Analysis

  • user interaction
    yes
  • max time kernel
    67s
  • max time network
    75s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 22:39

General

  • Target
    VelxsLibModder-0.1.0-portable.exe
  • Size 85.4MB
  • Sample260809-2k5mqacg59
  • SHA256 de405207f9bfa505628c5a7fc623b0ee12623ce8cdd3a745be5675f239766bc1
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VelxsLibModder-0.1.0-portable.exe
    "C:\Users\Admin\AppData\Local\Temp\VelxsLibModder-0.1.0-portable.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5024
    • C:\Users\Admin\AppData\Local\Temp\3HbZ8D2c8BqMndKm5jryZ7ScAUc\Velxs Lib Modder.exe
      "C:\Users\Admin\AppData\Local\Temp\3HbZ8D2c8BqMndKm5jryZ7ScAUc\Velxs Lib Modder.exe"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\3HbZ8D2c8BqMndKm5jryZ7ScAUc\Velxs Lib Modder.exe
        "C:\Users\Admin\AppData\Local\Temp\3HbZ8D2c8BqMndKm5jryZ7ScAUc\Velxs Lib Modder.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\velxslibmodder" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1840,i,17319801432769388926,8668616586350176108,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,7178289404999390573,18397455487264933883,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1832 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5472
      • C:\Users\Admin\AppData\Local\Temp\3HbZ8D2c8BqMndKm5jryZ7ScAUc\Velxs Lib Modder.exe
        "C:\Users\Admin\AppData\Local\Temp\3HbZ8D2c8BqMndKm5jryZ7ScAUc\Velxs Lib Modder.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\velxslibmodder" --field-trial-handle=1840,i,17319801432769388926,8668616586350176108,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,7178289404999390573,18397455487264933883,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1948 /prefetch:11
        3⤵
        • Executes dropped EXE
        PID:1600
      • C:\Users\Admin\AppData\Local\Temp\3HbZ8D2c8BqMndKm5jryZ7ScAUc\Velxs Lib Modder.exe
        "C:\Users\Admin\AppData\Local\Temp\3HbZ8D2c8BqMndKm5jryZ7ScAUc\Velxs Lib Modder.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\velxslibmodder" --app-path="C:\Users\Admin\AppData\Local\Temp\3HbZ8D2c8BqMndKm5jryZ7ScAUc\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1840,i,17319801432769388926,8668616586350176108,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,7178289404999390573,18397455487264933883,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2500 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4772

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\LICENSES.chromium.html
        • Size 19.4MB
        • SHA256 b911161e6594ec76b872498b423c54406168f2974e0d407a847f7de1e5ff94dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\chrome_100_percent.pak
        • Size 117KB
        • SHA256 d76fe8fa3a14cd73e4c858746e2ab2d2fa6f2df38a906fa5814b50a8a895fc96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\chrome_200_percent.pak
        • Size 192KB
        • SHA256 b74ad439f3d3762657f3ba533a6af3ac63315c838ed46519891366f43d834a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.5MB
        • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxcompiler.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\dxcompiler.dll
        • Size 24.4MB
        • SHA256 41004dbf82da5dd2f70c92defe2f0e0fce030daf85c072bd7922917ec90a6c28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxil.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\dxil.dll
        • Size 1.4MB
        • SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\ffmpeg.dll
        • Size 2.9MB
        • SHA256 d17c2a0ea5683ff02006676845b84ef2afe18b8f75a5fdcce2b364f85c37a34e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\icudtl.dat
        • Size 10.4MB
        • SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\libEGL.dll
        • Size 463KB
        • SHA256 7d6f4957a6c4d4cad4d717ebebbc9738acf4bfdf2d4ea1c0403d2c9a0661dc5d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\libGLESv2.dll
        • Size 7.7MB
        • SHA256 5d6c94812ca1f6dc414d6166da1ed95e4f072a151c7e16952b0fd9a450192d8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\af.pak
        • Size 599KB
        • SHA256 dcf39c3edbb6b0a625baee0263a9b426eadd1a6d1bfbf03a209501a18bc4b0e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\am.pak
        • Size 971KB
        • SHA256 b1d444f2346105a6e15f9b14fc5653e1edaa2b435290fb8f1238347a4d4ca8f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\ar.pak
        • Size 1.0MB
        • SHA256 36f46452c3becb64e1034a6e69286cb5e91f98593c81511c79176f1cc560e159
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\bg.pak
        • Size 1.1MB
        • SHA256 e4a5bea23a26a06af611a7cb518b22a1d53ec5df45a6322f0e264b99c7318441
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\bn.pak
        • Size 1.4MB
        • SHA256 137cf9cdba13ea7286584c5cac05dd34c6394f89036e367aa032ffb34f17dcc9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\ca.pak
        • Size 676KB
        • SHA256 94b2082cc585cc7f0e18839664683d97b45f9c15d0b027ba789902100fb029aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\cs.pak
        • Size 701KB
        • SHA256 5804ba5b76974b48b15922cf91c3e9dbbf549e2d88218dc767e4650520503135
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\da.pak
        • Size 629KB
        • SHA256 57f4637094de41122da569415c16c5524794bc90aa3af226da14703d04981db0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\de.pak
        • Size 677KB
        • SHA256 9b3218eebd6e5bfdfcc50436ff0cef02b92fb9454c4bc9f78093408651e325d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\el.pak
        • Size 1.2MB
        • SHA256 a687e7166636cc78afb903429c7b62aed48fe4a1e20057d5dd192e7806721d52
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\en-GB.pak
        • Size 546KB
        • SHA256 df40bcaed92ac89c6eb379a4053f9f44cd466f7e51268367f8d72e9508143a88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\en-US.pak
        • Size 552KB
        • SHA256 74404352908184e834397df60b238f23462e77d69ac4136b4f20af2db6191436
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\es-419.pak
        • Size 667KB
        • SHA256 55a36991fa1e523fcdbc49e4227d66bb83d28bfdc7d08dcc659837d1beda3281
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\es.pak
        • Size 663KB
        • SHA256 9ff88eabacab95f8bbef9e95f63d3619fa8d640ec03523d80abb26243b059a65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\et.pak
        • Size 605KB
        • SHA256 0292298736847491828465a3dcf04cf4a0d9bd63d4b1a9d183c7eeb389343d26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\fa.pak
        • Size 1002KB
        • SHA256 59a08aad82255e6574e187cf39bfe2523dcbe5cc27421711ccc42c45ad00da4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\fi.pak
        • Size 617KB
        • SHA256 0535e2acd4517ce8099aa0a4a3e562af37ca6a699faca1de3b348b8bfacf2a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\fil.pak
        • Size 698KB
        • SHA256 f9e86324deee168d160a51402588da9987646c8c5899b76b6255d7e3a46a7bb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\fr.pak
        • Size 721KB
        • SHA256 c2c7639ebdd3f50779ded050ac94c24773bf5e348984ff7ce53f0b386b2eec27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\gu.pak
        • Size 1.4MB
        • SHA256 34e4d54d66a0b0471542ee76c55cc9d3b27fcaf15cdf63c3d7e7b46cfdfb3f4f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\he.pak
        • Size 877KB
        • SHA256 f149893ec79d46937ccaaacefa2bea4179c79f45b4ddb4d215d7e7756b4101cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\hi.pak
        • Size 1.5MB
        • SHA256 57432f987cd26251065245e62b9ec47c1a90bd6ab2f2c4227c3c9becca3994f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\hr.pak
        • Size 674KB
        • SHA256 9ef77921560c91e5d6e42df6504589b8b7efb84c9b5119ac51e9a10d8c83a089
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\hu.pak
        • Size 721KB
        • SHA256 31e407f43bbd0cd0692755f961bb39d10af1f9f0af205455dd70fb4c7eeb85a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\id.pak
        • Size 598KB
        • SHA256 e7957c9c58f890b5d053ea50c5fcb4b66cbc3c47478c42a5962810cb15814249
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\it.pak
        • Size 653KB
        • SHA256 88220058e902f05d7a2e61ec21667a5ca44c543ad0042fe530d698aa55836aa4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\ja.pak
        • Size 796KB
        • SHA256 916884da7606a990aceb82c0cd4b3480c054e5d0562684df40767310ba9d4dab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\kn.pak
        • Size 1.6MB
        • SHA256 9744dbadbb7c31cc6393a0682daf91045be270bab934dff7dbad79b76287616e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\ko.pak
        • Size 677KB
        • SHA256 ee01af13e4e4b804e48d7126a38a059e210c7f4fba0c37fd2dfa9ef4c106b9d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\lt.pak
        • Size 734KB
        • SHA256 bc5d99751f1b252ed074bfc4bf6dc94321b3f785a0a0d4300209acae40220f74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\lv.pak
        • Size 731KB
        • SHA256 4a47f56c40b16b261cb8bf29a0b16be9638a88b8a5df4d8bb1d13c39271e2b58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\ml.pak
        • Size 1.6MB
        • SHA256 a45bcebcf69244bdbca6c0a4fe68c89430c6531e9d3cbddaa85758385b877934
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\mr.pak
        • Size 1.3MB
        • SHA256 fa87d519a8545b2748c52ccd7704b320877b2d03385991ceabe75c2745200331
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\ms.pak
        • Size 629KB
        • SHA256 2ab44645c1ed7b68c9121ee0ab9cdf8c7b9d1721d131b08f258b8a85b8ed0af0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\nb.pak
        • Size 601KB
        • SHA256 8eaa23c418a3fafb9e85b5445e73fb2f5e13be1f033ff2487c4081148aaa2f4e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\nl.pak
        • Size 627KB
        • SHA256 43a15f2dfda6ce1c908e9913eb02aba9602e3f24c6c96f7fed7852d61a1263f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\pl.pak
        • Size 700KB
        • SHA256 5e47475490d1514e3670c44f55a2061672c8e7f6219211b3d907bacbe5aa0a5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\pt-BR.pak
        • Size 657KB
        • SHA256 2c48cfad589795774dc2dbd5d7717f8695f3c02d85acc0076ad7a02666e60968
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\pt-PT.pak
        • Size 661KB
        • SHA256 e613f2149cb23de02296e8524981d594cd1bac34360d83bc1682ff37eccc55c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\ro.pak
        • Size 686KB
        • SHA256 909fadc1bb8b1bda780d182b823a98fd3b8f9fa362bffc95b3ebf2b270ad0698
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\ru.pak
        • Size 1.1MB
        • SHA256 b0977b6a115c6836189200423b44202c1329ff702b68ab9a72f996fe42c6ec81
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\sk.pak
        • Size 713KB
        • SHA256 9a2b0ed5cf2e1c8e1d18abc136af82867469a2503b76e3a9f848ee723b7a0102
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\sl.pak
        • Size 682KB
        • SHA256 2bc385d457dc844794f9396458c4090e6233afec5a08b4a5a92e45ef31e07b78
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\sr.pak
        • Size 1.0MB
        • SHA256 aa3a70c23a149e1ef9fea6db95d5cc0084a85477bd772f6d0629601f35f0e65e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\sv.pak
        • Size 609KB
        • SHA256 3af85c15ce3e76344404c37325a60932ce53763539c8cd8b3120424f709f73de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\sw.pak
        • Size 645KB
        • SHA256 a806d782b21930ec6243b8e5b393e7fa970ce9d297e96b02e6596fa6ce6c8a86
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\ta.pak
        • Size 1.6MB
        • SHA256 516660683214c01341300fa8d15c7e39aecc38792b76fe74bdcc464024f4294f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\te.pak
        • Size 1.5MB
        • SHA256 24e355a0b67eb09e93ee8caffbe34246dad42e526e6bd4877149c5068ab03ed7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\th.pak
        • Size 1.3MB
        • SHA256 946b4a45a9d43b15359927f33307fc35f50d7e880f02890b07bdfd1160f2db59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\tr.pak
        • Size 656KB
        • SHA256 37619e7084337a839d8ccf7915381cf9975d0ffc9451bd37d210bc7322645219
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\uk.pak
        • Size 1.1MB
        • SHA256 6b58314224303e7338c44c2014259c56894bfffe22de46eca6cae1bff4edcfae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\ur.pak
        • Size 986KB
        • SHA256 d57cd219249e207d34c21a619935d0f0a7814a0ccdd36051a42400c60a599e47
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\vi.pak
        • Size 781KB
        • SHA256 37f2c01a308ad8bb93d9525d81480880f97d54191dbe7c1c1e75aa9fcf009450
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\zh-CN.pak
        • Size 558KB
        • SHA256 0386ef8bf3ce4e24c604ee039273e452d12f8b1d6e5ac7e746995e8b39fab379
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\locales\zh-TW.pak
        • Size 551KB
        • SHA256 740c2da1eedff44b57d8700b6f81f1acf17e67bdf534220553b448da42f62b66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\resources.pak
        • Size 6.8MB
        • SHA256 77f82c006ca57145a385188e67f06c8a1136c0d86de10dc5889f0dbd6117b061
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app.asar

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\resources\app.asar
        • Size 240KB
        • SHA256 21a2ebbfc93641d629a7213951430fe02bbc21c528d11c76dc47d8acc7bf57ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\snapshot_blob.bin
        • Size 356KB
        • SHA256 01e68a60b8838be376b202607defadaabdb61b5907dc6caf2cfaf8e915229532
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\v8_context_snapshot.bin
        • Size 722KB
        • SHA256 8b01d2eb0fc5324e0ff3879a30efca0eb7f5dfe35f829721aebc98b0bffbb4c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\vk_swiftshader.dll
        • Size 5.2MB
        • SHA256 a0f117801db7c874cafca765aac0eddc4e07f422af5a38d6e673635ac5bb8a75
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\7z-out\vulkan-1.dll
        • Size 908KB
        • SHA256 58349de6c50157aa78500d383910dbc7b40a8a4a022aff9cc3eeef8915c9b3ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsj4D9A.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default.exc

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512

        data_0

        • Path C:\Users\Admin\AppData\Roaming\velxslibmodder\GPUCache\data_0
        • Size 8KB
        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
        • MD5 SHA1 SHA512 SSDEEP

        data_1

        • Path C:\Users\Admin\AppData\Roaming\velxslibmodder\GPUCache\data_1
        • Size 264KB
        • SHA256 ddbb4b860416fa4f40abd89e7ee0661fc1b49bf7b1215369ff3c96abc1db2b19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        data_2

        • Path C:\Users\Admin\AppData\Roaming\velxslibmodder\GPUCache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP

        data_3

        • Path C:\Users\Admin\AppData\Roaming\velxslibmodder\GPUCache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP

        Network Persistent State

        • Path C:\Users\Admin\AppData\Roaming\velxslibmodder\Network\Network Persistent State
        • Size 111B
        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
        • MD5 SHA1 SHA512 TLSH

        dbe754a0-be34-4f03-bb33-176d6ec4b1af.tmp

        • Path C:\Users\Admin\AppData\Roaming\velxslibmodder\Network\dbe754a0-be34-4f03-bb33-176d6ec4b1af.tmp
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH

        CURRENT

        • Path C:\Users\Admin\AppData\Roaming\velxslibmodder\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512

        MANIFEST-000001

        • Path C:\Users\Admin\AppData\Roaming\velxslibmodder\Session Storage\MANIFEST-000001
        • Size 41B
        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
        • MD5 SHA1 SHA512