Analysis

  • geolocation tags

    asiadelhiinindia
  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    450s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 04:33

General

  • Target
    Mechvibes.Setup.2.3.6-hotfix (1).exe
  • Size 76.7MB
  • Sample260802-e6hzhstsbs
  • SHA256 00ddeff79c9dfe78eb915c521511f598909e35a989806166b0d8ed1ecbd2a015
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 20 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mechvibes.Setup.2.3.6-hotfix (1).exe
    "C:\Users\Admin\AppData\Local\Temp\Mechvibes.Setup.2.3.6-hotfix (1).exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4164
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Mechvibes.exe" | %SYSTEMROOT%\System32\find.exe "Mechvibes.exe"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2556
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Mechvibes.exe"
        3⤵
        • Discovers running processes
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5088
      • C:\Windows\SysWOW64\find.exe
        C:\Windows\System32\find.exe "Mechvibes.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2644
  • C:\Users\Admin\AppData\Local\Programs\Mechvibes\Mechvibes.exe
    "C:\Users\Admin\AppData\Local\Programs\Mechvibes\Mechvibes.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Users\Admin\AppData\Local\Programs\Mechvibes\Mechvibes.exe
      "C:\Users\Admin\AppData\Local\Programs\Mechvibes\Mechvibes.exe" --type=gpu-process --field-trial-handle=1612,9440728911285360088,11323611723646851865,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1620 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4080
    • C:\Users\Admin\AppData\Local\Programs\Mechvibes\Mechvibes.exe
      "C:\Users\Admin\AppData\Local\Programs\Mechvibes\Mechvibes.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1612,9440728911285360088,11323611723646851865,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2128 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1564
    • C:\Users\Admin\AppData\Local\Programs\Mechvibes\Mechvibes.exe
      "C:\Users\Admin\AppData\Local\Programs\Mechvibes\Mechvibes.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1612,9440728911285360088,11323611723646851865,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\Mechvibes\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:116
    • C:\Users\Admin\AppData\Local\Programs\Mechvibes\Mechvibes.exe
      "C:\Users\Admin\AppData\Local\Programs\Mechvibes\Mechvibes.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1612,9440728911285360088,11323611723646851865,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2748 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1440
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Programs\Mechvibes\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\volume.exe get"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1632
      • C:\Users\Admin\AppData\Local\Programs\Mechvibes\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\volume.exe
        C:\Users\Admin\AppData\Local\Programs\Mechvibes\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\volume.exe get
        3⤵
        • Executes dropped EXE
        PID:3068
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Programs\Mechvibes\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\volume.exe mute_status"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Users\Admin\AppData\Local\Programs\Mechvibes\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\volume.exe
        C:\Users\Admin\AppData\Local\Programs\Mechvibes\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\volume.exe mute_status
        3⤵
        • Executes dropped EXE
        PID:1204

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Programs\Mechvibes\chrome_100_percent.pak
        • Size 123KB
        • SHA256 f1a935db8236203cbc1dcbb9672d98e0bd2fa514429a3f2f82a26e0eb23a4ff9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Programs\Mechvibes\locales\de.pak
        • Size 101KB
        • SHA256 8aa79db66cff1cc9f6bd19b3832d7a787bce3ee23e2c83a3725f4ba5db883263
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 c44607a865e7a6db05552baa0ef71f9887d96acd00d123854b44996bc27c0e33
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\LICENSES.chromium.html
        • Size 4.9MB
        • SHA256 a6692be8af33d0673504a5d2bd519f4738aa872595eccc0434f5921185c0d56d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\chrome_200_percent.pak
        • Size 183KB
        • SHA256 7f9ded50d81c50f9c6ed89591fa621fabbd45cef150c8aabcceb3b7a9de5603b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.3MB
        • SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\ffmpeg.dll
        • Size 2.7MB
        • SHA256 8653b57b37618f11e358c93aad9dc9ef0193f0288f7e59147194e42b0842b50e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\icudtl.dat
        • Size 9.9MB
        • SHA256 02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\libEGL.dll
        • Size 436KB
        • SHA256 b516cf5b8073ef35797e8cd422b62ebc117d8bc49471392a9f249d5d20dd8269
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\libGLESv2.dll
        • Size 7.5MB
        • SHA256 47b58af0713e4563489f85716abaed659d8ac85064e3e498cc5af5582da3f537
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\am.pak
        • Size 145KB
        • SHA256 4c0b4273dc4103c666ff01ed8b9db995f68c5c178973465bb25cd5cdf99ef01a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\ar.pak
        • Size 148KB
        • SHA256 776db47dd91bce8bc813a54a815be3e73b6e58e9fe5f24db7bf0d8c06a240f6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\bg.pak
        • Size 158KB
        • SHA256 6c62771c4673320b40e6c73b3a6a7fdf441e94e1866021b9f253c93d419fab8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\bn.pak
        • Size 208KB
        • SHA256 2fa9fa7d2a69818846ff28e05f0f48817a7cd1c608315ac84e4ef3ca43f70ca4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\ca.pak
        • Size 101KB
        • SHA256 93f1feadeb46fc05aa43d8f1b0368e5c57a3eec334187a96a730d7958c6fa9cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\cs.pak
        • Size 103KB
        • SHA256 0c554977f587f1910ab077d99b97f5011f5c466f0b6d86df08f9a4c7c940d99f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\da.pak
        • Size 94KB
        • SHA256 88da5fab329c56d1625205cf1a27f508a4797d4129c59d2a966b2628ae4545b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\el.pak
        • Size 176KB
        • SHA256 9655c11e3c3c70f30104effa382cf3e9614e63f6c01e12d3e55768a0b1467781
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\en-GB.pak
        • Size 84KB
        • SHA256 cbe3e2904ae4ec757576c1223605754b3a3f41f29a395aceda8738e92f4d65cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\en-US.pak
        • Size 85KB
        • SHA256 ac1cdb4fb4d9fb27a908ed0e24cc9cc2bd885bc3ffba7e08b0b907fd4d1a8c4b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\es-419.pak
        • Size 99KB
        • SHA256 2786809ab8fec0874955f37130fa3b0d0edd2ae1500b052e78dce583a9883ac7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\es.pak
        • Size 101KB
        • SHA256 115c1c08de2d8d250cffbdc458f96d716531c122ccefb23c6d3a087828c9792e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\et.pak
        • Size 91KB
        • SHA256 7eea04d27a3a6b04f6ae51b817705fbdf9a17ed3ee32638bbf4c0d2f25f96f7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\fa.pak
        • Size 141KB
        • SHA256 38fe2704e2f84f400760f424054037dcc99c3d710c942532ca0ef8f3b2843972
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\fi.pak
        • Size 93KB
        • SHA256 528e453ee8fd16b6e2066b5417b115504cd31afc4ffbd79206369c747caad1fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\fil.pak
        • Size 103KB
        • SHA256 500906ac9cab570726fe2c3c819eec3f88cb69f326857920d8423883c222c773
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\fr.pak
        • Size 109KB
        • SHA256 0ddb18e05d4a58c010a42207af0ffdfaf12f9bee29f6971459bd69fdf26b0e79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\gu.pak
        • Size 199KB
        • SHA256 5a23541ce618f91b78a809fe91a0c68681e20018c4411e00d8c205ab1d850dbf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\he.pak
        • Size 124KB
        • SHA256 ca440d0128b62e35333730c5925992ae5b4b05a37c10105a9145eb5cf7a77071
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\hi.pak
        • Size 206KB
        • SHA256 1ca6a0546f9627fa9ba3d377d79a21ff26ec9b349d47247c9b241a70728d0699
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\hr.pak
        • Size 99KB
        • SHA256 64e531e46cf5b644d1b7f1df885efcf51a65db50fab65ab250f5e4e1adfa9d29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\hu.pak
        • Size 106KB
        • SHA256 fdd99d667419612bf98200783e0ccf0f7c11913ca03ca162d72d43f6861e5478
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\id.pak
        • Size 91KB
        • SHA256 03e35e4c8d682d80ebde0492ba01d5a922766daf70df6cb2a22a5a5365adff1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\it.pak
        • Size 99KB
        • SHA256 fe223a2126fdf72c0f3c8ae178fba8a05a31c2478e2d4c91a37429e178210b79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\ja.pak
        • Size 119KB
        • SHA256 58f85435f0b4b83ce7d5f7550fdf0b67d6f6c49c8e0fc99d8960355e3167995d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\kn.pak
        • Size 228KB
        • SHA256 a0e82096a74c771e168f0ef58840338a3abb8044b2a493ca5a5f27a147626d8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\ko.pak
        • Size 100KB
        • SHA256 cf6141dc6ec615172864c3c295e371581a6bb559efb75a4717a2c6e66e5414b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\lt.pak
        • Size 107KB
        • SHA256 70996649507cc815f0c4886f8c4822d45c5e201e8e41dc464ab4973ea19d8a23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\lv.pak
        • Size 107KB
        • SHA256 605d916a697824c4ad6c418d6e7cc157b85825da5dc08a0716d89c56bef0a6fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\ml.pak
        • Size 240KB
        • SHA256 4c6b53ac0884508ee987bba5c33f52134e45b91694241e8a242dea70806dc8e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\mr.pak
        • Size 195KB
        • SHA256 29adb357639ebbcbb0811ec27717cb58e71473b857032afd620edb193e553147
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\ms.pak
        • Size 93KB
        • SHA256 e1bd100002dfaae4321cc5afd5aaa2e879367ba58246a0333faee15f20b6a0b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\nb.pak
        • Size 92KB
        • SHA256 54efd9675a9c6871cccab53bdc4e193ce67d6b8d640e78eb1271e0b906f7d5c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\nl.pak
        • Size 96KB
        • SHA256 0191852e67e4919c83b4bf5b472da286c52f4f883cad5e71cdbe73608d402dc7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\pl.pak
        • Size 104KB
        • SHA256 bec3d598cb65bc230f25b0b0e7a26dfcb4424f5f6a677ad4d60a65d291c8bc3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\pt-BR.pak
        • Size 98KB
        • SHA256 8e8e1bc121b06f3e3caf538ecac874214d06a1989b809ce3d7594ee06a3b9f64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\pt-PT.pak
        • Size 99KB
        • SHA256 b7ddb4bc90ba6ba3a5b95555603019ddec0049abd0c87cfd319a00467488cfca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\ro.pak
        • Size 102KB
        • SHA256 c902d1975026837a589d8260547fa05b2f1d5ac4ac833b384f22163cadc717a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\ru.pak
        • Size 161KB
        • SHA256 f1e0c6aa66833c9492b7044c69ba3bb5cb699cd4b62f0a61dc565e5fbf06744e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\sk.pak
        • Size 105KB
        • SHA256 52b20fbf729478ce580f4b200776198df44d1ea44c811c9a7ff09b44df56e553
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\sl.pak
        • Size 101KB
        • SHA256 454cd3f1743829d031bbb90475905de1a9f693632a8c448d9919701337bd58f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\sr.pak
        • Size 151KB
        • SHA256 09ba7958019df039768e5b54009aa11b282c7abfbf920419a0c32cf28d12ccfe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\sv.pak
        • Size 92KB
        • SHA256 a127a098862901fe5d7df5334721cecae1b9a6d4ec8a20c07a8f14264e0f4487
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\sw.pak
        • Size 93KB
        • SHA256 8311c3f993a212b3c44333f2eefa30ae6666a7750fa851e09ed7b1f19949c6ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\ta.pak
        • Size 235KB
        • SHA256 043f65d8e557f10960bb9d6bf0f8195b51c93530e7c71dcc1f7893cb6d9fe27c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\te.pak
        • Size 218KB
        • SHA256 18e766f67c75ce29735ff8e18bd5cdab2157c18f561fa68c81ee7a85b8c4c116
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\th.pak
        • Size 187KB
        • SHA256 755f6ef7592ac74df7d0ee3571711726ef2f6fd72ebb6d3c050cf7cb49c02ebb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\tr.pak
        • Size 97KB
        • SHA256 a5879bddaa2932b93daaf9494bc2ef67a2768aa351f5240616e5b99304d1b8ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\uk.pak
        • Size 161KB
        • SHA256 6b267e79ed0ab8364652d47041d20e6504c421f4aeba9be49205b3f496d2c863
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\vi.pak
        • Size 114KB
        • SHA256 028a9785613b84b60ccc0880502484ca1620aaef040c87cc2cec09ccdb1fa6a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\zh-CN.pak
        • Size 85KB
        • SHA256 54af5945c4341f65e56f1bed15ed960163da6f2758f8441b107812deffc6bbef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\locales\zh-TW.pak
        • Size 85KB
        • SHA256 b53648c0195db153ad4628c642d550f60ddff82ace12be4711c6cb4902e0d590
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources.pak
        • Size 4.9MB
        • SHA256 367467609a389b67600628760c26732fc1a25f563f73263bc2c4bf6eec9033df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app-update.yml

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app-update.yml
        • Size 93B
        • SHA256 ef29165ebfa66c6a80d9d0e9e00b4180e396c8c358c4f3e316f3796f630f7823
        • MD5 SHA1 SHA512 TLSH

        app.asar

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar
        • Size 26.8MB
        • SHA256 e810471fec32a81a92b07587b7f412e86cea4170433c0809ae0664b43a62dff7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\LICENSE
        • Size 1KB
        • SHA256 db892712ff987da49d8b9e73f6b7f8068a338b2137e9f95a05445749cef446e3
        • MD5 SHA1 SHA512 TLSH

        execCommand.js

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\execCommand.js
        • Size 519B
        • SHA256 1c98c7c0deb7eed86c4c7cea327bb7a82085cae485779419591d6cb34ca0c639
        • MD5 SHA1 SHA512 TLSH

        execCommand.js.map

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\execCommand.js.map
        • Size 520B
        • SHA256 63b58bec4efd07d25ff31aadd0277f0aa3aa03936d303e300ff03b2d6b11fc86
        • MD5 SHA1 SHA512 TLSH

        index.js

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\index.js
        • Size 1KB
        • SHA256 b434b37e2f168c20d7df926366cb79585421d4671fdbf2b927db71b0bb379dcf
        • MD5 SHA1 SHA512 TLSH

        index.js.map

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\index.js.map
        • Size 777B
        • SHA256 0960e6e1f81f9db3e347d43692d95481e853da45f013aa7d1093cdc767f2ae37
        • MD5 SHA1 SHA512 TLSH

        index.js

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\darwin\index.js
        • Size 2KB
        • SHA256 7a79418184bdd19514ef0b3a6dcc73e54a41396e8e84c25097bc0b34f941a350
        • MD5 SHA1 SHA512 TLSH

        index.js.map

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\darwin\index.js.map
        • Size 1KB
        • SHA256 7afbb103fb37384133419a5ff933b25e9e38c972868c5e55e26a0010197fba6e
        • MD5 SHA1 SHA512 TLSH

        index.js

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\linux\index.js
        • Size 3KB
        • SHA256 0e1b7013013fea4407a0799a6ba6403053f2ab3aa377e85b68f2dca0c1c32bb2
        • MD5 SHA1 SHA512 TLSH

        index.js.map

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\linux\index.js.map
        • Size 1KB
        • SHA256 854d39dfc7482f9a34b6d0eab80f3c26d91c2608791625b6f51c8c7a744cfc2b
        • MD5 SHA1 SHA512 TLSH

        index.js

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\index.js
        • Size 2KB
        • SHA256 c4425f498cc1dbd83b5e500936690c9b953231e9e7eaa47e4b63f32ad1fa1bb3
        • MD5 SHA1 SHA512 TLSH

        index.js.map

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\index.js.map
        • Size 1KB
        • SHA256 833b66a5d5bf1576ea367daa10e10d81fee5bea53c2730b9281882d785f7dd98
        • MD5 SHA1 SHA512 TLSH

        volume.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\volume.exe
        • Size 145KB
        • SHA256 71893b9d33fc1ac90456a32c11185abf6bf2af5b804a74d0897f12d9c2e9609c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        volume.spec.js

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\spec\volume.spec.js
        • Size 2KB
        • SHA256 23476bd34fde4c81ca2dab248dc1dcff0af8cc0e10320a294b6736e95a79a61c
        • MD5 SHA1 SHA512 TLSH

        volume.spec.js.map

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\spec\volume.spec.js.map
        • Size 1KB
        • SHA256 396cac50dd479e879b6192043118f2ab6ca5e96ecb5b4c734b54f737ea0a901e
        • MD5 SHA1 SHA512 TLSH

        types.js

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\types.js
        • Size 328B
        • SHA256 b8394d47eea269dd4d0a231837f79c6a7a6f827ff1372ee45afe84078cb7f898
        • MD5 SHA1 SHA512 TLSH

        types.js.map

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\types.js.map
        • Size 192B
        • SHA256 b09e174ec9390fe2b46ebe539e95f2c94024392e05b2d2e63ad497c88dfc5e7d
        • MD5 SHA1 SHA512 TLSH

        toElectronPath.js

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\utils\toElectronPath.js
        • Size 865B
        • SHA256 27badcb0e1bf0ac236e1b5d6e6c45e8e38a15bd2b3b856859a69bc882d2072a7
        • MD5 SHA1 SHA512 TLSH

        toElectronPath.js.map

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\dist\utils\toElectronPath.js.map
        • Size 254B
        • SHA256 3ecff09bade43bed33827e2894c30c65ddbc841c88b5670f6889b30b012559e2
        • MD5 SHA1 SHA512 TLSH

        package.json

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\easy-volume\package.json
        • Size 689B
        • SHA256 3c2a05444e354aadebf39575aba5b4f175a69670dd2708f585fc3454cd9ec50e
        • MD5 SHA1 SHA512 TLSH

        .nvmrc

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\.nvmrc
        • Size 3B
        • SHA256 9a92adbc0cee38ef658c71ce1b1bf8c65668f166bfb213644c895ccb1ad07a25
        • MD5 SHA1 SHA512

        CMakeLists.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\CMakeLists.txt
        • Size 3KB
        • SHA256 2a14d8beb7bca493c523ca01e956d539fdbb130be3d594f807e71b01e6ae9b67
        • MD5 SHA1 SHA512 TLSH

        LICENSE

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\LICENSE
        • Size 1KB
        • SHA256 f98c13fc55febd7c4e2ab4d2185765696001ae22a7f9a91267d67efa16f3a178
        • MD5 SHA1 SHA512 TLSH

        build.js

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\build.js
        • Size 6KB
        • SHA256 667c8af5f36f9263a34f0d3537d91a5db5ed784a3199d865727d9a20cb0a194a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uiohook.gyp

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\build_def\darwin\uiohook.gyp
        • Size 862B
        • SHA256 2c7b8b5719b83aee64ee1de7c4e2e8e22e330dbcd744ace99256d0e5ada6b2c1
        • MD5 SHA1 SHA512 TLSH

        uiohook.gyp

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\build_def\linux\uiohook.gyp
        • Size 998B
        • SHA256 113ecf3727940eb782971a725e8151482428b536a0b55d4a05c0d2998de76626
        • MD5 SHA1 SHA512 TLSH

        uiohook.gyp

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\build_def\win32\uiohook.gyp
        • Size 527B
        • SHA256 03efde41aa10588a49d9517d1b9027096bd88cf7e2656d410e88de9bd616ea4a
        • MD5 SHA1 SHA512 TLSH

        iohook.node

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\builds\electron-v87-darwin-x64\build\Release\iohook.node
        • Size 68KB
        • SHA256 4c072f359d95bae5883ca6c7b7901f576aff0b52e76c0bfd4faf570698bb420b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uiohook.dylib

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\builds\electron-v87-darwin-x64\build\Release\uiohook.dylib
        • Size 59KB
        • SHA256 d233e30802b6bf1aeadb0d7ef6ffc2f5081b2aae213941560462889bed04c942
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iohook.node

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\builds\electron-v87-linux-x64\build\Release\iohook.node
        • Size 56KB
        • SHA256 cc32bb40e67c55d85879590f529461c46091ae4c4038ebc27d7105481a1e28b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uiohook.so

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\builds\electron-v87-linux-x64\build\Release\uiohook.so
        • Size 45KB
        • SHA256 68770090eb8961e322ecd898bc0ace11b682ca61ce83389a2b201ff42e13475b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iohook.node

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\builds\electron-v87-win32-x64\build\Release\iohook.node
        • Size 156KB
        • SHA256 77580e5c454f7c757370562ce54231a5db13088821234a704c2d5172223c2396
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uiohook.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\builds\electron-v87-win32-x64\build\Release\uiohook.dll
        • Size 138KB
        • SHA256 c6e5f3ad4890a8633d6c4bd5a5a6134c0c89c73d0f7d32d95e16404e084d5d88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        helpers.js

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\helpers.js
        • Size 1KB
        • SHA256 cbb5bfabf0c6284c37c3e9548920a85760b8f19a22190e66db2b9751e940bb98
        • MD5 SHA1 SHA512 TLSH

        index.js

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\index.js
        • Size 10KB
        • SHA256 3b86aaca5882a0b012ac02175f967707558c79c40c7a2b8238238ae4d2280e43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        install.js

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\install.js
        • Size 4KB
        • SHA256 6b04824706a4864b218da706204df28caab0283859bcc6d2fb9ace9589867148
        • MD5 SHA1 SHA512 SSDEEP TLSH

        package.json

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\package.json
        • Size 2KB
        • SHA256 e761965987bff4d1f98fc511a2aefcce115ecbc362a1daf4813d4cf449b5072b
        • MD5 SHA1 SHA512 TLSH

        iohook.h

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\app.asar.unpacked\node_modules\iohook\src\iohook.h
        • Size 517B
        • SHA256 227782182d3a8676104a4e959f15fd8ca9de25540bb0130b62c55618de03ef36
        • MD5 SHA1 SHA512 TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\snapshot_blob.bin
        • Size 46KB
        • SHA256 75ba76097b6539f306b305b295dcb81fddff17ef7c5644d84a1d485b24812ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\swiftshader\libEGL.dll
        • Size 458KB
        • SHA256 bfd1d3fb9e50a3d9a58d9c62663fbf46bedcac24744020b801c9bb4cdc55f977
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\swiftshader\libGLESv2.dll
        • Size 3.1MB
        • SHA256 54b6e787450bfcebed843ad1dafb31ca0904a908131d1005b567513ee8e2db46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\v8_context_snapshot.bin
        • Size 160KB
        • SHA256 31c3aa5645b5487bf484fd910379003786523f3063e946ef9b50d257d0ee5790
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\vk_swiftshader.dll
        • Size 4.4MB
        • SHA256 74404d6f6082edbc4af2b0405a2bca64bc0ddaa15f45923e25b452041af8ac0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\7z-out\vulkan-1.dll
        • Size 717KB
        • SHA256 8ed0495528846a950fbc97c5f3623987dd0854680aec2cea4c564839616a9d7a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UAC.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\UAC.dll
        • Size 14KB
        • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WinShell.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\WinShell.dll
        • Size 3KB
        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
        • MD5 SHA1 SHA512 TLSH

        nsDialogs.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsExec.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\nsExec.dll
        • Size 6KB
        • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        data_1

        • Path C:\Users\Admin\AppData\Roaming\Mechvibes\Cache\data_1
        • Size 264KB
        • SHA256 63c1a7e5a7815c3bcdfe5b26e78f31ac691ffb780ff51eea4faaef52d4b2e738
        • MD5 SHA1 SHA512 SSDEEP

        data_2

        • Path C:\Users\Admin\AppData\Roaming\Mechvibes\Cache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP

        data_3

        • Path C:\Users\Admin\AppData\Roaming\Mechvibes\Cache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP

        CURRENT

        • Path C:\Users\Admin\AppData\Roaming\Mechvibes\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512

        MANIFEST-000001

        • Path C:\Users\Admin\AppData\Roaming\Mechvibes\Session Storage\MANIFEST-000001
        • Size 41B
        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
        • MD5 SHA1 SHA512

        default.dic

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512

        memory/1440-1089-0x0000020BFE950000-0x0000020BFEA1D000-memory.dmp

        memory/4080-981-0x00007FFB6F810000-0x00007FFB6F811000-memory.dmp

        memory/4080-1088-0x000001C642140000-0x000001C64220D000-memory.dmp