Overview

overview

7

Static

static

3

Avatarlock...ne.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

Avatarlockpick.exe

windows11-21h2-x64

7

LICENSES.c...m.html

windows11-21h2-x64

3

d3dcompiler_47.dll

windows11-21h2-x64

1

dxcompiler.dll

windows11-21h2-x64

1

dxil.dll

windows11-21h2-x64

1

ffmpeg.dll

windows11-21h2-x64

1

resources/...app.js

windows11-21h2-x64

3

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

Analysis

  • geolocation tags

    cacanadananorth-americatoronto
  • max time kernel
    149s
  • max time network
    36s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    13/11/2026, 02:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Avatarlockpick-2026.11.12-b33-win-x64-standalone.exe
  • Size 102.8MB
  • Sample261113-cmp8daex7y
  • SHA256 d6521db5570adde02aed6470ac50a37e019f9b4e3487d8b6cd466b6288899e84
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 13 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Avatarlockpick-2026.11.12-b33-win-x64-standalone.exe
    "C:\Users\Admin\AppData\Local\Temp\Avatarlockpick-2026.11.12-b33-win-x64-standalone.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3992
    • C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\Avatarlockpick.exe
      C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\Avatarlockpick.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2052
      • C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\Avatarlockpick.exe
        "C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\Avatarlockpick.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Avatarlockpick" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1700,i,3557172084114345954,1372466266502654685,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1704,i,12955069936619558694,1001891732465419643,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1696 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2692
      • C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\Avatarlockpick.exe
        "C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\Avatarlockpick.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Avatarlockpick" --field-trial-handle=1700,i,3557172084114345954,1372466266502654685,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1704,i,12955069936619558694,1001891732465419643,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2256 /prefetch:11
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        PID:4408
      • C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\Avatarlockpick.exe
        "C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\Avatarlockpick.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Avatarlockpick" --app-path="C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=543867132 --field-trial-handle=1700,i,3557172084114345954,1372466266502654685,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1704,i,12955069936619558694,1001891732465419643,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2864 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1120
      • C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\Avatarlockpick.exe
        "C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\Avatarlockpick.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\Avatarlockpick" --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1700,i,3557172084114345954,1372466266502654685,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1704,i,12955069936619558694,1001891732465419643,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2936 /prefetch:10
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Network Service Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2888

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LICENSE.electron.txt
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LICENSES.chromium.html
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\LICENSES.chromium.html
        • Size 19.5MB
        • SHA256 e6e6b1f9cb0f32235412be113de7716333e88121f9159a0ea0ff3be652021af7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_100_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\chrome_100_percent.pak
        • Size 702KB
        • SHA256 ab7c4b7b6cb8832a31d44b95ec50ce52294f49422a3bdde4e21968eca2930cbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_200_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\chrome_200_percent.pak
        • Size 1.2MB
        • SHA256 30fa4a6e27c9ff2fb0f939f01158477e621a67d86e9ecb84cf11b3947db8eb9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dcompiler_47.dll
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\d3dcompiler_47.dll
        • Size 4.5MB
        • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxcompiler.dll
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\dxcompiler.dll
        • Size 24.6MB
        • SHA256 22d415f86ce445f4beb57afbb6856b3b83f19918ad270b6ae6047168ec73956d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxil.dll
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\dxil.dll
        • Size 1.4MB
        • SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffmpeg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\ffmpeg.dll
        • Size 3.0MB
        • SHA256 d38957b4351486a16141bdd3162643b811564ba6bfa1d12f374c13b70207dc11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\icudtl.dat
        • Size 10.4MB
        • SHA256 da53f0b69843aaa43315f0f210a67e4a874b0be338f3dae08ff57b8afe76ab0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        af.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\af.pak
        • Size 621KB
        • SHA256 3017b141bd16e24190d810f0748612f0fd4352ca8553002b9a63a7f77f7154f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        am.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\am.pak
        • Size 1005KB
        • SHA256 67b938d162bc75db067120bb8366b5bafd9a75fa99a0ca9ad4f46b47d1d37634
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ar.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\ar.pak
        • Size 1.1MB
        • SHA256 4c47004abd0969cb1174d06eb7429c024872207960986afbf3cae37e339a8d01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bg.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\bg.pak
        • Size 1.1MB
        • SHA256 2eb9c74c67e4b13b45a73061fa978738e335bc245da71bab0ea9b205fe91074e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bn.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\bn.pak
        • Size 1.4MB
        • SHA256 415621a5c0b1546e6e447d43b76414425a8703cc7681d637ec1f283ad0c787e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ca.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\ca.pak
        • Size 700KB
        • SHA256 6f28297c1ccb628f534d65dade167ae559f83eace359acf47e48ff890b9409d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cs.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\cs.pak
        • Size 725KB
        • SHA256 799a789ce531991cb975425730db310f9a8fe74091eee568f3e65fcc7ef0cd57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        da.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\da.pak
        • Size 650KB
        • SHA256 530fd95daee21d793b99492ca7d0bf9979daffe42944e24414d4b08a3d23b9fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        de.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\de.pak
        • Size 701KB
        • SHA256 58165025c4252ba8b2ce8203b59362b9968938cb0fef9d7da04941be22f41bb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        el.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\el.pak
        • Size 1.2MB
        • SHA256 37d2e1ef69fea9bdb1e0902cbc61a458baa9009fc3761029bd1c1882a7a0c9b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-GB.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\en-GB.pak
        • Size 566KB
        • SHA256 01d9200a5daee1770f7147b166d25baa6a8dd72c138c3c526421e656dec789f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\en-US.pak
        • Size 572KB
        • SHA256 23b271e8009bfa14783700cd0712b4ecaa5b8f2ea28a4d81ae1d7e05bc0c96b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        es-419.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\es-419.pak
        • Size 691KB
        • SHA256 2766fd52da83ff679346313e66440f013a7d478b9be946df4ab197505912450b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        es.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\es.pak
        • Size 687KB
        • SHA256 fe6fff51ef19db1f4fe0fc602e0bd4bd7fabcfb1ca5d6896d1ce0efcf37e49c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        et.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\et.pak
        • Size 627KB
        • SHA256 dd1205eae606f12510e24ce39f301439c98b3293d766ca5839dc292a14d7973c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fa.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\fa.pak
        • Size 1.0MB
        • SHA256 ba33624ccad6d0e4a4339589c56be557b28968bf9422bd12a8f26e2a3d581577
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\fi.pak
        • Size 639KB
        • SHA256 1f3123d7fb5c22a95b5250ea17450b665c3c6cd6a6dfd28bbdde15e1bf684a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fil.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\fil.pak
        • Size 724KB
        • SHA256 02e2c70d3d85b0deb677a9ae576ae3cf89e80774532cb3315c14f1e8ce64b310
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\fr.pak
        • Size 745KB
        • SHA256 8bad7fd88072ac66649dd9307da9163962f8ab00313e627bf1c5ca4450a48b4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gu.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\gu.pak
        • Size 1.4MB
        • SHA256 e86e8c240d4b6283abb03c49df9e8899607ef9def6d4933c7a541d63b5835271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        he.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\he.pak
        • Size 906KB
        • SHA256 ddc1f304ab1f4489d19ae2b31e7f8e3ffb47dae439520159e8975422c65e4115
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\hi.pak
        • Size 1.5MB
        • SHA256 015b3856dc05e8635a48e749e6970fe43f5d620b8dbd04e5abff586178213f6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\hr.pak
        • Size 698KB
        • SHA256 d46c64ae8af3562e37eb80438aa2bee228fafda251d58ba4d0991291f1c72aab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hu.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\hu.pak
        • Size 747KB
        • SHA256 0a46fc8d50f74effd1cfe1979e677df3de6fc47e6b551267303d93d57bd83f50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        id.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\id.pak
        • Size 620KB
        • SHA256 f567569c42a25bb2dfc5c33e13aac558c0e2a1d5d4b969592bbd0841b36438db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        it.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\it.pak
        • Size 677KB
        • SHA256 aeb1d99a2a09476d9ee0fd133df2d4d987c731b9f91a248ac4e60377ddda1ca5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ja.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\ja.pak
        • Size 822KB
        • SHA256 f6e0d8eda3bc8f1112494bda96b230f3c44f054c47cced50c94c5ee9199f04c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kn.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\kn.pak
        • Size 1.6MB
        • SHA256 af5fed2130102ecc0c878059c88faed9d6db2e8b147fb5ae9e15e3fe69706c8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ko.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\ko.pak
        • Size 701KB
        • SHA256 55a3a8db9c84b1fe9e50b56d68fb069ad7546117cf1f6cb89f36f49cc044ad5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lt.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\lt.pak
        • Size 759KB
        • SHA256 af969f4407c190dd01a426fa1244cb1ec7cdf2909d1c3ba5b87ff662ba567303
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lv.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\lv.pak
        • Size 756KB
        • SHA256 4455ab7c06172c2c80796a99558e41f452cc3b33be76654d70440cf4ac7a2d34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ml.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\ml.pak
        • Size 1.7MB
        • SHA256 b5606265910e45098a88e989202a550531f6d00333c6b112ed4c5cbc07b2ff6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\mr.pak
        • Size 1.4MB
        • SHA256 8465d4077ed5414cbcb7d9bdb00d85e515a1a069703cdc1d4d67c9d6e5623fb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ms.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\ms.pak
        • Size 652KB
        • SHA256 af7021a00befa586aa067ae3ccb339079e6f13ee0cab1621836f6abb608b6f2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nb.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\nb.pak
        • Size 623KB
        • SHA256 d97a2b0cbe6adc99add2ed3ce0d15d0bb124b778086c466c126634d60ea72608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\nl.pak
        • Size 649KB
        • SHA256 b642c8ab5ce11438e9a8fd4639244fa8f1d55cfd70269565490bc55ee907b048
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\pl.pak
        • Size 724KB
        • SHA256 8a0969fc743d3e2f5111387d53c0d79e8c1d9f68256ad6553b87fca2bcaa7e6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pt-BR.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\pt-BR.pak
        • Size 680KB
        • SHA256 5546559a56f9ac3191062c3fd42defd190a68e78ac988eb57fa5a6fd2dc5f874
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pt-PT.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\pt-PT.pak
        • Size 684KB
        • SHA256 bdfa7264dddf70f936f1785737969559a577b51d1952c820a468c611d18b17ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ro.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\ro.pak
        • Size 711KB
        • SHA256 1e6b5b0dac63a9e951daf523de310f6bd9e5c53e281f37706d41bd35d2a08bb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ru.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\ru.pak
        • Size 1.1MB
        • SHA256 a9e76536472c45b39e7ae2af5f3ae1bc0e50a11646efdb6fb3ca373b5f2e2c70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sk.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\sk.pak
        • Size 737KB
        • SHA256 3cdc8bca8696c90a572fb15c865caa5c286df45344c72194c3eea97201cc816a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\sl.pak
        • Size 705KB
        • SHA256 e1371c8df577b979e3a515af34b0aaa3d07153c7a5c55d39a9b49a7ffe62d3d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\sr.pak
        • Size 1.1MB
        • SHA256 c42a674e3f43aa70cef005931915c8b7ceb34b29566fba3309f8da931dc7861f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sv.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\sv.pak
        • Size 631KB
        • SHA256 7b0399a206bfbebe77d1a4fc598c8a6636a1bd940d3ab56519cf4af0134b6edb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sw.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\sw.pak
        • Size 669KB
        • SHA256 bd41ea707a0d90d683ec8d5d0f0c79f3e925747bc4ea1982562dfb75080199b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ta.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\ta.pak
        • Size 1.7MB
        • SHA256 91fb1460711df108d8d435a378c8be1d1e80b0886c0158d8c6ae92f35812681b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        te.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\te.pak
        • Size 1.6MB
        • SHA256 fc8c2706c5dfd36e7af8e380a240e0f697cc5fe969b512092a2185896512c4af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        th.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\th.pak
        • Size 1.3MB
        • SHA256 c1f4235c31bc05153230b0e55b7aabc9020d7460d5b0a025c386885e1e4bda3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\tr.pak
        • Size 681KB
        • SHA256 d5648d7eaf1826211fb244fcf8419dabdc16c228d92139bc8b0b73c7a6b7e700
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uk.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\uk.pak
        • Size 1.2MB
        • SHA256 ec5d0b426e289c064e8f2d63636ae2a544ff30fc1e99dde04fe1920971e4d060
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ur.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\ur.pak
        • Size 1023KB
        • SHA256 c218e21744df2ff0669a87d497d65d76333073577360d4c662c592de146bf82a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\vi.pak
        • Size 810KB
        • SHA256 76a32f8ad5d08a6f9899e12e4aa9b3d9a9023931e2ca0f73e5ced541c922dcfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zh-CN.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\zh-CN.pak
        • Size 578KB
        • SHA256 7887bd3d01e12306e32a11d9a20566ca0e93688a0375e6ff59da04cf782b1681
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zh-TW.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\locales\zh-TW.pak
        • Size 570KB
        • SHA256 7cb5f76e54a548d4e52aa8cdf226a4339bdadc304897abca690f407e95e42f4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resources.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\resources.pak
        • Size 11.9MB
        • SHA256 335d91338d271cc341cbea39179941cf043965f47aa5d1cd8ef0c98401ddcf9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default_app.asar
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\resources\default_app.asar
        • Size 108KB
        • SHA256 0eb2491b0a9ac94790389d39c09dd5005c6c1f0665842943829bbd0193f6cc4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevate.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snapshot_blob.bin
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\snapshot_blob.bin
        • Size 360KB
        • SHA256 ec901619d6c0d2589d30e94cb60c313b49dd9c2e4334b6deeb454ac97a67ce21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        v8_context_snapshot.bin
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\v8_context_snapshot.bin
        • Size 724KB
        • SHA256 883f08309bf436fb442d1903452a69c03747ed77c5f502e88667d9aa1b706556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        version
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\version
        • Size 6B
        • SHA256 3e1e0322d949de3be7e5b9883a0c8014660aafa67e417a7d86b281e9733829a1
        • MD5 SHA1 SHA512
        Submit Download

        vk_swiftshader.dll
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\vk_swiftshader.dll
        • Size 5.3MB
        • SHA256 e66cfe13aafbd7d80226e3ce085de5786479de35f7d6a75eded9ecb4ebf9784b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vk_swiftshader_icd.json
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vulkan-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\3M0pj1FS26oR05RvoYBqcZp3YW8\vulkan-1.dll
        • Size 917KB
        • SHA256 85d52af200d0020855e91477f6334b59e12167f051991b2a0bb35b9697c0c778
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StdUtils.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsy8C2F.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsy8C2F.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsis7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsy8C2F.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        the-real-index
        • Path C:\Users\Admin\AppData\Roaming\Avatarlockpick\Code Cache\js\index-dir\the-real-index
        • Size 48B
        • SHA256 03e0fe6afe458fd6340fa5355c603796ead73a4494a1f91a253a9fc32fd023cd
        • MD5 SHA1 SHA512
        Submit Download

        data_0
        • Path C:\Users\Admin\AppData\Roaming\Avatarlockpick\DawnGraphiteCache\data_0
        • Size 8KB
        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_1
        • Path C:\Users\Admin\AppData\Roaming\Avatarlockpick\DawnGraphiteCache\data_1
        • Size 264KB
        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_2
        • Path C:\Users\Admin\AppData\Roaming\Avatarlockpick\DawnGraphiteCache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_3
        • Path C:\Users\Admin\AppData\Roaming\Avatarlockpick\DawnGraphiteCache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        CURRENT
        • Path C:\Users\Admin\AppData\Roaming\Avatarlockpick\Local Storage\leveldb\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        default.dic
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512
        Submit Download

        image.ico
        • Path C:\Windows\SystemTemp\scoped_dir2052_1068371894\image.ico
        • Size 361KB
        • SHA256 8963651144fb5ea4224f422ae23d700fee9eb3ad6defae766d9a4a070515f422
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1120-610-0x00007FFD593F0000-0x00007FFD593F1000-memory.dmp
        Download

        memory/1120-609-0x00007FFD5A950000-0x00007FFD5A951000-memory.dmp
        Download

        memory/2692-690-0x000001989A1E0000-0x000001989BA78000-memory.dmp
        Download

        memory/2692-685-0x000001989A1E0000-0x000001989BA78000-memory.dmp
        Download

        memory/2888-707-0x00000211CA9C0000-0x00000211CA9C1000-memory.dmp
        Download

        memory/2888-706-0x00000211CA9C0000-0x00000211CA9C1000-memory.dmp
        Download

        memory/2888-705-0x00000211CA9C0000-0x00000211CA9C1000-memory.dmp
        Download

        memory/2888-718-0x00000211CA9C0000-0x00000211CA9C1000-memory.dmp
        Download

        memory/2888-717-0x00000211CA9C0000-0x00000211CA9C1000-memory.dmp
        Download

        memory/2888-716-0x00000211CA9C0000-0x00000211CA9C1000-memory.dmp
        Download

        memory/2888-715-0x00000211CA9C0000-0x00000211CA9C1000-memory.dmp
        Download

        memory/2888-714-0x00000211CA9C0000-0x00000211CA9C1000-memory.dmp
        Download

        memory/2888-713-0x00000211CA9C0000-0x00000211CA9C1000-memory.dmp
        Download

        memory/2888-712-0x00000211CA9C0000-0x00000211CA9C1000-memory.dmp
        Download

        memory/2888-719-0x00000211C8FC0000-0x00000211CA858000-memory.dmp
        Download