989f770da70ebb4e392ebd0680f0c0a0ab2dc658f4fe4ea71ef0c65836f56960

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
901s
max time network
480s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mechvibes.exe
Size 125.1MB
Sample260802-e6hzhstsbs
SHA256 989f770da70ebb4e392ebd0680f0c0a0ab2dc658f4fe4ea71ef0c65836f56960
MD5 647412bc3625466467d5f39049895192
SHA1 a776e31c257ede6767c6339fde6d8f14d349c863
SHA512 46910816258fc22459fab353aff66f6fe7035ae4af032d4defcb9bd774e3343e7803180536393c33770f578e22e52710f49a38b636bbcf68e94c86f09f045fa8
SSDEEP 1572864:njABn4GrHbdfM633Q0Hiafm5wlJ35jGlBJAyhGuKEtQI+e1hg2uhC:ngP3Qeia3d/hNFw
TLSH
T1D8588D13E2A610DDE05DD1B59B4A8636EEB1B8450735B2DF265027162FBBFE02B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution spyware trojan

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1364	cmd.exe
2872	cmd.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mechvibes\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Mechvibes.exe\" \"%1\""	Mechvibes.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mechvibes	Mechvibes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mechvibes\URL Protocol	Mechvibes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mechvibes\ = "URL:mechvibes"	Mechvibes.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mechvibes\shell\open\command	Mechvibes.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mechvibes\shell	Mechvibes.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mechvibes\shell\open	Mechvibes.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	Mechvibes.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Mechvibes.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Mechvibes.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3032	Mechvibes.exe
3032	Mechvibes.exe
2348	Mechvibes.exe
2348	Mechvibes.exe
5092	Mechvibes.exe
5092	Mechvibes.exe
5092	Mechvibes.exe
5092	Mechvibes.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe
3408	Mechvibes.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 2668	3408	Mechvibes.exe	89
PID 3408 wrote to memory of 3032	3408	Mechvibes.exe	90
PID 3408 wrote to memory of 2348	3408	Mechvibes.exe	91
PID 3408 wrote to memory of 5684	3408	Mechvibes.exe	93
PID 3408 wrote to memory of 1364	3408	Mechvibes.exe	94
PID 3408 wrote to memory of 2872	3408	Mechvibes.exe	96
PID 2872 wrote to memory of 5504	2872	cmd.exe	99
PID 1364 wrote to memory of 2684	1364	cmd.exe	98
PID 3408 wrote to memory of 5092	3408	Mechvibes.exe	101

C:\Users\Admin\AppData\Local\Temp\Mechvibes.exe
"C:\Users\Admin\AppData\Local\Temp\Mechvibes.exe"
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Users\Admin\AppData\Local\Temp\Mechvibes.exe
  "C:\Users\Admin\AppData\Local\Temp\Mechvibes.exe" --type=gpu-process --field-trial-handle=1516,11709534544906980188,10947273863912167990,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1524 /prefetch:2
  2⤵
  PID:2668
- C:\Users\Admin\AppData\Local\Temp\Mechvibes.exe
  "C:\Users\Admin\AppData\Local\Temp\Mechvibes.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,11709534544906980188,10947273863912167990,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2100 /prefetch:8
  2⤵
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\Mechvibes.exe
  "C:\Users\Admin\AppData\Local\Temp\Mechvibes.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1516,11709534544906980188,10947273863912167990,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2180 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2348
- C:\Users\Admin\AppData\Local\Temp\Mechvibes.exe
  "C:\Users\Admin\AppData\Local\Temp\Mechvibes.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1516,11709534544906980188,10947273863912167990,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:5684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\volume.exe get"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\volume.exe
    C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\volume.exe get
    3⤵
    PID:2684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\volume.exe mute_status"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\volume.exe
    C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\easy-volume\dist\platforms\windows\volume.exe mute_status
    3⤵
    PID:5504
- C:\Users\Admin\AppData\Local\Temp\Mechvibes.exe
  "C:\Users\Admin\AppData\Local\Temp\Mechvibes.exe" --type=gpu-process --field-trial-handle=1516,11709534544906980188,10947273863912167990,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3052

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Mechvibes\Network Persistent State
Size 336B
SHA256 dd09f707d4bf5097bb5fed10c4a16ecddaac80aae4e44c136b901ee0b3be0c78
MD5 36f9b14d5b4394a48dc7ddc01e22534c
SHA1 d44eede36ee016f62a44a27363425399e5ee8003
SHA512 4198b2c4a61dada1067cfdb00263ec15e53dc0e6c08b693c8c8de6daa20c4255da15dcef8a8338c49e0b9e97b05525739aeed5de87cd8c466ba7b67aa4ecab40
TLSH
T118E0DFBB067418FF4702C3A188143F13DAFE0009134CE8AD89946B2A95319B7940488E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a63bc.TMP

Path C:\Users\Admin\AppData\Roaming\Mechvibes\Network Persistent State~RFe5a63bc.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Mechvibes\config.json
Size 29B
SHA256 b3e61654efa7b03054c1e751e07ff83385edca57f82b42574d370ac9e60eef4f
MD5 6c2f923dc459ae4ec7ad866f88f575d3
SHA1 a84aa9876e4605de7ca2c3b2c5d84aa68e7ed41d
SHA512 babd8316d4153df6f4e2d7d4e435fd3485c2a344abfe8717e994875ec240b7d87be334c48b1c25512d17a5c1abb57ff6f4c2299b3637c1018857bb62e73618d8
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Mechvibes\config.json
Size 29B
SHA256 21b0e7fa148bedc416158857b77c1fcf48f25694adebfe3ca75ad9db66c8b782
MD5 9eaa36cf2a724891bb6b1f291b0aa92b
SHA1 e35f623d41c18cb31bc7b0f2bfa653e01954516c
SHA512 c5d810b147df45591bf4d4d1aac15da6939b51c803402a1254c8ee3313ee2302b75c76e48606fe48e242b7b4f25419c652edc74b78004f02ae5ae8b3f79552de
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Mechvibes\config.json
Size 29B
SHA256 e4056746b97eefab6a9efa59225509c1e6899dd1a2a7b76f7125585ceee14026
MD5 b65c946406af0e7dc1aa2e72e6cf9779
SHA1 c199e621963685476c32bad2acbfcc15a1c2a027
SHA512 6eec70805ee681caa28516cceaa6958975ad46480820cb324aad8dbe85edce137dab0fc693ea7e868d1cfaac299f343e0caf16648b81f2de4789793256f088a8
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Mechvibes\config.json
Size 29B
SHA256 dcfaec4186fcb320494c690d334bb2e86b9a845f651a083c479af9febc875fa1
MD5 7f09b77d6b75a37c3d474b58f3bdbb7f
SHA1 7d5935d7443ea2290e6c1a8f1c56fafce2a1b7e7
SHA512 e506493c8c7633c274e39a1ba6638a57c463c336419482fe3bba72444f3f5a528faf21aefa1c48c11644ecf35734548528f4e28ec581138ce61b57191be12c2c
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Mechvibes\config.json
Size 30B
SHA256 c0ef43bf4315b6c2374a5027444300aea6707d657e8acb9c5bca619143714585
MD5 6d7ee38a581cf425058e414102e20513
SHA1 aa4820a439bc4c358f117b30682bb6ea71950c16
SHA512 5951208fa59ab39c3e72039fa8563ad27c41b0dd6698fd19aca9ffe4d69843e9cbdb51773979f2552a636b64ef4e4025fbebbdc1526c4c44ab86823cfcb66cc8
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Mechvibes\config.json
Size 30B
SHA256 f4f0ff741d6cb5fe5ef7a2dbb669625530e9b79e223c77e5bf25199fd33ebf3a
MD5 1fff1415a62cb3edbaf66f02697d9a74
SHA1 35c1e17929c9e3be5f5ec8940a26d9e7bc79bf83
SHA512 ad87e6eaa3a27bfe642f057cf15f1d0f6c5d0f898bb15ab50c93922b6e60f0f6b3a0598c8bcc2ea1373cd25f2c605ed363f6b5f5574fdeb146cace79b7535e6a
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Mechvibes\config.json
Size 30B
SHA256 f76690bc5ab12658b199c52c0ea30ff2e62953e9545db8123ba3e27f2c220af6
MD5 8d3830f9e26f229cf488a84f066dbba7
SHA1 8d5f1d09833d0a3b4ff9a216a6e034888e421405
SHA512 cc474757b85fb35f1e97a7b586ec98778a0e21cee8619dbe70883581fe7b4be56480062aeaae0507b10b6154ccde74b59f4ef992367ef46199dab41f81e9e020
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Mechvibes\config.json
Size 30B
SHA256 fc40749dcaef05847c5982fff49937c375266e04325fa7e1e9e9880e49eccd52
MD5 2970131bb2410ea30f4e9e38b09ba518
SHA1 014e481ae413b8926d243f506c6dca7c6fb8b5db
SHA512 e4d29e41f3898a69539b198648d203069a52e97ab5d981344f894dfeb4df3ed2a51e586e675a317c70f36eb5cbe0420d1574bab0c9eb6371ef7e171d3e86e9d3
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Mechvibes\config.json
Size 30B
SHA256 701c16ec3edaf4a4589ea1af077f80ec32ac7fa0a22abf82dfba59df88a76c0f
MD5 cc4da67f1a62a47c8c80c8445ad42780
SHA1 5eaa9938f3124c6646acdd6aee4be4eabc121474
SHA512 f5f9062c23929d425163fcb19dc2ab61f1c97e27ef51db4fcca7d095094694894fbd946058282161f87fc64b0ca6f529bb7790ac904fd4c2959acdf4cf44ee7c
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Mechvibes\config.json
Size 30B
SHA256 1bf5a07a5c1c05f3b03cf0e3c55678e2de61427e3cda1a6af77d4a8cec7ca554
MD5 6e7644fab7f364c9ef5b2189e34208bd
SHA1 d2e56dc8ee638aeb8f2dbad022000556ee7fe234
SHA512 8ba2315c86757435682fa4aae54ba4d7b8a958cd6ed4501fcd9ba7a26de5ed805d5661fc31587ebedab252040d4ce6f61c1dc5578e7e9d38ce0c53f8eeab9dbf
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Mechvibes\config.json
Size 30B
SHA256 f9a66adc862a45880229ec47bcaac6c9cf61cdc0ecfb1b5be7bd077b9b7ee749
MD5 e57f155d64beaba143be3925fda05053
SHA1 bed49c3265c3ae066019aa77a2da4259446b51d4
SHA512 81ccd92087905d2fbe2a7cb9d57fa474c3740c212211b5e43877258590ebd2c27d072dfdc148be2fce545acd25e6432d444964af10ef1a97033046179c0abfa6
MD5 SHA1 SHA512

Submit Download

config.json.tmp-5645421754e197c5

Path C:\Users\Admin\AppData\Roaming\Mechvibes\config.json.tmp-5645421754e197c5
Size 30B
SHA256 6af5a8f3da61a3b34f113bb09ffb1f550be253a96c7d949b12d33f2860b01d3d
MD5 45606d2e755e4d4ebd311a7cefd3eaf4
SHA1 e2fae5a6db2fe8668035ef2ac8510a55b6dcb521
SHA512 330e78a1b1b42d3301bb7ddc7de66aba612839e7ebb01c28f94888ceea075deb3ee955f69a340e6fc6e61fe7931f38dda7ebc91e0ef5b967932218898478bcf3
MD5 SHA1 SHA512

Submit Download

config.json.tmp-5645421834baf6c9

Path C:\Users\Admin\AppData\Roaming\Mechvibes\config.json.tmp-5645421834baf6c9
Size 30B
SHA256 083ad53b71e548faa37c7ea20788b6577274823e9620bab71be9f4b3620ce075
MD5 f23204bb5e91be81bd03a5dfca1e30c5
SHA1 ae03f3542859956ca908ff0c5e974ca0bf322ef6
SHA512 ba773bcce811272dc7844f791c77d329b57e6fc7c41b6dd9473ea6afe0963987656f6afe2ea2a7dd1ecae3e09a67a07dc917bcf423cedc28e98dab811f789f2e
MD5 SHA1 SHA512

Submit Download

config.json.tmp-56454218786ea5b3

Path C:\Users\Admin\AppData\Roaming\Mechvibes\config.json.tmp-56454218786ea5b3
Size 30B
SHA256 a3a364f05219435cca7ac9581270b45161bdd8803a98c21ff6735762e956fc3a
MD5 4af185ca62ab3522a89d707058a1169a
SHA1 3c2935d1224663b7e4d2c43bf82ea68b815df4e3
SHA512 8ee270244473a18143b19d7a25a60617391fefb431ee964ad123f8a4a1c40a1f5348bfec59c27131017845f329ed126950b9f7da659d5d24926a244664683235
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2668-2-0x00007FFEE20A0000-0x00007FFEE20A1000-memory.dmp

Download

memory/2668-65-0x0000016EB41D0000-0x0000016EB4369000-memory.dmp

Download

memory/5684-66-0x00000265324D0000-0x0000026532669000-memory.dmp

Download