Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 18:46

General

  • Target
    ARP-Vision-AI-0.1.0-Windows-x64.exe
  • Size 102.8MB
  • Sample261024-xeszhsdv2q
  • SHA256 c7a6d40c30bce26510e16c261c1105adb6c4d35ae1bc3d37c077b11b3331ac6c
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 14 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

  • Network Service Discovery 1 TTPs 6 IoCs

    Attempt to gather information on host's network.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ARP-Vision-AI-0.1.0-Windows-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\ARP-Vision-AI-0.1.0-Windows-x64.exe"
    1⤵
    • Loads dropped DLL
    • Network Service Discovery
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:780
    • C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\ARP Vision AI.exe
      "C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\ARP Vision AI.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4280
      • C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\ARP Vision AI.exe
        "C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\ARP Vision AI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\arp-vision-ai" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1776,i,4637912395821456698,2389195304067211247,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1780,i,16923052720041940092,7298358391824983198,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1772 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Network Service Discovery
        PID:3216
      • C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\ARP Vision AI.exe
        "C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\ARP Vision AI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\arp-vision-ai" --field-trial-handle=1776,i,4637912395821456698,2389195304067211247,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1780,i,16923052720041940092,7298358391824983198,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2040 /prefetch:3
        3⤵
        • Executes dropped EXE
        • Network Service Discovery
        • Reads the TCP/IP host and domain name from the registry
        PID:4548
      • C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\ARP Vision AI.exe
        "C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\ARP Vision AI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\arp-vision-ai" --app-path="C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1776,i,4637912395821456698,2389195304067211247,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1780,i,16923052720041940092,7298358391824983198,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2944 /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Network Service Discovery
        PID:1816
      • C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\resources\engine\arp-vision-input.exe
        C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\resources\engine\arp-vision-input.exe
        3⤵
        • Executes dropped EXE
        PID:548
      • C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\ARP Vision AI.exe
        "C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\ARP Vision AI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\arp-vision-ai" --app-path="C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1776,i,4637912395821456698,2389195304067211247,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1780,i,16923052720041940092,7298358391824983198,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=1752 /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Network Service Discovery
        PID:3372
      • C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\ARP Vision AI.exe
        "C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\ARP Vision AI.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\arp-vision-ai" --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1776,i,4637912395821456698,2389195304067211247,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1780,i,16923052720041940092,7298358391824983198,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=1076 /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Network Service Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2076
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2020

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          LICENSE.electron.txt

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\LICENSE.electron.txt
          • Size 1KB
          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
          • MD5 SHA1 SHA512 TLSH

          LICENSES.chromium.html

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\LICENSES.chromium.html
          • Size 19.5MB
          • SHA256 e6e6b1f9cb0f32235412be113de7716333e88121f9159a0ea0ff3be652021af7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_100_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\chrome_100_percent.pak
          • Size 702KB
          • SHA256 ab7c4b7b6cb8832a31d44b95ec50ce52294f49422a3bdde4e21968eca2930cbe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_200_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\chrome_200_percent.pak
          • Size 1.2MB
          • SHA256 30fa4a6e27c9ff2fb0f939f01158477e621a67d86e9ecb84cf11b3947db8eb9d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          d3dcompiler_47.dll

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\d3dcompiler_47.dll
          • Size 4.5MB
          • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          dxcompiler.dll

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\dxcompiler.dll
          • Size 24.6MB
          • SHA256 464772bfaa07fdb378e14f8ccf6d6e8b1d053dddcc2b59f57862d6912f39a023
          • MD5 SHA1 SHA512 SSDEEP TLSH

          dxil.dll

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\dxil.dll
          • Size 1.4MB
          • SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icudtl.dat

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\icudtl.dat
          • Size 10.4MB
          • SHA256 da53f0b69843aaa43315f0f210a67e4a874b0be338f3dae08ff57b8afe76ab0d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          af.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\af.pak
          • Size 621KB
          • SHA256 3017b141bd16e24190d810f0748612f0fd4352ca8553002b9a63a7f77f7154f8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          am.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\am.pak
          • Size 1005KB
          • SHA256 67b938d162bc75db067120bb8366b5bafd9a75fa99a0ca9ad4f46b47d1d37634
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\ar.pak
          • Size 1.1MB
          • SHA256 560244ecff0d522b6fbf97693bdde0a318c5bc516615cb15751ee2527a6eb730
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bg.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\bg.pak
          • Size 1.1MB
          • SHA256 2eb9c74c67e4b13b45a73061fa978738e335bc245da71bab0ea9b205fe91074e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\bn.pak
          • Size 1.4MB
          • SHA256 415621a5c0b1546e6e447d43b76414425a8703cc7681d637ec1f283ad0c787e7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ca.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\ca.pak
          • Size 700KB
          • SHA256 6f28297c1ccb628f534d65dade167ae559f83eace359acf47e48ff890b9409d5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cs.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\cs.pak
          • Size 725KB
          • SHA256 799a789ce531991cb975425730db310f9a8fe74091eee568f3e65fcc7ef0cd57
          • MD5 SHA1 SHA512 SSDEEP TLSH

          da.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\da.pak
          • Size 650KB
          • SHA256 236b73e0bd8cf984609f03612b40d4583525b0293f994ef5bbddecfaa3aa1e7f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\de.pak
          • Size 701KB
          • SHA256 52b9d92d2d09532a6016ce07a355e7acb385a9ea245436e0db188a76b8b7f622
          • MD5 SHA1 SHA512 SSDEEP TLSH

          el.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\el.pak
          • Size 1.2MB
          • SHA256 37d2e1ef69fea9bdb1e0902cbc61a458baa9009fc3761029bd1c1882a7a0c9b2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-GB.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\en-GB.pak
          • Size 566KB
          • SHA256 56ea59d5f21fbd25dfc02a6de4504cb134464f388e64509b2ea1657e238aa427
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-US.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\en-US.pak
          • Size 572KB
          • SHA256 23b271e8009bfa14783700cd0712b4ecaa5b8f2ea28a4d81ae1d7e05bc0c96b1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es-419.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\es-419.pak
          • Size 691KB
          • SHA256 530e5b8edc93f95a64700178c2a3fbb55f4d4eadec8cabba25fd21bc5835c63e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\es.pak
          • Size 687KB
          • SHA256 f0982c7ebc30101e609225e2011339378c96075e094e082b694a467eca1108cd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          et.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\et.pak
          • Size 627KB
          • SHA256 1e3b4eb21d233e3adaab469310a8c6c61e045379771cbc381c4c000e1716ab28
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fa.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\fa.pak
          • Size 1.0MB
          • SHA256 0e57a54b3be643b9f5e3c46d40a26d40e00915828b0ab9dfd39991cff1283240
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\fi.pak
          • Size 639KB
          • SHA256 1f3123d7fb5c22a95b5250ea17450b665c3c6cd6a6dfd28bbdde15e1bf684a0e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fil.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\fil.pak
          • Size 724KB
          • SHA256 02e2c70d3d85b0deb677a9ae576ae3cf89e80774532cb3315c14f1e8ce64b310
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\fr.pak
          • Size 745KB
          • SHA256 8bad7fd88072ac66649dd9307da9163962f8ab00313e627bf1c5ca4450a48b4a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\gu.pak
          • Size 1.4MB
          • SHA256 e86e8c240d4b6283abb03c49df9e8899607ef9def6d4933c7a541d63b5835271
          • MD5 SHA1 SHA512 SSDEEP TLSH

          he.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\he.pak
          • Size 906KB
          • SHA256 ddc1f304ab1f4489d19ae2b31e7f8e3ffb47dae439520159e8975422c65e4115
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\hi.pak
          • Size 1.5MB
          • SHA256 015b3856dc05e8635a48e749e6970fe43f5d620b8dbd04e5abff586178213f6e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\hr.pak
          • Size 698KB
          • SHA256 d46c64ae8af3562e37eb80438aa2bee228fafda251d58ba4d0991291f1c72aab
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\hu.pak
          • Size 747KB
          • SHA256 0a46fc8d50f74effd1cfe1979e677df3de6fc47e6b551267303d93d57bd83f50
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\id.pak
          • Size 620KB
          • SHA256 f567569c42a25bb2dfc5c33e13aac558c0e2a1d5d4b969592bbd0841b36438db
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\it.pak
          • Size 677KB
          • SHA256 0a4090fd79acda3b75ea4cbf59c299b7fbb2c8ed69696158c6f3620bf1901955
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\ja.pak
          • Size 822KB
          • SHA256 65a19121dfdd2163072d104cfe71970d132e76847d6ead6a2c103212314e83b0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          kn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\kn.pak
          • Size 1.6MB
          • SHA256 af5fed2130102ecc0c878059c88faed9d6db2e8b147fb5ae9e15e3fe69706c8a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\ko.pak
          • Size 701KB
          • SHA256 56449cc28bc41af4ccbf35b98dd30019839e8cc193f7ecf4ccd8dacc26302303
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lt.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\lt.pak
          • Size 759KB
          • SHA256 af969f4407c190dd01a426fa1244cb1ec7cdf2909d1c3ba5b87ff662ba567303
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\lv.pak
          • Size 756KB
          • SHA256 4455ab7c06172c2c80796a99558e41f452cc3b33be76654d70440cf4ac7a2d34
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ml.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\ml.pak
          • Size 1.7MB
          • SHA256 b5606265910e45098a88e989202a550531f6d00333c6b112ed4c5cbc07b2ff6a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\mr.pak
          • Size 1.4MB
          • SHA256 8465d4077ed5414cbcb7d9bdb00d85e515a1a069703cdc1d4d67c9d6e5623fb0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ms.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\ms.pak
          • Size 652KB
          • SHA256 af7021a00befa586aa067ae3ccb339079e6f13ee0cab1621836f6abb608b6f2a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nb.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\nb.pak
          • Size 623KB
          • SHA256 d97a2b0cbe6adc99add2ed3ce0d15d0bb124b778086c466c126634d60ea72608
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\nl.pak
          • Size 649KB
          • SHA256 b642c8ab5ce11438e9a8fd4639244fa8f1d55cfd70269565490bc55ee907b048
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\pl.pak
          • Size 724KB
          • SHA256 8a0969fc743d3e2f5111387d53c0d79e8c1d9f68256ad6553b87fca2bcaa7e6e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-BR.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\pt-BR.pak
          • Size 680KB
          • SHA256 8d893475afae1f579c7199f245aad184650b0224e697e80cfe700b4061f6c16d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-PT.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\pt-PT.pak
          • Size 684KB
          • SHA256 bdfa7264dddf70f936f1785737969559a577b51d1952c820a468c611d18b17ca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ro.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\ro.pak
          • Size 711KB
          • SHA256 1e6b5b0dac63a9e951daf523de310f6bd9e5c53e281f37706d41bd35d2a08bb5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ru.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\ru.pak
          • Size 1.1MB
          • SHA256 a9e76536472c45b39e7ae2af5f3ae1bc0e50a11646efdb6fb3ca373b5f2e2c70
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\sk.pak
          • Size 737KB
          • SHA256 8eff7365eff78623cd26e40d40540f52b511df96c2824f62531da65f0d3a8087
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\sl.pak
          • Size 705KB
          • SHA256 0e1c50e529821f318e4200e024d863daccd78e15de1a5658fa3fb1ebf6312bd1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\sr.pak
          • Size 1.1MB
          • SHA256 c42a674e3f43aa70cef005931915c8b7ceb34b29566fba3309f8da931dc7861f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\sv.pak
          • Size 631KB
          • SHA256 7b0399a206bfbebe77d1a4fc598c8a6636a1bd940d3ab56519cf4af0134b6edb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sw.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\sw.pak
          • Size 669KB
          • SHA256 bd41ea707a0d90d683ec8d5d0f0c79f3e925747bc4ea1982562dfb75080199b9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ta.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\ta.pak
          • Size 1.7MB
          • SHA256 91fb1460711df108d8d435a378c8be1d1e80b0886c0158d8c6ae92f35812681b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          te.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\te.pak
          • Size 1.6MB
          • SHA256 fc8c2706c5dfd36e7af8e380a240e0f697cc5fe969b512092a2185896512c4af
          • MD5 SHA1 SHA512 SSDEEP TLSH

          th.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\th.pak
          • Size 1.3MB
          • SHA256 c1f4235c31bc05153230b0e55b7aabc9020d7460d5b0a025c386885e1e4bda3c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\tr.pak
          • Size 681KB
          • SHA256 3a3bc4efffaf53859a9b2d8488f2ea4862a6a082c2af68a125923cc01f69a79c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\uk.pak
          • Size 1.2MB
          • SHA256 ec5d0b426e289c064e8f2d63636ae2a544ff30fc1e99dde04fe1920971e4d060
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ur.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\ur.pak
          • Size 1023KB
          • SHA256 c218e21744df2ff0669a87d497d65d76333073577360d4c662c592de146bf82a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\vi.pak
          • Size 810KB
          • SHA256 b3171c4c3c1b7803c606eee280456b380d57984745f6719afeb8d95591071c25
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-CN.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\zh-CN.pak
          • Size 578KB
          • SHA256 66c3984c1345b5aba722005458b9cc0af54496260ad06f2509c7afa011d4981f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-TW.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\locales\zh-TW.pak
          • Size 570KB
          • SHA256 45f34b57f5b54ba521561d4f818e650430114a713de36b72603b880db939ad37
          • MD5 SHA1 SHA512 SSDEEP TLSH

          resources.pak

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\resources.pak
          • Size 11.9MB
          • SHA256 9611f9a65a37eea7d7f631eba0ed2cc49205f47aaa8a2937694ca2de2d821bd8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          app.asar

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\resources\app.asar
          • Size 32.2MB
          • SHA256 2651e1631de8a7e27a05f72fbc8c9d400d3a0efba47c931794543745460e9fc2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          default_app.asar

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\resources\default_app.asar
          • Size 108KB
          • SHA256 0eb2491b0a9ac94790389d39c09dd5005c6c1f0665842943829bbd0193f6cc4f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          elevate.exe

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\resources\elevate.exe
          • Size 105KB
          • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
          • MD5 SHA1 SHA512 SSDEEP TLSH

          arp-vision-input.exe

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\resources\engine\arp-vision-input.exe
          • Size 1.4MB
          • SHA256 876a2e524f51cca1623028dc7e687a443036d820f04a75bdd86163bb1400fc4d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          snapshot_blob.bin

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\snapshot_blob.bin
          • Size 360KB
          • SHA256 e20e875e78f7eef460fe1a6f7066212be9097bcc84e2dea2d2cc2cada96473a6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          v8_context_snapshot.bin

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\v8_context_snapshot.bin
          • Size 725KB
          • SHA256 88d93ed0f028d74b78dc610f2cf60f0838035b2ad3b79a9d2f9f930a4dd7e10a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          version

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\version
          • Size 6B
          • SHA256 9331b8f378c9763a3bdd6870abf39ed41af9e675435294a06ec6f4bd6c82165e
          • MD5 SHA1 SHA512

          vk_swiftshader.dll

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\vk_swiftshader.dll
          • Size 5.3MB
          • SHA256 2ae263d1079d9b1e4a231879cf7048dc517b2806748b38f36547b5b8c649cddd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader_icd.json

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\vk_swiftshader_icd.json
          • Size 106B
          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
          • MD5 SHA1 SHA512 TLSH

          vulkan-1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\3L9AObkGYjdCkkd7cldHxlhnWP7\vulkan-1.dll
          • Size 917KB
          • SHA256 03120814ccb06e0fa9141cfa7c2ec906984f32ef56f8caf50e56e97a7a3225fa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ffmpeg.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsb388C.tmp\7z-out\ffmpeg.dll
          • Size 3.0MB
          • SHA256 96094bc6b5082e6372a9aa21970fcecfc069abd68caf4b48673b84dc3e8cf99b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          StdUtils.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsb388C.tmp\StdUtils.dll
          • Size 100KB
          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          System.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsb388C.tmp\System.dll
          • Size 12KB
          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsis7z.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsb388C.tmp\nsis7z.dll
          • Size 424KB
          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
          • MD5 SHA1 SHA512 SSDEEP TLSH

          default.dic

          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512

          temp-index

          • Path C:\Users\Admin\AppData\Roaming\arp-vision-ai\Code Cache\wasm\index-dir\temp-index
          • Size 48B
          • SHA256 ba1b1bbc2ba9dc9755d56b1de30ba18dbee585f1b9f8cfc2f7a6ca4461a15f34
          • MD5 SHA1 SHA512

          data_0

          • Path C:\Users\Admin\AppData\Roaming\arp-vision-ai\DawnGraphiteCache\data_0
          • Size 8KB
          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
          • MD5 SHA1 SHA512 SSDEEP

          data_1

          • Path C:\Users\Admin\AppData\Roaming\arp-vision-ai\DawnGraphiteCache\data_1
          • Size 264KB
          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
          • MD5 SHA1 SHA512 SSDEEP

          data_2

          • Path C:\Users\Admin\AppData\Roaming\arp-vision-ai\DawnGraphiteCache\data_2
          • Size 8KB
          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
          • MD5 SHA1 SHA512 SSDEEP

          data_3

          • Path C:\Users\Admin\AppData\Roaming\arp-vision-ai\DawnGraphiteCache\data_3
          • Size 8KB
          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
          • MD5 SHA1 SHA512 SSDEEP

          CURRENT

          • Path C:\Users\Admin\AppData\Roaming\arp-vision-ai\Local Storage\leveldb\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512

          Preferences

          • Path C:\Users\Admin\AppData\Roaming\arp-vision-ai\Preferences
          • Size 57B
          • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
          • MD5 SHA1 SHA512 TLSH

          Preferences58bf4bca-b927-4d79-8a84-3caa9ba322d2.tmp

          • Path C:\Users\Admin\AppData\Roaming\arp-vision-ai\Preferences58bf4bca-b927-4d79-8a84-3caa9ba322d2.tmp
          • Size 132B
          • SHA256 d12d62b14c0cfc37fb8dead458ac2d43a06e3c063c638433e85c16c1ef8c7a12
          • MD5 SHA1 SHA512 TLSH

          memory/1816-594-0x00007FFEBF880000-0x00007FFEBF881000-memory.dmp

          memory/1816-593-0x00007FFEBEBC0000-0x00007FFEBEBC1000-memory.dmp

          memory/1816-698-0x0000022D922C0000-0x0000022D92615000-memory.dmp

          memory/2076-762-0x0000015C5D500000-0x0000015C5D501000-memory.dmp

          memory/2076-761-0x0000015C5D500000-0x0000015C5D501000-memory.dmp

          memory/2076-763-0x0000015C5FFF0000-0x0000015C61888000-memory.dmp

          memory/2076-752-0x0000015C5D500000-0x0000015C5D501000-memory.dmp

          memory/2076-751-0x0000015C5D500000-0x0000015C5D501000-memory.dmp

          memory/2076-750-0x0000015C5D500000-0x0000015C5D501000-memory.dmp

          memory/2076-756-0x0000015C5D500000-0x0000015C5D501000-memory.dmp

          memory/2076-757-0x0000015C5D500000-0x0000015C5D501000-memory.dmp

          memory/2076-760-0x0000015C5D500000-0x0000015C5D501000-memory.dmp

          memory/2076-759-0x0000015C5D500000-0x0000015C5D501000-memory.dmp

          memory/2076-758-0x0000015C5D500000-0x0000015C5D501000-memory.dmp

          memory/3216-688-0x00000221B6F40000-0x00000221B87D8000-memory.dmp

          memory/3216-708-0x00000221B6F40000-0x00000221B87D8000-memory.dmp

          memory/3372-699-0x00000213D05C0000-0x00000213D0915000-memory.dmp