Overview

overview

8

Static

static

3

stats.cc-i...er.exe

windows10-2004-x64

8

stats.cc-i...er.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-ltsc_2024-x64

3

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

3

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-ltsc_2024-x64

3

stats.cc.exe

windows10-2004-x64

8

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-ltsc_2024-x64

3

$R0/Uninst...cc.exe

windows10-2004-x64

5

$R0/Uninst...cc.exe

windows11-ltsc_2024-x64

5

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    166s
  • max time network
    175s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/08/2026, 08:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    stats.cc-installer.exe
  • Size 82.4MB
  • Sample260812-knh5fszthy
  • SHA256 01022dba96ebdce7cb7e3316383af447e76dc8ae93d9c6bf36b742efe9688292
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell to get system information.

    execution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 8 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Loads dropped DLL 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 7 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\stats.cc-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\stats.cc-installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2324
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2380
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\stats.cc', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2964
  • C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe
    "C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5748
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1296
      • C:\Windows\system32\chcp.com
        chcp
        3⤵
          PID:3732
      • C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe
        "C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\stats.cc" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1936,i,10381697851147824387,9996867996697917968,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3860
      • C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe
        "C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\stats.cc" --field-trial-handle=2208,i,10381697851147824387,9996867996697917968,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5012
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4232
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5576
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4368
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4184
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4332
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4892
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6092
      • C:\Windows\system32\reg.exe
        C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v stats.cc /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe\"" /f
        2⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:1188
      • C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe
        "C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\stats.cc" --app-path="C:\Users\Admin\AppData\Local\Programs\stats.cc\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3460,i,10381697851147824387,9996867996697917968,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3456 --overlayed-runtime="{\"userId\":\"8e8af825-4562-4ddd-9fcc-c9dfc4f3beaa\"}" /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1048
      • C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe
        "C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\stats.cc" --app-path="C:\Users\Admin\AppData\Local\Programs\stats.cc\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2848,i,10381697851147824387,9996867996697917968,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3800 --overlayed-runtime="{\"userId\":\"8e8af825-4562-4ddd-9fcc-c9dfc4f3beaa\"}" /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4832
    • C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe
      "C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5824
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1736
        • C:\Windows\system32\chcp.com
          chcp
          3⤵
            PID:3352
        • C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe
          "C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\stats.cc" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2364,i,13016962634088999242,15887439200488163517,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4224
        • C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe
          "C:\Users\Admin\AppData\Local\Programs\stats.cc\stats.cc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\stats.cc" --field-trial-handle=2516,i,13016962634088999242,15887439200488163517,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1596 /prefetch:11
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3724

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 17KB
            • SHA256 e8d97f776db99865c95e0e13ef4728320e5ce202a56a89447e933c53e5722aec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 18KB
            • SHA256 831fe3418f9db35c74402c414471dad321817d40a23df27087094343a0b971af
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 f4767bed3bbc844ed024fbe749b5f2390cffdaf9cf6e7185c1fe39e565be8ba7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 16KB
            • SHA256 6df9341c732abf0a2e56ad09c2c86036a50c303dd8e218d0032c00c1172c8bf9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 21bd18717e30ec05c9c6b239b27697404c75c3491a193d2de3168c126328c492
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            6d39193c-01c4-4c52-849d-c6b926ecc55f.tmp.node
            • Path C:\Users\Admin\AppData\Local\Temp\6d39193c-01c4-4c52-849d-c6b926ecc55f.tmp.node
            • Size 1.6MB
            • SHA256 78d9def3b64adc919c5abcff78e3a3615766e1d6c27348c36e37c4a55d3bda0b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            94a13760-c14c-42e4-8f7f-895da5d112e0.tmp.node
            • Path C:\Users\Admin\AppData\Local\Temp\94a13760-c14c-42e4-8f7f-895da5d112e0.tmp.node
            • Size 1.0MB
            • SHA256 fb2a32767fe107e94aee80e2f29b7bff74ccfcdf9f31333b9fe33febfaa93db3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_tsl0x3dl.u1e.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tsl0x3dl.u1e.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            a4974e5a-dd77-4006-89e4-d32866239953.tmp.node
            • Path C:\Users\Admin\AppData\Local\Temp\a4974e5a-dd77-4006-89e4-d32866239953.tmp.node
            • Size 1.2MB
            • SHA256 17097df08617616d48d54424fd9cc47836881c280270e75ac37af32df4c7a041
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LICENSE.electron.txt
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\LICENSE.electron.txt
            • Size 1KB
            • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            LICENSES.chromium.html
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\LICENSES.chromium.html
            • Size 8.7MB
            • SHA256 84eba87e0ac3a3b3bb09a1fc184823af3d5bed105aaa4894d223fa863b7ec935
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_100_percent.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\chrome_100_percent.pak
            • Size 148KB
            • SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_200_percent.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\chrome_200_percent.pak
            • Size 223KB
            • SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            d3dcompiler_47.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\d3dcompiler_47.dll
            • Size 4.7MB
            • SHA256 8d1639ee1be7b4cf8b99afbc0dda4167e67029d016c4514410e0cee0ab0ade1c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ffmpeg.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\ffmpeg.dll
            • Size 2.8MB
            • SHA256 256400ecf84c97824493becea95888af70ab1f2dd2747354d24b2c2308b90b51
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icudtl.dat
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\icudtl.dat
            • Size 10.0MB
            • SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libEGL.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\libEGL.dll
            • Size 504KB
            • SHA256 d07fa3eb9daca2b6cec748f26c6ddf0360a5d3f02b3f93d8e84e7920d14a381d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libGLESv2.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\libGLESv2.dll
            • Size 8.1MB
            • SHA256 91218528bf93522d9bec3ffc33ccb67ec44287f46e59b547f3fe8bb776a07f29
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            af.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\af.pak
            • Size 520KB
            • SHA256 c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            am.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\am.pak
            • Size 840KB
            • SHA256 49a2095ad9ffac0b7ffaadba64d2c2b51a05e0695e21d1c428735485757bd11c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ar.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\ar.pak
            • Size 921KB
            • SHA256 50856eefd9b5ec8f6cbe899343870f0a0275020378ad32ede8489ea1f0eb1386
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bg.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\bg.pak
            • Size 959KB
            • SHA256 f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bn.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\bn.pak
            • Size 1.2MB
            • SHA256 5a57265ebac6df683f0279684909755ad71ea70fea71c6ecc1810eac61d1cb3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ca.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\ca.pak
            • Size 584KB
            • SHA256 06809011053b482b4830517039057c65021783129cc90b20857141d4f37ce9bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cs.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\cs.pak
            • Size 602KB
            • SHA256 c34d78191d030688f77b446d39ede5e5cf01f548bc0c4304b4e9960e17d0764e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            da.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\da.pak
            • Size 545KB
            • SHA256 e71730c1bfb469f327212f7488c7674e66a59f857a4bdbb8c7736765215e5ffb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            de.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\de.pak
            • Size 582KB
            • SHA256 be0d49be3b021c0a4d917ad437d8ed817d676c40bca4fc08f2f9a8b2cbe67fc3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            el.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\el.pak
            • Size 1.0MB
            • SHA256 b8707f2511c4ec5533077009771f3aa92b0fb5b395b13907f5860a9151b2431d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-GB.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\en-GB.pak
            • Size 474KB
            • SHA256 628113c44412776b616755feb7b5eb23a097be3a537f3b4f6be99df7559cb663
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-US.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\en-US.pak
            • Size 478KB
            • SHA256 75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            es-419.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\es-419.pak
            • Size 575KB
            • SHA256 0ee595ac6814586b46101e854d01ce6b1076092b07aa2564d6c8adb5d7a082e6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            es.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\es.pak
            • Size 575KB
            • SHA256 ca33ec56edc38c3af6b42d4cc3ba2a4b2d9ec941de83f9b6c263ddbbe98705ea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            et.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\et.pak
            • Size 523KB
            • SHA256 9645d7cd33602006b0ffe3750c05b668e9eac1d49a609093d6b7cc13c519fd3a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fa.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\fa.pak
            • Size 855KB
            • SHA256 d789039e2fddaf1112f02c284d869ed340bf68043962b9ec0651c91102ebcbc0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fi.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\fi.pak
            • Size 534KB
            • SHA256 8d62395944362d437fc1bd7810d8fd037afcc2f94f56bfaee4368350c189c106
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fil.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\fil.pak
            • Size 604KB
            • SHA256 9b69d82f50c159d1ec5603ef45dc139143b4f05761f38f263a66fffedd28ff5e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\fr.pak
            • Size 622KB
            • SHA256 83aa713743c61dba4fafb0b6a66ad2a9eeb8862affe444655b9cbb589d0d88d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gu.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\gu.pak
            • Size 1.2MB
            • SHA256 1adaaacf2f9ab872fb35932fd1ed3b005f370f0ec22b95b42039b4c58660675c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            he.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\he.pak
            • Size 751KB
            • SHA256 0a7ea1ca91b012477c35c8007d40158ad079ed2892e9bbb14c2721572af03762
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hi.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\hi.pak
            • Size 1.3MB
            • SHA256 f73ccac3debba20fb225209805ff2383609853111f931e6b82095c1eb56a6ce4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\hr.pak
            • Size 581KB
            • SHA256 4afc620ec483fd5bf38277055d5292a2855f16cd9d5071fd35754ae6dd9b1ef1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hu.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\hu.pak
            • Size 625KB
            • SHA256 ec81ac981af0e962654ad4f65030064a6369dc2316cb1b10bb24b473808ad1e9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            id.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\id.pak
            • Size 516KB
            • SHA256 429545a9dfef1d88edbae8b9468ceebaa4cea00e4c92e53d0e8512f2eaf855be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            it.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\it.pak
            • Size 567KB
            • SHA256 50ea6b6d021dd43eeb27f63cde8d1e81825430968f9bcb7dcb5065ac6b809e48
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ja.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\ja.pak
            • Size 691KB
            • SHA256 667205ae05da874c462edd80a41a74b5a9a71633c9249dbb63b281256f7b8e28
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            kn.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\kn.pak
            • Size 1.4MB
            • SHA256 64036ae42e441a0d5e24e3596dff0e772e62a055e8a12091c8d9f179481d1602
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ko.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\ko.pak
            • Size 585KB
            • SHA256 1af8aeac229711e127844a71cabcafb29fc752d3d8401f42cd120fce3084744b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            lt.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\lt.pak
            • Size 629KB
            • SHA256 9fe73d75dd155d0bda60a638b8f8d48048d17fadfd2d746bac597e5ac3b7f6dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            lv.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\lv.pak
            • Size 628KB
            • SHA256 6fdd062d6bd6e880f7cd2e1a5ceda57e00d6d5e3e5b0b54621b44df4ffb0fb6f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ml.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\ml.pak
            • Size 1.4MB
            • SHA256 01b8451504a151efca188b43e4f1265fb81c69a8d7b7a98d107896608bc57734
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\mr.pak
            • Size 1.2MB
            • SHA256 7181c3bc7a369d2d0b8ae6c1cf8f160603ec56996d20b266833edc3acce4c78e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ms.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\ms.pak
            • Size 541KB
            • SHA256 6a3ced7828f0608297da29c99832a389ec9d0d03060ddb20304cd081be494adb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nb.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\nb.pak
            • Size 525KB
            • SHA256 697882ac2da78894e449cb1f75da43e7115c2481bbd2fee3bdaa425e82fc232c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nl.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\nl.pak
            • Size 543KB
            • SHA256 41ae88508d9d01173276517ad21003e132b1778fa629be14cf0d27031ba3e5b2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pl.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\pl.pak
            • Size 604KB
            • SHA256 cf2c44ff41be15f86ed3f6f3683871437a7faed09ade2aac85fad9370c389a89
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pt-BR.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\pt-BR.pak
            • Size 568KB
            • SHA256 5a496e969e72eebbd4d4757923c8c47f15ca3aff2a5f9cd3147ff9fdf7f9baa3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pt-PT.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\pt-PT.pak
            • Size 571KB
            • SHA256 9ebafb943bf20c66f8d9ca533633fdc63519e8ad38d78a3dd28b4457c38ba79d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ro.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\ro.pak
            • Size 592KB
            • SHA256 cf59cd7c26cfe3d87ed2b3a2ef254c3a3667824bbf06cd591bfc9dbf2a83ab91
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ru.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\ru.pak
            • Size 972KB
            • SHA256 74d0105e1336e36ca0c685c7f6bd3675dec9b0934c8eda4378897b1bdf335dc1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sk.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\sk.pak
            • Size 611KB
            • SHA256 d878e9c2c14ebdece240c38d82c03ec3936525225b89e65f05dff810d4a106d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sl.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\sl.pak
            • Size 587KB
            • SHA256 2142b2c2dec86fc3b2d5ea490fb6a392f659e46cad560e2f9a4be9c448d91c0e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\sr.pak
            • Size 903KB
            • SHA256 10a29c3d8b7d1c3ffe6fe7735f1a841e46b845da854765f3b18508f0fe0d426e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sv.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\sv.pak
            • Size 528KB
            • SHA256 d8b9fa3f5fefdd71214f58ea66267a65b61e14e6802c04eceb5b3ebbe4157aa4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sw.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\sw.pak
            • Size 557KB
            • SHA256 434879a83079fba562af9dac928ad2fcc1033e0a6a5a1f4822d36e710decdd2b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ta.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\ta.pak
            • Size 1.4MB
            • SHA256 0e1d7c0fa1eab312b42ff5e8978b7146d6cac313603fcaf101bef2eedc70313b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            te.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\te.pak
            • Size 1.3MB
            • SHA256 1faa8cb780908552f3ca0d2b0e20eb6aaa902cb5bd759c18ed1238beb0bb34dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            th.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\th.pak
            • Size 1.1MB
            • SHA256 3884d89d4b3fda41fa08c9f29c45a3a947d80cdf5936c2b21481be336a8748db
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tr.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\tr.pak
            • Size 567KB
            • SHA256 f2ca71fed0f1c1d8f081adf740e5a04927890ff35dccde1fb2253479b927f93f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            uk.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\uk.pak
            • Size 972KB
            • SHA256 bfdc151dea6f00724db4efb758ed1cbfe7230dd59fe9bd851da1d4a67c674914
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ur.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\ur.pak
            • Size 850KB
            • SHA256 1929f3c85e550ccca9985cef47be30b690a701cbca70345baa0c2aaee99809f6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vi.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\vi.pak
            • Size 673KB
            • SHA256 107e10a8cab39630e1d606e473ae7adf5361baa6d3ba7257306a521bbf0188aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zh-CN.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\zh-CN.pak
            • Size 484KB
            • SHA256 5f4e8a9774b4d5635709da5bc2adfafc8ba3e614a0eadb312e493f626864b953
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zh-TW.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\locales\zh-TW.pak
            • Size 479KB
            • SHA256 147ac7bac178e8efb1044353b62fc47037f1b6cb56cf975b2fd03503b260b0b1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            resources.pak
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\resources.pak
            • Size 5.5MB
            • SHA256 ab1e9e37cc56c9e3be1aedcf6f89f12aa81c0bfb9f3edb2b32adb673d4229b0e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            app-update.yml
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\resources\app-update.yml
            • Size 301B
            • SHA256 db61fa7b80b9c4677524c84139e1073c89130b00dc5efb478a7cd5c73b4debd7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            app.asar
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\resources\app.asar
            • Size 13.8MB
            • SHA256 4b82fc60ba943c95c020823c063e7166e2a9aa950735e35e35e1d7771457731d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevate.exe
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\resources\elevate.exe
            • Size 127KB
            • SHA256 17a48de6d296a172be02d55581d6f70e694173e582c80029b5f544dd15935e9c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            meta.json
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\resources\meta.json
            • Size 314B
            • SHA256 de983204831584eada03e1584b92529b402851bfd8f573d93e6976c1d5b5e758
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            snapshot_blob.bin
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\snapshot_blob.bin
            • Size 309KB
            • SHA256 945d23356191d668dd4f9c52f600efb3f1c57f9ca93593540cb74759fb217c30
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            v8_context_snapshot.bin
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\v8_context_snapshot.bin
            • Size 671KB
            • SHA256 fb174e31e1e7e3799ffc7b4bb890b384da9e47d31641629d36a69f26774db5b0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vk_swiftshader.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\vk_swiftshader.dll
            • Size 5.3MB
            • SHA256 be462b2596b5bb3a6bae678243408281276ada704d85edefc1dd66756cbccaf5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vk_swiftshader_icd.json
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\vk_swiftshader_icd.json
            • Size 106B
            • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            vulkan-1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\7z-out\vulkan-1.dll
            • Size 896KB
            • SHA256 b027b78b235c4fa2b1e21a38c07a312c7e79dd7709db375651ffaf2595cc36e4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StdUtils.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\StdUtils.dll
            • Size 100KB
            • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\System.dll
            • Size 12KB
            • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UAC.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\UAC.dll
            • Size 14KB
            • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WinShell.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\WinShell.dll
            • Size 3KB
            • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsExec.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\nsExec.dll
            • Size 6KB
            • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsis7z.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz74AA.tmp\nsis7z.dll
            • Size 424KB
            • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            default.exc
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
            • Size 2B
            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
            • MD5 SHA1 SHA512
            Submit Download

            overlayed-2026-08-12.log
            • Path C:\Users\Admin\AppData\Roaming\overlayed\apps\01JZE3KDF3S2F7WHZY787PDX8Z\logs\overlayed-2026-08-12.log
            • Size 6KB
            • SHA256 2676fb69cea6b162565ad286d3e16aa1c9c94830d0f42262995439614b09a4c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            meta.json
            • Path C:\Users\Admin\AppData\Roaming\overlayed\meta.json
            • Size 145B
            • SHA256 53e3d2eb9345277851c366d772e1c0831ea181da00b7c84cde8aefb31e873fce
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Code Cache\wasm\index-dir\the-real-index
            • Size 48B
            • SHA256 325c5ece38a0ce93c7e5b8ee740895ca46d8196edf0dd4ad8bc7d7110122534e
            • MD5 SHA1 SHA512
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Local State
            • Size 434B
            • SHA256 46276eefb28324929a4451834e468e9b59f5081ce62422203a3b4317f7385016
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Trust Tokens
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Network\Trust Tokens
            • Size 36KB
            • SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            index
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Partitions\overlayed-01jze3kdf3s2f7whzy787pdx8z\Code Cache\js\index
            • Size 24B
            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Partitions\overlayed-01jze3kdf3s2f7whzy787pdx8z\Code Cache\js\index-dir\the-real-index
            • Size 1KB
            • SHA256 fa0820c9ab56365cc2b7c74ec72bd4e87a41a9a4ba4d48419434ce27dc8d9d74
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Partitions\overlayed-01jze3kdf3s2f7whzy787pdx8z\Code Cache\js\index-dir\the-real-index
            • Size 48B
            • SHA256 d78f2def48493ed3028c7becd6bab34b1c9be02be2a775e040ffb5b65e531dc4
            • MD5 SHA1 SHA512
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Partitions\overlayed-01jze3kdf3s2f7whzy787pdx8z\GPUCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Partitions\overlayed-01jze3kdf3s2f7whzy787pdx8z\GPUCache\data_1
            • Size 264KB
            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Partitions\overlayed-01jze3kdf3s2f7whzy787pdx8z\GPUCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Partitions\overlayed-01jze3kdf3s2f7whzy787pdx8z\GPUCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Partitions\overlayed-01jze3kdf3s2f7whzy787pdx8z\Local Storage\leveldb\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Partitions\overlayed-01jze3kdf3s2f7whzy787pdx8z\Network\Network Persistent State
            • Size 2KB
            • SHA256 e591bed6d0320216ec2ccbf246c82f3643ea54daa5972f5d3f00bcbfb5a17b59
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Partitions\overlayed-01jze3kdf3s2f7whzy787pdx8z\Network\Network Persistent State
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Partitions\overlayed-01jze3kdf3s2f7whzy787pdx8z\Preferences
            • Size 122B
            • SHA256 45380e016ad21d6155d64c1cc1a2b54622f7cac58b8d7897c200cd9313df2568
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Partitions\overlayed-01jze3kdf3s2f7whzy787pdx8z\Session Storage\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Partitions\overlayed-01jze3kdf3s2f7whzy787pdx8z\Shared Dictionary\cache\index-dir\the-real-index
            • Size 72B
            • SHA256 a337b442b155f4b8137d36b020b8d27d59ee6326920c59bb30ae6b739772be46
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index~RFe5b11fe.TMP
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Partitions\overlayed-01jze3kdf3s2f7whzy787pdx8z\Shared Dictionary\cache\index-dir\the-real-index~RFe5b11fe.TMP
            • Size 48B
            • SHA256 bda5be470ca990e6c4f10dbf456b6395659be040e4961e6ea78cc1ddda859055
            • MD5 SHA1 SHA512
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Preferences
            • Size 57B
            • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Shared Dictionary\cache\index-dir\the-real-index
            • Size 48B
            • SHA256 d60c57ea0294008b4a844e6d3338ec96d219d84d25937b5f6711bf54b4be3ffe
            • MD5 SHA1 SHA512
            Submit Download

            db
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\Shared Dictionary\db
            • Size 44KB
            • SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            electron-log-preload.js
            • Path C:\Users\Admin\AppData\Roaming\stats.cc\electron-log-preload.js
            • Size 959B
            • SHA256 a0fe377b43049be8e77cd765500f269d09d02c7f3960cafa7f6825361b3dbf4f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1048-672-0x00007FFE8D570000-0x00007FFE8D571000-memory.dmp
            Download

            memory/1048-673-0x00007FFE8D5C0000-0x00007FFE8D5C1000-memory.dmp
            Download

            memory/2324-27-0x0000000005450000-0x0000000005472000-memory.dmp
            Download

            memory/2324-35-0x00000000070F0000-0x0000000007126000-memory.dmp
            Download

            memory/2324-22-0x0000000073882000-0x0000000073883000-memory.dmp
            Download

            memory/2324-24-0x0000000073870000-0x000000007402C000-memory.dmp
            Download

            memory/2324-26-0x0000000073870000-0x000000007402C000-memory.dmp
            Download

            memory/2324-25-0x0000000005480000-0x0000000005ACA000-memory.dmp
            Download

            memory/2324-28-0x0000000005B40000-0x0000000005BA6000-memory.dmp
            Download

            memory/2324-50-0x0000000073870000-0x000000007402C000-memory.dmp
            Download

            memory/2324-29-0x0000000005BB0000-0x0000000005C16000-memory.dmp
            Download

            memory/2324-32-0x0000000005C70000-0x0000000005FCB000-memory.dmp
            Download

            memory/2324-33-0x0000000004FB0000-0x0000000004FCE000-memory.dmp
            Download

            memory/2324-34-0x0000000006460000-0x00000000064AC000-memory.dmp
            Download

            memory/2324-48-0x0000000070390000-0x00000000706EB000-memory.dmp
            Download

            memory/2324-47-0x0000000007700000-0x0000000007724000-memory.dmp
            Download

            memory/2324-46-0x00000000076D0000-0x00000000076FA000-memory.dmp
            Download

            memory/2324-45-0x0000000006110000-0x000000000611A000-memory.dmp
            Download

            memory/2324-44-0x0000000007490000-0x00000000074AA000-memory.dmp
            Download

            memory/2324-43-0x0000000007B10000-0x000000000818C000-memory.dmp
            Download

            memory/2324-40-0x0000000073870000-0x000000007402C000-memory.dmp
            Download

            memory/2324-39-0x0000000006700000-0x0000000006720000-memory.dmp
            Download

            memory/2324-36-0x0000000070230000-0x000000007027C000-memory.dmp
            Download

            memory/2324-23-0x00000000028F0000-0x0000000002926000-memory.dmp
            Download

            memory/2324-41-0x00000000073E0000-0x0000000007483000-memory.dmp
            Download

            memory/2324-42-0x0000000073870000-0x000000007402C000-memory.dmp
            Download

            memory/2380-61-0x0000000070230000-0x000000007027C000-memory.dmp
            Download

            memory/2380-64-0x0000000007590000-0x0000000007626000-memory.dmp
            Download

            memory/2380-67-0x0000000073870000-0x000000007402C000-memory.dmp
            Download

            memory/2380-65-0x00000000074F0000-0x0000000007501000-memory.dmp
            Download

            memory/2380-55-0x0000000073870000-0x000000007402C000-memory.dmp
            Download

            memory/2380-58-0x0000000005A50000-0x0000000005DAB000-memory.dmp
            Download

            memory/2380-59-0x0000000073870000-0x000000007402C000-memory.dmp
            Download

            memory/2380-54-0x0000000073870000-0x000000007402C000-memory.dmp
            Download

            memory/2964-74-0x0000000070230000-0x000000007027C000-memory.dmp
            Download

            memory/2964-77-0x0000000070440000-0x000000007079B000-memory.dmp
            Download

            memory/4368-710-0x0000026569880000-0x00000265698A4000-memory.dmp
            Download

            memory/4368-637-0x0000026569370000-0x0000026569392000-memory.dmp
            Download

            memory/4368-694-0x0000026569610000-0x000002656962E000-memory.dmp
            Download

            memory/4368-709-0x0000026569880000-0x00000265698AA000-memory.dmp
            Download

            memory/4368-695-0x0000026569630000-0x00000265696E2000-memory.dmp
            Download

            memory/4368-701-0x00000265696F0000-0x00000265696FA000-memory.dmp
            Download

            memory/5748-931-0x000001618E1E0000-0x000001618E38A000-memory.dmp
            Download

            memory/5748-696-0x000001618E1E0000-0x000001618E38A000-memory.dmp
            Download