hxxps://www[.]dezor[.]net/

Analysis

user interaction
yes
max time kernel
157s
max time network
159s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-de
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-delocale:de-deos:windows10-ltsc_2021-x64systemwindows
submitted
08/05/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://www.dezor.net/
Sample260508-3d4brafv61

Score

8^/10

defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
58	4752	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	Dezor.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	Dezor.exe

Executes dropped EXE 6 IoCs

pid	Process
5328	Dezor-v4.2.2-x86_64.exe
5712	Dezor.exe
2972	Dezor.exe
5344	Dezor.exe
4632	Dezor.exe
2700	sslocal.exe

Loads dropped DLL 15 IoCs

pid	Process
5328	Dezor-v4.2.2-x86_64.exe
5328	Dezor-v4.2.2-x86_64.exe
5328	Dezor-v4.2.2-x86_64.exe
5328	Dezor-v4.2.2-x86_64.exe
5328	Dezor-v4.2.2-x86_64.exe
5328	Dezor-v4.2.2-x86_64.exe
5328	Dezor-v4.2.2-x86_64.exe
5712	Dezor.exe
2972	Dezor.exe
2972	Dezor.exe
2972	Dezor.exe
2972	Dezor.exe
2972	Dezor.exe
5344	Dezor.exe
4632	Dezor.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
98	raw.githubusercontent.com
99	raw.githubusercontent.com
93	raw.githubusercontent.com
94	raw.githubusercontent.com
95	raw.githubusercontent.com
96	raw.githubusercontent.com
97	raw.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5068	tasklist.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_719312052\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4608_1005921223\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_719312052\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_144912417\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_144912417\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_719312052\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_144912417\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\uk\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1552857367\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Dezor.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Dezor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dezor-v4.2.2-x86_64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4752	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "164"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227563006014806"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\mediaurl\shell\open	Dezor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\mhub\URL Protocol	Dezor.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\mhub\shell\open\command	Dezor.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\mhub\shell	Dezor.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\mhub\shell\open	Dezor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\mhub\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Dezor\\Dezor.exe\" \"%1\""	Dezor.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\dezor	Dezor.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\dezor\shell\open	Dezor.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\mediaurl\shell\open\command	Dezor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\mediaurl\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Dezor\\Dezor.exe\" \"%1\""	Dezor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\dezor\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Dezor\\Dezor.exe\" \"%1\""	Dezor.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-880639880-2214913997-617214392-1000\{2DC916AA-4079-4707-B485-C881CE1385DE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\mediaurl	Dezor.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\mediaurl\shell	Dezor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\dezor\URL Protocol	Dezor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\dezor\ = "URL:dezor"	Dezor.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\dezor\shell	Dezor.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\mhub	Dezor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\mhub\ = "URL:mhub"	Dezor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\mediaurl\URL Protocol	Dezor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\mediaurl\ = "URL:mediaurl"	Dezor.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\dezor\shell\open\command	Dezor.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Dezor.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5328	Dezor-v4.2.2-x86_64.exe
5328	Dezor-v4.2.2-x86_64.exe
5068	tasklist.exe
5068	tasklist.exe
2756	msedge.exe
2756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	tasklist.exe
Token: SeSecurityPrivilege	5328	Dezor-v4.2.2-x86_64.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe
Token: SeShutdownPrivilege	5712	Dezor.exe
Token: SeCreatePagefilePrivilege	5712	Dezor.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6476	LogonUI.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 5064	4608	msedge.exe	83
PID 4608 wrote to memory of 4752	4608	msedge.exe	85
PID 4608 wrote to memory of 5584	4608	msedge.exe	86
PID 4608 wrote to memory of 5584	4608	msedge.exe	86
PID 4608 wrote to memory of 5584	4608	msedge.exe	86
PID 4608 wrote to memory of 5304	4608	msedge.exe	87
PID 4608 wrote to memory of 5304	4608	msedge.exe	87
PID 4608 wrote to memory of 1120	4608	msedge.exe	88
PID 4608 wrote to memory of 2692	4608	msedge.exe	89
PID 4608 wrote to memory of 1120	4608	msedge.exe	88
PID 4608 wrote to memory of 1120	4608	msedge.exe	88
PID 4608 wrote to memory of 2692	4608	msedge.exe	89
PID 4608 wrote to memory of 2692	4608	msedge.exe	89
PID 4608 wrote to memory of 4764	4608	msedge.exe	93
PID 4608 wrote to memory of 5916	4608	msedge.exe	94
PID 4608 wrote to memory of 4764	4608	msedge.exe	93
PID 4608 wrote to memory of 5916	4608	msedge.exe	94
PID 4608 wrote to memory of 5164	4608	msedge.exe	96
PID 4608 wrote to memory of 4172	4608	msedge.exe	99
PID 4608 wrote to memory of 4172	4608	msedge.exe	99
PID 4608 wrote to memory of 4172	4608	msedge.exe	99
PID 4608 wrote to memory of 568	4608	msedge.exe	100
PID 4608 wrote to memory of 568	4608	msedge.exe	100
PID 4608 wrote to memory of 2336	4608	msedge.exe	101
PID 4608 wrote to memory of 2336	4608	msedge.exe	101
PID 4608 wrote to memory of 2336	4608	msedge.exe	101
PID 4608 wrote to memory of 2220	4608	msedge.exe	102
PID 4608 wrote to memory of 5328	4608	msedge.exe	103
PID 5328 wrote to memory of 4448	5328	Dezor-v4.2.2-x86_64.exe	105
PID 4448 wrote to memory of 5068	4448	cmd.exe	107
PID 4448 wrote to memory of 5976	4448	cmd.exe	108
PID 4608 wrote to memory of 5908	4608	msedge.exe	116
PID 4608 wrote to memory of 4660	4608	msedge.exe	117
PID 4608 wrote to memory of 4976	4608	msedge.exe	118
PID 4608 wrote to memory of 1160	4608	msedge.exe	119
PID 4608 wrote to memory of 1160	4608	msedge.exe	119
PID 4608 wrote to memory of 1096	4608	msedge.exe	124
PID 4608 wrote to memory of 1096	4608	msedge.exe	124
PID 5712 wrote to memory of 2972	5712	Dezor.exe	125
PID 5712 wrote to memory of 5344	5712	Dezor.exe	126
PID 5712 wrote to memory of 4632	5712	Dezor.exe	127
PID 5712 wrote to memory of 5340	5712	Dezor.exe	128
PID 5340 wrote to memory of 3960	5340	cmd.exe	130
PID 5712 wrote to memory of 2700	5712	Dezor.exe	131
PID 4608 wrote to memory of 6192	4608	msedge.exe	133
PID 4608 wrote to memory of 6192	4608	msedge.exe	133
PID 4608 wrote to memory of 2916	4608	msedge.exe	135
PID 4608 wrote to memory of 2916	4608	msedge.exe	135
PID 4608 wrote to memory of 2756	4608	msedge.exe	136
PID 4608 wrote to memory of 6456	4608	msedge.exe	141
PID 4608 wrote to memory of 6456	4608	msedge.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.dezor.net/
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff8f9dc188,0x7fff8f9dc194,0x7fff8f9dc1a0
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,16487610781031742042,1465485230592919544,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,3048499897053673692,2971046162618974934,262144 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,8846060413990606749,17200667681125296113,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,1263583437654044846,3375127914457065051,2097152 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,17369240726380287285,11781212911136074651,2097152 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,5448751723739600571,3665284492873589291,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,8601325855223125552,8728646895777197278,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,541720748930361334,1234375810792377523,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,541720748930361334,1234375810792377523,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6008,i,9718632459317239917,12709254240745468761,2097152 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=de --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,4022894515106956441,372155596385813675,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:8
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6388,i,6922309472472433174,17264851860244723726,2097152 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,4598001530328649716,3818162628013612502,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:2220
- C:\Users\Admin\Downloads\Dezor-v4.2.2-x86_64.exe
  "C:\Users\Admin\Downloads\Dezor-v4.2.2-x86_64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Dezor.exe" | %SYSTEMROOT%\System32\find.exe "Dezor.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Dezor.exe"
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5068
  - - C:\Windows\SysWOW64\find.exe
      C:\Windows\System32\find.exe "Dezor.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=772,i,18398973771011311250,1451839654109182284,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=136 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,10879817958413097473,13223593387577113943,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,6227705124620362759,18425919126675927209,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=772,i,16904141818981377626,16113434097399363834,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,15908223440621874735,13821139563715723639,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,6205818452710644996,11851467338441068390,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:6192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,679671832082290482,10150541295269634782,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6988,i,14444898928008720098,10156729955705772486,262144 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,11172538860902467718,1894973406063635383,524288 --field-trial-handle=2416,i,3627787723570071269,11972451044496561519,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:6456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2792

C:\Users\Admin\AppData\Local\Programs\Dezor\Dezor.exe
"C:\Users\Admin\AppData\Local\Programs\Dezor\Dezor.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5712
- C:\Users\Admin\AppData\Local\Programs\Dezor\Dezor.exe
  "C:\Users\Admin\AppData\Local\Programs\Dezor\Dezor.exe" --type=gpu-process --no-sandbox --use-gpu-in-tests --user-data-dir="C:\Users\Admin\AppData\Roaming\Dezor" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1820,i,3022464292258485270,15565167794605493347,131072 --enable-features=PlatformHEVCDecoderSupport --disable-features=AudioServiceOutOfProcess,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2972
- C:\Users\Admin\AppData\Local\Programs\Dezor\Dezor.exe
  "C:\Users\Admin\AppData\Local\Programs\Dezor\Dezor.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Dezor" --standard-schemes=mhub,mediaurl --secure-schemes --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2036 --field-trial-handle=1820,i,3022464292258485270,15565167794605493347,131072 --enable-features=PlatformHEVCDecoderSupport --disable-features=AudioServiceOutOfProcess,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5344
- C:\Users\Admin\AppData\Local\Programs\Dezor\Dezor.exe
  "C:\Users\Admin\AppData\Local\Programs\Dezor\Dezor.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Dezor" --standard-schemes=mhub,mediaurl --secure-schemes --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\Dezor\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --no-sandbox --autoplay-policy=no-user-gesture-required --register-pepper-plugins=mpvjs.node;application/x-mpvjs --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2632 --field-trial-handle=1820,i,3022464292258485270,15565167794605493347,131072 --enable-features=PlatformHEVCDecoderSupport --disable-features=AudioServiceOutOfProcess,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5340
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:3960
- C:\Users\Admin\AppData\Local\Programs\Dezor\resources\app\node_modules\shadowsocks-bin\win32\x64\sslocal.exe
  C:\Users\Admin\AppData\Local\Programs\Dezor\resources\app\node_modules\shadowsocks-bin\win32\x64\sslocal.exe -c C:\Users\Admin\AppData\Roaming\Dezor\cache/ss-3223.json
  2⤵
  - Executes dropped EXE
  PID:2700

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39f7055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3987e6960d50d0b9f4805ddd01d890dd49f30972396d7aa724fe55264630df86
MD5 72df2a200dc3f360121221061041e05c
SHA1 a0ffce40276da9c8f22d0765b43ba3ecfce78466
SHA512 924446a32d5be59b3b032829b97b136ce0eb2369a0e4f2f5ab6d99d948a51ebd95aa3b14cf8487f6fa6eb13a3f5b22fced5b017c4cadbfc1cd31b4d2f40d463f
TLSH
T162D0806C15715D35CCD66970059577293726C863AD53975A1837243C1CC246115AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 89181e384b24058cc97a65a0b8b694c40ce28512b1eede72d5e1d6b5c63cfc1a
MD5 467e5bd6d8dca8502ace0f4aff434630
SHA1 73056831a2d4cd469a83a8aa920146b15f62a00a
SHA512 c2778aa2b73b5e2bea491c580f2f444fb44a5dfe2e80745d5a5f46f26042b0f8946f375a418630bfa4c54dd87209163fd763ac7f65ae7b3b1d2204cdd0f80a60
TLSH
T143E022BACA24AD3708F9076D24A4470AEB50131B2B41894F373D9A0C8FB433A43C281C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 75e3790b6b1a8c40159a61662be24cc64b80bf0c631532bc4a4b8dcc851e0e03
MD5 13c8ea468213e49ab44faf63064e5139
SHA1 ca1f3cf80555f90910c455aeb90ff3e96aa39348
SHA512 5a0ecbe0b2774e56889ed750878fdf4747577044ccead2523ac665d9da77ae3b3f2908f730b8ba321c8946bfb290a988b5b772511ab54d153a2f41ba65bb9aad
TLSH
T1D451E70C1EA08196D3E384729FDF21857F398919A903EF2015FC46FD7E17B555A8E41C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 2d15d1a30785666c49831a5f576a862cbcf96e20e769a85459f93b023a1fb8d0
MD5 8b81c51427788daa7c346b9f7679e4c1
SHA1 b466666ca62f4102f15a65b4b84907a97b184028
SHA512 170baf598b42456ff411222239f85c936c74e063f1b5677f763c9d2eb99ce633d4ec96e49eacf6a0981bb5447433c3c030c17b43ca40ca5aba08d9a798b5051f
SSDEEP 1536:RfEE4+V7loQNNGZqW3w5PDuVjbpBuW8vRZsM62UhPq:qSVOZi7ZU0
TLSH
T1DFB35227D6A64C6B01F16264EC754382F325436F9282A82F3A3C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 535096d0948e62d7c1913023e522491b3b1c943a2006308a37a92fb05ef1cd5a
MD5 bd0f13c19507850965c0620130e3973e
SHA1 c5bedcac4130c2f0eaad5ee0bfe1debc3f49fc79
SHA512 20d7ef9959627bfed1c8cbc9ee967f28977240f9fb45df28a756f9a7f18bca69b638eb5d577182f754c4e5358aa4688f589a8d0d8e5da565981fe8fd686d3c44
TLSH
T1AE51BEF783E8867D891152F4FA196E2FCE590521532C3D6BC9E49E1BA3E2470E100A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 601cc1fae0deb36ad61ff349b89701fe64211f855cea8dbbfe0f0c499535c99c
MD5 7b4aa86bb44144471e2f0e8b28747b5a
SHA1 2ba2c7b7b22a309fb1b7a608b173a56c6b866cfe
SHA512 d6c6c4cd422a8d44336719b9210fb8c7a873cc166c3242bf29ad5f6532367fb9d7e2eb836cdf599e85d7ebacab26f76e218aa9d82bd2e0f286294d64392e056c
TLSH
T1FA51BEF783E8867D891152F4FA196E2FCE590521532C3D6BC9E49E1BA3E2470E100A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e84dd09331c6cafc840551f84fa6bedeb73398dac55a849fbc813121f150a5aa
MD5 c46b8e911f587347d9c3e7fdc44fa1cf
SHA1 64e149ef1287f20b7d066629784dfa15611afc98
SHA512 024f9e32d5fb4ce5101473e7fa18364ee48054a576441ae8b98ad75db9a313504da0555e9ac311da9f3f781065964125f3cf6d3e455202e3f1b15c7ad3936e09
SSDEEP 192:sxZmqRDyijBKOMl8UQTjv/fCs190qicyuzodpaKHW6+WNaQh/Yt3hIwAIg5gYPJ:sxZmqwq3v/fCs19SDFHbn/HbR
TLSH
T18372D815AA38997B8CD7D219FA45BB53D7F91523D1904E489AFC8B0C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b5e78357fae5f9fb3a39a2e239cb0582319b4fe9fd7b4e5887cd785187c0c1d5
MD5 b7f95cae83a8335546b64dc8fd7b23ec
SHA1 902ac2931eb2628b1bd25c518757ab0ce94506c9
SHA512 300cf764b6cddd3cd1276d03e03bfeaeb6c5823dc9ca41ed56fbe820a25bf15685fcaa30fae2b54e9a694bce0369999f4890a422b90d1c19ff5e900e78e58b53
SSDEEP 192:sxZmqRDyijBKOMl8Mjv/fCs190qicyuzodpaKHW6+WNaQh/Ytuh7wAIg5gYPJ:sxZmqwbv/fCs19SDFHbn/lbR
TLSH
T10372C715AA38997B8CC7D619FA45BF53D7F91523D1904E489AFC8B0C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 df975dada5a9526584157f4e5322f204d1cbfde888919ef7d646b1ba8aad7baf
MD5 c0c9a875db71e6c3957b02e3585c3e75
SHA1 52c63ca1bc0d2c1bbd20d75c69f2ae5cfd341e38
SHA512 3a1b4b1dba9ba6806ddcdbe044e80ce41b21b7f71b6d9c091896fa8eb903a209622a3f5e1a546bd9e26716f76f1b88db877fa257f47646686a3adee5d310dfad
SSDEEP 192:sxZmqRDyijBKOMl8M9v/fCsV20qicyuzodpaKHW6+WNaQh/Yt9P7wAIgjYJ:sxZmqw1v/fCsV2SDFHbn/Mj8
TLSH
T13562C815AA28997B8CC7D219FA45BF53D7F91533D1904E489AFC8B0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 4b8ac2fa48e9b6601ef77734c4fb65b4d968486f68863c5baed6d7b7fa9251cb
MD5 16a274deda6d973c5a4c0cdfc371811d
SHA1 77b11f0b479499c61b8584eacd124d6bfcdb0906
SHA512 c700d94949f1092a59957dc85a096ba6bc992ffa4dc1d9fe9705a3f4b4bad4f23a09ea570a6184870060bfab5344f8b96425949b356967274394bb3b0ba5e0a4
SSDEEP 768:wsk8n557pLkdL/PvWvP5kF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTI/eLlkqHdvr+:wsk8n5PkJ/PvWvP5kFu1jaiI/eLiId81
TLSH
T114F2FB3B280CCB7E4F800E9CDC2A7E9F6DE8028F96D8895447E9944C03DA6EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 e35e775a2bfe691254372a648be8d10796984c66fcbc37ade4c6d37239f3d836
MD5 7cdf709fad5bd01e123571fe9a427169
SHA1 53c600f96e91f99a99b251733fcffdee032e4de5
SHA512 7388546db53aa043b4937cb4a4474986cce74725e18e6fa4dfaa60930af567b5999131e5e14952dbcf1a3c24c414ca558e44948cedff4668abd7ed28e5ecb8ca
SSDEEP 192:eflBf6532xxBzXcn5H3P0hHduz40ekw/ItEsGWtKRWO14gcMGLQMWc4nQlsEuOtP:eNJ652DBjc5H/0RSXzn5
TLSH
T1A6C25A51763A02903A7E69CA8595B96F52C331733118E53B7BB900A25F6BE20CDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0852d5fd35a811fe118d046d4df2fd601e0b4f5154084e8e589cab64d9d650e3
MD5 ab07757cdd4842514988132eaf07d87b
SHA1 d67559ac53b06857ef5b623d9da4f9678fa07406
SHA512 6a00a3f42c165914e2c04faf7781e799d87003ded577f91a678d5c60659a1b5f2db995fc1f915798457c7102b87bc5ed5cf2999d57cdf87eecefdf52f5e189ea
SSDEEP 768:DF/cpeywgzTfGuyYTMO64vfXGwLaArXY4v:cecTf64XWwLJB
TLSH
T14DC26C35D8A8CAABEDE68FD5E35A3657EEE00163C2CC9AD4D9D91E0D00871DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8ff3b873ee42abd5a210eda7546274e8d6c2d53b708a934a545c4da768036cd2
MD5 dd23b7715cd87a81da37c48e8b69f537
SHA1 9571947603b2b9c5902592b86bc00b943348e5f7
SHA512 089e98ed6916d0fc9fe0c1a3c32b20ed30b57760fb21905a3f892bff5602492cc4a35911dcec2fe73b6caa7599b21c418709fa9ea8b1260542a59964d1d6b884
SSDEEP 384:nriFavqMg3sNI8TUNTUlImkrqOABAp1VNrfnY5hMO6HcRYV/Vw1mRt7irrN1k+5U:GFayv39wgRxnYTMO6HcRYk1mb7G8
TLSH
T1BFC26C35E894D9ABEDE68FD9EB497A07EEE001A7C58C4AC8D6D81E0D00D71DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2a3e77588c252bb83c0fecc4fca642b41c7526e3f0a0e1951b64625590a01671
MD5 eabbcf3b7610bc622627e091d6001aa8
SHA1 3891b035f0f72b4692b6dde58c9ed3120cecb3a5
SHA512 a4479b65464b0b3fdcf9bd2172863c0620490d1262ab071f0ffd982c5569626c803bb8e0fecf777a9259029e3ed226b81afd9f4c24aa60146e77eb5492796c20
SSDEEP 768:CFtcpSywgzTfVuyYTMO64vf7GwLaArXY4v:BScTC64XiwLJB
TLSH
T126C26C31D8A8DAABEDE78FD5E35A3657EEE00163C2C89AD4D9D91E0D00871DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f9dfad572bcbc48430c6cd27e702fffccd7284ef10ca553b0b5c697dc2201638
MD5 7530b37e46b45c4b35beee67419e19a2
SHA1 c1ed7a8c02ff78f87c83a7d387c9d886c724c369
SHA512 9bb847850570a389d6a2664b57b25495f5f014daa97075d63a1298bdaec36f5c3d6eae2b2e3dea999bbdb8f1b0c3f730009db0d0bb11d1fb6402ef4d083d2ec2
SSDEEP 768:DFKcpeywgzTfGuyYTMO64vfXGwLaArXY4v:1ecTf64XWwLJB
TLSH
T196C26C35D8A8CAABEDE68FD5E35A3657EEE00163C2CC9AD4D9D91E0D00871DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 c29b9e5abb317effb0533e10c034a597bc8ac4f0360f138d183c94d98cd7c376
MD5 75e3fdb93eb1138e0cd16ddd3530b408
SHA1 1034c84eddc2d63a35401b246853ca611642b1c8
SHA512 401377d46af144dde1d3f34a81c4b74931dbca6b751b79b5876db9f2e50c8871bd3133cbbd059c7cb22195743ab63e8ddf22bfb09e8d156c7e7cabd97a66c687
SSDEEP 768:VFKcp/ywgzTfvuyYTMO64vfsGwLaArXY4v:v/cTk64XBwLJB
TLSH
T10BE2B2F198DB8977E89E8B97A37D2D069EBCC153B1884994B7D50D0CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 84ef7c173b68a98bbb5646cb5fbdb745319b1e34bb3574b8768cfe472f4c190d
MD5 7b27384035e58a2f672976b81caf79f4
SHA1 380e5b56d99538129a8dae399e121cb9c15f46ab
SHA512 b3bf36ef8df82f1425f3e0e233adf993cf505f5072087be15ae59f6a2e1f0334b985bfaadbfa932e29f04d443195858e32c9a7b6b0c117b2a0d78d889aa22c8b
SSDEEP 768:CFccpD3ywg3TfrXYTMO64vf7GwLaArXY4v:GD3sTw64XiwLJB
TLSH
T1EAC26D31D8A8DAABEDE68FD5E35A3657EEE00163C2CC9AD4D9D91E0C00871DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d346c0d7f36b840102ee165e17faeaa023c01e2a8351c523b6c2d0bcb3675902
MD5 8ccecf805cde4fd9923073ac41801e71
SHA1 d258cb4ad7fe2a37fe73419d2f82098e7fcf3afe
SHA512 ffec57706fd2488513293fc76d356ac4250c98717f4320f3ccfeb875df6055523822c0b1f0b4aa707d3338e07bce19dd123abe4ce0ae6f0b83e81b16344dcf0c
SSDEEP 384:nOiFavqMg3sNH8TUNTUlImkrqOABAKbmNrfnY5hMO64PXfUGRYV/Vw1mRt7irrNK:lFayv3CwgReiYTMO64vfUGRYk1mb7G8
TLSH
T1E7C25C35E894D9ABEDE68FD9E74A7A07EEE00167C58C4AD4D6D41E0D00D719E170FC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8fa837aaa29ae0f51b15da58c3597e355bf77627a7718882f02ade182fd9a715
MD5 72963dcbe9a0dfd884a29377f982062a
SHA1 8e10c6b5b053fc01d39c0e040e08ea5179e13b80
SHA512 aa3c8214b922d4731ad412b6f06464806b7586d5c459fc958ea6cdff04fcd45eef3c48381e7a68fb9898f9fe8442d25988bd3e765bbd77a631b125b4369ee0aa
TLSH
T1A23120E18C3D2AD1C8FD0E6EA05B7CFC94D8C32AF5B871795824EE94463A91E640043F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1cd772609af97cca1737d69b57b4c8cab1c516870b4621b6d5154b795c1d0f38
MD5 ce0b1e964c79684b2ca484d2d8ab18ee
SHA1 86d9d4cb680a0e0d79d35ee6aba80990ce73ab56
SHA512 3d7633c53a22666fc17988f72b3014380fab19bc1dc2cf724726b27c9227e1c1809e58b9494394dc2eb4e4a1bddc88bebb14aad5820dcfd4b31642a161005565
TLSH
T1BF412C58A6E91108B3B77F56AFF6A86E487BBD772E46D45E00110E4F0A22B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\LICENSES.chromium.html
Size 6.3MB
SHA256 c5a05048505c00af46c75fb5ca22057f09dce001eada3a756c3839d59011758f
MD5 34999967f735b07e9cbcf6c397cea4db
SHA1 8001fcdd6ce0c6e5a3d91fd45e4c9726fa67f3e4
SHA512 b6c2f722b6551231801e453bba8f9593d9f1a82edb305869ee07ef77f286968eb6ad5db1abbe750e88c8af973c362ee161aa5c591ea04ff39e4f4b34e6fa4baf
SSDEEP 24576:/PV05W5WS9YzHIlGMmfu626s6W6a6q5AHWeQFpD:F9n
TLSH
T12866942F7B48037306C602A2AB8BA5CBF21B903F3B565654345CD1681F6BE2543FB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\chrome_100_percent.pak
Size 126KB
SHA256 bca4401b578a6ac0fe793e8519fed82b5444972b7d6c176ec0369ed13beaad7b
MD5 44a69827d4aa75426f3c577af2f8618e
SHA1 7bdd115425b05414b64dcdb7d980b92ecd3f15b3
SHA512 5c7bdf1f1deb72c79b860bf48f16c19cb19b4d861c0b6beb585512ad58b1bc4b64e24edfcd97233e5b91dcd0f63ed1c7b278d22ec062fd0dfe28fe49cae52049
SSDEEP 3072:DKzwqCT4w/qzOovg6/Csp7O2o418Gb0+VRLf0ld0GY3cQ39Vm2I:DKzwt44yrgKpyK18Gb0OV8ld0GecQ3f2
TLSH
T1C4C3E0D7B3F5EDBDCA5355B3A12640B2ECB246351A92034A478FD8362A3674DD8C8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\chrome_200_percent.pak
Size 175KB
SHA256 b2c25fb30fee5f04ccdb8bf3c937a667502d266e428425feeb5af964f6167d48
MD5 9c379fc04a7bf1a853b14834f58c9f4b
SHA1 c105120fd00001c9ebdf2b3b981ecccb02f8eefb
SHA512 f28844dba7780e5f5c9d77ac3d29069dfcd6698447d5723886e510eadd51d6285e06adbda06bf4a69f841afc161c764cb2e5b9ad2c92f0a87176709b4acd2c13
SSDEEP 3072:oDQYaEQN6AJPgqzOovg6/Csp7rfR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNN:oDQYaNN68gyrgKpngx5GMRejnbdZnVEd
TLSH
T19804E1DB63B4DD7DC9630AB3A22901F1ECB1123559B6425B53DFEC353A56B8988CC283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
MD5 cb9807f6cf55ad799e920b7e0f97df99
SHA1 bb76012ded5acd103adad49436612d073d159b29
SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
TLSH
T19E367D5673E940A9C1BBD138CE478213EBB1781403345BEB5191C669EF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\ffmpeg.dll
Size 2.6MB
SHA256 906b781978ee1524039abc6eafea3c66e7fa45748184e87fb4cf2931e774b6f4
MD5 f7478ad3e40fcf468bb7218a152c7dc2
SHA1 c81ef6dd8ddea5c23ad1afe05ff830720ffcd80b
SHA512 eac024adaf1958c8b858fbca65da11cf35b244770567f4d269bb90db9da65dd5897e9d431bcd5d5d8787631f1eaf3dedc71f5a1e2ec710cf296e386c9370383f
SSDEEP 49152:/YuqVaqc35GHXVNtcZ44yODvSEbO/1o/GRRpYN4MJ8eIknusyUUjkU+jLtyTzQVD:/YLVl54yODvH/ySJUiLtyTzQVkU5qkJx
TLSH
T1F8C59E13E6D644DDC01EC27487AF9233F93138468724A5EF2A9196252F3AFD06E7E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 8d8a74ca376338623170d59c455476218d5a667d5991a52556aa9c9a70ebc5e5
MD5 cf9421b601645bda331c7136a0a9c3f8
SHA1 9950d66df9022f1caa941ab0e9647636f7b7a286
SHA512 bc9601e2b4ab28130bfadfd6f61b3ed500deb0bd235dc5ca94999c09f59d10bdcbf278869a9802f918830041f620c88e2c3b506608ade661db48ccd84c1977eb
SSDEEP 196608:j5zwSv9AAyse6liXUxCGZHa93Whlw6ZCnG0:jyKlysTliXUxCGZHa93Whlw6ZCnr
TLSH
T134B62907A2FB4DC2F9F7AF30D8F552679567BD496E32805A01442F3B1C337A08661BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\libEGL.dll
Size 464KB
SHA256 71e4896016446bb46984a4cb11741a1fea9f2da40fcc2808847206147530fae4
MD5 4b1c6fae4e5ad623642408f029dbcd93
SHA1 9a5e55ef7afb81061b0be90c183957db77268511
SHA512 ae69e3b782ddfda96b8d168be0839c10bae5eaf297cf3a2f8676329c513259f9c31c81e0f1ea59ed69add79196c2793a5465da2a3ea12948ecc2629cff548232
SSDEEP 6144:r3rGS+e87yDqHfFetvM/jvtGgJ53B6Zj8s1al2zl0ovk1Su7e:XGS+e87A6eZM/jvtGgJZB6ZirS
TLSH
T1EEA48D16779444B9D03AC1748A538612DE72B8920F25F7EF12A4927D2F77BF85B3A320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\libGLESv2.dll
Size 7.0MB
SHA256 7de7578c77d402fa646ea6d051ce6c31e1c133bd44e45ac013f1175d2ad7fffe
MD5 c4f82de52f2f0e59720c982f12c0dd35
SHA1 e9cade984f41a1e476b2cbdc65d1798245037326
SHA512 84ccda975f8b714f6e1f9c617ee0b32be18d304c2ca2785c2f467fae465801452f45562cf012a5b543fdc553ff850519fd8f14a44849e5db500de17e27319074
SSDEEP 49152:+eVuXb3YA7G9pc1VFcghzu1nkSUvSZZ54xzSDXUJV76dLLeEyet6r2ehnWJ6TQVU:/WZ7+CmV1L/zvWXtKZHWJvlP1H
TLSH
T19A766B07E695409DC05DD2B88B5BA222FA70BC490724B2DF269473152FB7BF46BBE710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\af.pak
Size 327KB
SHA256 b1987cdcbb8d76598422aa1739a246ed6690dc1b211f950fcbf2f040491ed7a8
MD5 c9312ff081e600e5fb4483b46ddd7c23
SHA1 1ff05a6a06cc73caf2d7545a3821d90c228ac0af
SHA512 20c136b44770aa0e06259687656675a3e14310ea4e8ba214726b216bc1bcad6026267bf0132cbca642c0b5c49293386d0a1bd93ba40e1c33b648ae70416e8898
SSDEEP 6144:ZP+kgc+kVWlEvC9Z5D49Em7kLjB6oAYxjYgDbwxesB+xSK1IA3y25tHwDwv22iGe:ZPfclEvC2im4LjB6oAYxjYgDbwAVSK16
TLSH
T170641B0ADB80273D05E07696FA0445F7BB9CB26DD770B2BADD9981321962EFC01BD1D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\am.pak
Size 531KB
SHA256 ee363b88697a26d486c77bbf05f5f7f62d4b40c235e1d85e11448083070576f7
MD5 e8bac983607c5432f789afdacdda42ac
SHA1 95c26f47f7102be338263fd7f7e365632651f22e
SHA512 5e26f40c8dc088d21b9b6a01041ece3bd4b2899ee33fdd85be995545c7a24860fdc9c672da8c9345a08891e0bac04ccf4d65de543f4cfba0bab0ae3fb32354c7
SSDEEP 12288:GguzxX8xfzKsEYg95z9SBeuUPQvx30jH8+I:GX8xfzKnYg95z9SBoPQr
TLSH
T128C4BB547DF9F7170F8E8A19A4321E8E9594AD4652813C38C35AE3FC2B2DF1B4CDA219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\ar.pak
Size 574KB
SHA256 bfa2a3c3ebb3c6afbca42cb70b4da8f997068d511cf40ee8a952a893b8f9d7cd
MD5 d1d99f4f2045531edc47d37a367402bd
SHA1 825385e524ece779c641a4ce2a57d14ff126d509
SHA512 4255b02c19ed373d711068a2d4639d462372071cc2aadb6afce459d9fe19bda21ffcbf1604e4937617cd5fee996f9b3786be1c2bed4dc4919d849c7a988a6ac0
SSDEEP 12288:el2RFtqr0jXjiRp8DvYUBuSYRrA5SNbr+ATg8Y3MgSEN6h:m2Ru1fRk52+M
TLSH
T1C5C47BE21A2584720B96DF0FD1E2366CE872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\bg.pak
Size 608KB
SHA256 6c10b64d31e0dc2c4befc6703ac17343ca473b4350cfb3c6e01833f505b69590
MD5 96372403a9ded96f3a699262029a4580
SHA1 07069b20fe303f6eef1fb6c8c0a19266a0c705c9
SHA512 0df60fe13818f0c3c6838e77686c5de9fa03b97cbf0943f7a2a4ae2f3a0890d3d64b3a7652d8c81c23de876ac92e4c6b71d584fb106c3520c96ef76ba30250fd
SSDEEP 12288:dPnB1xlYrdAs1alUDpzaVVwsl867mFyY3SKN3rsbDxXs7Jfu64KGzrFSZp8VqJ5O:dvBjlYrdAs1alUFTsWoY3SKIVcdu6pGB
TLSH
T1D1D433A15B9A689F0101F45F98087E093CEB54FE3FE7879241642DBD39F20B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\bn.pak
Size 780KB
SHA256 297d52b252df0912490ddf26fa58706895e70c2a0f3f09d0dc756706720095ef
MD5 cb203032925be270222dc2c20fe771e2
SHA1 2f2f20bbbd07ee01cc996247bd9c2f40037dff80
SHA512 052be75c51051949c84216566b462733b61026ba74e212b000cbed7d93cb852e74ae83d64d2eaadc3093af4265b6783184cf8e0368a75e077d4b75daba40f9b4
SSDEEP 3072:Kw+ZjJj+E7z0eC6HcvR1kgBbdawSU5ZwXll4:4tJXZ78vRNBbdz5ily
TLSH
T10405EE209C6E91B2A8D5CDC9434C6370C1236E9B9B61F34DDC17A24938ADC7C8DADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\ca.pak
Size 371KB
SHA256 78bbee9bf6c95d239418037fd4660d081ebc0f369e727e613b6b652e380e6dd0
MD5 de21c7d001b771d4d59e2acfdd67dd44
SHA1 ef5870e9cf34416edbec6aa76a6feb77b70b9acf
SHA512 3276a84a4b4d90b47789a7ce6a3ae34afec187145a438fbdb7f398152b182e97ba10acda4941456ea2387c03c101bc2b1716a8950897ea3be180b3d8c073902e
SSDEEP 6144:moaCg6EDiYqdSIs3cehEYBC2l3nbh9aGHQl2SwAGwXZM0dLbpuQRBtryBocaGIlI:Hg6EO9dSIs3cehEYBC2l3nbh9aGHQl2t
TLSH
T1D0840A238BCD3B7604D2220AFB46C317F18CA9847B16D294F5AF0B5622CDADCD673695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\cs.pak
Size 377KB
SHA256 08e40f5efc616cdc0588fb4b1a706d997c69d17ddaf97eb91a4aabafaa11cee6
MD5 3e2c49143f4718ddd9c1c74f8599fac2
SHA1 7cce45de66a3895c3493b998fef7bedf045b29e2
SHA512 a849ca0d09e0d4c025d9de6c8008c13e13581961c321f53a552deeaa210db891914386fd51673615aec8b5d8d68a921a968db5d0fe447963892ceb0948861e3d
SSDEEP 6144:QhKH/gwYPl/XACAjRe15q8+Y1zAXn5q8QM:9fgdPl/Q3e15q8+Y1AXnF
TLSH
T1F0843B1EDB936435894002487BFA4228BD5E87500B6FA5BB7CCF98862175B7E8FF4D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\da.pak
Size 342KB
SHA256 13c9583127d9d723801c946039e60f72dbbde898dd23fb9f675b9e299d0ce72a
MD5 f3a47e259c59de0aabef03e6b5a263ca
SHA1 c45bd961c8bb84331d652f4399675b365f5dfe23
SHA512 4249456e572403249580905f1b4b4471b6a8d84c6c71201c42adc862d4e0d33f957ae1057109e900a10a029a8dfc45257b0e0e283ad9eca21a30498a0795eff2
SSDEEP 6144:eAzv/f19wl6qKJwRXFGZO2Z5nYryGzOWi05TWwc:5H9IF85Yr5T0
TLSH
T176746C8BCC5C332FC6A90B65F2108EA7EB5D953CC680664F75D8943A09CBD6093BE1D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\de.pak
Size 367KB
SHA256 8bd127d689be65e45bb8d2a2ff66698200da97835809c6b56ec9e2929b70618a
MD5 cfc9d90273c31ccf66d81739aa76306a
SHA1 ecab570041654b147b3dd118829e2f7ae668f840
SHA512 c9a5058b34c4045ff1b7ae25f1f47bff14d06b3a97b7b1f30da65618ca7aeb0638d79f4e1cea4773cd92d9dfa7f9d2203e5734d0cfe11ee2d2a460d6cec18380
SSDEEP 6144:F+QNkAjzYyqSFaPjON3Be0mzBWCj0Xs5HgIxBI0gql:cQLjMyvFaCN3mzBd5xy0gql
TLSH
T1C0840703ADDB625EC78273607701CDBB7718E26BC346316794DDD13BA54BAB283AC426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\el.pak
Size 664KB
SHA256 bc07e403272a4d65305fe24a827404d7b931d01cda547f8c07a840d19e591430
MD5 8f5a15560710db2af852512b7298b93e
SHA1 30a13ebef10108effbad8c24b680228660658415
SHA512 e3cedc0eaa82b10a68a40aca8ec1379a6bb924766e1c5abd97e39c621dcbc195d6c1ff80921c2320f0f1c87d160bc2a6258108399876339e5104f98d90a861de
SSDEEP 12288:RdquNwK202pgaZH4q5OaPY3HvO9K63/fgBsbfFnxHuhWTT9rkv0pfBtMMkffFZig:RdquNwK202pgaWqsaA3Hm9K63/fgBs9I
TLSH
T16AE4DFEFB4542DED8086950785D8F07C67C62D6CE749CBD86229CB20BDF90719A22E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\en-GB.pak
Size 299KB
SHA256 e1e357c853eed83fb6c4133f8f4df377a8eda4fe6f0e55395f21c5ab6e38faa8
MD5 05ac84aa6987eb1f55021b6fba56d364
SHA1 58cb66bba3af0c6cc742488ccc342d33fc118660
SHA512 c615e1eb01412c5e2c0402242d442a6cf08965318d1c0d261ca5bc6df9acba5efa2c87ade20e1e4740d2239ea56d1ce4d3fc7a4c3eabe81b876ecb364b3e91b6
SSDEEP 6144:WJeP/KOb6vG8GGvDJAgdMP9ectcaAfaYEnG2J05SSvqo:1COb6ugdMrcarnGf5SSio
TLSH
T105643D1FF784226906931162BB45A6A2FB26D07CA31116673CBD802C33B6B56C3777E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\en-US.pak
Size 302KB
SHA256 a99bd31907bbdc12bdfbff7b9da6ddd850c273f3a6ece64ee8d1d9b6ef0c501c
MD5 3fef69b20e6f9599e9c2369398e571c0
SHA1 92be2b65b62938e6426ab333c82d70d337666784
SHA512 3057edfb719c07972fd230514ac5e02f88b04c72356fa4a5e5291677dcbab03297942d5ecdc62c8e58d0088aed4d6ea53806c01f0ea622942feb06584241ad2d
SSDEEP 6144:yoaiWmH9xPN6DacNMP9elahdQfaYejDJDsN5ySMZswS:taiWF+cNMbhd7jDJi5ySEswS
TLSH
T15E645D1FE784226A069352627F05A5A2FB36C06DA35112573CBC812C33B7B66C3777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\es-419.pak
Size 366KB
SHA256 943fa8774ade38d57349a5d27869097a782bc06bd34c40864a85ba829457d127
MD5 13c6d0a268545541f325375d431b41ae
SHA1 5f5c41348f00c5e5539d261c2b76ae6e3ec7af83
SHA512 09cbb2b21304ca8afa8b760b738adb5422e83550085f1aed8e8590eeef04a2b0e131e1ead6723c3e85383630c483d7720e55f71305ff4821d7822fe6d7aa4252
SSDEEP 3072:rt+uPUzEx0HrKJBjQMU0dmdv5jrqMCOyu0sdzPh7buhwwJ3Os57lLfGLFg3WSszj:rt+o+I0H6nUxv5rYQQJH5sLFg3WSsTG6
TLSH
T191842B22AAC81F5310E2A348B783D753E5D49545F408C29BE8EB83A562CCF8CD977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\es.pak
Size 367KB
SHA256 11ef2c0229c1fe1c10be08e3d5f36c973bc3c272f37b40e05c534a118757461b
MD5 c8086dc25cf0a3c978b2c3b37edf8d67
SHA1 7b6d2ce8b3cc5a33ab2bcd23114fe65ccc568e7a
SHA512 230e6999a6fea1df3b2708eb331a2c25ca53677b3453745ff9cc7fbbc013b69148af5609166720255a2db7e63b25e2d0c599fb07057a6b47bf61f63ea9db9e01
SSDEEP 6144:OYkS2J1Bc2UoWCfgfr56ZLb5R7q5zrB7bUlo4AN6PZmz:OYl2XWn5r0pFRm5zreloXnz
TLSH
T1DA841922AACC1F6340D39349B783D743E5D89585B408C29BE8EF87A651C8F8CC967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\et.pak
Size 330KB
SHA256 3599e7138a24a31839da877cc9718b9c0c9522437ea93a6222a119080f108d14
MD5 054865950b3b9e8312a7f9490268eaca
SHA1 28b0176112eddb7af58386b4f8aed4a49b9a2661
SHA512 bfc72f19ad1a52c0da82409accb33a27b2844ed29010207268c7d695ad7562a8867a87b70ac50142909b50b81a5c84d6f6a43968353ae7a72bc042aea8cbb59f
SSDEEP 6144:GPJXg42WkHwGkDmzZpDM0djry2zuJbT/RcLvihV15Ujc43ceLfLPQu:6JuvymrDbWF15Ujf
TLSH
T184744B42A17D771B692412F4D223AE63DC9FE7C974000D9678974A1970FEF8C39B2B68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\fa.pak
Size 535KB
SHA256 bb28ad47e95aefaa2d8d7b6a7f449f9707cfadbcd4c21bad8bd8a6578108d2cd
MD5 c27431f2de37b9643b83e383f7eae5a8
SHA1 16d068d9738e1aa9b94658299a4eac3972520864
SHA512 4ccc46dc7756ea0e60e6d278bcac1262a54ba03742fd0eb4d9f1f962486394fa56491844871dacb4cb0501c6f594334d3f23f3db82bfdfa1f938e1ae609d6600
SSDEEP 12288:aGz43DX9nuya1jfwHLwNUaGSSfStQvueKT+JwMTAKzIxRAQiHedNu3htodxWetlh:aF3luya1jfwrwNUaGSSfStQvueKT+Jw7
TLSH
T11FC4C3D56AAC9AB16756CA0341D33438C773EF12D34DFE40ACA1076609A5B139B4FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\fi.pak
Size 338KB
SHA256 df8cefa4831fc2fdf817dd6d49a6373edee4f51f23cf990c690e72ce348f69bb
MD5 aac0554a39bb1ae91e2ed4246e04c30e
SHA1 031785024765eda1534fd9504eccbe1b471ae618
SHA512 a6afc9464047c75157dcb8ece086c1c5bf4dccb48d33da24e35c43110f300cfea503c4cca093f3d4bcc7a0fdcb306138da5be288ef646881b625751e40d93689
SSDEEP 6144:3pR/2jxpvwhnVgQsm3aOE/8aCEELsR5w5jSH4EJ18GWU/8nZRuX1wr2:vOnvoG8a35w5+H4EJ18GWU/o2
TLSH
T151744E914259C22237C4928E7CF0903EF6E9E39D8C244D9AF443C6D546EA9C87E7277E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\fil.pak
Size 379KB
SHA256 448bc8eae353c188ffaa4c2466956598ad807f0f0aae7f12e1bc59584e1aac2d
MD5 f989a7215cac1e3fb4759e5fba9aef67
SHA1 5ecf35f160e1f8242b3bca163673e24cf6d77403
SHA512 b872beb5b1c2702f4eae616f633318b4575f573c06a3f1f0f1e1ab83585a52caf2f3c788c0c3a0d499c381fb7f06a3ea355b8686ded2ed1e392662f2746db01f
SSDEEP 6144:Po2wvMrF/y/DQkaRqQHunLxenGkZ3+mo59gmPHkAxw78:ykeCBHudqo5KmF
TLSH
T18E84E706A7402744DBC356E613A0682F66E570B83F822C6E4FBF26977BE7CD5D270186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\fr.pak
Size 395KB
SHA256 7af39af49846fba6d6b8ee18b2a212f1323ebc1cff1af0053194d01d8d5433f6
MD5 13968778147dad5af68fdb7464ca517c
SHA1 42abb9873c472a82d400e6896e90731b7cae06b5
SHA512 c1f54ccf4f82e158173d9db8464adca64a88f8ddee23afbb51d80535b4f25f138dac16a337504ca3ff8c3dbe9aff05ecc2aaa40afe8d77bbbd4f141b07e39100
SSDEEP 12288:k7L2tn6QuagV1YzhKJZsMYnYE1OxBW50xLHIWWCMcpU8wRp5a5FQusDh6dBKIJFb:GJVdMcN5B
TLSH
T15484F75FAAD432C719C21273FB12D667DD348248F212E340D8DF4296129A9ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\gu.pak
Size 755KB
SHA256 047da4dfadcfc6bec8f4dc7d250b1757caf31a23bcfa2ea3e1f3b1cdbe9a3995
MD5 7b476c423ce29e61b0b21d7b6a2a56b2
SHA1 5558dcec5b2580345b0797f1f2ea41952417335a
SHA512 a494ab32e45cf74e2b7e0424b4e3740470c5c6cfac8f6cc980a681eb8c21cab76255391b6884134593dc7b1029ffd861f74b47130533232881c137c41ef92cac
SSDEEP 3072:/h/zHr2DzDNmtZITYKMaWZu/lsMhmkTd4MUz2sQm251jvHsWnIIRfAHw/g/I/B6i:/ZDizBm/Voaz5cYh+Gyj
TLSH
T165F419D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\he.pak
Size 468KB
SHA256 6649a844f222cfcec01e75d3de3cb3658f1347ea3851d31b8124597b87e7b57d
MD5 f4dad4f97b5f75d6d7219d43f630c2b9
SHA1 ed8c790b3b5e3faf683aa978895f266eea5b823e
SHA512 f00e7e38ec0da1c110b4142dd13b3cae8b912c16518eeb4cfd7f19a0cef2c6601ec1e4959597066703b12b7dffb44fd918c7170231c2b42e40b0d90241b85133
SSDEEP 12288:lsQOFiBr3By4L92QmYq6A560SAX4o75P5oAHM7O5p9mTfDnwPEQgo:lsbss5Bok
TLSH
T1A5A4A9C4A2D452255231AAC39FA4FA286FF3CAB53CA33512CB18526CAC774F4BD530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\hi.pak
Size 787KB
SHA256 eda355e3785313e3d982c1d3652266dce1b6e08832056fe58854b825e0712ca5
MD5 1185163466551aacae45329c93e92a91
SHA1 0dcbfed274934991966ce666d6d941cfe8366323
SHA512 6fad3e24eb868acf78db0591c7ba77abc84e92cda28e8bffee435ea89940a8607e7628c6c5159349377a8d933f373db2dfa4e5715ca404bc3e67fd4a0f22a606
SSDEEP 3072:4m//Yxz8BS65Ob5EeQzFc67R7dk5Sv34QAEm5dmLrsoe4GR3doInN8edYbOqGPt5:rYZ895O9ExFlReg5R5HQO4
TLSH
T11805180CEBBEF3B55DEC3C8A32890D37D59D3674A3E9521348D5B3DB9844CB4146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\hr.pak
Size 365KB
SHA256 bada5828fc0d80c842d1409b54e8da516ae737ca30d86658b3fad5c8ace4722e
MD5 04fdc1dac2cae614b0f566310dc83bd0
SHA1 74e460e19a5e9c8b6181fa37cb9085f93bbc6233
SHA512 a07bebd16f00b0b46059a7b80454664757687a59903bc36cb837cfb55e69bf7f683157372f74ff8355ad50c3b747c9674ee942aac95a9804c39acb3841721d24
SSDEEP 3072:Rt0zZ58bkQijHuVGgYzgJ5OSFT0uPFG4rV6WI6DkYAiKbeMuVjLsGW0Yqz7pFyLI:72Z5QYuVb3P6T5D37pW
TLSH
T14C842B7CBEF2670A0896A346EFA6434579FE08CCE56587BB7C4F522E0003F4D66B8159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\hu.pak
Size 395KB
SHA256 688312f38488c7256370b1517b84963a3ff886b31692cc504fe169db241a43f0
MD5 410d8966721ff8817eb3a57f95a4b885
SHA1 f0fbe70c772bd635b0c4a927420e15b96dae05a5
SHA512 d0aa167ee919589ff3b80640e8db4c6d11f9159e4a246082f0a564482789011c260f124b9a7102649d998c6a89cbff58cffab5a40e33769b990e64d6cc703378
SSDEEP 6144:gvROCXS24UmV5z/fZ2GRoSYTLySam7YF3tys5gRULJatGqUnvydpECk3ICf:gvRZsV5z/+lP7+tys5vNDp
TLSH
T1C9844C7793769449BCA8179368643F16592E485B9F3B25FB28C3C8AD30A17CD0D83C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\id.pak
Size 324KB
SHA256 21368245d99265e760b1b57a3169feb72e6b5099c3f1855155d147b2f788eda4
MD5 0e82cf23475ab7328741670f4dfa3093
SHA1 fd854e31f4ab212d0b3bca676420d5600d8daa83
SHA512 52d694afeb3e7272740192e6b4cab9acab460ae6e66912f090b049a1f431a5c17a4c3d037fc9c450b8a224ed793605e234b4d649a95289770997acd43b5dbb32
SSDEEP 6144:NbXLerWB/kUEPsw0ofjDVnjHFXFmP2L6aF5NyhBvt4fSRsEaF:h7cKE/0GVnjHF1m+LlF5Nyhs
TLSH
T18664F8632ECD310C4A4803D5A2C9A91F7CCD233BAF05A76F8E748F7055B67686726B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\it.pak
Size 360KB
SHA256 13dd077e5e8c8b04ac0854e4466ee074df67c74cd29cc48a0c2c9f96f768fad5
MD5 9fbb2f5d9c70d9e46368538853929f75
SHA1 45daceb422478c5a7b7b61f5ee68cc08a19f2ac3
SHA512 77d8607ba52190258ed2e7c6e43a44bad1669294a441cc6ee9d91fa28c26c6675225e41cc309200aee01fecc1a0d369a8e4458c0095c297ed237bba50798c4dd
SSDEEP 6144:dF9dctIYSrqRrhsO1FGT9TEAGw3nlXgOPwtkWgGyu8HryYm0wNB6XtS6LevpLOvy:3/lZRe8+Yx3vjw5Lsol
TLSH
T1AF742A3699D620111A976359D221B085FBAEF8CDFE41721C999B431C23CFE84F2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\ja.pak
Size 440KB
SHA256 2c5457b0fa6fe41b7b524aa726dae4dd69e7072864f73f211c731810d00b9323
MD5 67a379c826f0eb60750bfba0b8e10468
SHA1 62662d8efd773b18c99169752996b11f30a64ca3
SHA512 38c44dd6c83362cd118543b7619811c671283618a3081f07a015f8110388d71b7767eb0a7a49c37c8e2e9e900dae6aa7f8560e5494afe6b29e01ede402e4944e
SSDEEP 6144:jUZWQGehaoFbqn6S+RUpZSb2LwPH+5VgxVg:LQhJe60pZSb2kPH+5VV
TLSH
T1DCA45F7CE3C969369D6153A22C0E36D57606EC9BFCA23A36402DC071BD70BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\kn.pak
Size 872KB
SHA256 c315e791770cea204c7e49ef5b68fa46fe42864a33e77fa5a1d42f87ba85124f
MD5 8a3427385226ab72e8421d84225f7adf
SHA1 701a85bc6bca0ed33dbe1aa3a617ce26576c7421
SHA512 310719fb102c1f892d354f1478bba06e856bd45da08416be970a0a76e44c7d81aaa9ddd878234b2348b625e0d18cfe7c966379115f35d51f4ee78a986c1243b0
SSDEEP 6144:O+wN1jeEb7qb4GvGK25j/u7cB2jrith0vkcVwVattrmQLHMj0AWviYRpySIvSuNu:NwzSS7qdR+QygZ5gJ765mWUj+yt++FS
TLSH
T13315CF185DBA7D302BD5006B24EC603EDFF16BD29CAA07D2F4DDD7802C66C6A90869DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\ko.pak
Size 369KB
SHA256 3ee7d79af9ec226bebfdd9d79907f1bc97d528d2009dbd0db23d74ad655e0256
MD5 3340fd0a5e8f97f122e1d6e9a2052ca6
SHA1 9c8504b78633b6d6e445723b351a08392916c7d0
SHA512 07eb8dab24ea8545cdaf38e35bc23a71a33bf87a1c0ac78ac564c103c6ae53357de2d4fd635b22995cefdc9d8e8241c66d78dd44d68a9f2f251be77c0afa7704
SSDEEP 6144:DL/SK0qZvHJmb1QdTVtZqZXRZqiq7vqLZyQnP9kYvWyCt8Oh+jJAhxlw5R7X98dz:DL/SQJmJKh0noyCt8OhoJAhXw5R7X989
TLSH
T12184E9F238DB63CD11938D82AEF4FA1983C1D976B7430294ED44CE54DE146C7498AABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\lt.pak
Size 395KB
SHA256 e7c133a8dc438870f97112587f5f223f5fcae4f1510874b95b72cc281fa150fd
MD5 c037c0d80be2c913c20e3fe96d9cdaff
SHA1 8dfd2a42fb2e0041d6ac9b90c78b3cad0283c757
SHA512 0a90dd7d39759e1e63205a827ed6611dc6e54b37c668795123de7f35c446ee41174675a0d813974dba7353c0a1cc4320049d4fd1368cdfccb9cf9afa47fcb4f5
SSDEEP 6144:ExMwGiVqc4anfOfbZnaI+onSzwB74p5Ub04ua7OoMI8Z2IF6SB:lw/M/fBX+onPup5S0MMJP6SB
TLSH
T1AD843B016AD3AEFB9B0053CA81E4CA74DFFE50009627A861EC59C79BC477F4629A4F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\lv.pak
Size 393KB
SHA256 6e99a3ef823a651f5187c5c549a6885002a2f8523c014f989ec6d53d87e7aac7
MD5 b14f9d61e064903bc73d18e40846e1ac
SHA1 5a3da27335194707ffeb07add46662df1fefd76f
SHA512 dab97f5d75d5f60c82969ac01dfc1ffffc0ec5fbe2063c6df0535130ea1432363be1475a440b6075440f68217cd6840a63bcfea0409586d755ff8e57c029baf3
SSDEEP 6144:b3p3yLG9mRNhtVFO6mM7pl44cfX7apaRZ5v4m0cxEl9AC2anpArAFTHVs1C:TpigT87P4467zZ5NEH2ms1C
TLSH
T155843A958EC68F964E905DCB7336D123A9CCD740EE07E112ED7D4B3A620F52422B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\ml.pak
Size 915KB
SHA256 6295eb0b0d05d26b3fdaa19ad390ba30f267b7af7a60a214db558dcdbdb436c4
MD5 fc33673850c17a865cae7695fd3eb5b5
SHA1 72f3241ea35554c881e1849ba53b8f64b04502c1
SHA512 6845293c0cd4ee1aa94972da1d58fd7085da5dd664d4031005200ae38fc4ab20f2c5cf44fe07ff80e003ef072f7f1cb23a452d6ce47124aa1efb3d26ae86b279
SSDEEP 12288:Wq0rekvVG6W+SG7/KgLC4nMmWDcZubSAemNPHVhJ5n/7d597Y3rE:fQel6W+jHsd5n/7V03w
TLSH
T1E415AE1BA036CD3B0FD102257B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\mr.pak
Size 743KB
SHA256 f63460da44e2f71c237b2555eda621c8c211c13ae68927c27ad121f03daa0599
MD5 d1f1c482775f60a868ca094108e3ac3c
SHA1 ba4396e5b585735e8505263ed42884876bdb564f
SHA512 2686c406b29750ee39b83247e4a4e6a0ce3325c1284ea11fc986696b43c672eeb0c5259c4834e4419c131941b9d1d35e53b05606168c766d27a614f49e223dae
SSDEEP 3072:2ZUwY/TAN6sXspP2eIbFNMEu3RTD5014CQ4WmHwMa4AtRRYfNJZIFyX9a30OKSQs:2ZUwYMNeVhfIS09ddv5ieUIK
TLSH
T12AF4D24CF77AF3685DACBC8E36584D3BD8FD31B1C3E9925608E1B3A74884CB405596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\ms.pak
Size 339KB
SHA256 ad044cb5cc56f8cba19ea3319081c194661f072d6b1193509e3690769bbfc2d3
MD5 52c793391de0e946616d31f7d5b90761
SHA1 50e014d9715df658221edea402609d7b09c9fb10
SHA512 d5db7fb23779bf1b258f949ce6af5115adf3bd93760041ef70f1e2f599ef3be6a7a1ec871b18858a1eaca906b98b0a04348a427d5ecd26bc99d8e6d986843478
SSDEEP 6144:4RN7RATF08Q+MxbcjsV5ulDUjd/ZwT5sC4AMMqZI:4RN7oHkxbhklDgNZC5mTM/
TLSH
T14774C6069EDD3118496843D9D2D96A2B3CDD3333B705AF2B4DA08FB112AE7A53316F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\nb.pak
Size 332KB
SHA256 18512064afcc3fb5a0e1f36400e592ff34e8c6c9a7ed0bbe3432255c4759ad8c
MD5 f15c568a9ed8b2ca497571453ce6bce2
SHA1 957ffec56ce14f33fa75f493936552751e966d16
SHA512 3bd27f9612b39836e5e7654e6f07c2fd5a31f2c338db36daa51e2c1462986cf4b651d555245ee2e97acd044e44a5beffb8cc9d56c1af11f52fedf9f7fbf7da97
SSDEEP 6144:I9HHvGNQkyLirVh6EQFewqOp7fyyVgLmy07E6SRw5PX4RXODcF:6npqrOEQFewqOp7fyy3ELG5PX4IDcF
TLSH
T116742A83EE46B72AF29447A4F019965B9B7D952CCD88099B64CCC63B0DC7EF092BD1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\nl.pak
Size 344KB
SHA256 bdb8fb52d8032a8f9cf5336698ca715b4beb4d567bf3657e12a47c36020ae256
MD5 ae7b592c5885481f7bd8c382cf90bfa5
SHA1 fccf9ecbc0e9f3259e805a243928d80e8f3fa672
SHA512 95dba1b426e4c396c4c4730d8cfc3f2fd1430864fae753423799142516c1d424c8534963676a6fad4061887754cc2b24fcbd0327f67de67b39420b96019e11f3
SSDEEP 6144:bUc2AqWlagCV256qzaHoNA3D+qnuDSV5nxQeN1PW:/2nWcgCV256qzlAuOV5nxQejPW
TLSH
T15A740A07AC8E263E59C0B385F6044FBBBB2ED22CC26CE67D94DDD1351453F9852AD889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\pl.pak
Size 381KB
SHA256 65b6dd63aaba1692f36774413d372f6c6c66088d7ec4009a2dbee1648ca133f1
MD5 cd2d3406f70bbc5ed427295da14cd92d
SHA1 cb9828b0ecf5db97cadb259b746590f03ed7c013
SHA512 bb18f667991900854d8e021e38b799828117f56c90d4d90bac1675a1786e5d1fa33186850e35f75de433f4c5717ac19cd81a424a692aca8d311d98d748e6e568
SSDEEP 6144:vzAsMbZp+gAhiWTUbRvPvmCUdUU+hzLSIQpmN/1Qht9f52z4o5x1:vbED/AhiWYbRvPeCUdUU+bumN/1Qht92
TLSH
T1CE846D0E86E59E4E4DB008E6F1E31B7CACDCC848E119C35FE05F8526615729ECABE5D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\pt-BR.pak
Size 360KB
SHA256 7b171f2a6d46295147a8d10e475048bac4346c6a5162b32a0336334baccad520
MD5 e4b1fb0229dc7a913012cb5313123c3c
SHA1 6c137b91712593040c6e02bedb82d90d85cc2b84
SHA512 7224d310713d94f56aafbdb80a4a7ddab5e19dd18a7880f93770b86204e323072aa8e879d2f7e1fea25a6506836e8ca9ed73068e76f4ff9b74c0ecfb807c37cf
SSDEEP 6144:EQE7KHElRCGZNBXBLZd6Rqkd8yOB5cDJYvvpphX:EnAmkK5CJOTR
TLSH
T1F9744C2E1DC9136605225340B74ADB47E6881646FD0ACACBDCFF4B46A3D9F80DA33B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\pt-PT.pak
Size 363KB
SHA256 f374bd5c54596aacbc35f47bdd4c9ab4045bebdfa479ae386fd2fdd2d0041216
MD5 1df331064ff162d97dd13a78372487b3
SHA1 8c98bf3d6964f667df6bbc326c8bcb95ac264441
SHA512 0dc4913b56900940d17c0780dccfff344b2b7f918b8c00dd1beb3fe020b7f61bb646ac636c152ef0bcb20a3ee9c4ee9a1ed6e01c9b7efa414022e4da3df5f160
SSDEEP 6144:68e2nRYBB9skieJVJJxhYXua1js+CajX5RKD6B:68vRiB9MXuj+TX5RKy
TLSH
T191842A285EDA132605225341B709DB03F7C86655F80ACACBDAEF074672CEF84D2B6F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\ro.pak
Size 372KB
SHA256 c50f824e63806e5782b693f7d474c48684b9e5174e93463a9bc2876c94990879
MD5 efd3112d1eac487bb3dd2839385eed39
SHA1 d7a45ffdc10d24425c8b1590ef1239de34737a2b
SHA512 f604f37f59c17e7a231ecc55121620138ba3c458f532889cd4b70a6046f0aa3ca0d53e0f342977d5ae0c1edf23706806ed429f72442ff90603b896125243e406
SSDEEP 6144:0IF/ZU9jrzEFGC7+mo0O5ZG/ou+s2K/xuoTr:x/ZqzEFGC7+mLO5Zaoe/br
TLSH
T119844C2391C82ED72D5102B2F76625D7E98E105DF641D28D60EEC97910CA9DBC22EECF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\ru.pak
Size 606KB
SHA256 44f0cbb2d5414b6dfca6abb40a435200670e2a71607b158fcbaba67fd6b3ba08
MD5 ac07a58897f578635b29c5d7bddaad5d
SHA1 d506deb804112aa690c60995613cd9e49496dce8
SHA512 ecfa1cd37782e76a5685a385222b87884dd29ef63059f389ce8efce7e814ba50ef8ae03c7bd7b18bd7a8502f29ff6f1fa168ce6395baff2b59cbd434ff400cec
SSDEEP 12288:BcXeXN2hHO3j/juDzvsJ/ZkFCe8P/XzLhI0aUdLkUwCoWcWCfG1ULZ22bqGYhcDd:hk85X6oi
TLSH
T1F8D48660669E64DE1101F01BDC08BE0D7CEB45FE3FABA36619642D7E35F2024C67E61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\sk.pak
Size 383KB
SHA256 dbd82a2a08f8e9ba9581b2672bc49e0fa5c89f073b58f152225f9e2815228ddf
MD5 989d000fbe286c0fd4bfb35305b52f48
SHA1 5a30a2cc1abe9977b1ffc4c4712452e6d55bc7df
SHA512 ed57c66237d5226d4d5cb63e98248c0df9d381ef86b6d4ef339523f430c54aab14f84121e05e9fedaf273323ec04b8a539c0aeb791245858890126de2ce38283
SSDEEP 6144:HX/6WrhCQ+koL+vMFVxyXiFJ7VC35hJYLjaQ3yGLBGR:HX/6Wr8Q2hnxyXiHVO5hJYLjaQ3yGL2
TLSH
T1BD845E3FCFE61C1E8E990108DEF57210F9BE4690864DA4A6D44F328724E37DD9AB8D49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\sl.pak
Size 369KB
SHA256 d0415bfa061b36a6eb93fa2c78563448da8b63c91e0523086c7eb2714933ab99
MD5 234e628a62f822bd7b3546b91e79cab2
SHA1 10f48382495bdbfa3b30c15b91768817df13d828
SHA512 51234fc3fb5199a3a86dcb7ca68d3c471f1b97897b1a9f90139cfff9846a6c6fd039a0c817e7611e0e59637746cc51045f6ce493cd6f2d4e144fec1c6a561456
SSDEEP 6144:mK8+KqhWYynnbANj7nHZiGm4ocyxPbPDZFu+Hr7ftjQLm55gdrcKx6EIbi/fzMNS:z8+awi91L55Arc7EMi/fzMiqg
TLSH
T1EB842B35ABA75E0E0DAA66CBFDB203017BDC048CD641D6A6FC4F33695012B2827BD599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\sr.pak
Size 572KB
SHA256 d459c1a781ddc344de76558211983dd07d47e3ca6cacffb518043bd78dc48fbe
MD5 aa4e2e54b648f66794f485318651b730
SHA1 18c1d5badcc5c05dfcf9e68df66f53c69e33e0ab
SHA512 cda7b189f48f28463d045174f3641f16737288b159adcf41da0c131a05a396a40e562b2f0aa10b08d323290f19d864755f238b074a698efa3c573d2b5512948d
SSDEEP 12288:AqOufVklJRr1HI/Y11PPeHyxsYQf5uaxbbNK6374Xzt/k/t:AVIkh3HNcf53xnZ
TLSH
T1EDC457B19B9E64DB0501F41BD808BE493DAF41FE3FAB975611201DBD34E20B847B929E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\sv.pak
Size 334KB
SHA256 3f0acf6f6319636c3e72cdc392b7b80ab0cfd8ae1a5a8e319624e4b46bcd3c42
MD5 c5437bb175fed93e85c5e7caf76ff352
SHA1 0d74f7df049ea73a47fe93b75c98e356b9bdd4b7
SHA512 00af14e7d89a12f4f39fb45a3f9c136e20c06752f98fdedbad426ac9a5b820260a329059659cd82fd089ab1d94c1f51ab4202fb6b142b27538d0139e67877239
SSDEEP 6144:UIcs6Ou/WpIjSwjcT+BjxEEkb/LX6uTSOoDE/xUDSS35655egbH:It/vjtBok5U5h
TLSH
T1D5743B428A20F536FBB2170DB904115F4ADDE15CE7E2848E78D9883DAE87D9845FF24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\sw.pak
Size 351KB
SHA256 dea6947693fceb6457801d912ea7c716add3c0cfb4c34782a9cfa4c4e06b9402
MD5 e37fc1c3dce484bd0ce496f548f14a43
SHA1 02b088a11363b0a4c0527053669af32737f1403b
SHA512 c5c39d54f4eb6b0659903ce9b5c8804a750a254bf88cc7c6e729e7813ecbbcc88df882af9294b5b795ef5b8afe8f1a60fcb46b3929a9b2cdf41c84188e5852b2
SSDEEP 6144:HhUmBklgBZcaZwoRdkN6Csdq0rnKKcLLK+9s35FSaDN+q5CwAyeKnHwQ0/:mplGCkp9KhHW35gyCHyG
TLSH
T1E974E76288B1D0195733518603D8FF7317DCED9C292B28A35A46BF4F218F98C57ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\ta.pak
Size 899KB
SHA256 e0421b4cf2736bb465ec02cd85c2df09809f86479cb7624195373f25edbcedd3
MD5 5002d84bffb908a2dcc7e1b69836c265
SHA1 4cbbe387a6744aa6c51b15b5a3a223135a3f6115
SHA512 c2a4a46a27304eb080b066f049d2eae733470dbf0f8107220049eaefdd73fd8b41abd1b02b4a2ee6934b4cae18de97bca5360022a8e295427a0bd63603bec410
SSDEEP 1536:gozNJu8JvUHZZvrdAYWSXR1q+y5fNU1prH+O8ep3EvFZRj2IpewYxg3ZHa4dpeJT:gsNJvUXdWSXRUlUj9yw5fG7zWtRjcA2S
TLSH
T159151CCE923EEE890F93288F0319536912996155C07BE3A27C756E1298ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\te.pak
Size 836KB
SHA256 f53e06181c9fa0f6028906a7388fd4e8f000ffb7277330634462433d34572395
MD5 b1a4d471fd8af54dfb8ff252246bfde1
SHA1 2044ee38f8d8d76176a735e726de189feac14985
SHA512 18248d3fa8f4cc409788d28a244889230b074fff416ba5998f25f3b67ad0c627172a5e7e3947e61e72ce28a5b4cb2134d6627b6252b3d282b54f84b424136c87
SSDEEP 12288:VluBe3p1F9fBiTlbUYgiNFOSdrUH4GrQKZkC28+5HX0Dkq9GyAdsoAkhodSMtS6f:VlUh4D5nM2
TLSH
T14B0592023A6AD310DAE70273752CF66C49681B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\th.pak
Size 704KB
SHA256 4fe2b7b6886e3ce068be0b7a0a71d45756eb797eda1e7d4fad52ab8a370e8336
MD5 85f59bf2f1167e34ab2b666608805420
SHA1 f0d8e8fc644c15c52c5f9d3419f88e6072799736
SHA512 86d6061895c996ad1caa3f3871c014b656e7ba7bb91f05c72a591cb5877c3db61965bc1a5094dcf7c4127d11f8106622355464704fd0695372627d8400a16ddd
SSDEEP 12288:kCoJR/3RMVqsUs5Uv/cLRflrj87rS6DotyeuLADu7Kle9don7j9Fo09XAyFHPL4i:poH25p5p
TLSH
T142E44BB33247D9D479441B5B262A7789673DAE693F73F8E00489215A73F071A8422EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\tr.pak
Size 357KB
SHA256 5df18798a35b502a18fb4f82e9b03b7ca100903ecd5d192ab2a3f0bc7646c366
MD5 da4c47bef469c086cdb7e5b74310304a
SHA1 9f0569659eb21261003a232d5d92d3aae8d47b7a
SHA512 55c745cd8d0aba6f4a2454c494b80eb4cc74f733771e7279b9033d52716551a85154e9eb31eebe17dce05ba71e0213e581c4b98b59a6b88aa8b9569c411e397a
SSDEEP 6144:GqgGhItL0rKiPxTcQXKVSIOD7rB/78GgeD58/D+iMi1AxZE9VwiBsJm7:JhIN/i5TTmUrZ7f58/5
TLSH
T1FE740A8178EF382C8BB9278FD2E50626F99F0766F331E4469A169636774674703F620C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\uk.pak
Size 605KB
SHA256 3fb15957c77f3635aa7cfca796b045a1ee1f1abfc0c12c163cfb537364f3c80a
MD5 229325584cd98c8408f7fc5c5603c6de
SHA1 dd31356ede30833a138fc3a6b8838cef89344a00
SHA512 3b57f57649877700f03aee73bc6e6e863ad65ec7c13b9851a3fc7e5d06d11ea154ce087d0a64dc689cfc55aca9eb6492154c9eb18130f6d17b8d94ac8c37a6df
SSDEEP 12288:c5cHmNYribnlyvk7KQ0N1nteW51B3IjNtE6TxLNiXEFqIDV2:c5cP+kT552Ef
TLSH
T10BD488B19A9D58DF0105F05BE84C7A0D7DA741FE7FA6871625A43DBF28F20248A3C71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\ur.pak
Size 532KB
SHA256 06a0c18d978b54dd163c7f77b7ee0f2ecf3607c5dc14032326f21b4a1f304d81
MD5 6310a289e55b1022f12b4f3cc29fe831
SHA1 150d81ec8db4d9aec6c0e83e5577dcb7f1956b38
SHA512 acb538fce25486e6a01401aa0e9204a6f519cd1dfbca48663d6142e1fb6280bab271dfd2b4c5ddc858de6920805e539b791c48eddcad124d0aae298d479dcf48
SSDEEP 12288:K6Du8PzOYzXPyn+jAcMR5RQEA2WzRbQYrkuvco/9NjjFpvUu:cYiD59WZ
TLSH
T115C410D1E6BC92B25A21D92780E33C34CB635F13D34BF286E56106C54E9A1136F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\vi.pak
Size 424KB
SHA256 f1602637e7f3e0a908d7a9a3f630b8dd38bfd26704cc64ef432d2c88a1ee7017
MD5 1b1b14f542bb4a9f014d1801fb2e4007
SHA1 0f56c35b2515fc92690126c54d57aa763a5c3288
SHA512 3e98c44ad74d905fee06851eab16576f6261a15336f1c1f625f646af725988b75957ed89c16876ec6127150e2b28778a5b65f897b9540ad1e4cec98be705cde7
SSDEEP 12288:PJnzrvsPgnzj0VyK1wSMTgG9lt5uEHziW+UH6JziV1ZH:xnzTsPgnzj0VySwSG1n5/TiW+UaliV1N
TLSH
T1A094861216E0702680AC553EC5CE540E6FCAE42FF7808FE57FE4297576221A56F21BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\zh-CN.pak
Size 308KB
SHA256 97fe793b325d0c27669f62235bd157c51a3e1aeaffba30e7fe028c9d64939c5f
MD5 32b1659c7abe8a01a702e46c69f0a3ce
SHA1 43eba1f94417109834f25006a81653bf635ce9a0
SHA512 72b932cb9e19788a67a1a7beaea0b9b076af0a5f1c568f9d2d6e8653d3c9fd4bc17db1a39db1f12b8184112b8e67125f443b8b2b60f31e62e16ef9c6a8e2c4a6
SSDEEP 6144:ZdzIbmDPgQyQ74nqKm0YnHrYE85UN6RregFlo:DEm8QunqKRYnHx85UN6Rr4
TLSH
T18D647EE900FDBDEC054640902724617E7980620BF667AFB77ED244ED27A2F9E0757A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\locales\zh-TW.pak
Size 305KB
SHA256 280ba35171dfb6a54efb13fc4ddedc13a0283a9a6eebff4c15275767beb4ba77
MD5 14f3f547a54713f91251b38459a096b5
SHA1 02ac592a2eb4a7c6631dad5aae83726ef9c33ec0
SHA512 0ad8c6a6eb0dcbcbbf6f9e114c93bc2cf6004dfa9ad7b68dba31c2a9856c0a56acb66507f65b1823434b1ad362c1ac812b72c254e5329a2858e888a761f45ec1
SSDEEP 6144:c0oQX1m/Xs2eI7uhvxO4/x5wuznWMc/9yJTl:cQX1m6IaxO4/x5wuzWZ/u
TLSH
T151646CA608FFDEEE0901F884B3C9462F7C8B742CDD377637FC4918992E76A541A5214A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\resources.pak
Size 5.2MB
SHA256 f7fdde9650504d8872a7aa2b68e1f5b3cedd100ded1e19e44c2b6282eb637813
MD5 f6dd61d802bfe64545deaf4c93eb6db9
SHA1 96be1ec4723a6dc2b1dc6e073a7dab026443b1fb
SHA512 33585e7f19222e43926bad8cdbf36bfd395feb4d043f524f82053920405afd933eec4d294b6558409ee9419c977553e513549470638532dc19bb93296387cf76
SSDEEP 98304:lLFhuX3bm18oDS6qdKVFzh1s3U7sHCMvrwrfinPF1GZW+extMVUAkWZkm:lL/mbm18ov5hqU7sH3krfAPfGZMkHkm
TLSH
T10B463310F2946C32D5C993B6E8A890272B38D54319E1785CF4CD651ECFADAAB05387BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\resources\app-update.yml
Size 222B
SHA256 bf9c59dffef475cc7037da9a96e6635aefed40213b97c94b7724288a7265634d
MD5 f0a7c74bf6e426120a7566ab6227b5c0
SHA1 853199d2c442418808522ea846a605b36e8eb3a6
SHA512 923aa49b5f8f7e66a37873fcb20ff2a52e0b822fe0425b7e2e2ddf7316f6e017e589ea5753ff445b7c9d7c16983893dd520e1e105420159d1135f251b02add17
TLSH
T150D02354F35CE0F343354A1734C0C91462F38A54954741ACA5CE140843325404C8F14F
MD5 SHA1 SHA512 TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\resources\app.asar
Size 31.1MB
SHA256 0c52802377ac01b96b477e558b3cd774029d49a8e55af56afd872fde7da2eaa5
MD5 97140af99d49b2f097c7d2ce3411ba51
SHA1 5fc1125c18308285105e8c34e2c08d196575ad1d
SHA512 c0de234de9b176e03f4464d6bcd32374678da8790f19baa33e9c0c06d4a28d14b329f2694fcb37a637718de85f6719c3e364437fda3c403a4ac0eead4bd3745a
SSDEEP 98304:gn6kJzMh9YX9nx/cguP/tbjRSbj2TRd6A+xjeSydpI4BLOTEbBLOTESydpIo:26vh9YhxKFTRk4BLOQbBLOQ3
TLSH
T10A675D546A7EA0A6C242513C5B2FF0903718D48797E8DA00777CD6E0BF5F886D9EDE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpvjs.node

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\resources\app.asar.unpacked\node_modules\mpvjs\build\Release\mpvjs.node
Size 245KB
SHA256 162fe732afd5aedc049dcd40d438828c575071669acb8f2924625415a68aa0a8
MD5 80d291eced7d60d2c2bd6c2c261bad21
SHA1 8ba0ecc549ebb227fc9fcf93c9f789f2516f218d
SHA512 e3cf05a16dde1789d0c6f873f461146928d230086389b7b742bcfad1822c47189075fcd0f78803952dfb9404de50d4eaad463afd306a564f8c3cc821a788dab3
SSDEEP 3072:lAOBYE4MZEJHXycUO5oJCSwlyFLbYfEErteOqIy5FWypsCfYyvVW81n8XLPB25xN:nKFMidXBB7E633qxsypn718bYr
TLSH
T11B346B1973A50CB9E8778239CD974906D7F278110B70DBDF07A402AA9F2BBD1553E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\resources\app.asar.unpacked\node_modules\mpvjs\index.js
Size 4KB
SHA256 0c7b31d75d4f794f9fdf6ad97b6560076dbe8b98e1b1f807d4bf9c587f4e1e09
MD5 25f2b87095fc1cc6e8fdfd186b780768
SHA1 3cf07427d690425c87b7f75a7d355c02f0cd1472
SHA512 a0e6fd1c861593b3f2162ad522c72dc8b32e6fb71f64f681f3f9a68524777fa031a1dff45711f2971327e7d5ffe2dd759446631e6eb4ab56b46d768be2cc128d
SSDEEP 96:QfV/YXC05JgziBf8a0qR1hprao5c3AatpD+Br:Qf1i7YiBf8aXR1hprB5c3AsAr
TLSH
T172918406BEF908D2009368F95B0774C1E826525F263968D837EEB7FC4F4DE3C0161A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\resources\app.asar.unpacked\node_modules\mpvjs\package.json
Size 703B
SHA256 7141fdaec40e99d9fb25f9a2789c2359a4dfbc72e5e5c8716402b3a77366ca61
MD5 7ad885a457b83fe1bc9e69919fff8dab
SHA1 28f3795dc5ef0989112fb786c15bdec62b90054f
SHA512 4342a468343857ee0f78fc11ede83e57ee39021f5d12122f6cbc1f5265d8f7f7f8fad96ad87f344da2a37fcb6220b2a5985a0e3be2d8863c4aa5180f7678b4ea
TLSH
T101012B34C9685CE30ACA0B59A4311187D22159AB3885FC0C7396531C8F5D47F70F5A6E
MD5 SHA1 SHA512 TLSH

Submit Download

tools.js

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\resources\app.asar.unpacked\node_modules\mpvjs\tools.js
Size 1KB
SHA256 a29918f578d1fcba815eaf6a0ddbcd5de3aa93618262de344ae880325b0046f7
MD5 eaabedcb661ba8786b0c0c985dd5bde5
SHA1 522dccbf42660536b36debe347eba177c6448b65
SHA512 2bd3eb6848bfcb36dd3316e4cdc17074c4b00e83515b810023c5bc5873ff2c6b29ddc3152df28de889f4ded794781c204abf3d753c3fa8956c7c0a7aa5732dde
TLSH
T1E531DC4329FE204285FE77E4558E06D9361C87E36229D9016EFD1380AF9986042B6F8C
MD5 SHA1 SHA512 TLSH

Submit Download

sslocal.exe

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\resources\app\node_modules\shadowsocks-bin\win32\x64\sslocal.exe
Size 6.1MB
SHA256 6e74173226e8050a59764a6e2acfbba2932c93ac2a098ad714e80a1d87b00f8c
MD5 c5797d38efdd145e05c9d358fbee4c5d
SHA1 cca0c26cd1b09eb59fb49cb598b3dca95eb9a025
SHA512 a33ef625254712ed845a505e5cdea2c16957109f6bb0c86f20ccbe8f02297aef8d146b57054dab8d5b959aed4132c30450683fe4f8c997c56c36301920618c11
SSDEEP 49152:HX6k92R3tMrYLLY93WjCjCJPJQDBXSKXTsveaEYMY2VsMwflo30imEGtysnAzf05:3OyMLLgvjC/6wxnHHs8VN3BjF
TLSH
T1A9564907F75294ADC46AC57893166332FB31BC8D4535BB675BD0AF303EA1B10AA2DB48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\resources\elevate.exe
Size 125KB
SHA256 afdb249d08958da7b93d6346c68a4f5613ac45f95bdc71a17cd124975fec0d31
MD5 7e9368f00571101f3fede394eae1cddd
SHA1 278b2ec742f2f64ccc2d008e665c66c021706660
SHA512 a0c6a05305aefa55d9ff34f2a72421caa178073f64746b8fead7b27c0b98ea595f8a1f494a4df6f07101a09f7a093fb89a2f743e67609a997c71978d6dec06e9
SSDEEP 3072:iCbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlEb:ZPrwRhte1XsE1lEb
TLSH
T1A4C38C1274C08472E9732E3555B4C9618E6DFD711E71DEEB2398027A4F602C0AB6AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpn-daemon-linux.py

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\resources\vpn-daemon-linux.py
Size 5KB
SHA256 15b91af9f1af292057a4123ba46c67925aa88ec8ae3aeadec3c43c99a3122b8e
MD5 715e5240e5061beb9fdbec52ce8875de
SHA1 98e9bef25d17450f4d09de21f530dc5570f0a3e4
SHA512 578a11cfca04bc10d7d5c8afe960aca20323289b566dc29a8797e1e81386308c32510269aa2cd0940b6c349ab1dab56d33ef93f4120e6c2456bc0f131a1b2ee9
SSDEEP 96:T9LjLXNSLoCii8AEanGs8+W0+DTriKnOyAJO74y:xLtqaanKI+Pri5fy
TLSH
T12CC14014AC6A20764273CA4C5813E0C5F3179357A3319C22BAEC8BA56F715B8D6B1DAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpn-daemon.ps1

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\resources\vpn-daemon.ps1
Size 6KB
SHA256 0a732aa3f4bca3e8e97f50d13af28c9be4d16c0e0361feffd7c4951e0ad15031
MD5 544b935115c023bef56664af8a1d7393
SHA1 44553feb1af2cf70f8f0a6d114b7f35bcaf502c3
SHA512 6253b30fd7ceaaeaa2ad5055efcd838ef1f2ec3f7b1e938cd7872e1e53e305a2d2ec3758013d2884d3b53f7f18045e29693bbfe146f5da4077d94839b002337b
SSDEEP 96:SQwMayoyAP6fj6660ZYFL6NqPIBMbNBvixZeH8l:EyoyAy29KWLPPI+ixZm8l
TLSH
T157E152597985A6740AF35776DC07C006EA738133E320A60175EDD988AFB156DC1B2FCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\snapshot_blob.bin
Size 410KB
SHA256 ece191beef3b53272a925c1f5e8c02a0dc78b00559799d27a0665fc480380b3c
MD5 c5d06bf7a12109e49dce962b6888f051
SHA1 63189d373271fd89079b4f55d035b7746f96ff00
SHA512 622854c9310ccd84dd100ced5eb3ba3d52f75dc68597cfb550b9b84e3798bbb90d39a41d3f9fa7b0fa58654e2ba0ac657d70b8dd89677126d39889abf9e0c008
SSDEEP 1536:U+cnVF12dTCL/TNBCR/+7c1oEcD0Oc+68KcldU1zVbnyVC2hiCfwoWJiuqi+wcW/:r5IMyWFGlFexW1OwE6UZ4kWWCPa
TLSH
T17694D936F3A8C269EB17F2BE88C2C5986572F2041F651A3F7565072DB4BBB680D71780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\v8_context_snapshot.bin
Size 710KB
SHA256 ea2ea0f97ac908fd127a423f505241ebf4acea0ba5d02635cae40f7cd9c2f464
MD5 4d582d568efb15b489a15be358d9a68f
SHA1 295393f0707d04ed60ebda8ea7c0297c411c7f33
SHA512 ed8a6af3d51904020abc8e8f3e734ccbf1663d8bd3c0f526e1d69ebfdf47b6061fcf3660b70239ba755f1273f6c608054d6dccd3721a4bcd81e7e9f3a3c7daf9
SSDEEP 6144:4dxIaCPBHaXAqTOLhzTRQsLRgBoGngm9R4T8kfS7eTTId5r1q5:4dxIdhaXAqEKGGg6Tkfdwd5r14
TLSH
T183F4A539F719CA2AEB03ADFD09C2D94531B1B948AF56152BB1E9072F71EBB581C70390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\vk_swiftshader.dll
Size 4.8MB
SHA256 56809fc84c83b7b651014df670631399546e6c335fbb69ece77681cbf0163866
MD5 78063ec6110108c74579751e27276989
SHA1 89a45e07df44bfb2802938efe1415a3d9e0297f8
SHA512 2fdc6d61a7b12c432458b9d6a47487b294f3ab0cf70650958306bdc809bdfaf27241ace9970afd8b686edd4e4ba2bd5ef7cfd5ec69fe078805f467d66efee977
SSDEEP 49152:TveyoM/h2BPSjPJEvoSNxxJanAf9dX2kcngUkomWPG2pu6n9MT5F9AZCeqx7l1Zi:jQM/agZaHt7A4P/
TLSH
T1C5364B03F6458199F06ED17D875BA622E671BC811B7276EF12A02F062E77BE06B3D704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\7z-out\vulkan-1.dll
Size 858KB
SHA256 7adaaeb870b6c3220527cfd971e75c22567d8f921a0737dc2574419b36cf8b4f
MD5 7935f27952b085cd1298323b3905d4ed
SHA1 08ca6df7475ccf536178fef17114b6e945a03258
SHA512 775c33c56aa29854883e496c27dd8d3d1bbdf53612bec78cd8fccbc2625cc18d479629911590a7de36fad214b93e86ee17f0f67080732ccfd5412c0eb1dde8ad
SSDEEP 12288:oefVW1lX8MvG9E0wsYox2Nmp6yWEaAT6bJUQzH3To+/AEir1iS:oOcTX8p20wsYHmXaATmXjyF
TLSH
T19C156D27A7948566E476C035D9828603CAB17C921B26B6CF03686718BF6FBF4273D734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpiderBanner.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\SpiderBanner.dll
Size 9KB
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
TLSH
T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv782A.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49c087c0-7667-4a52-b962-8a6416e7e916.tmp

Path C:\Users\Admin\AppData\Roaming\Dezor\49c087c0-7667-4a52-b962-8a6416e7e916.tmp
Size 54B
SHA256 aeef9ae170498c52c919f9bf07ab46d45a0fa78a685e345be40207d29adf6ace
MD5 cd2a33ef74950d0c2e037a136cb4dced
SHA1 26292267c8082ed86dd3dc440701f75d50d509d9
SHA512 74eeda213c771928e7e5ea2d9968c275bc6ff1c77b08c0c531f4dfc04dee8d32f7f3ffc0f4dc1a32cc97357c0f54ba077a54b0c03839c4eaea796eee20b45a02
TLSH
T18C90029B242224755A5F1DA54006889A5C6515A0DA0B4B0600D03286897745C088305F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Dezor\Network\Network Persistent State
Size 1KB
SHA256 39a17ace8a8fc8e0d404091b46d5a0ea7eb9b03da9d5876c58223f3cadadf7ad
MD5 f308f37cccbadd432b981b15c1a108f5
SHA1 03dfd856f3da8f2d931a7f29b6789c6d825fb9a2
SHA512 3827c2895e685866a7bd2f67bbd5addb2fc8b7018422617c3d51c27c4d635ec8c92c09a2eba1592c40dc107fb19ed2a9db83d7a9753701c9da9398f2e065e001
TLSH
T19731A7ABC3E8097E8A5383F1A7253A26D4BE055C53297D0FCDC89F4E52F0877A20108E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Dezor\Network\Network Persistent State
Size 1KB
SHA256 950af9b0f43ce07bc6f32eb8ed980f421bff1af925c8a55e2652d804ce498f6a
MD5 a91af8894b0c0c5500e1e0d0028a59e7
SHA1 dae514791b2c635473259edeaedd9b534d7423cf
SHA512 cefc8b7bf3fbc8c8365d2a316890ab56896f1fca57caefae6e231cacf4dbc493407b66935d8aa231caa9e90f8649ad9463322b22794b89823b31789c8d2f6df8
TLSH
T12931A7ABC2E8097E8A5383F1A7253A26D4BE055C53297D0FCDC89F4E52F0877A20108E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Dezor\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Dezor\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Dezor\Network\TransportSecurity
Size 703B
SHA256 60507da58603f104ff7d7d65dd568517ec8babc60613d8bc1e5402139db7cddb
MD5 48165106e07c2cecb80eda377cc149e7
SHA1 b82e9d729c6ddc8c5ccaca448eada98c4daea5f7
SHA512 f8edd5c7fdc100923be004dce316f29e4b8535376c8362b5d3ba07e91a83f867d10df10c3a2ebc123e43e2d523713e887e20aa9d635529d8ffa108a8a01b6299
TLSH
T1AA014C63876EA86B9038496B5E4178459EF9B47002C364F4C9E6C57CA0944E72503402
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Dezor\Network\TransportSecurity
Size 701B
SHA256 2ac1c512dd7f7c11a14053d49f0acbbe9ff91c412e269bdc6f3506ed5a5fcc7b
MD5 e36b5851807148ffb5c5b17eff256982
SHA1 3a63bbd4a2c38dbc4b5c21fb0e8014132f299406
SHA512 c8e991a0b8e308d3f30d53c9d2ac243cdf7ddf1004c0c8c3c6deaaf63bbec58d34d4c98cfb1f2d2c0e63020e3f80f714e0dc2574428cbf5bf179897fd8b949b5
TLSH
T132014C63876EB46B503C49AB5E517845AEB9B47412C368F4D9E6C57CA0840E72503402
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Dezor\Network\TransportSecurity
Size 705B
SHA256 0e7eff0ec48a160d866d80ed5f82bc49e6ecb8fae34e2aadee4a1462696713ba
MD5 b663694da1916dfdaef421e6feba098d
SHA1 3957c1a938d1c4f79b55e47bc4059ff52a9048a3
SHA512 514b11eb1cfc4bce49a1dcd9ac09198408b093170589ce52512f38e97df8e0135415690de3c59bc368e60b5c1685c2d2f105199e28ca41eb5045670b33fe7671
TLSH
T10F014C63876EA86F503849AB5F41784599F9B43002C364F4CAE6D57CA0544FB2507802
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe593c25.TMP

Path C:\Users\Admin\AppData\Roaming\Dezor\Network\TransportSecurity~RFe593c25.TMP
Size 371B
SHA256 199dd902f93c116ee28d04168744bb4b8224598cb582c81cbbe68afad0546f6c
MD5 9d4e5700507d78b8fa6764adee5e0ada
SHA1 3e6ecba2d1d8f668a2e9047841c5e945afb269d7
SHA512 8b547e749908182cbbd80b02e51dd6256acdac7361a95d48aa7e55e4496a1efb9d8c9e61bfcab2dc011e9a2fb61e30b7c5122f4c6c30e155cf3a0ec6756cd97b
TLSH
T159E0D86387AAF46B506C05A76E46A9459EB9F47441C6A4F8D5E1C27DD0880EB2603D03
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Dezor\Partitions\webviewsession\Network\Network Persistent State
Size 296B
SHA256 849888acd1443c7d3186ba18b201c966d7cfd590c61eeb72b44f815239e059d7
MD5 a0228ba3c9fbbea89704916a36bcaff3
SHA1 9c38c0308513565dafe91bd8118254a69268ebce
SHA512 ff6214feeb12cd788494ac03120fe59f565823f9ba379c16ede82f5b19008f006126b716cfcb9de31fd19a5724e2984368d15f071d0a1a6b934d8bf7b613d03d
TLSH
T116E0729BC2D49CFE078283F023242663C2BE084942183E0ECAA8B71E42A08BD440088B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Dezor\Partitions\webviewsession\Network\Network Persistent State
Size 296B
SHA256 cb06f13996d7ddb9b3dbd5e2257b6b0b2477cb1f25d253003e6d604d28c829a2
MD5 d821ae81b9566661ddc388207a570516
SHA1 a4d1d2cb2c3d598f4078d5abc600eb47881c3efb
SHA512 79dc5286b07dc04b20487a1c78b412154a1b2619757e11696c1abcab76de31655251ffad6856afb3e177b1b0419e2bad9ffcb4d1b61709436825e3a8463ce534
TLSH
T13AE0729BC1D49CFE078283F027246653C2BE084952183E0ECAA8B71E42A08BC480088B
MD5 SHA1 SHA512 TLSH

Submit Download

ss-3223.json

Path C:\Users\Admin\AppData\Roaming\Dezor\cache\ss-3223.json
Size 317B
SHA256 b788ff9f41c29b68af153038551b193c3e021a5ca5d016e8c35b3717cdc98dea
MD5 1d8d497dc1d342403bcb5df5ba1a157a
SHA1 3f23e9ea053dfe6cba519a6e7a50aa6f4615fafd
SHA512 33d88fdc629cb92c2866dbfe91f071925eb6e53f1d670c90f935ba3a30c9f3ea286d9e0a5056c117f39e46a2255e2f3f0911a44fe25dbe49d1ee4c682f1d3469
TLSH
T125E0721784924BFFCAE083EC1B1FB098E3C4428AA00930498EBC0F0E95F3F9D1180948
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\de-DE\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Dezor.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dezor.lnk
Size 2KB
SHA256 402a6756860a75984c9278a054159aa24a5cab2247d821201757b727fbac6a85
MD5 864f4b7e7e7cd964e5a74e52758d7eec
SHA1 07caed5c2d985e36cb4ca523046a229ff71bf4b7
SHA512 735ee1b47f76fccff83db74573ce459a6f38752bc8e3c034e5eed929939c852abe64c2acab74c9d80a9ebe916c5ee8bcc0d525e1055bb95052c5cd6812df519a
TLSH
T1D4419D09ABEF2760F3AA943656F796295679F460BB0A2B0D0050C3850F31A455E19F6F
MD5 SHA1 SHA512 TLSH

Submit Download

Dezor.lnk

Path C:\Users\Admin\Desktop\Dezor.lnk
Size 2KB
SHA256 5373a343d806d5a5604cee449fa6ac7b3fb97397ddae22083bf5bf6c98fdeab9
MD5 903eaa1572862cea44a6a8e51f42e869
SHA1 a1eca08b0cb2beccd46f145947a5f10b82e70f6e
SHA512 fe43b2446b3331da6f78306873c2b97568ba3bea31c70d3978ec2bd6a459bf32b797922bd27aadd6239b05e42c1e4b50fd9afc4959991f2cb6453474e2a5a71b
TLSH
T16C41CD09BFEF1660F3BB983652F792291679F4607B0A2B0D0050C3850F31E515E19B6F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2700-1274-0x0000000000400000-0x0000000000A0F000-memory.dmp

Download

memory/5068-287-0x00000000025B0000-0x000000000262E000-memory.dmp

Download

memory/5328-1113-0x00000000023D0000-0x000000000244E000-memory.dmp

Download

memory/5328-579-0x00000000023D0000-0x000000000244E000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads