Analysis

  • max time kernel
    152s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 16:57

General

  • Target
    NewLauncher-2.0.9-windows-x64.exe
  • Size 101.2MB
  • Sample260806-vgrs5abb33
  • SHA256 72d9b13247d9f9b59612f70a5c730cacbeea2a3c082a633ca64ddba708559d16
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 21 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4364
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4996
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3208
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\NewLauncher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1004
  • C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe
      "C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\NewLauncher" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,3171913163347960948,7427669214851889079,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1892,i,17337640880214968656,11297344248282292187,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1848 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5192
    • C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe
      "C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\NewLauncher" --field-trial-handle=1904,i,3171913163347960948,7427669214851889079,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1892,i,17337640880214968656,11297344248282292187,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1956 /prefetch:11
      2⤵
      • Executes dropped EXE
      PID:2284
    • C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe
      "C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\NewLauncher" --app-path="C:\Users\Admin\AppData\Local\Programs\NewLauncher\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1786035565680179 --launch-time-ticks=628709393 --field-trial-handle=1904,i,3171913163347960948,7427669214851889079,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1892,i,17337640880214968656,11297344248282292187,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3192 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5864

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 3a604e395e1ad4d9214d13f5704929278188f1bca683e52c0e79b6b404cd3d26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StartupProfileData-NonInteractive

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 16KB
        • SHA256 0b32c3ddf7ab416646d57bee87acafc46c47a7dc5698ae35ffe741789aa1bae6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        53b656b2-b428-4a41-a4b1-f33f9d3812af.tmp.ico

        • Path C:\Users\Admin\AppData\Local\Temp\53b656b2-b428-4a41-a4b1-f33f9d3812af.tmp.ico
        • Size 30KB
        • SHA256 db817faf38ca5898dea1ee59e867e2f74f6f1f61cee8fff0c110f32d28ea4036
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __PSScriptPolicyTest_0ewcawit.v2v.ps1

        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ewcawit.v2v.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\LICENSES.chromium.html
        • Size 18.6MB
        • SHA256 62e3b53be6bbbb2e7747b7a55c8b4f4a3cf38b95e0fff594737b3bfdac8cf373
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\chrome_100_percent.pak
        • Size 113KB
        • SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\chrome_200_percent.pak
        • Size 183KB
        • SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.5MB
        • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxcompiler.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\dxcompiler.dll
        • Size 24.5MB
        • SHA256 7a743a2af5b4cb59cec8c38e7fb544b87fb6547f215491634a577a03a4e83bd8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxil.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\dxil.dll
        • Size 1.4MB
        • SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\ffmpeg.dll
        • Size 3.0MB
        • SHA256 e7aec5ca86d80540ea30c5acdf0a13acb34d1d9dd0f9e78b36fb21776b711a1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\icudtl.dat
        • Size 10.3MB
        • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\libEGL.dll
        • Size 510KB
        • SHA256 6edaea2de8f6bca40dc4cbb60a55be5ae93c2454a66474c3706953b5d1d73e26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\libGLESv2.dll
        • Size 7.6MB
        • SHA256 49c2a50a3a43c10e258eee0d58e81be9d207ebeae206d603314f1ebc36d7567f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\af.pak
        • Size 595KB
        • SHA256 973c21a2ccc0375a016b1ba0028cc3fb2cfa4e9ab82a52217fdff342ba43fbe5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\am.pak
        • Size 966KB
        • SHA256 ab591598cac20048c2b7a2d73eb4d1ca9054f9dda153eb51855935e969c7f54d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\ar.pak
        • Size 1.0MB
        • SHA256 dacb642f184b6aa20d062eae55b49101c507d7378d60e53a014a2631c0bb20bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\bg.pak
        • Size 1.1MB
        • SHA256 e854a940ef467662ee733bcf5c5aac0f5aef8d006200af173b4f840ab9f6d3ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\bn.pak
        • Size 1.4MB
        • SHA256 2465ef35bd984ed78c1a0ffff00713facada7ca0d419104716eafb149187d9f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\ca.pak
        • Size 670KB
        • SHA256 7f9a90bc5821548acd42546604c18d525b3b00f87094739ab95b5683d08aa79c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\cs.pak
        • Size 696KB
        • SHA256 94c119305964dd203e4335ef1676f373d56fad9e27ae6e11987d790b2b3f5a41
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\da.pak
        • Size 626KB
        • SHA256 f097260d271900ebb3a6a68e42e49005d3441026904462c3b306c87e21f2d640
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\de.pak
        • Size 671KB
        • SHA256 1eec5b0a6d7a2888127c1a490d40497e2913460b96c4334815e278bc882802e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\el.pak
        • Size 1.2MB
        • SHA256 f9715c939e27d6da75c89866aac6de5fe9f25baef524d85db2fd812750cc43b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\en-GB.pak
        • Size 542KB
        • SHA256 acefd35ede3e9dde3c91880bba726546cfb8e543712b7c7167b53867a0f155e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\en-US.pak
        • Size 548KB
        • SHA256 a02518efe75c630a1b5419af5ffdb1b16636b939139bccd7710e37f36ad9d55c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\es-419.pak
        • Size 661KB
        • SHA256 818f06880dc921662f0685d8f79d85f76ab7b5490deb7497208f307ba9c6d42e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\es.pak
        • Size 658KB
        • SHA256 5228d6bbac5909cf285aceeac65c042462c6da99b957f03f5c4070763bcba583
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\et.pak
        • Size 601KB
        • SHA256 c7364bca48cec7994e40a3169d465d6af04a66becbadccff24c9fa74d9410cbb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\fa.pak
        • Size 995KB
        • SHA256 d840449c2aa71835bfaa739156c5ad00c4d0709557e129e4c87ae8ca38c4d960
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\fi.pak
        • Size 612KB
        • SHA256 6b09e983a58aca1a3b4bdfe35f4c8d37a568feda3ed680e14b24395ba04d880c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\fil.pak
        • Size 694KB
        • SHA256 c5335e3b4468ebafd55fdbe77553a3838bfb6a1fd5a5ed0396598a0e96e7792d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\fr.pak
        • Size 716KB
        • SHA256 06acba3cbd3f4e7cca4fa2103c5d71e8f6de3a7530717b0c72b454bd670be503
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\gu.pak
        • Size 1.4MB
        • SHA256 897b9ed176073cd0e8a39004158a2ad9877bc69f79cf260e029937fc9c556f95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\he.pak
        • Size 871KB
        • SHA256 b777e7ede2e0ba88186a1a6dcacbcc918e7983c2027922f92994f937a1f0327e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\hi.pak
        • Size 1.5MB
        • SHA256 966845384bd7213dd03e87a80655cdcb2bb02d180e778fa0583e86edcdba73cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\hr.pak
        • Size 670KB
        • SHA256 30d7259b46052fa6735cab8a6d4cba682df021e68998a4b3723248a5b806eacd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\hu.pak
        • Size 717KB
        • SHA256 3bf2106670f2a461ec3454d790bf94010079e4e683d24aabd4a19e8d89e333c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\id.pak
        • Size 592KB
        • SHA256 4d003b8e85f4daea7c28c4f6854d46a62b32abe9973e6df764e2882b4472ea64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\it.pak
        • Size 648KB
        • SHA256 3e241f9341c9593ecbe3a2a74a5249e8d737962741b51fe60143e3529470d716
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\ja.pak
        • Size 791KB
        • SHA256 03427863b47fcde8164855a13d01f09cfcf27bf9ea59d6abf74f2f7b255fb1ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\kn.pak
        • Size 1.6MB
        • SHA256 1dc837117f2b3dc69fc36c1c199addc999d5fb5a131072680796accd25e33b8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\ko.pak
        • Size 671KB
        • SHA256 e43762e4f3b00819c2c5570ed292a6d42e53bbb00220c3f76a6aa0d502a76060
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\lt.pak
        • Size 729KB
        • SHA256 1cf37f7eafa0612186eebb76406767518f9b5dba12872bc3170b9a309c5050cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\lv.pak
        • Size 726KB
        • SHA256 01913d9951959803c419816189ba5517568b1f36f70c539549713c4579105be9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\ml.pak
        • Size 1.6MB
        • SHA256 98c8ecff32021c532167cbd7e60b714c6dd8e240a3527af141da9d3916ea7d4f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\mr.pak
        • Size 1.3MB
        • SHA256 962928ac0c648b426dbd5dc930528900935acca4b336be6cf3fd911e99ef400f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\ms.pak
        • Size 624KB
        • SHA256 7b5ecc027a33e3123596cacfe6d4a8b33c8185c6d90d65aceb686aaaa234c5c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\nb.pak
        • Size 598KB
        • SHA256 c4bfbb6dfa8c2f38caa27f77b58a5a373792284032d998f48469b2d8f050b084
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\nl.pak
        • Size 623KB
        • SHA256 1f9f8fdf67a93b571823fcdbf4f6c1132663a92bf199fcd8b3554a1404138182
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\pl.pak
        • Size 696KB
        • SHA256 1c328e8286098d6758aae4562ad0465094bf38477035475ea3b7ce9729c59518
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\pt-BR.pak
        • Size 652KB
        • SHA256 76af448316964d70f5ca6ea2d3d10dfdda055521d981c0342c8eb2df1aace27d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\pt-PT.pak
        • Size 656KB
        • SHA256 8ecd368ebcf0c4cbd3decb1709c1e6cda9ebd75dc4c3d0869b86dcf959c15565
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\ro.pak
        • Size 681KB
        • SHA256 bb8cb9b4b9708cba17c6a1b00d448c500ecb1658019fd2451868603c68251e92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\ru.pak
        • Size 1.1MB
        • SHA256 4f7ef4e041932011eabc4d2dc8f8544106f57ee62c023e6b6a9a3a3ac23a7cc2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\sk.pak
        • Size 708KB
        • SHA256 9494cb93b7dd65cef73072d315c7c031005a3783594fdf43fe96d9e531f5cda7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\sl.pak
        • Size 678KB
        • SHA256 b50824ca2479dc29b404a8e2c252a9a791f444ba10b839d09b684b52cbb7b4b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\sr.pak
        • Size 1.0MB
        • SHA256 02224e36d8d12e79c22e573425b5e7b2505e1f68d8be4cebada710a9c0ebdb00
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\sv.pak
        • Size 605KB
        • SHA256 ba098c7e48f588677686e8c4353432ef185ed4d659bd43d0b1bc76029b36aa30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\sw.pak
        • Size 640KB
        • SHA256 c806d266dacc573c6f2a852bbba1cf1980063f08a803e6a0f5783c1418b4c16d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\ta.pak
        • Size 1.6MB
        • SHA256 cc82344df7ec4fefc02fc36f5d1af7286b27f4c267477bffbb0ac4f4fefab901
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\te.pak
        • Size 1.5MB
        • SHA256 f354b638c25843ec70a625d98066d1e291d6567830a327a308262f7872739f43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\th.pak
        • Size 1.3MB
        • SHA256 72495fa1c87e6009499c3c478eb8ff1dc295e4fa8e1e97c915c4334cd48df45f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\tr.pak
        • Size 651KB
        • SHA256 d42ef3d1bfd531ef93d1e30e34d0c9a9fad37d08aa26fb61930d67ef31e5a471
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\uk.pak
        • Size 1.1MB
        • SHA256 2b3e02603e4d06b513b59db0d262971c8ec9e7f85233c6862f52e72bbc4e0afc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\ur.pak
        • Size 981KB
        • SHA256 0f5565df4484d9c0ed2f3033156e876aa8ff25406fb5a628ba12dc2588d5f7b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\vi.pak
        • Size 774KB
        • SHA256 b5ae891cb2c1b98e01b7b819946849b7f1530b2991584b74045766f566ab739a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\zh-CN.pak
        • Size 554KB
        • SHA256 d9ba93569044c34fdc3aea0a0be892e0b6eab8a71e3008bc854924bd5efcd19a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\locales\zh-TW.pak
        • Size 547KB
        • SHA256 217b6776de0fc342d2ba3259aef9c5a6d9747f20942791be4e5fa16cb412b970
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources.pak
        • Size 6.4MB
        • SHA256 741b7aebbec65ed7af754530e77b45ea4274e8f7c012c4396de789563a1183a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app-update.yml

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app-update.yml
        • Size 92B
        • SHA256 142dbcda9ba86178d342850ee52ec418104175f1bdf2d6a24daa781d846808b9
        • MD5 SHA1 SHA512 TLSH

        app.asar

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar
        • Size 33.7MB
        • SHA256 9da8b59b988131afe36c071b29326acb8643306e061a7de044c5a26add6a9731
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\LICENSE
        • Size 1KB
        • SHA256 9415b233c6c5a6fc3ac6977cde3530d149f45a61d86b2fd9611cbca4bf08f4e2
        • MD5 SHA1 SHA512 TLSH

        lzmajs

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\bin\lzmajs
        • Size 1KB
        • SHA256 f29aae866c7bb66e5424a730c473231c1329f6bb0636ad33945299a4c4957a50
        • MD5 SHA1 SHA512 TLSH

        index.js

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\index.js
        • Size 13KB
        • SHA256 77d9568c9c5479953a4588875b9d5c4a06ce9f926f9fab96d7678e68a74e6985
        • MD5 SHA1 SHA512 SSDEEP TLSH

        liblzma-build.sh

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\liblzma-build.sh
        • Size 138B
        • SHA256 ae56a4c3e521e37c5677e4d867e79ab46ac23b3f5682a7e2893497232a0326ce
        • MD5 SHA1 SHA512 TLSH

        liblzma-config.sh

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\liblzma-config.sh
        • Size 733B
        • SHA256 100d04495f6b1804aef3983377d91509864758cf9aa7470d28a24b69f0bce116
        • MD5 SHA1 SHA512 TLSH

        package.json

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\package.json
        • Size 777B
        • SHA256 492448e7c5e26eada710d45c14a2d8eb5c6333eb39dbaff4631befaad37e0ed6
        • MD5 SHA1 SHA512 TLSH

        electron.napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-arm64\electron.napi.node
        • Size 227KB
        • SHA256 b322385eb19c1d0737144fbe2fef3c5d27b5e5531878f5a21700489785e51ac4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        node.napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-arm64\node.napi.node
        • Size 227KB
        • SHA256 7eb79b4ace336fc1f31923f7407d997d2676f95a5fab4a3dc4688be2ed659f1a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        electron.napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-x64\electron.napi.node
        • Size 434KB
        • SHA256 37713bcaf2468d4a60c94652dd2ed8801fff57f270650b2fee90428bc5ad290a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        node.napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-x64\node.napi.node
        • Size 434KB
        • SHA256 5c77fb5f183ee197b110c76440b390d74aae7c35ab1ea48861308d8b62c22f65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        electron.napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\linux-arm64\electron.napi.node
        • Size 421KB
        • SHA256 99006146d3f02a3701a254dbf57d10175a2950fa7d85b4dee90b99c997d882da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        node.napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\linux-arm64\node.napi.node
        • Size 421KB
        • SHA256 9a03f9e38254ac721d042561b23842c944db243c3c30fb21f240a577a34c8cb8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        electron.napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-ia32\electron.napi.node
        • Size 619KB
        • SHA256 e73951d1d9f4155cadbeb530be14dd32e1abc4ad9332527507ede586ce41e095
        • MD5 SHA1 SHA512 SSDEEP TLSH

        liblzma.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-ia32\liblzma.dll
        • Size 148KB
        • SHA256 37c4a4277ac066522402c71fd03bea5e8900fefd505ccf9b6399128c92182780
        • MD5 SHA1 SHA512 SSDEEP TLSH

        node.napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-ia32\node.napi.node
        • Size 619KB
        • SHA256 ab5e095b49f13ef86a3dc83f0c11b9bee1fef24a4cf0616b0015d0ebabd443e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        electron.napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-x64\electron.napi.node
        • Size 797KB
        • SHA256 5c7dd24a625d806e37cca949e52ec348ef0054a902e8700f9fdb61cac44e4c9e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        liblzma.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-x64\liblzma.dll
        • Size 147KB
        • SHA256 fc7348418be392d5ecebd7b9f07c1ae5bc530260fef923801b140088eddce96e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        node.napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-x64\node.napi.node
        • Size 796KB
        • SHA256 c738ba03c84330556184b07d4f9a94bb875807834f46c0b49ea42c8e45df714f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        filter-array.cpp

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\src\filter-array.cpp
        • Size 1KB
        • SHA256 0cbca5a1c726cbb06e9f466727cdd2eeabf33588f9b54138eaf14f5e8eb1f988
        • MD5 SHA1 SHA512 TLSH

        index-parser.cpp

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\src\index-parser.cpp
        • Size 15KB
        • SHA256 9fe709a77ab9073a903922a88f242f997985fb62e997e1c876685a67beac54cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        index-parser.h

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\src\index-parser.h
        • Size 7KB
        • SHA256 e3f9760df002dcf558888484cd4eea67b4812b9ea46411d4574e1f1270d7feeb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        liblzma-functions.cpp

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\src\liblzma-functions.cpp
        • Size 2KB
        • SHA256 0061d0cf1cafa5664e456d28156b26b864eb3db973e4d7d66c8e6a00951a5820
        • MD5 SHA1 SHA512 TLSH

        liblzma-node.hpp

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\src\liblzma-node.hpp
        • Size 7KB
        • SHA256 083be435288cabebb7e7d2663e06396327b5d9c58bc0a48ffa1e849aa4bc3998
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lzma-stream.cpp

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\src\lzma-stream.cpp
        • Size 10KB
        • SHA256 62a94542647f30332b4c9d4b26092980a46e056b15037c68a6ad2463beb378d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        module.cpp

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\src\module.cpp
        • Size 5KB
        • SHA256 952f0fe5f1e6421a91f5cfc5f1556d8f88af6072676bed71691c2d1dfe8bbd33
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mt-options.cpp

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\src\mt-options.cpp
        • Size 793B
        • SHA256 955fef2460387cab4f96a45bc03a110bf82e062d1b6f62c524cd037a9835857c
        • MD5 SHA1 SHA512 TLSH

        util.cpp

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\src\util.cpp
        • Size 4KB
        • SHA256 88a6913de83d47fb45ae173d7b61c2545d65cf19707ceaedbc0385bb1ea0301e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\snapshot_blob.bin
        • Size 333KB
        • SHA256 ed719d078977be84118c45420df70a0cc46dd32ae326559c9e6d9a909aeda099
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\v8_context_snapshot.bin
        • Size 698KB
        • SHA256 c321440b5b893fabf4cb983c46c325e6b1959536b7c98a3f1f0200df8ad61a33
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\vk_swiftshader.dll
        • Size 5.4MB
        • SHA256 d50b5ed41356b540e1f1d3525837effd4045220cb4efbfc2b913fd7d7edd0999
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\7z-out\vulkan-1.dll
        • Size 932KB
        • SHA256 35b0d20574fd7f4c8b959e4789cd75950a37cc6106119f89210d086e7f15b47e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UAC.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\UAC.dll
        • Size 14KB
        • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WinShell.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\WinShell.dll
        • Size 3KB
        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
        • MD5 SHA1 SHA512 TLSH

        nsDialogs.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsExec.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\nsExec.dll
        • Size 6KB
        • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz2746.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default.exc

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512

        Preferences

        • Path C:\Users\Admin\AppData\Roaming\NewLauncher\Preferences
        • Size 57B
        • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
        • MD5 SHA1 SHA512 TLSH

        Preferences~RFe5a35e6.TMP

        • Path C:\Users\Admin\AppData\Roaming\NewLauncher\Preferences~RFe5a35e6.TMP
        • Size 93B
        • SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
        • MD5 SHA1 SHA512 TLSH

        CURRENT

        • Path C:\Users\Admin\AppData\Roaming\NewLauncher\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512

        memory/1004-81-0x000000006FCC0000-0x000000006FD0C000-memory.dmp

        memory/1004-84-0x000000006FE20000-0x000000007017B000-memory.dmp

        memory/3208-61-0x0000000073300000-0x0000000073ABC000-memory.dmp

        memory/3208-63-0x0000000073300000-0x0000000073ABC000-memory.dmp

        memory/3208-62-0x0000000073300000-0x0000000073ABC000-memory.dmp

        memory/3208-67-0x000000006FCC0000-0x000000006FD0C000-memory.dmp

        memory/3208-70-0x00000000078B0000-0x0000000007946000-memory.dmp

        memory/3208-71-0x0000000007840000-0x0000000007851000-memory.dmp

        memory/3208-73-0x0000000073300000-0x0000000073ABC000-memory.dmp

        memory/4480-839-0x0000000063CC0000-0x0000000063CEC000-memory.dmp

        memory/4996-51-0x0000000007A20000-0x0000000007A2A000-memory.dmp

        memory/4996-41-0x0000000073300000-0x0000000073ABC000-memory.dmp

        memory/4996-42-0x000000006FCC0000-0x000000006FD0C000-memory.dmp

        memory/4996-39-0x0000000006670000-0x00000000066BC000-memory.dmp

        memory/4996-38-0x00000000062C0000-0x00000000062DE000-memory.dmp

        memory/4996-37-0x0000000006310000-0x000000000666B000-memory.dmp

        memory/4996-36-0x0000000006100000-0x0000000006166000-memory.dmp

        memory/4996-33-0x0000000006090000-0x00000000060F6000-memory.dmp

        memory/4996-32-0x0000000005EC0000-0x0000000005EE2000-memory.dmp

        memory/4996-31-0x0000000073300000-0x0000000073ABC000-memory.dmp

        memory/4996-30-0x0000000005840000-0x0000000005E8A000-memory.dmp

        memory/4996-29-0x0000000073300000-0x0000000073ABC000-memory.dmp

        memory/4996-28-0x00000000051B0000-0x00000000051E6000-memory.dmp

        memory/4996-40-0x0000000006C20000-0x0000000006C56000-memory.dmp

        memory/4996-45-0x0000000006C80000-0x0000000006CA0000-memory.dmp

        memory/4996-46-0x0000000007900000-0x00000000079A3000-memory.dmp

        memory/4996-47-0x0000000073300000-0x0000000073ABC000-memory.dmp

        memory/4996-48-0x0000000073300000-0x0000000073ABC000-memory.dmp

        memory/4996-49-0x0000000008030000-0x00000000086AC000-memory.dmp

        memory/4996-50-0x00000000079B0000-0x00000000079CA000-memory.dmp

        memory/4996-52-0x0000000007BC0000-0x0000000007BEA000-memory.dmp

        memory/4996-53-0x0000000007BF0000-0x0000000007C14000-memory.dmp

        memory/4996-54-0x000000006FE20000-0x000000007017B000-memory.dmp

        memory/4996-56-0x0000000073300000-0x0000000073ABC000-memory.dmp

        memory/4996-27-0x0000000073312000-0x0000000073313000-memory.dmp