c6c7f93986fb153d42ea9e84
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-9_black_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-9_black_notification.ico
            • Size 44KB
            • SHA256 bf153562376c526dae11f62c20763f71215d83855e11df7154d0977d4558faf8
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-9_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-9_notification.ico
            • Size 44KB
            • SHA256 f9d16dfd9daff120420e662e76b78994f4392fd8828b15cdcbff329c267993f8
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-9_white.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-9_white.ico
            • Size 44KB
            • SHA256 633cea2e1c3c24e4b351965480dd09807f47a20af8ca19d4f835b5832450e3e5
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lock-9_white_notification.ico

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\build\assets\images\menubar-icons\win32\lock-9_white_notification.ico
            • Size 44KB
            • SHA256 04dd427b9686d43e9e28dae203d3f0e74e99df686d33f5f9c9e7cf39612c0258
            • MD5 SHA1 SHA512 SSDEEP TLSH

            Cargo.toml

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\Cargo.toml
            • Size 634B
            • SHA256 a723ef05cf7e016689e1a42572141a5efbb4406ab452f51b5bac0e77d7e1034e
            • MD5 SHA1 SHA512 TLSH

            index.node

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\dist\win32-arm64-msvc\index.node
            • Size 335KB
            • SHA256 feea2e57886033a6156a6bd30b69c1537a194a4e4664a23aba4f2bd1720ef3d5
            • MD5 SHA1 SHA512 SSDEEP TLSH

            index.node

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\dist\win32-x64-msvc\index.node
            • Size 346KB
            • SHA256 d5efde32026db725889557150d8285a351d451f258534911089c51b71ebf4bb6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            eslint.config.mjs

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\eslint.config.mjs
            • Size 116B
            • SHA256 6ea80e9b70e892381bfda0a9d8292edefb076e12433787b6bcc5d893a7ebcf3d
            • MD5 SHA1 SHA512 TLSH

            index.cjs

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\lib\index.cjs
            • Size 1KB
            • SHA256 ace40d17f3e7b29d7ce0c4c5e745dd80a815df2c4163f94c56c2a8aa31c4d9df
            • MD5 SHA1 SHA512 TLSH

            index.d.cts

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\lib\index.d.cts
            • Size 496B
            • SHA256 5631f1ae3f5299d0fd996645f26d89929d44c7f12b359871983a9de897315cb5
            • MD5 SHA1 SHA512 TLSH

            index.d.mts

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\lib\index.d.mts
            • Size 29B
            • SHA256 367b9e4e891801071f84072950f452e70bb63372ab988d06479cfb0d2e848983
            • MD5 SHA1 SHA512

            index.mjs

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\lib\index.mjs
            • Size 84B
            • SHA256 36958d9b1a52bb0e2c7eb6c1ff18715596a5c3d0b802a6902518d9a35fadb08c
            • MD5 SHA1 SHA512 TLSH

            load.cjs

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\lib\load.cjs
            • Size 489B
            • SHA256 ca628860af1019d27cfaa24a47a1478518bf03f50a878f91599a46f8e395a8eb
            • MD5 SHA1 SHA512 TLSH

            load.d.cts

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\lib\load.d.cts
            • Size 11B
            • SHA256 8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881
            • MD5 SHA1 SHA512

            package.json

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\package.json
            • Size 1KB
            • SHA256 ba0218790a526bf877fe276d5326454fc81d2717738c0c430ed7d99484e1ff69
            • MD5 SHA1 SHA512 TLSH

            index.cts

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\src\index.cts
            • Size 784B
            • SHA256 b6df7fbd727bcc317928ff64022cc9ebae8c817d3d6c7ffa887be9b4e4f1478f
            • MD5 SHA1 SHA512 TLSH

            index.mts

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\src\index.mts
            • Size 85B
            • SHA256 970e3db6be99fa63f7c08b2131888b4b5fad6e1a3eac5637c07e5312767f01e4
            • MD5 SHA1 SHA512 TLSH

            load.cts

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\src\load.cts
            • Size 399B
            • SHA256 08a63a0b0ba1003ee8c50dc634ec1327d7e47b9558c3da72bb05b241a6bc514a
            • MD5 SHA1 SHA512 TLSH

            tsconfig.json

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\tsconfig.json
            • Size 158B
            • SHA256 0e26ad511ca4f5bcebd90ff65e7821932b0f07185ab1413ec7e2a475b5f13cc8
            • MD5 SHA1 SHA512 TLSH

            fs.rs

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\windows-utils-rs\fs.rs
            • Size 1KB
            • SHA256 8dcc939b1a3d37475e39958d0719d730edbee7a94891f8dfffc1ac242f294da1
            • MD5 SHA1 SHA512 TLSH

            lib.rs

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\windows-utils-rs\lib.rs
            • Size 331B
            • SHA256 dd7b758f1f141850180336bc04d9b96e042e5832dfad732be692df31bd797c80
            • MD5 SHA1 SHA512 TLSH

            shortcut.rs

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\app.asar.unpacked\node_modules\windows-utils\windows-utils-rs\shortcut.rs
            • Size 6KB
            • SHA256 66c8205b8632e737d98372fa315fdde893b9fa1de49f0ff727ccd4e2d80b18b3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ca.crt

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\ca.crt
            • Size 2KB
            • SHA256 37182bc47c1cff334eb3c670c9a7d643d14774015178be5a3591b5633a77d597
            • MD5 SHA1 SHA512 TLSH

            elevate.exe

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\elevate.exe
            • Size 105KB
            • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
            • MD5 SHA1 SHA512 SSDEEP TLSH

            mullvad-daemon.exe

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\mullvad-daemon.exe
            • Size 20.0MB
            • SHA256 6618b63fcc575743db2478f64f4ac206d8e495b19c86cbde6ff9a2ec6950467e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            mullvad-problem-report.exe

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\mullvad-problem-report.exe
            • Size 5.5MB
            • SHA256 c89e7490dce4e0c2081c62d2523790a93b71f2c003fee55d9b28f7577314b97d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            mullvad-split-tunnel.sys

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\mullvad-split-tunnel.sys
            • Size 96KB
            • SHA256 10cf25bbcfe51fd663a1fec88a98e9b858f3a579589bb2ec496b66e4fdd1b201
            • MD5 SHA1 SHA512 SSDEEP TLSH

            mullvad-wireguard.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\mullvad-wireguard.dll
            • Size 784KB
            • SHA256 222f42da46686ba2603337b2c5e90a3d68e46897e9dff79c3bf7cc9275cce298
            • MD5 SHA1 SHA512 SSDEEP TLSH

            mullvad.exe

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\mullvad.exe
            • Size 6.7MB
            • SHA256 1299777400729a0f39be2e331b8f64026f4222f9139c8f328f6ab1d7525b9fc6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            relays.json

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\relays.json
            • Size 611KB
            • SHA256 fe86c9c168fb75e4f710851de47ffb6ea8fe57a5f9e84a2911427596ffd4b083
            • MD5 SHA1 SHA512 SSDEEP TLSH

            wintun.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\resources\wintun.dll
            • Size 417KB
            • SHA256 e5da8447dc2c320edc0fc52fa01885c103de8c118481f683643cacc3220dafce
            • MD5 SHA1 SHA512 SSDEEP TLSH

            snapshot_blob.bin

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\snapshot_blob.bin
            • Size 394KB
            • SHA256 eb484904e06c217beaafd2cd6847eb909225a5f0a4bf814cb1ec22653e6bd2e3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            v8_context_snapshot.bin

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\v8_context_snapshot.bin
            • Size 758KB
            • SHA256 1fa1cdd08423809344fe15fac2d9d1ec604cc3ea5af4b944d89a51b1e98c8665
            • MD5 SHA1 SHA512 SSDEEP TLSH

            vk_swiftshader.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\vk_swiftshader.dll
            • Size 5.4MB
            • SHA256 a089801e624e1c6809f33f55b328b3ebce33d7cc6b80237541769dddf166c975
            • MD5 SHA1 SHA512 SSDEEP TLSH

            vk_swiftshader_icd.json

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\vk_swiftshader_icd.json
            • Size 106B
            • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
            • MD5 SHA1 SHA512 TLSH

            vulkan-1.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\7z-out\vulkan-1.dll
            • Size 922KB
            • SHA256 781d6bad9dc2ad30ede89a89a056e5538fed8e3b1d25c669201233c02ab7c1a4
            • MD5 SHA1 SHA512 SSDEEP TLSH

            StdUtils.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\StdUtils.dll
            • Size 100KB
            • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            System.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\System.dll
            • Size 12KB
            • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UAC.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\UAC.dll
            • Size 14KB
            • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
            • MD5 SHA1 SHA512 SSDEEP TLSH

            WinShell.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\WinShell.dll
            • Size 3KB
            • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
            • MD5 SHA1 SHA512 TLSH

            mullvad-setup.exe

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\mullvad-setup.exe
            • Size 5.9MB
            • SHA256 a1537c6a2230e3082dc842504292068cb2d587d74a8d6d0a72347302b6c63117
            • MD5 SHA1 SHA512 SSDEEP TLSH

            mullvad_nsis.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\mullvad_nsis.dll
            • Size 343KB
            • SHA256 60a74c5c5e74bda7c0df7093accaeca471f25219de6bb566b35c48e0aa53c39f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            nsDialogs.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
            • MD5 SHA1 SHA512 SSDEEP TLSH

            nsExec.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\nsExec.dll
            • Size 6KB
            • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
            • MD5 SHA1 SHA512 SSDEEP TLSH

            nsis7z.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\nsis7z.dll
            • Size 424KB
            • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
            • MD5 SHA1 SHA512 SSDEEP TLSH

            winfw.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsa8EAB.tmp\winfw.dll
            • Size 486KB
            • SHA256 32c7a6ba5f36cbd9cdc67875d47ed4c03011df2ecc07f13ef6122ebc27763eb4
            • MD5 SHA1 SHA512 SSDEEP TLSH

            modern-wizard.bmp

            • Path C:\Users\Admin\AppData\Local\Temp\nsv1ACE.tmp\modern-wizard.bmp
            • Size 150KB
            • SHA256 178a08d28347b86b8d390935f7fa3e2811220acdc0ddd67633ad31e84fa0753f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            default.exc

            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
            • Size 2B
            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
            • MD5 SHA1 SHA512

            memory/4256-984-0x00007FFC4CAF0000-0x00007FFC4CAF1000-memory.dmp

            memory/4256-985-0x00007FFC4BB20000-0x00007FFC4BB21000-memory.dmp