Analysis

  • max time kernel
    149s
  • max time network
    163s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/09/2026, 23:48

General

  • Target
    OpenCode Desktop Installer.exe
  • Size 120.4MB
  • Sample260901-3tt31sfd25
  • SHA256 d2b743342b0d80b4520cdbeaa739d677f427afccf57e87c8f98da86e90f26efa
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 5 IoCs
  • Executes dropped EXE 8 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

  • Loads dropped DLL 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OpenCode Desktop Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\OpenCode Desktop Installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3284
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3584
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:120
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\@opencode-aidesktop', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1064
  • C:\Users\Admin\AppData\Local\Programs\@opencode-aidesktop\OpenCode.exe
    "C:\Users\Admin\AppData\Local\Programs\@opencode-aidesktop\OpenCode.exe"
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1012
    • C:\Users\Admin\AppData\Local\Programs\@opencode-aidesktop\OpenCode.exe
      C:\Users\Admin\AppData\Local\Programs\@opencode-aidesktop\OpenCode.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\ai.opencode.desktop /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\Crashpad --annotation=_productName=OpenCode --annotation=_version=1.18.25 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.3.3 --initial-client-data=0x4c4,0x4e8,0x4f0,0x4ec,0x4f4,0x7ff75022dd88,0x7ff75022dd98,0x7ff75022dda8
      2⤵
      • Executes dropped EXE
      PID:120
    • C:\Users\Admin\AppData\Local\Programs\@opencode-aidesktop\OpenCode.exe
      "C:\Users\Admin\AppData\Local\Programs\@opencode-aidesktop\OpenCode.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ai.opencode.desktop" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1764,i,17988502091940713254,8358394511312775183,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,8817471871265339994,11844271705706463873,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1760 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1064
    • C:\Users\Admin\AppData\Local\Programs\@opencode-aidesktop\OpenCode.exe
      "C:\Users\Admin\AppData\Local\Programs\@opencode-aidesktop\OpenCode.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ai.opencode.desktop" --standard-schemes=oc --secure-schemes=oc --fetch-schemes=oc --streaming-schemes=oc --field-trial-handle=1764,i,17988502091940713254,8358394511312775183,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,8817471871265339994,11844271705706463873,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1840 /prefetch:11
      2⤵
      • Drops file in Windows directory
      • Executes dropped EXE
      PID:1484
    • C:\Users\Admin\AppData\Local\Programs\@opencode-aidesktop\OpenCode.exe
      "C:\Users\Admin\AppData\Local\Programs\@opencode-aidesktop\OpenCode.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ai.opencode.desktop" --standard-schemes=oc --secure-schemes=oc --fetch-schemes=oc --streaming-schemes=oc --field-trial-handle=1764,i,17988502091940713254,8358394511312775183,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,8817471871265339994,11844271705706463873,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2964 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "$global:ProgressPreference = 'SilentlyContinue'; Expand-Archive -LiteralPath 'C:\Users\Admin\.cache\opencode\bin\ripgrep-15.1.0-x86_64-pc-windows-msvc.zip' -DestinationPath 'C:\Users\Admin\.cache\opencode\bin\ripgrep-b4PFb5' -Force"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5500
      • C:\Users\Admin\.cache\opencode\bin\rg.exe
        C:\Users\Admin\.cache\opencode\bin\rg.exe --no-config --files --glob=!**/.git/** .
        3⤵
        • Executes dropped EXE
        PID:8100
      • C:\Users\Admin\.cache\opencode\bin\rg.exe
        C:\Users\Admin\.cache\opencode\bin\rg.exe --no-config --files --glob=!**/.git/** .
        3⤵
        • Executes dropped EXE
        PID:7992
    • C:\Users\Admin\AppData\Local\Programs\@opencode-aidesktop\OpenCode.exe
      "C:\Users\Admin\AppData\Local\Programs\@opencode-aidesktop\OpenCode.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ai.opencode.desktop" --standard-schemes=oc --secure-schemes=oc --fetch-schemes=oc --streaming-schemes=oc --app-user-model-id=ai.opencode.desktop --app-path="C:\Users\Admin\AppData\Local\Programs\@opencode-aidesktop\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1764,i,17988502091940713254,8358394511312775183,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,8817471871265339994,11844271705706463873,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3300 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:856

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ripgrep-15.1.0-x86_64-pc-windows-msvc.zip

        • Path C:\Users\Admin\.cache\opencode\bin\ripgrep-15.1.0-x86_64-pc-windows-msvc.zip
        • Size 1.7MB
        • SHA256 124510b94b6baa3380d051fdf4650eaa80a302c876d611e9dba0b2e18d87493a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        COPYING

        • Path C:\Users\Admin\.cache\opencode\bin\ripgrep-b4PFb5\ripgrep-15.1.0-x86_64-pc-windows-msvc\COPYING
        • Size 129B
        • SHA256 dfe7d0a6134a17d3de7409762e08dc02133303912875cab40a74ba07a390f85a
        • MD5 SHA1 SHA512 TLSH

        LICENSE-MIT

        • Path C:\Users\Admin\.cache\opencode\bin\ripgrep-b4PFb5\ripgrep-15.1.0-x86_64-pc-windows-msvc\LICENSE-MIT
        • Size 1KB
        • SHA256 970813655a1bf777d2ead189cef71ab73ab92ce04dc864027d61a45de03e6728
        • MD5 SHA1 SHA512 TLSH

        README.md

        • Path C:\Users\Admin\.cache\opencode\bin\ripgrep-b4PFb5\ripgrep-15.1.0-x86_64-pc-windows-msvc\README.md
        • Size 21KB
        • SHA256 24c3effdbd5c493ceedce5bdcd955ee95c4a1b9acb4c431488c482a9ab0daaa0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UNLICENSE

        • Path C:\Users\Admin\.cache\opencode\bin\ripgrep-b4PFb5\ripgrep-15.1.0-x86_64-pc-windows-msvc\UNLICENSE
        • Size 1KB
        • SHA256 640514163b17f977adc997cb16f51871122cfb0555ebad1a3f01e167b7ba8857
        • MD5 SHA1 SHA512 TLSH

        _rg

        • Path C:\Users\Admin\.cache\opencode\bin\ripgrep-b4PFb5\ripgrep-15.1.0-x86_64-pc-windows-msvc\complete\_rg
        • Size 32KB
        • SHA256 24038494de2bd87d4fa68ce1f96b3612e8b63430f1688f5bff50b65824e5e316
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _rg.ps1

        • Path C:\Users\Admin\.cache\opencode\bin\ripgrep-b4PFb5\ripgrep-15.1.0-x86_64-pc-windows-msvc\complete\_rg.ps1
        • Size 25KB
        • SHA256 053309e2043ed4b5ef2a718a34602592f98573f1a166469ae2fd532cc98b05e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rg.bash

        • Path C:\Users\Admin\.cache\opencode\bin\ripgrep-b4PFb5\ripgrep-15.1.0-x86_64-pc-windows-msvc\complete\rg.bash
        • Size 20KB
        • SHA256 9fd807931c6d350d50e0bb6819629b6cc83e6253528342e95bbaeef81241d0e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rg.fish

        • Path C:\Users\Admin\.cache\opencode\bin\ripgrep-b4PFb5\ripgrep-15.1.0-x86_64-pc-windows-msvc\complete\rg.fish
        • Size 14KB
        • SHA256 b63b76a059be13e041104d2576e2594067c15f29cd56cb339a021dca9cb1a656
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CHANGELOG.md

        • Path C:\Users\Admin\.cache\opencode\bin\ripgrep-b4PFb5\ripgrep-15.1.0-x86_64-pc-windows-msvc\doc\CHANGELOG.md
        • Size 88KB
        • SHA256 7f720bf9e53ade51a48a3a7afc22c05c60a8abe806775569971e4e59a2a009a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FAQ.md

        • Path C:\Users\Admin\.cache\opencode\bin\ripgrep-b4PFb5\ripgrep-15.1.0-x86_64-pc-windows-msvc\doc\FAQ.md
        • Size 42KB
        • SHA256 3cc08f312b63aec68ea4063067f528613331d6ca229fbcf448fc18a1045fd748
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GUIDE.md

        • Path C:\Users\Admin\.cache\opencode\bin\ripgrep-b4PFb5\ripgrep-15.1.0-x86_64-pc-windows-msvc\doc\GUIDE.md
        • Size 40KB
        • SHA256 2ff96d78612fa939280fa9e17387d3f6bac8e489ee9d81ec22b3a5984f14a7b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rg.1

        • Path C:\Users\Admin\.cache\opencode\bin\ripgrep-b4PFb5\ripgrep-15.1.0-x86_64-pc-windows-msvc\doc\rg.1
        • Size 84KB
        • SHA256 35c844073303dc14289cf3661bc4371af7cb455754da8fde103f4dcda4dd91b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rg.exe

        • Path C:\Users\Admin\.cache\opencode\bin\ripgrep-b4PFb5\ripgrep-15.1.0-x86_64-pc-windows-msvc\rg.exe
        • Size 4.1MB
        • SHA256 decdd4992f3f1b9a5ef9898f1b40ab16886d579d6516b4efd3d5eaa19364e408
        • MD5 SHA1 SHA512 SSDEEP TLSH

        .package-lock.json

        • Path C:\Users\Admin\.config\opencode\node_modules\.package-lock.json
        • Size 11KB
        • SHA256 1670eafaa4ae6a88248ae852eb4b70c613160b7c2e76755794aaec51a5635c87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        package-lock.json

        • Path C:\Users\Admin\.config\opencode\package-lock.json
        • Size 14KB
        • SHA256 2c3f305186cf43d2ea8ac87aac5812ad735ba08e35db68126cd1ae166c5d5721
        • MD5 SHA1 SHA512 SSDEEP TLSH

        package.json

        • Path C:\Users\Admin\.config\opencode\package.json
        • Size 65B
        • SHA256 af7f0d9817b58464b81020a3b0180ca3771b9838e93256766b4ba00074a88586
        • MD5 SHA1 SHA512 TLSH

        StartupProfileData-NonInteractive

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 3f29894dcbb6ad1d6c76e3b30df8f5500e292ead85095d8ea85245ac7056609d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StartupProfileData-NonInteractive

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 19a9dd568a88f569d550c11ca8695a7107baca5c9a5f564dcd5bf21906b7a5d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StartupProfileData-NonInteractive

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 16KB
        • SHA256 ef4329036fc1a9d146a5823bbe889bc5cc86b1f759f4f29bd68dd186e71cf61e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __PSScriptPolicyTest_tecqja3g.r32.ps1

        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tecqja3g.r32.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\LICENSES.chromium.html
        • Size 19.4MB
        • SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\chrome_100_percent.pak
        • Size 117KB
        • SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\chrome_200_percent.pak
        • Size 192KB
        • SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.5MB
        • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxcompiler.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\dxcompiler.dll
        • Size 24.4MB
        • SHA256 5be4721b8153a392428759f160fd282f28c6f1d81c541ba8db78cef04a04315b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxil.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\dxil.dll
        • Size 1.4MB
        • SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\ffmpeg.dll
        • Size 2.9MB
        • SHA256 fa5256dfdf155074121921c28e1e3a4dddfa25bfce837b117a1b95b3f3c33b91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\icudtl.dat
        • Size 10.4MB
        • SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\libEGL.dll
        • Size 467KB
        • SHA256 95a80c09f9901d7a0389f9da16861c9b8b133f25a4bb9c986c5c3090b65622e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\libGLESv2.dll
        • Size 7.6MB
        • SHA256 bdd409acd8ba96317f030cc2be592bd19694e30000a231bff712d3aeb046be09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\af.pak
        • Size 605KB
        • SHA256 d990f4ced39e31a1149d2a1842ce2504706885e6ab05957ee2f338c77d94c16b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\am.pak
        • Size 983KB
        • SHA256 8d3d5dfc64acfbb0c35036d74561d09ddf3b22058eeed0f8d26a2e9c0703248e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\ar.pak
        • Size 1.1MB
        • SHA256 295b944f5e032235abd83e7ed5a65ded77e37a0d7911935448a13753fbde0863
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\bg.pak
        • Size 1.1MB
        • SHA256 2789212aac5f2133ed23c1f84623bc64eb4cfbd93aef7af751d1221e27a21daa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\bn.pak
        • Size 1.4MB
        • SHA256 e72b72977b40fb10472fe1a3fcffcda8b434bf52e2bb2da2935faa80da224812
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\ca.pak
        • Size 683KB
        • SHA256 49eda8c16449dbe7620f52c3354f6a5f0d14c98e9ffe4624b81465c141420172
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\cs.pak
        • Size 709KB
        • SHA256 8386f70e830a565d0674014ae4ad385a61eb43d7e7b99d4d373d14388dfd32ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\da.pak
        • Size 637KB
        • SHA256 ff687bb6dc79bb638bca4f6a9226544a783209645922d323cf777b169690b25a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\de.pak
        • Size 684KB
        • SHA256 941c4d0ac3de30cdb5922e4bf1423354eca1148aacd3dd71499af3bba1fcea8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\el.pak
        • Size 1.2MB
        • SHA256 3ee2e46a5a569e411ccf9d77ee4f356e1833bfccbaefcc5e71b7c1517206ab5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\en-GB.pak
        • Size 552KB
        • SHA256 aac3b4904d021d58d053bdea2d8056a219ecda1e341d87cb70070aea2cee418f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\en-US.pak
        • Size 558KB
        • SHA256 bce3ec06227dba2273c4ff12482cba37b709cc8bf5fd29c4380f9a07b92bf821
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\es-419.pak
        • Size 674KB
        • SHA256 a0b3cf210b1d1523a76dfee93372743bc1f881be733872d0d48e1b5c82d52fea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\es.pak
        • Size 670KB
        • SHA256 940fb4b4b54dba60441fd52bdf3175e088c72fef7003a82988be25062a5266d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\et.pak
        • Size 612KB
        • SHA256 ecc838878412cc9f28dda9efed2fc60b67315f5fdf64e912db33cee7571a5939
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\fa.pak
        • Size 1013KB
        • SHA256 5fa7790100ab1e84a0c9b45612943cca98783fb3973cb07a4c083037e0cfe9dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\fi.pak
        • Size 623KB
        • SHA256 18d904efd7d15a49ef3638c45a40b3aa604e5ec4b68e017ab3f568e6a8202fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\fil.pak
        • Size 706KB
        • SHA256 4034bd7ef11f48d7d646aacb7006562f0f9caec888785a13c36e31b9724dd798
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\fr.pak
        • Size 728KB
        • SHA256 3f67ef11ecc42bfc8a8f6d1cccc3bb505c028256801e26fd3f784dc0998a3762
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\gu.pak
        • Size 1.4MB
        • SHA256 b207f2046791aa8150015ca78f9f76f2f6509953a00c5e89b155bb40e3a26474
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\he.pak
        • Size 887KB
        • SHA256 a8bcc73c8195b7f77ab4c4746bdc1f7970fb4431ab9a5b6495d1869521ec1312
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\hi.pak
        • Size 1.5MB
        • SHA256 6e58e12bfc69547d03d61f23445bc996e1b09ed5e8599b00f553bf8d022a08b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\hr.pak
        • Size 682KB
        • SHA256 6990ba056fcd1cac97ed5b48024be4ab366846a9c517d43a181cbb0eefa095d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\hu.pak
        • Size 729KB
        • SHA256 b83fc60c6d3ce3a04338ea16ba4627d6dfdf81f4373fe4921ac01c7c9558bcb6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\id.pak
        • Size 603KB
        • SHA256 a6ccb8c77ecd0db5c9d8d3b809937e627fffb136737ffeba65a9c09e6469a243
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\it.pak
        • Size 660KB
        • SHA256 666f811313f9bfd0f582816ff5c9fd693da6a3b4ec0e1d6af7cbbc100d8d7bd6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\ja.pak
        • Size 804KB
        • SHA256 babf93791e59b57c7b21e850e1bba68b07dedb2a7c5cb8afdbd1a1814527deea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\kn.pak
        • Size 1.6MB
        • SHA256 88af1f1770525fc5fa3a8f3e0f1ecb5fa5d68045795043d3bf3745059c86b962
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\ko.pak
        • Size 684KB
        • SHA256 37f167bdf1c7f0095e256dfdf1d5f40a92e29a350bc78a8fe048f364d5fdbd76
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\lt.pak
        • Size 742KB
        • SHA256 0c755ce72d1b71e77d58ab014228458d8ce2b0c51a9b00769635c6609255c9f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\lv.pak
        • Size 739KB
        • SHA256 911f922f6ab11d04c4913b04088619276994104979b2c5f132182953fabc24a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\ml.pak
        • Size 1.6MB
        • SHA256 8beb5df27b5a1b88d0f441518a807b2c6acd99a81820cd0249710ea12bc179d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\mr.pak
        • Size 1.4MB
        • SHA256 1971da05e4868841c9d9f78be5e17ab09178af99b86a6c07df385015a0c9d9ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\ms.pak
        • Size 636KB
        • SHA256 b60c552a9ced5d0e1f4ed408f65a04068acad7d80db7cf88528fbebbcd337e23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\nb.pak
        • Size 608KB
        • SHA256 cb50908b03c77263297e63ff75d4d3c58fb0cb491c69a8964239e787c762f52d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\nl.pak
        • Size 634KB
        • SHA256 b6a6cecceeb0097d5fd9628c684d53339f7871948655740e0f625bfedbf526ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\pl.pak
        • Size 708KB
        • SHA256 dee5b710ca72425cd4d1236ce260f8d68b41bfdfceaeb2f98c8e89217b24208f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\pt-BR.pak
        • Size 664KB
        • SHA256 1b39ea90b1823d9dedb7ee5ad1269d712680b0d6c81ed387a25ce8a48fd9bb59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\pt-PT.pak
        • Size 668KB
        • SHA256 266e49a497c6bf9e48502c7eb01aea1fa90260b6fb1609165ff50307a3d81b59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\ro.pak
        • Size 693KB
        • SHA256 16b11fb73ea0c5d0336de453d3e2abd2de69b3e6c66dcd72bae318666525bb18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\ru.pak
        • Size 1.1MB
        • SHA256 d8e86f2b2fb7232cde6fec3a927678a5923f5844f4e5d87bbe114f5dd717dac6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\sk.pak
        • Size 720KB
        • SHA256 8c14d528efad4c75e09ce70719b0b3d1162954b4de4013112e014e2ac6a84d3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\sl.pak
        • Size 690KB
        • SHA256 1550f8df161a3484a6c7af9bc5321fae524e10d6853467afcb8749054a73e601
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\sr.pak
        • Size 1.0MB
        • SHA256 a76930f2c72e49dc3a2c9be7e7bce0f9da0c93de03b6e275521fa86da0d2d39c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\sv.pak
        • Size 615KB
        • SHA256 118cbf34d040c8946669f889393364070e88d3f0263f1b66ab4638b1f8f3c291
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\sw.pak
        • Size 651KB
        • SHA256 f4e0e2f5b49d9d767884074cc3ee8d0dd83a986f7c1d2de236885998d7a53460
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\ta.pak
        • Size 1.6MB
        • SHA256 2c5f8aaf21c9a035f71d763cfa9a20886892fcde7cf71878168a9df0faa6d417
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\te.pak
        • Size 1.5MB
        • SHA256 e9e85c763b92b5a98e74290c3ff07e7953269ab6228a4cc343745229819d7f8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\th.pak
        • Size 1.3MB
        • SHA256 0684a30ec9e0fe9baeeb215840b6c6b4f04e11c9afbcf9d18687af9a685e0927
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\tr.pak
        • Size 663KB
        • SHA256 7a42e54611e2633c9c999f121abf2ffbda37746237e01ce29dc650510af08b0c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\uk.pak
        • Size 1.1MB
        • SHA256 1fafb514e4380b430b19b9031b30249e93aaecd71109b125e5b6d99c2be60b43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\ur.pak
        • Size 997KB
        • SHA256 0c1cfa61d9a9be6338b0a160b43ff362a982003053ae5be3b3ec867e78374d7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\vi.pak
        • Size 789KB
        • SHA256 3594ddfb89758a3d87d51bf90e676a5dd6107a6becd96c8840df6739cf268af1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\zh-CN.pak
        • Size 564KB
        • SHA256 2fcc82972ec5b9b3d1c7adbe7f5ccebbcec8f592383fd835c134a03e82bf8a24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\locales\zh-TW.pak
        • Size 556KB
        • SHA256 8e831ed21bd21ce3610dc4b658aa337229c83dd6d7cef336923d69779d0365b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources.pak
        • Size 6.6MB
        • SHA256 51231c347431cacf879e667eab84b6ee7cdabd6560c35406ed231aa3eea86288
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app-update.yml

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app-update.yml
        • Size 116B
        • SHA256 6bab0d7491cc781a5f268b2aaae480d0bb006f774cc28fb9bc2464d02ba832a1
        • MD5 SHA1 SHA512 TLSH

        LICENSE

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\LICENSE
        • Size 3KB
        • SHA256 a3d60eaf32d2fb09c9d82ef39f14bd6e2c0f3ca7de30daa827486c0d6f8b6e9f
        • MD5 SHA1 SHA512 TLSH

        conpty_console_list_agent.js

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\lib\conpty_console_list_agent.js
        • Size 927B
        • SHA256 4a9f51fa5b23be652e965dfe390d7fbe8cc9cd79a480260998c6c101fc944f08
        • MD5 SHA1 SHA512 TLSH

        eventEmitter2.js

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\lib\eventEmitter2.js
        • Size 1KB
        • SHA256 f1c14613aa90c10def4ca7238329270871997eb26f919f7074dc25533e3e75dd
        • MD5 SHA1 SHA512 TLSH

        index.js

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\lib\index.js
        • Size 1KB
        • SHA256 c1b82c92c4c63aaa8e8441fc5a291c4727cd3f3550666d2fec7250e0f6d4b173
        • MD5 SHA1 SHA512 TLSH

        interfaces.js

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\lib\interfaces.js
        • Size 233B
        • SHA256 56e4173f09aad26173f9d4c79800fda0b808c34424f987ef8d671cc931119a0a
        • MD5 SHA1 SHA512 TLSH

        conout.js

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\lib\shared\conout.js
        • Size 348B
        • SHA256 6ae3b0532616da11aa2a11b4506bb89b0d40be005a9ea9fb369fb59eefdbda47
        • MD5 SHA1 SHA512 TLSH

        terminal.js

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\lib\terminal.js
        • Size 7KB
        • SHA256 5ed5cd66a766afba4a04093284e999f8516d41936501839055800b10eca5d304
        • MD5 SHA1 SHA512 SSDEEP TLSH

        types.js

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\lib\types.js
        • Size 228B
        • SHA256 408bf8287717b6322cc380ea66caf1b5e366dcf697707ae2f3cc454e08f3b151
        • MD5 SHA1 SHA512 TLSH

        utils.js

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\lib\utils.js
        • Size 1KB
        • SHA256 6981b69ce5b162393f59f3a541f0e188b9e70bb8300786d1d6be83a231eac7ca
        • MD5 SHA1 SHA512 TLSH

        windowsConoutConnection.js

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\lib\windowsConoutConnection.js
        • Size 5KB
        • SHA256 1440f70908fb1f55911ac8e936a1230f68a9c00c03096fcef6788eac6aad9d62
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsPtyAgent.js

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\lib\windowsPtyAgent.js
        • Size 11KB
        • SHA256 1583dc8d41632d0a571d6b3ac27a7d58d445e359ad7799af042de6b5d50d68d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsTerminal.js

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\lib\windowsTerminal.js
        • Size 7KB
        • SHA256 d6bc0912ecfaf2857651965f887a37bfeb04c745c075e8d10b31cbf661d3aef3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        conoutSocketWorker.js

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\lib\worker\conoutSocketWorker.js
        • Size 848B
        • SHA256 3e4bac095ac3870c3248a7302f5d10217de625f30c32b7000fe48a34788e47ac
        • MD5 SHA1 SHA512 TLSH

        package.json

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\package.json
        • Size 366B
        • SHA256 b36f18a54608269e2e93c2a6c3b763ac5c784979a9023968e7e4e76e01e82c05
        • MD5 SHA1 SHA512 TLSH

        conpty.node

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\prebuilds\win32-x64\conpty.node
        • Size 305KB
        • SHA256 2d1fb89aa74b692ad026807e78f90d970ef4e4b5b4b0254f94854f0f3f442306
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OpenConsole.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\prebuilds\win32-x64\conpty\OpenConsole.exe
        • Size 1.0MB
        • SHA256 679fa460c31305c0a5d7f1a4985a3478b75d2f92d5ef5110406cb86a7931a592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        conpty.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\prebuilds\win32-x64\conpty\conpty.dll
        • Size 107KB
        • SHA256 3319b484b80bb53d1f4d0a9eb0ea60fd0f61da69db7280ca43b84215f19245ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        conpty_console_list.node

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lydell\node-pty-win32-x64\prebuilds\win32-x64\conpty_console_list.node
        • Size 131KB
        • SHA256 4b443e5347883c47220e26eed0d03d35fce6bea8d30bb0d577541202783618e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        node.abi115.node

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@msgpackr-extract\msgpackr-extract-win32-x64\node.abi115.node
        • Size 110KB
        • SHA256 300b188fb8c997214cb65bf1b00729da293176c7d57035e40c2f432ea384dd89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        node.napi.node

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@msgpackr-extract\msgpackr-extract-win32-x64\node.napi.node
        • Size 110KB
        • SHA256 6958541c624784dfcebfc4f3c360c57f71cfeedd0530c2393845061729081a08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        package.json

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@msgpackr-extract\msgpackr-extract-win32-x64\package.json
        • Size 377B
        • SHA256 5ca28cd9343e1d079307257ecc7e57249cb129448385cf797dbf4e69a950f71a
        • MD5 SHA1 SHA512 TLSH

        LICENSE

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@parcel\watcher-win32-x64\LICENSE
        • Size 1KB
        • SHA256 5cfba9d5711264d45a2431a53c79f597cef12720cc7c764db2602daa92d0bd2a
        • MD5 SHA1 SHA512 TLSH

        package.json

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@parcel\watcher-win32-x64\package.json
        • Size 605B
        • SHA256 bc6f57a93e4df8d0373afe4e3d7f07e9b7a1ee82c89b7a9c1a3a5fb548608a6e
        • MD5 SHA1 SHA512 TLSH

        watcher.node

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\@parcel\watcher-win32-x64\watcher.node
        • Size 506KB
        • SHA256 a8199cf7b6c5102267a5889f80321a4cc92e631d7504c474d32a35b4d440f315
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\LICENSE
        • Size 1KB
        • SHA256 d00470775464c789c7ac04cfba3bf1b79ef149790eb72556d1c51d8f50c8e7f3
        • MD5 SHA1 SHA512 TLSH

        download-prebuilds.js

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\bin\download-prebuilds.js
        • Size 336B
        • SHA256 e5d9fb733fb23a14f4a3e09f0618051b9393a419b0f77e2b15766a8cf8beb22c
        • MD5 SHA1 SHA512 TLSH

        extract.exp

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\extract.exp
        • Size 1019B
        • SHA256 dc23941a77dbc375078e1f3d9a9a2e5b87cbc5d727b413340fff45ef6fd0705f
        • MD5 SHA1 SHA512 TLSH

        extract.iobj

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\extract.iobj
        • Size 132KB
        • SHA256 a04ce9033ff96ea1fd79289c8d9d6328892862f35b05497693ab7e7a9e942ed6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extract.ipdb

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\extract.ipdb
        • Size 17KB
        • SHA256 31233be5293223aeb4521a48c561ca534f1e181eb42310535353b90b80c2f7a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extract.lib

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\extract.lib
        • Size 2KB
        • SHA256 001d4cc4732cf61fec0d33b446d20c6be5e85432a1e0471f3c09636459c37f68
        • MD5 SHA1 SHA512 TLSH

        extract.node

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\extract.node
        • Size 110KB
        • SHA256 2c446ded29f073a8a946c2db1b415300a5dc77db1146e218dbb7ecdf9feaf931
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extract.node.recipe

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\obj\extract\extract.node.recipe
        • Size 333B
        • SHA256 f679f366acf5746a40b728869edd0fb48ea26c975ca9463837e8244ebced3447
        • MD5 SHA1 SHA512 TLSH

        CL.command.1.tlog

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\obj\extract\extract.tlog\CL.command.1.tlog
        • Size 6KB
        • SHA256 ab2d000dd9bd08e73b85df739b1513e140c194cd9dc437618a5ffe9b60ffa75f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CL.read.1.tlog

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\obj\extract\extract.tlog\CL.read.1.tlog
        • Size 49KB
        • SHA256 c9e28500d1dd8b34bc61e7bccaa327e922962fc6289eccc71693e84d4d3863a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CL.write.1.tlog

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\obj\extract\extract.tlog\CL.write.1.tlog
        • Size 780B
        • SHA256 e446b1562f8d1d97ee0a3c23cfec46cd7bd184c2ee8a5380c90b30d28f87c293
        • MD5 SHA1 SHA512 TLSH

        Cl.items.tlog

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\obj\extract\extract.tlog\Cl.items.tlog
        • Size 385B
        • SHA256 03d7c1cb303bcb3f91a5d567e0aeed1f07bf2a122cb30ef7fe28a7ed1dfef9c8
        • MD5 SHA1 SHA512 TLSH

        extract.lastbuildstate

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\obj\extract\extract.tlog\extract.lastbuildstate
        • Size 201B
        • SHA256 5f602efc11fe66a62a1459a203b9e3212d29f70954b3fee8927bbbf9bf862002
        • MD5 SHA1 SHA512 TLSH

        link.command.1.tlog

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\obj\extract\extract.tlog\link.command.1.tlog
        • Size 1KB
        • SHA256 ff9b4cfff1f63e9611dc7b83598bc435bf0974fdc91eebe685e3f22eca09aebb
        • MD5 SHA1 SHA512 TLSH

        link.read.1.tlog

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\obj\extract\extract.tlog\link.read.1.tlog
        • Size 5KB
        • SHA256 8974093ba42fce2c095876d5535402615ac093cdd0d198ca183a5c8a29430e2f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        link.secondary.1.tlog

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\obj\extract\extract.tlog\link.secondary.1.tlog
        • Size 588B
        • SHA256 e25bba59bab0680db5963895f4e66086e6727adde112ef4dd09cd7450a751e88
        • MD5 SHA1 SHA512 TLSH

        link.write.1.tlog

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\Release\obj\extract\extract.tlog\link.write.1.tlog
        • Size 812B
        • SHA256 921031314a3a3b37895eea6e896e09ddb1a163c8d7e07878c564f021d2319dcb
        • MD5 SHA1 SHA512 TLSH

        extract.vcxproj

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\extract.vcxproj
        • Size 11KB
        • SHA256 6c61817ef9d7297eb37f952940ede18a68a220930d4d99e649c3ca99ebf6ea3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extract.vcxproj.filters

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\build\extract.vcxproj.filters
        • Size 2KB
        • SHA256 ef926b1c582a275eaea649da17310a708fd3e723ba245ac57aaebf1fc391b630
        • MD5 SHA1 SHA512 TLSH

        index.js

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\index.js
        • Size 72B
        • SHA256 a2b9244e83810de461c09f0cd3629899619bf145a40bc05af44553faf40b9ff5
        • MD5 SHA1 SHA512 TLSH

        package.json

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\package.json
        • Size 1KB
        • SHA256 711b4e04e67bfe1b128e336b08f86a5104f10880ad3fdc54ed700e71cc739f8c
        • MD5 SHA1 SHA512 TLSH

        extract.cpp

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\app.asar.unpacked\node_modules\msgpackr-extract\src\extract.cpp
        • Size 8KB
        • SHA256 77c504c7adc96204fcf4aac1d44911e8a372f8b7f19c6d74faf609e5eb2e8de0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\resources\elevate.exe
        • Size 119KB
        • SHA256 112880e911432f15d6b499ef9c19c1bbba85ffade5a46e5ad956f198a32082d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\snapshot_blob.bin
        • Size 338KB
        • SHA256 fac8fa3a800a56892d18f6ddd9ec769ebfb95093faac0dead7a1b0bf0148b68b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\v8_context_snapshot.bin
        • Size 704KB
        • SHA256 bc75f706ce64e25785b54f468caaed24c9a47d4997ce040fde3567007bdc566b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\vk_swiftshader.dll
        • Size 5.3MB
        • SHA256 b9605f10cd7da15812f5bd42b33afc79c30b49face83b265a9d340eb58b81c2a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\7z-out\vulkan-1.dll
        • Size 904KB
        • SHA256 502d871769ce2c51fd619e46a4c14d4598b468b71b84d93ab978b6415fad9f8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SpiderBanner.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\SpiderBanner.dll
        • Size 9KB
        • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WinShell.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\WinShell.dll
        • Size 3KB
        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
        • MD5 SHA1 SHA512 TLSH

        nsExec.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\nsExec.dll
        • Size 6KB
        • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        e70e70e0cbc9b00841927b0c23c58d97f21063208f3e872c3e04db58c13b

        • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\04\bb\e70e70e0cbc9b00841927b0c23c58d97f21063208f3e872c3e04db58c13b
        • Size 705B
        • SHA256 f78092ef7291089d0f68db69058a05ef07d75d2221ba109ea938d143889d9a48
        • MD5 SHA1 SHA512 TLSH

        9ceb636d5cd849b1674662ae98b1eca87ffa6a23530cb7132fb8c6c84ec5

        • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\0e\18\9ceb636d5cd849b1674662ae98b1eca87ffa6a23530cb7132fb8c6c84ec5
        • Size 710B
        • SHA256 3729d9a5ce69ba079f824f0c7d6c61b5e4322004d62da943ef3ab24648fcffbf
        • MD5 SHA1 SHA512 TLSH

        e961e2a18e6d479c4957b4c19785d201494bc3311025f61df4a91e826b6c

        • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\0e\a4\e961e2a18e6d479c4957b4c19785d201494bc3311025f61df4a91e826b6c
        • Size 715B
        • SHA256 50a6637ad84b0a74c455e15ee2c8860a7aa5e9dec4285b8ac00429eca5c8512a
        • MD5 SHA1 SHA512 TLSH

        a14a3cd7312978b6c877cafb0f3900a6bc17e40561269c5bb61a96ac5791

        • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\37\c8\a14a3cd7312978b6c877cafb0f3900a6bc17e40561269c5bb61a96ac5791
        • Size 722B
        • SHA256 030dd5b2690674415cc96fec25b0b9db09c90b7f75f8364a08ffb745c843d356
        • MD5 SHA1 SHA512 TLSH

        89f0b89d2ca92cd54ff481086fdd599c67170ea69eb9b22d37e34638d25e

        • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\40\1e\89f0b89d2ca92cd54ff481086fdd599c67170ea69eb9b22d37e34638d25e
        • Size 689B
        • SHA256 5b23452efdd4969215ab64bd83642a4fb0a71565e6c5161b38cbb03cc2e08941
        • MD5 SHA1 SHA512 TLSH

        95a55cc1e29a4f5e87adb25ca49ed4e033107d6c775a0304d7821f69cf40

        • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\5e\32\95a55cc1e29a4f5e87adb25ca49ed4e033107d6c775a0304d7821f69cf40
        • Size 716B
        • SHA256 22084c9c387df0f99d2ed9e8138a73e1a6080d9879642ba9eb8c558364fca400
        • MD5 SHA1 SHA512 TLSH

        5446c5cdae0493e4ad3b10347b77c8df4b17b5fbe14834f5c6b06faa9f95

        • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\7d\e8\5446c5cdae0493e4ad3b10347b77c8df4b17b5fbe14834f5c6b06faa9f95
        • Size 682B
        • SHA256 d43033e6e2f8c9f73bdb5e58751b72e2dc3fe47c516822b65a538a7b36098d40
        • MD5 SHA1 SHA512 TLSH

        e2ba88ed525834b932f3ddb5624a540e279742a3c6851ec4ee466890a5ed

        • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\89\0b\e2ba88ed525834b932f3ddb5624a540e279742a3c6851ec4ee466890a5ed
        • Size 697B
        • SHA256 c132004a84764071b6f43c5d68cf5f07e7ca1cf6a337f932c7ff5cfc11a2dc14
        • MD5 SHA1 SHA512 TLSH

        50e645a13078a26cc4815e5247112414423b0f67e99477f5492d6c6e8ce1

        • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\90\83\50e645a13078a26cc4815e5247112414423b0f67e99477f5492d6c6e8ce1
        • Size 695B
        • SHA256 beda422630b97211b72c5890537eeaca21c299eb909ab881b4197ee848bc2409
        • MD5 SHA1 SHA512 TLSH

        51ddec1dd5fe5b4bb49547f326a7ba6b4bb18f675d1f6f7cf05edabf8fa1

        • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\ab\89\51ddec1dd5fe5b4bb49547f326a7ba6b4bb18f675d1f6f7cf05edabf8fa1
        • Size 708B
        • SHA256 2f8f1538d9f897ea4776be8047b79f0e351bd49f4a23f5b11faa8de7e6c28c77
        • MD5 SHA1 SHA512 TLSH

        54e92059d3c7633415eeff13db4a889a5dc4f5680703ecb9553898ec076b

        • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\fb\4e\54e92059d3c7633415eeff13db4a889a5dc4f5680703ecb9553898ec076b
        • Size 710B
        • SHA256 2a3e9fb32a9a150895ceacffafced4b905e566ef7f36263c4dcf67192a393565
        • MD5 SHA1 SHA512 TLSH

        3d4d4b298b89443713c7e90b110bbf9b5eb34197d7638d311ce3aba49aa5

        • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\fc\1f\3d4d4b298b89443713c7e90b110bbf9b5eb34197d7638d311ce3aba49aa5
        • Size 712B
        • SHA256 24f007b4b48b5cdfd8d75c66393a0149e53b077e0fba2f58cdfb68eb98b47173
        • MD5 SHA1 SHA512 TLSH

        b502557c-ca7c-4373-a1ae-caae8f379c2a

        • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\b502557c-ca7c-4373-a1ae-caae8f379c2a
        • Size 708B
        • SHA256 d9c37564d3c4b1060b85b8ff7fc7673773af515fd6d2ec8ec5eff458ff3a7ff5
        • MD5 SHA1 SHA512 TLSH

        default.exc

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512

        3e9c57d2-080f-4326-9e0a-a581a3483f18.tmp

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\3e9c57d2-080f-4326-9e0a-a581a3483f18.tmp
        • Size 57B
        • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
        • MD5 SHA1 SHA512 TLSH

        f_000003

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\Cache\Cache_Data\f_000003
        • Size 340KB
        • SHA256 90a86751d7aef8eceabf24db33109851c1f285af5612daa78325079677583571
        • MD5 SHA1 SHA512 SSDEEP TLSH

        data_1

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\DawnWebGPUCache\data_1
        • Size 264KB
        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
        • MD5 SHA1 SHA512 SSDEEP

        data_0

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\GPUCache\data_0
        • Size 8KB
        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
        • MD5 SHA1 SHA512 SSDEEP

        data_2

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\GPUCache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP

        data_3

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\GPUCache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP

        37b0a5f6-7079-4410-a42d-2d13127e4a47.tmp

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\Network\37b0a5f6-7079-4410-a42d-2d13127e4a47.tmp
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH

        Network Persistent State

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\Network\Network Persistent State
        • Size 327B
        • SHA256 447568da4f25e6046845718d0c654a84795554b0c4404de3c474b96826f708f2
        • MD5 SHA1 SHA512 TLSH

        CURRENT

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512

        default.dat.tmp-8307086548c8fa15

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\default.dat.tmp-8307086548c8fa15
        • Size 826B
        • SHA256 2de92ea61f9d3f0c4a83ec6b60d7f92cd6ed7620f3f2ea252e246aa86af85c5c
        • MD5 SHA1 SHA512 TLSH

        default.dat.tmp-830708676914c65b

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\default.dat.tmp-830708676914c65b
        • Size 873B
        • SHA256 30ba70646013a2a549329068c2deaa197824b1c4e052519d641fa40748d35060
        • MD5 SHA1 SHA512 TLSH

        default.dat.tmp-8307086817dd88db

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\default.dat.tmp-8307086817dd88db
        • Size 941B
        • SHA256 a868a0eea8e1b9c48b5614d9e54fb5aeb7cb924ff7016e6e9bc266c45aa8e4a6
        • MD5 SHA1 SHA512 TLSH

        default.dat.tmp-830708745872bc68

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\default.dat.tmp-830708745872bc68
        • Size 977B
        • SHA256 7abb2144084785f0d995b44fb2822d4bde3ab4eb19066a82ee87de5da5cca74e
        • MD5 SHA1 SHA512 TLSH

        main.log

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\logs\20260901T235758\main.log
        • Size 10KB
        • SHA256 b066e1f9ad8edca4e345e38a1570f27edb5bf91a60a94922bcfb3e5335a591d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        opencode.global.dat.tmp-83070876526f6a35

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\opencode.global.dat.tmp-83070876526f6a35
        • Size 836B
        • SHA256 6f767557ec9b523bd4a7a58feec6a0ec13bff2c2b8de514c5fec8ca0080d5ca3
        • MD5 SHA1 SHA512 TLSH

        opencode.global.dat.tmp-8307087875b32b6f

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\opencode.global.dat.tmp-8307087875b32b6f
        • Size 1022B
        • SHA256 6f726ba6d7942c4c9b406fe3d84148be1d9176572c2c61562a31a20fad9eb74f
        • MD5 SHA1 SHA512 TLSH

        opencode.global.dat.tmp-83070880969ae6a2

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\opencode.global.dat.tmp-83070880969ae6a2
        • Size 1KB
        • SHA256 5099b69cbb3b1fdc635012b5bf5e58fc8c35aa2ff0f9c2318d0cb1f370eeb59d
        • MD5 SHA1 SHA512 TLSH

        opencode.global.dat.tmp-8307089028f87099

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\opencode.global.dat.tmp-8307089028f87099
        • Size 1KB
        • SHA256 ba2fe13d8a1c5d14aa29619a93e53eaa84f8c83b64de824a3d707aacf6b6268d
        • MD5 SHA1 SHA512 TLSH

        opencode.global.dat.tmp-8307090628e5c83d

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\opencode.global.dat.tmp-8307090628e5c83d
        • Size 2KB
        • SHA256 f1707330580386bef14a926ab7afa709520cc390dda229c33b9b10a269702667
        • MD5 SHA1 SHA512 TLSH

        opencode.settings

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\opencode.settings
        • Size 31B
        • SHA256 e98a45d499a921c2f68a8cda2b28c31cdb61b03812a82da33cb646abbf954d76
        • MD5 SHA1 SHA512

        opencode.settings.tmp-83070785639cab6d

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\opencode.settings.tmp-83070785639cab6d
        • Size 55B
        • SHA256 4974d79c089c51f8fa9f9f707d969fcb3c89905d893720e6fef7eebdc9ab5c4f
        • MD5 SHA1 SHA512 TLSH

        opencode.settings.tmp-83070846432ebfbf

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\opencode.settings.tmp-83070846432ebfbf
        • Size 116B
        • SHA256 677cce617a651217f1f94421af9ae0dbfaf554efb25279061714c8dab70dfee0
        • MD5 SHA1 SHA512 TLSH

        opencode.settings.tmp-83070876962e4ca9

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\opencode.settings.tmp-83070876962e4ca9
        • Size 156B
        • SHA256 72bbbacdb91c43a4ffcfcd6194040bd909e4173595c3cd905826ec2bd0567646
        • MD5 SHA1 SHA512 TLSH

        opencode.window.84673d6b-ec3f-43b9-9176-b0998b0d7d7f.dat.tmp-830708963235e84d

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\opencode.window.84673d6b-ec3f-43b9-9176-b0998b0d7d7f.dat.tmp-830708963235e84d
        • Size 260B
        • SHA256 458e3aa5d1c00071ab154fc025097530bc2be97c0d226ead611e2c954f29da2e
        • MD5 SHA1 SHA512 TLSH

        opencode.workspace.C--Users-Adm.165uql.dat.tmp-83070965932ec918

        • Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\opencode.workspace.C--Users-Adm.165uql.dat.tmp-83070965932ec918
        • Size 148B
        • SHA256 71de5c7e35756cecf52d47cf84ab8e046df8a0966edddcce8b118a3f76597d44
        • MD5 SHA1 SHA512 TLSH

        memory/120-65-0x0000000073770000-0x0000000073F2C000-memory.dmp

        memory/120-53-0x0000000073770000-0x0000000073F2C000-memory.dmp

        memory/120-54-0x0000000073770000-0x0000000073F2C000-memory.dmp

        memory/120-55-0x0000000073770000-0x0000000073F2C000-memory.dmp

        memory/120-59-0x0000000070130000-0x000000007017C000-memory.dmp

        memory/120-62-0x0000000007840000-0x00000000078D6000-memory.dmp

        memory/120-63-0x00000000077A0000-0x00000000077B1000-memory.dmp

        memory/856-1062-0x00007FFC89F10000-0x00007FFC89F11000-memory.dmp

        memory/856-1063-0x00007FFC8AC30000-0x00007FFC8AC31000-memory.dmp

        memory/1064-75-0x0000000070290000-0x00000000705EB000-memory.dmp

        memory/1064-72-0x0000000070130000-0x000000007017C000-memory.dmp

        memory/3584-34-0x0000000073770000-0x0000000073F2C000-memory.dmp

        memory/3584-49-0x0000000073770000-0x0000000073F2C000-memory.dmp

        memory/3584-32-0x0000000006FF0000-0x0000000007026000-memory.dmp

        memory/3584-31-0x0000000006050000-0x000000000609C000-memory.dmp

        memory/3584-30-0x0000000006020000-0x000000000603E000-memory.dmp

        memory/3584-29-0x0000000005C40000-0x0000000005F9B000-memory.dmp

        memory/3584-26-0x0000000005A90000-0x0000000005AF6000-memory.dmp

        memory/3584-25-0x00000000053D0000-0x0000000005436000-memory.dmp

        memory/3584-24-0x0000000005230000-0x0000000005252000-memory.dmp

        memory/3584-21-0x0000000073770000-0x0000000073F2C000-memory.dmp

        memory/3584-23-0x0000000073770000-0x0000000073F2C000-memory.dmp

        memory/3584-22-0x0000000005440000-0x0000000005A8A000-memory.dmp

        memory/3584-20-0x0000000002B00000-0x0000000002B36000-memory.dmp

        memory/3584-19-0x0000000073782000-0x0000000073783000-memory.dmp

        memory/3584-38-0x0000000007310000-0x00000000073B3000-memory.dmp

        memory/3584-39-0x0000000073770000-0x0000000073F2C000-memory.dmp

        memory/3584-40-0x0000000073770000-0x0000000073F2C000-memory.dmp

        memory/3584-41-0x0000000007A40000-0x00000000080BC000-memory.dmp

        memory/3584-42-0x0000000007400000-0x000000000741A000-memory.dmp

        memory/3584-43-0x0000000007470000-0x000000000747A000-memory.dmp

        memory/3584-37-0x0000000007030000-0x0000000007050000-memory.dmp

        memory/3584-48-0x0000000073770000-0x0000000073F2C000-memory.dmp

        memory/3584-33-0x0000000070130000-0x000000007017C000-memory.dmp

        memory/3584-46-0x0000000070290000-0x00000000705EB000-memory.dmp

        memory/3584-45-0x0000000007640000-0x0000000007664000-memory.dmp

        memory/3584-44-0x0000000007610000-0x000000000763A000-memory.dmp

        memory/5500-6361-0x000001EC48E30000-0x000001EC48E52000-memory.dmp

        memory/5500-6365-0x000001EC48FF0000-0x000001EC4900E000-memory.dmp

        memory/5500-6366-0x000001EC49010000-0x000001EC490C2000-memory.dmp

        memory/5500-6367-0x000001EC48FE0000-0x000001EC48FEA000-memory.dmp

        memory/5500-6373-0x000001EC48FF0000-0x000001EC49002000-memory.dmp

        memory/5500-6374-0x000001EC48FE0000-0x000001EC48FEA000-memory.dmp