Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/08/2026, 16:54

General

  • Target
    Loader.exe
  • Size 142.7MB
  • Sample260811-vem26ahn71
  • SHA256 b09f79c27061e502552d9a1932939c0d790ca2cd628461e762747cb0b65f8395
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 63 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4452
  • C:\Program Files\Loader\Loader.exe
    "C:\Program Files\Loader\Loader.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4512
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "net session"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:824
      • C:\Windows\system32\net.exe
        net session
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2348
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          4⤵
            PID:1500
      • C:\Program Files\Loader\Loader.exe
        "C:\Program Files\Loader\Loader.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Loader" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1696,i,15002228280801051278,18356392060560505861,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3200
      • C:\Program Files\Loader\Loader.exe
        "C:\Program Files\Loader\Loader.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Loader" --mojo-platform-channel-handle=2024 --field-trial-handle=1696,i,15002228280801051278,18356392060560505861,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5924
      • C:\Program Files\Loader\resources\Python313\python.exe
        "C:\Program Files\Loader\resources\Python313\python.exe" "C:\Program Files\Loader\resources\Python313\script.py"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1744
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /F /IM firefox.exe
          3⤵
          • Kills process with taskkill
          PID:6120
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /F /IM chrome.exe
          3⤵
          • Kills process with taskkill
          PID:5100
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /F /IM msedge.exe
          3⤵
          • Kills process with taskkill
          PID:3372
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "taskkill /im Telegram.exe /t /f >nul 2>&1"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2424
          • C:\Windows\system32\taskkill.exe
            taskkill /im Telegram.exe /t /f
            4⤵
            • Kills process with taskkill
            PID:4212
      • C:\Program Files\Loader\Loader.exe
        "C:\Program Files\Loader\Loader.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Loader" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2924 --field-trial-handle=1696,i,15002228280801051278,18356392060560505861,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:5020
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:1268

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            base64.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\__pycache__\base64.cpython-313.pyc
            • Size 25KB
            • SHA256 9c4fe820164bead6cb4ba88f92b18de463ecfa443baf009e5338f91378f3a6e6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            enum.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\__pycache__\enum.cpython-313.pyc
            • Size 83KB
            • SHA256 191d602c826922ea5701c4dbcc97ae2d2c5e548f11c4febe029a466a8203b279
            • MD5 SHA1 SHA512 SSDEEP TLSH

            functools.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\__pycache__\functools.cpython-313.pyc
            • Size 41KB
            • SHA256 b54fd4ba18e9ea8e811b082847dbf03f1943a9f51ec37145fcbc7b2b0548b0c6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            keyword.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\__pycache__\keyword.cpython-313.pyc
            • Size 1KB
            • SHA256 a62b8bef0fe5c28a77b87c3e59d6522042efcf6cb5ea56ef1c44db4aa9084b4e
            • MD5 SHA1 SHA512 TLSH

            operator.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\__pycache__\operator.cpython-313.pyc
            • Size 16KB
            • SHA256 2933dded0a31bfc611cc0f715a2d1e6d470a7b3951e509f1067d2daab282e12d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            reprlib.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\__pycache__\reprlib.cpython-313.pyc
            • Size 10KB
            • SHA256 3b71ddce3132f6997af3be693d6fb8f35b4971a14949b08eff266a0cf15f3047
            • MD5 SHA1 SHA512 SSDEEP TLSH

            types.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\__pycache__\types.cpython-313.pyc
            • Size 15KB
            • SHA256 0491d984b3286c09a17276479eda9b4f3db4ab7b9a724bbfd833c7f3372dc4e1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            base64.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\base64.py
            • Size 21KB
            • SHA256 82a7c36fd4b58f4222e7ddd0f2fb9da39527e72da75ab04270e4734974b717b6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            __init__.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\collections\__init__.py
            • Size 52KB
            • SHA256 122e1b2f545513d280b82df93203726455ff432265da3a888e1dd3767e467ea6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            __init__.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\collections\__pycache__\__init__.cpython-313.pyc
            • Size 71KB
            • SHA256 bcbea0f194d8637e40dc53d2b1e40eed50f9027b5549dfca908115be6c7e00c0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            __init__.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\encodings\__init__.py
            • Size 5KB
            • SHA256 8b997e9f7beef09de01c34ac34191866d3ab25e17164e08f411940b070bc3e74
            • MD5 SHA1 SHA512 SSDEEP TLSH

            __init__.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\encodings\__pycache__\__init__.cpython-313.pyc
            • Size 5KB
            • SHA256 5fd30524cbaed5bbd6fb8c347cb6b8dc565718f1360501d8395573bbb8b36b16
            • MD5 SHA1 SHA512 SSDEEP TLSH

            aliases.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\encodings\__pycache__\aliases.cpython-313.pyc
            • Size 12KB
            • SHA256 e7d56ea5d4068e2adbb012f47ceab92dfa8fde5f7dd2b21b9c547366f06fcfb0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            cp1252.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\encodings\__pycache__\cp1252.cpython-313.pyc
            • Size 3KB
            • SHA256 27aff6d0f35839e81b14d6152eea1548992ecf051d8b23cca462a9576862f6b4
            • MD5 SHA1 SHA512 TLSH

            utf_8.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\encodings\__pycache__\utf_8.cpython-313.pyc
            • Size 2KB
            • SHA256 962cace2c3ecc637028bdec4fa007111087d465be4e311e18b0bdc944356ed2c
            • MD5 SHA1 SHA512 TLSH

            utf_8_sig.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\encodings\__pycache__\utf_8_sig.cpython-313.pyc
            • Size 6KB
            • SHA256 4cbc974ebcba6f84883bb7481f86979de1f3beb6fb1f3c5677a05f32222bf975
            • MD5 SHA1 SHA512 SSDEEP TLSH

            aliases.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\encodings\aliases.py
            • Size 15KB
            • SHA256 486d5a2f3172d22e6d1e6205d807da13d9839a48e96fadbd4071484d16b793f1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            cp1252.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\encodings\cp1252.py
            • Size 13KB
            • SHA256 7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519
            • MD5 SHA1 SHA512 SSDEEP TLSH

            utf_8.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\encodings\utf_8.py
            • Size 1KB
            • SHA256 9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e
            • MD5 SHA1 SHA512 TLSH

            utf_8_sig.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\encodings\utf_8_sig.py
            • Size 4KB
            • SHA256 21a95bb95448f2f064f08aa2c89e843b87a20a5a13c45c6c47c288f2be5219a4
            • MD5 SHA1 SHA512 SSDEEP TLSH

            enum.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\enum.py
            • Size 85KB
            • SHA256 fe74cbb0a33d82fe2acbd38b6a9027c0080504f0b2d10f981026bcefa8c6f975
            • MD5 SHA1 SHA512 SSDEEP TLSH

            functools.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\functools.py
            • Size 39KB
            • SHA256 a1dfaedce47847ee289b7dc654020f0aea88463c03d8065d7d8f892453e864b3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            __init__.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\importlib\__init__.py
            • Size 4KB
            • SHA256 b9db2f9b696913507da9fd83ecfc1f73cf6215d4c5a5cf4b4848688a8c710dc0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            __init__.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\importlib\__pycache__\__init__.cpython-313.pyc
            • Size 4KB
            • SHA256 3528fd5746128f09b1ae07c653df2f606da866f2e4de4d4bac7b524c38c13498
            • MD5 SHA1 SHA512 SSDEEP TLSH

            _abc.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\importlib\__pycache__\_abc.cpython-313.pyc
            • Size 1KB
            • SHA256 3cf2840486fbfefadad4be2896d5901a5a20319c2962d48fbd621b8c1b6ce05b
            • MD5 SHA1 SHA512 TLSH

            _abc.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\importlib\_abc.py
            • Size 1KB
            • SHA256 795157b91862d662ae681c0521daa1311b34b763b955e01505a27c865d848eae
            • MD5 SHA1 SHA512 TLSH

            keyword.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\keyword.py
            • Size 1KB
            • SHA256 1f28f509383273238ad86eda04a96343fa0dc10eeaf3189439959d75cdac0a0b
            • MD5 SHA1 SHA512 TLSH

            operator.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\operator.py
            • Size 11KB
            • SHA256 67913d932dac8b13318940921d45a3f7788d063435abeba40201a620d09014f1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            __init__.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\re\__init__.py
            • Size 17KB
            • SHA256 af6b51360592d5b38a256a19e717061fa2656d80c112fac578b742b4773edd76
            • MD5 SHA1 SHA512 SSDEEP TLSH

            __init__.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\re\__pycache__\__init__.cpython-313.pyc
            • Size 18KB
            • SHA256 a42ff5887a5b4aa50d1486d457c306abf38e841f73be0c5d20309e92a0e2ddf6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            reprlib.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\reprlib.py
            • Size 7KB
            • SHA256 e9116668660ada346d613c10d327fba311705398341441650859468fd657eda3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            hook-PyQt5.Qt3DExtras.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\PyInstaller\hooks\hook-PyQt5.Qt3DExtras.py
            • Size 633B
            • SHA256 5287211c9e7572467fb325c9c9e2ccdbae124d45d1081fd152cbf7a0277a83df
            • MD5 SHA1 SHA512 TLSH

            hook-PyQt6.Qt3DExtras.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\PyInstaller\hooks\hook-PyQt6.Qt3DExtras.py
            • Size 633B
            • SHA256 c7261094df2d79913d890f5e09b515284286ed0edf2a14a16f8b24aecd259476
            • MD5 SHA1 SHA512 TLSH

            hook-PyQt6.QtOpenGLWidgets.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\PyInstaller\hooks\hook-PyQt6.QtOpenGLWidgets.py
            • Size 633B
            • SHA256 d85f6a0f862a219aba0cc2917a09fb0c7bd2e84ab72169016b949189ed7537ea
            • MD5 SHA1 SHA512 TLSH

            hook-PySide2.QtWebEngineWidgets.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\PyInstaller\hooks\hook-PySide2.QtWebEngineWidgets.py
            • Size 633B
            • SHA256 f2fd53d6140e5fd8d20f7cbaac48b07443b2b6aa8d07b17119e8d76d590394c5
            • MD5 SHA1 SHA512 TLSH

            hook-gi.repository.cairo.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\PyInstaller\hooks\pre_safe_import_module\hook-gi.repository.cairo.py
            • Size 783B
            • SHA256 7397fbe0a78f507b7eedf1ffb4941fbaa078e32b184cb6c29bbeaed90541d3b5
            • MD5 SHA1 SHA512 TLSH

            hook-inflect.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\PyInstaller\hooks\pre_safe_import_module\hook-inflect.py
            • Size 924B
            • SHA256 3b9eae501758fe37b78c6a71c16a3fab22870943d95fcd3969d6b0ae3f240411
            • MD5 SHA1 SHA512 TLSH

            __init__.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\PyInstaller\hooks\rthooks\__init__.py
            • Size 2B
            • SHA256 32c4858e22cc2c967b42150fa550562a2c839c2cebcaab91cabdf6f4da020022
            • MD5 SHA1 SHA512

            __init__.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\_distutils_hack\__init__.py
            • Size 6KB
            • SHA256 df81e6bcba34ee3e3952f776551fb669143b9490fdd6c4caeb32609f97e985b4
            • MD5 SHA1 SHA512 SSDEEP TLSH

            __init__.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\_distutils_hack\__pycache__\__init__.cpython-313.pyc
            • Size 10KB
            • SHA256 808be8bb83fd2b655ebf2466647af30f8294c270b31c49e5aa659315e90efec1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            hook-nvidia.cudnn.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\_pyinstaller_hooks_contrib\stdhooks\hook-nvidia.cudnn.py
            • Size 686B
            • SHA256 aef5cf7cc2159968d064c77e77e7d757e9b65e7206e000879583f0064d7c09f3
            • MD5 SHA1 SHA512 TLSH

            hook-timm.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\_pyinstaller_hooks_contrib\stdhooks\hook-timm.py
            • Size 557B
            • SHA256 2f9d3c7a5555edac77de6383908477ceb9029da8628681fb5088e17860330a43
            • MD5 SHA1 SHA512 TLSH

            INSTALLER

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\certifi-2024.12.14.dist-info\INSTALLER
            • Size 4B
            • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
            • MD5 SHA1 SHA512

            QtPositioning.pyi

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\cx_Freeze\importshed\PyQt5\QtPositioning.pyi
            • Size 84B
            • SHA256 32bb8de66110cec3208c4a3525a8398a9271f475938b690fc41440144ae4d658
            • MD5 SHA1 SHA512 TLSH

            QtSql.pyi

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\cx_Freeze\importshed\PyQt5\QtSql.pyi
            • Size 136B
            • SHA256 11fd6263fec201b8a6b97287ba1a13429cee6543811c3f34d476c80864a28819
            • MD5 SHA1 SHA512 TLSH

            QtNfc.pyi

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\cx_Freeze\importshed\PyQt6\QtNfc.pyi
            • Size 145B
            • SHA256 c693498c77916f7324bcc8130f5b125885d0fc1f205863af18baf4576bbc5a84
            • MD5 SHA1 SHA512 TLSH

            QtTest.pyi

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\cx_Freeze\importshed\PyQt6\QtTest.pyi
            • Size 197B
            • SHA256 bc97972a4ca46f8fe6a76d7962c7ef434e65447915abc2171b8259d895531b39
            • MD5 SHA1 SHA512 TLSH

            distutils-precedence.pth

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\distutils-precedence.pth
            • Size 151B
            • SHA256 2638ce9e2500e572a5e0de7faed6661eb569d1b696fcba07b0dd223da5f5d224
            • MD5 SHA1 SHA512 TLSH

            __init__.pyi

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\lief\assembly\riscv\__init__.pyi
            • Size 479KB
            • SHA256 4861bcec2f770ee2cad0140f9a804f0f07fbfc17b83c2716918d4a201e2b922c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            top_level.txt

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\pypiwin32-223.dist-info\top_level.txt
            • Size 1B
            • SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
            • MD5 SHA1 SHA512

            pywin32.pth

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\pywin32.pth
            • Size 185B
            • SHA256 d902584a2a0a5216ce12c712d1378fe07541d32c383d0cc5abcd68412144fe4d
            • MD5 SHA1 SHA512 TLSH

            LICENSE

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE
            • Size 1023B
            • SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
            • MD5 SHA1 SHA512 TLSH

            WHEEL

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL
            • Size 92B
            • SHA256 189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
            • MD5 SHA1 SHA512 TLSH

            WHEEL

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\typing_extensions-4.12.2.dist-info\WHEEL
            • Size 81B
            • SHA256 1196c6921ec87b83e865f450f08d19b8ff5592537f4ef719e83484e546abe33e
            • MD5 SHA1 SHA512 TLSH

            LICENSE

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\websocket_client-1.8.0.dist-info\LICENSE
            • Size 11KB
            • SHA256 453e6a69427ed9ff92a03ef2d7b21ef1db41fdf56d62307a49ba85059f7a0c62
            • MD5 SHA1 SHA512 SSDEEP TLSH

            pywin32_bootstrap.cpython-313.pyc

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\win32\lib\__pycache__\pywin32_bootstrap.cpython-313.pyc
            • Size 1013B
            • SHA256 ac48a8ecc11bf9a7bc48a6f6f807c954dce1404e1db6dabbab41bbf64c112c0d
            • MD5 SHA1 SHA512 TLSH

            pywin32_bootstrap.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\win32\lib\pywin32_bootstrap.py
            • Size 1KB
            • SHA256 5b7a20a3b71615e1d08fdd9b91125ca615295457be54a77713705874772ac289
            • MD5 SHA1 SHA512 TLSH

            __init__.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\win32comext\internet\__init__.py
            • Size 139B
            • SHA256 dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13
            • MD5 SHA1 SHA512 TLSH

            zope.event-5.0-py3.11-nspkg.pth

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\zope.event-5.0-py3.11-nspkg.pth
            • Size 529B
            • SHA256 4961151fe8c45ac298acbd2aa02e86049692b71fe22b11a8018f4f432705542e
            • MD5 SHA1 SHA512 TLSH

            zope.interface-7.2-py3.13-nspkg.pth

            • Path C:\Program Files\Loader\resources\Python313\Lib\site-packages\zope.interface-7.2-py3.13-nspkg.pth
            • Size 458B
            • SHA256 cc3343c0cf21e390e859c01297d9dbb3fcc0e91a94b0b11ac831884e769fd54c
            • MD5 SHA1 SHA512 TLSH

            __init__.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\test\test_importlib\import_\__init__.py
            • Size 147B
            • SHA256 6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225
            • MD5 SHA1 SHA512 TLSH

            __main__.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\test\test_importlib\import_\__main__.py
            • Size 62B
            • SHA256 b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216
            • MD5 SHA1 SHA512 TLSH

            types.py

            • Path C:\Program Files\Loader\resources\Python313\Lib\types.py
            • Size 11KB
            • SHA256 43c5b856f24aa29663331391aec6e5189a6502aabe63c501e0a2db4524ddeebc
            • MD5 SHA1 SHA512 SSDEEP TLSH

            cxfreeze-quickstart.exe

            • Path C:\Program Files\Loader\resources\Python313\Scripts\cxfreeze-quickstart.exe
            • Size 105KB
            • SHA256 c6e2616af150a7fffce3f60d1b02b57c7ae5790983b758dc14083fadb93d23c8
            • MD5 SHA1 SHA512 SSDEEP TLSH

            VCRUNTIME140.dll

            • Path C:\Program Files\Loader\resources\Python313\VCRUNTIME140.dll
            • Size 117KB
            • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
            • MD5 SHA1 SHA512 SSDEEP TLSH

            python.exe

            • Path C:\Program Files\Loader\resources\Python313\python.exe
            • Size 103KB
            • SHA256 03573716a7fcbd8b7fed8fe0163bbfbd3a852546920d6a666123f307c8dac7d9
            • MD5 SHA1 SHA512 SSDEEP TLSH

            python313.dll

            • Path C:\Program Files\Loader\resources\Python313\python313.dll
            • Size 5.8MB
            • SHA256 78b1dd211c0e66a0603df48da2c9b67a915ab3258701b9285d3faa255ed8dc25
            • MD5 SHA1 SHA512 SSDEEP TLSH

            script.py

            • Path C:\Program Files\Loader\resources\Python313\script.py
            • Size 6.5MB
            • SHA256 d266345fea990a115134768b9255c5ac2f47134f4dce362c92b7162949523694
            • MD5 SHA1 SHA512 SSDEEP TLSH

            temp_db

            • Path C:\Program Files\Loader\resources\Python313\temp_db
            • Size 160KB
            • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
            • MD5 SHA1 SHA512 SSDEEP TLSH

            LICENSE.electron.txt

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\LICENSE.electron.txt
            • Size 1KB
            • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
            • MD5 SHA1 SHA512 TLSH

            LICENSES.chromium.html

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\LICENSES.chromium.html
            • Size 6.5MB
            • SHA256 9f3f2b4d9bbd3113486839eca85de119fab766450cdca08a4574b80748885708
            • MD5 SHA1 SHA512 SSDEEP TLSH

            chrome_100_percent.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\chrome_100_percent.pak
            • Size 126KB
            • SHA256 9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            chrome_200_percent.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\chrome_200_percent.pak
            • Size 175KB
            • SHA256 1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            d3dcompiler_47.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\d3dcompiler_47.dll
            • Size 4.7MB
            • SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ffmpeg.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\ffmpeg.dll
            • Size 2.6MB
            • SHA256 aad7e7ac9d74ac18892801950c9728e9c4eacd3b676cbb5d6f63382da2ce0559
            • MD5 SHA1 SHA512 SSDEEP TLSH

            icudtl.dat

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\icudtl.dat
            • Size 10.0MB
            • SHA256 97b978a19edd4746e9a44d9a44bb4bc519e127a203c247837ec0922f573449e3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            libEGL.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\libEGL.dll
            • Size 473KB
            • SHA256 85f238fb7ace3cbdf7c29c72b01307c440f13491b07a509cbc5b9f257a637164
            • MD5 SHA1 SHA512 SSDEEP TLSH

            libGLESv2.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\libGLESv2.dll
            • Size 7.2MB
            • SHA256 25d49934fc220b169cadeb21fc99dc2a8fb1dd5a4f244265799392f0f5f2f8f8
            • MD5 SHA1 SHA512 SSDEEP TLSH

            af.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\af.pak
            • Size 340KB
            • SHA256 d63222c4a20fa9741f5262634cf9751f22fbb4fcd9d3138d7c8d49e0efb57fba
            • MD5 SHA1 SHA512 SSDEEP TLSH

            am.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\am.pak
            • Size 551KB
            • SHA256 55357baf28716a73f79ac9a6af1ae63972eb79f93c415715518027fc5c528504
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ar.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\ar.pak
            • Size 602KB
            • SHA256 e34d5cabaed4634c672591074057c12947bc9e728004228a9e75f87829f4a48a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            bg.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\bg.pak
            • Size 631KB
            • SHA256 fc4a59ea60d04b224765be4916090e97ed8ddda6b136a92a3827ed0fcc64bb0e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            bn.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\bn.pak
            • Size 812KB
            • SHA256 e325d936cd97c3f9ddfca2d87caefb8b6e7465ffa31d0386ae2456b18f7a92da
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ca.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\ca.pak
            • Size 384KB
            • SHA256 e1d6b5fd0bc411f2895eaaa1409916f5ffe39a5c6bd1bafe8af7ce33da5be17d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            cs.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\cs.pak
            • Size 393KB
            • SHA256 936466784a55b965d23b016bc49377655bc5d281d012c8369c0809c961e05c74
            • MD5 SHA1 SHA512 SSDEEP TLSH

            da.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\da.pak
            • Size 356KB
            • SHA256 1b0793b1cbeb6a56ff1e64523c37ba753457320aa29f9718022caa07b4981d8f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            de.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\de.pak
            • Size 381KB
            • SHA256 e0f632ce324951002c80e019dd0169be9f6b0640533fa434cd6ca80f28a1d3f7
            • MD5 SHA1 SHA512 SSDEEP TLSH

            el.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\el.pak
            • Size 691KB
            • SHA256 92403b6160e38746597d4dd7f64d64cf19e30b5e7862901263c39679187b2c91
            • MD5 SHA1 SHA512 SSDEEP TLSH

            en-GB.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\en-GB.pak
            • Size 310KB
            • SHA256 463af7da8418d7fb374ebf690e2aa79ee7cb2acc11c28a67f3ba837cf7a0937b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            en-US.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\en-US.pak
            • Size 313KB
            • SHA256 bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            es-419.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\es-419.pak
            • Size 380KB
            • SHA256 5aff3762747a6e8c6df9f2a3b470bf231b44163006b17ce87e2a03694be27b81
            • MD5 SHA1 SHA512 SSDEEP TLSH

            es.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\es.pak
            • Size 380KB
            • SHA256 267e7b6376e7e5ab806b16fde93bbbcd961bf0c3a7b3a2cabccab37faa9a1d16
            • MD5 SHA1 SHA512 SSDEEP TLSH

            et.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\et.pak
            • Size 342KB
            • SHA256 d984aee4d18ca24a88846b1b6e0294d373733430f30bb4f1b97bc7d50d512c2e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fa.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\fa.pak
            • Size 557KB
            • SHA256 221bbbde078d135f6daca4978a31cc6a82f8f46536467ebc9a0cd322c58a7785
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fi.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\fi.pak
            • Size 351KB
            • SHA256 5339b8ca52500bd0082e0ba5a5f440c5f04733803da47963280479760c7fff2c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fil.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\fil.pak
            • Size 394KB
            • SHA256 4cd3fa70487e894400ad29e3bfbfba3e1c5edd799aab12c62c3aff3c2580ce5e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\fr.pak
            • Size 410KB
            • SHA256 1f6bc09499ee37456968a28b67b81bbf5b9df4f0c6035a388242d2037a3b65a1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            gu.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\gu.pak
            • Size 787KB
            • SHA256 c36a20730d5f2b91cb61b5b2a5912db2ea5a328a9b8abe0fca0af300446d3c20
            • MD5 SHA1 SHA512 SSDEEP TLSH

            he.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\he.pak
            • Size 488KB
            • SHA256 875712bb852c698f677c0c74e088f62d31adb2bce65648fc390607aad8705c45
            • MD5 SHA1 SHA512 SSDEEP TLSH

            hi.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\hi.pak
            • Size 821KB
            • SHA256 1e9623c7407ae8b8a88df3f69a47ae8117f74c4dcb56897bb794a9c38ee5805b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            hr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\hr.pak
            • Size 381KB
            • SHA256 3d7685163c5eb6a11e745ff934312b8681c5f85dfa8d9ea701e9dcaee1e7a285
            • MD5 SHA1 SHA512 SSDEEP TLSH

            hu.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\hu.pak
            • Size 411KB
            • SHA256 3ec43893c6de5ec0f9433841afd5fa9feaaf59ddcef05f7e1cab14dba799887f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            id.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\id.pak
            • Size 336KB
            • SHA256 9210c4c4c33e7ceb5f70005a92a4fd36ca4facdd41701fdc1d2ce638db8adf22
            • MD5 SHA1 SHA512 SSDEEP TLSH

            it.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\it.pak
            • Size 373KB
            • SHA256 c0dc0a4a87f7bb054a30eb1174c3228ea2014bd94668a7d22995b99c4937d817
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ja.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\ja.pak
            • Size 456KB
            • SHA256 3accfd9a1833ddeedb2082fb94101beb59b555c60f42e3070e9e04a372eba84a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            kn.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\kn.pak
            • Size 910KB
            • SHA256 90b2df3338468e84e2cf2f2f67597cba5c3ceb5dba9c59ebd072ec15a70ce741
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ko.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\ko.pak
            • Size 383KB
            • SHA256 b04c1b91cab31054be70cb851dc6716065545445801045daceb96eeee4d2334a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lt.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\lt.pak
            • Size 412KB
            • SHA256 9200a9509bd77834d9912f4ba8f4219d2b9bd2cdad49a11873db30e99b9d1350
            • MD5 SHA1 SHA512 SSDEEP TLSH

            lv.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\lv.pak
            • Size 410KB
            • SHA256 b5a31cbfcb40ad8d911de1618c4eb7e8cc67b97eb8878220f15d40eb014d8ac8
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ml.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\ml.pak
            • Size 948KB
            • SHA256 61a372f170de0a22712be980c3c78b22035ebf40ce79332fab75cdcc4208c9e6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            mr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\mr.pak
            • Size 772KB
            • SHA256 481faf7dd66cf10a476d8b156fb4ea452f920322d8007f7e25d41b2837bdbc09
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ms.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\ms.pak
            • Size 351KB
            • SHA256 fe58cc4f62fc31e32c1fb9a0893a5483391ab6a91b1c92ed4a5e3103a962da7a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            nb.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\nb.pak
            • Size 344KB
            • SHA256 d565c6c95dad89d3f2b7210de4ec3fc437633de4dcfc994fde0704b92bb53ff8
            • MD5 SHA1 SHA512 SSDEEP TLSH

            nl.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\nl.pak
            • Size 356KB
            • SHA256 55413d5eddb3300e0ae0fa5d79d26fdf1e5a12922d7018c8054b1faa9d660301
            • MD5 SHA1 SHA512 SSDEEP TLSH

            pl.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\pl.pak
            • Size 396KB
            • SHA256 53b59486361b11512fb90f15065104b15ee2322bb7804f859cde2f2ecf9581fb
            • MD5 SHA1 SHA512 SSDEEP TLSH

            pt-BR.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\pt-BR.pak
            • Size 374KB
            • SHA256 c9ec3822044365457b8736348cf95a8e39bdfe3ed36267449bf3ed739accef2e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            pt-PT.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\pt-PT.pak
            • Size 376KB
            • SHA256 c89170385b3afb2ec89fbd61b8470ac718713c7296441c8430f173dac218e74b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ro.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\ro.pak
            • Size 387KB
            • SHA256 7247470057a936d03bfa2a8776508ab66aa1040c41a4eb8f79c1e93551c74bb8
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ru.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\ru.pak
            • Size 634KB
            • SHA256 b4223b56ec88235819a427d60bb937eb3984076523f02a018f57819e0429bea9
            • MD5 SHA1 SHA512 SSDEEP TLSH

            sk.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\sk.pak
            • Size 399KB
            • SHA256 75f179897cad221ca6e36b47f53cead7f3fb4159ee196f1d10a5181b84e1b5b7
            • MD5 SHA1 SHA512 SSDEEP TLSH

            sl.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\sl.pak
            • Size 385KB
            • SHA256 6002c129a56558832e9bd260c427c0bd2e1566e0aea3ad999f89c8e479534f9b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            sr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\sr.pak
            • Size 595KB
            • SHA256 524acc64e70918a77cda43fd9b27a727645b28ad2d4cce16b327105101c8bbeb
            • MD5 SHA1 SHA512 SSDEEP TLSH

            sv.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\sv.pak
            • Size 347KB
            • SHA256 3420a1fbcca5bf8c2d65d6dcb0db78b03f95f7f2fc56479a0de6e3312333ce6f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            sw.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\sw.pak
            • Size 365KB
            • SHA256 690027c4a31c4aea00b7d1b32ec6cd3fa50b1eac412ae273ab15e72eb485dd6e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ta.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\ta.pak
            • Size 936KB
            • SHA256 7e818deedd50a533851bbf08e056bf2ad8d45f442a1a61d9b48e66804ea848db
            • MD5 SHA1 SHA512 SSDEEP TLSH

            te.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\te.pak
            • Size 869KB
            • SHA256 d839531c4ff4a2885c993e0d358f78667215b0950c77a06ef01a6acff9221c5b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            th.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\th.pak
            • Size 731KB
            • SHA256 cd80bf232f2f128a3d411f52c8039987559dbc1055f746eed6e0e8478b116dc1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            tr.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\tr.pak
            • Size 371KB
            • SHA256 b22fc7b75c52cc142f201d5cf107d17c1b173a494a6add022127f559fb46bcb0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            uk.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\uk.pak
            • Size 634KB
            • SHA256 28ea88f19b2c34699d535ca0c691449b7e4001c12e8aed8d04b2078916e88a37
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ur.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\ur.pak
            • Size 552KB
            • SHA256 4c7affdcc324cd791d10e235da809ce7501e8005be64340b6e8bf5595647a707
            • MD5 SHA1 SHA512 SSDEEP TLSH

            vi.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\vi.pak
            • Size 439KB
            • SHA256 b75694e390bd2e20780b3bc72f6e1473ba45d7537c27642a7d888dfd3bb6c3bb
            • MD5 SHA1 SHA512 SSDEEP TLSH

            zh-CN.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\zh-CN.pak
            • Size 319KB
            • SHA256 a7ac9fda6f4cd189b75fdadc4b70cd0d369a09b66eaeb5d032678cb97ffc98f6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            zh-TW.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\locales\zh-TW.pak
            • Size 316KB
            • SHA256 c5061ec00bd969f76f3c0c6ff15ddacafed7491260bd8ced78118691ba57bdff
            • MD5 SHA1 SHA512 SSDEEP TLSH

            resources.pak

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\resources.pak
            • Size 5.1MB
            • SHA256 4f29587bcd952de1dbc0b98df0aa506bd9fcf447e6a7258c5eb7e9eb780e6d6c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            app.asar

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\resources\app.asar
            • Size 120KB
            • SHA256 560d51b6997ab2e02d84acdd914142b72406e78ee530a7a964d6d1a96b6205db
            • MD5 SHA1 SHA512 SSDEEP TLSH

            elevate.exe

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\resources\elevate.exe
            • Size 105KB
            • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
            • MD5 SHA1 SHA512 SSDEEP TLSH

            snapshot_blob.bin

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\snapshot_blob.bin
            • Size 168KB
            • SHA256 8613412ebcf462373d4d50f5729f5b9a61ef2b5c599b267f750276c8e29caf25
            • MD5 SHA1 SHA512 SSDEEP TLSH

            v8_context_snapshot.bin

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\v8_context_snapshot.bin
            • Size 471KB
            • SHA256 add78f3f85f0b173cbe917871821f74c5afe0a6562462762b181180d16df4470
            • MD5 SHA1 SHA512 SSDEEP TLSH

            vk_swiftshader.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\vk_swiftshader.dll
            • Size 4.9MB
            • SHA256 a32c3fbbf74699a10e7642bf4901191f29c88c5aec93ae7ba28c79ab28462a69
            • MD5 SHA1 SHA512 SSDEEP TLSH

            vk_swiftshader_icd.json

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\vk_swiftshader_icd.json
            • Size 106B
            • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
            • MD5 SHA1 SHA512 TLSH

            vulkan-1.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\7z-out\vulkan-1.dll
            • Size 894KB
            • SHA256 1f8b647f161f20d45d554e349b3e5ef0b7b5da8c7bdbc1ff631d37dc9c819503
            • MD5 SHA1 SHA512 SSDEEP TLSH

            SpiderBanner.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\SpiderBanner.dll
            • Size 9KB
            • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
            • MD5 SHA1 SHA512 SSDEEP TLSH

            StdUtils.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\StdUtils.dll
            • Size 100KB
            • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            System.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\System.dll
            • Size 12KB
            • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
            • MD5 SHA1 SHA512 SSDEEP TLSH

            WinShell.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\WinShell.dll
            • Size 3KB
            • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
            • MD5 SHA1 SHA512 TLSH

            nsis7z.dll

            • Path C:\Users\Admin\AppData\Local\Temp\nsq9D8F.tmp\nsis7z.dll
            • Size 424KB
            • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
            • MD5 SHA1 SHA512 SSDEEP TLSH

            memory/3200-1150-0x0000024767130000-0x00000247671D7000-memory.dmp

            memory/3200-410-0x00007FF848A10000-0x00007FF848A11000-memory.dmp

            memory/5020-13953-0x000001BE51E50000-0x000001BE51E51000-memory.dmp

            memory/5020-13955-0x000001BE51E50000-0x000001BE51E51000-memory.dmp

            memory/5020-13959-0x000001BE51E50000-0x000001BE51E51000-memory.dmp

            memory/5020-13964-0x000001BE51E50000-0x000001BE51E51000-memory.dmp

            memory/5020-13961-0x000001BE51E50000-0x000001BE51E51000-memory.dmp

            memory/5020-13962-0x000001BE51E50000-0x000001BE51E51000-memory.dmp

            memory/5020-13963-0x000001BE51E50000-0x000001BE51E51000-memory.dmp

            memory/5020-13960-0x000001BE51E50000-0x000001BE51E51000-memory.dmp