42af70f36904ff1184e40b83d83fa864fcf0a90130b15fe632483a7ffddedf2d

Resubmissions

01/06/2026, 20:05

260601-ytvx4afy8k8

01/06/2026, 19:55

260601-ynfk8aet9w8

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nightcord-Installer.exe
Size 50.9MB
Sample260601-ynfk8aet9w
SHA256 42af70f36904ff1184e40b83d83fa864fcf0a90130b15fe632483a7ffddedf2d
MD5 fdb2492fd44e6ba7341e225a83fe4778
SHA1 766862d05e3c697daa2a0c5d76da414f4b3e01ff
SHA512 1d9960cb7c26b64b8d6a4862cca2f3506fb2c5f8467c72bcbbcb5aa57664f3ad4bfc265d4822f4ea08ea735bfff6b2388d777527e41e4e3db63c85157c968c1e
SSDEEP 1572864:IR+qvl5FfaFObJhhr4ppuSNnAzBTBQ0xMbb7:IHl5pakJhgRuJBQFf7
TLSH
T1B3C73362B127EDBFE1CDF2F479B102B637419794A0362943CB6E52897B23917032B1E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
273	1540	msedge.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Nightcord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Nightcord.exe

Executes dropped EXE 20 IoCs

pid	Process
1872	Nightcord.exe
3608	Nightcord.exe
1668	Nightcord.exe
4752	Nightcord.exe
6720	DiscordSetup.exe
6776	Update.exe
6172	Discord.exe
5544	Discord.exe
6224	Update.exe
5308	Discord.exe
4448	Discord.exe
5224	Update.exe
3764	Discord.exe
1996	Discord.exe
4492	Discord.exe
3676	Discord.exe
2900	Discord.exe
6992	Nightcord.exe
6328	DiscordSetup.exe
6404	Update.exe

Loads dropped DLL 23 IoCs

pid	Process
1120	Nightcord-Installer.exe
1120	Nightcord-Installer.exe
1120	Nightcord-Installer.exe
1872	Nightcord.exe
3608	Nightcord.exe
3608	Nightcord.exe
3608	Nightcord.exe
3608	Nightcord.exe
1668	Nightcord.exe
4752	Nightcord.exe
4448	Discord.exe
4448	Discord.exe
4448	Discord.exe
4448	Discord.exe
4448	Discord.exe
3764	Discord.exe
4492	Discord.exe
4492	Discord.exe
4492	Discord.exe
4492	Discord.exe
4492	Discord.exe
6992	Nightcord.exe
2900	Discord.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
202	discord.com
203	discord.com
205	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nightcord-Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiscordSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiscordSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1540	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248175735051041"	msedge.exe

Modifies registry class 59 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\DefaultIcon	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9239\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\URL Protocol	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Nightcord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Nightcord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9239\\Discord.exe\",-1"	reg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Nightcord.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{8BF5FE29-C0CE-489E-B3DA-2FB606EC7B8E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Nightcord.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Nightcord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Nightcord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9239\\Discord.exe\" --url -- \"%1\""	reg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c00434653461600310000000000ae5c4602120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbeae5c4602c15c429f2e0000004ee10100000001000000000000000000000000000000f26454004100700070004400610074006100000042000000	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Nightcord.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\DefaultIcon	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord	reg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9239\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 5000310000000000ae5cd40410004c6f63616c003c0009000400efbeae5c4602c15c429f2e00000061e101000000010000000000000000000000000000002b6fff004c006f00630061006c00000014000000	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\shell	reg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	Nightcord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	Nightcord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Nightcord.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

T1112

pid	Process
6580	reg.exe
6620	reg.exe
6672	reg.exe
6656	reg.exe
2700	reg.exe
4260	reg.exe
5284	reg.exe
2188	reg.exe
6480	reg.exe
1424	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4752	Nightcord.exe
4752	Nightcord.exe
1668	Nightcord.exe
1668	Nightcord.exe
6992	Nightcord.exe
6992	Nightcord.exe
6992	Nightcord.exe
6992	Nightcord.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1872	Nightcord.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1120	Nightcord-Installer.exe
Token: SeShutdownPrivilege	6172	Discord.exe
Token: SeCreatePagefilePrivilege	6172	Discord.exe
Token: SeShutdownPrivilege	3764	Discord.exe
Token: SeCreatePagefilePrivilege	3764	Discord.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
6776	Update.exe
1872	Nightcord.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1872	Nightcord.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 1872	1120	Nightcord-Installer.exe	93
PID 1872 wrote to memory of 3608	1872	Nightcord.exe	96
PID 1872 wrote to memory of 1668	1872	Nightcord.exe	97
PID 1872 wrote to memory of 4752	1872	Nightcord.exe	98
PID 1872 wrote to memory of 1532	1872	Nightcord.exe	109
PID 1532 wrote to memory of 3540	1532	msedge.exe	110
PID 1532 wrote to memory of 1540	1532	msedge.exe	111
PID 1532 wrote to memory of 468	1532	msedge.exe	112
PID 1532 wrote to memory of 468	1532	msedge.exe	112
PID 1532 wrote to memory of 468	1532	msedge.exe	112
PID 1532 wrote to memory of 4796	1532	msedge.exe	113
PID 1532 wrote to memory of 4796	1532	msedge.exe	113
PID 1532 wrote to memory of 2840	1532	msedge.exe	115
PID 1532 wrote to memory of 2840	1532	msedge.exe	115
PID 1532 wrote to memory of 2840	1532	msedge.exe	115
PID 1532 wrote to memory of 4960	1532	msedge.exe	116
PID 1532 wrote to memory of 4960	1532	msedge.exe	116
PID 1532 wrote to memory of 4960	1532	msedge.exe	116
PID 1532 wrote to memory of 2692	1532	msedge.exe	117
PID 1532 wrote to memory of 2692	1532	msedge.exe	117
PID 1532 wrote to memory of 2692	1532	msedge.exe	117
PID 1532 wrote to memory of 1712	1532	msedge.exe	118
PID 1532 wrote to memory of 1712	1532	msedge.exe	118
PID 1532 wrote to memory of 1712	1532	msedge.exe	118
PID 1532 wrote to memory of 4940	1532	msedge.exe	121
PID 1532 wrote to memory of 4940	1532	msedge.exe	121
PID 1532 wrote to memory of 2312	1532	msedge.exe	122
PID 1532 wrote to memory of 2312	1532	msedge.exe	122
PID 1532 wrote to memory of 2312	1532	msedge.exe	122
PID 1532 wrote to memory of 5132	1532	msedge.exe	125
PID 1532 wrote to memory of 5132	1532	msedge.exe	125
PID 1532 wrote to memory of 5200	1532	msedge.exe	126
PID 1532 wrote to memory of 5200	1532	msedge.exe	126
PID 1532 wrote to memory of 5200	1532	msedge.exe	126
PID 1532 wrote to memory of 5296	1532	msedge.exe	127
PID 1532 wrote to memory of 5296	1532	msedge.exe	127
PID 1532 wrote to memory of 5296	1532	msedge.exe	127
PID 1532 wrote to memory of 5452	1532	msedge.exe	129
PID 1532 wrote to memory of 5452	1532	msedge.exe	129
PID 1532 wrote to memory of 5444	1532	msedge.exe	128
PID 1532 wrote to memory of 5444	1532	msedge.exe	128
PID 1532 wrote to memory of 2052	1532	msedge.exe	130
PID 1532 wrote to memory of 2052	1532	msedge.exe	130
PID 1532 wrote to memory of 5744	1532	msedge.exe	132
PID 1532 wrote to memory of 5744	1532	msedge.exe	132
PID 1532 wrote to memory of 5744	1532	msedge.exe	132
PID 1532 wrote to memory of 5820	1532	msedge.exe	134
PID 1532 wrote to memory of 3860	1532	msedge.exe	135
PID 1532 wrote to memory of 3860	1532	msedge.exe	135
PID 1532 wrote to memory of 3860	1532	msedge.exe	135
PID 1532 wrote to memory of 5380	1532	msedge.exe	136
PID 1532 wrote to memory of 5380	1532	msedge.exe	136
PID 1532 wrote to memory of 5380	1532	msedge.exe	136
PID 1532 wrote to memory of 3328	1532	msedge.exe	137
PID 1532 wrote to memory of 3328	1532	msedge.exe	137
PID 1532 wrote to memory of 3228	1532	msedge.exe	138
PID 1532 wrote to memory of 3228	1532	msedge.exe	138
PID 1532 wrote to memory of 2404	1532	msedge.exe	139
PID 1532 wrote to memory of 2404	1532	msedge.exe	139
PID 1532 wrote to memory of 2128	1532	msedge.exe	140
PID 1532 wrote to memory of 2128	1532	msedge.exe	140
PID 1532 wrote to memory of 4516	1532	msedge.exe	144
PID 1532 wrote to memory of 4516	1532	msedge.exe	144
PID 1532 wrote to memory of 5636	1532	msedge.exe	143

C:\Users\Admin\AppData\Local\Temp\Nightcord-Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Nightcord-Installer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe
  C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe
    "C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe" --type=gpu-process --field-trial-handle=1636,4172255217343001485,11183517837937600778,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3608
- - C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe
    "C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,4172255217343001485,11183517837937600778,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe
    "C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe" --type=renderer --field-trial-handle=1636,4172255217343001485,11183517837937600778,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nightcord.ru/
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffee437c188,0x7ffee437c194,0x7ffee437c1a0
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,3761115900004389144,7952026078119181881,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:3
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,9262824403403835409,11354994429443995005,262144 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:2
      4⤵
      PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,13682049685296308850,14218273085548038898,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:8
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,653026707919013325,3998456180536636891,2097152 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,17163001316841669061,17705888160911167090,2097152 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,3120193124928899620,14191018612689326909,2097152 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,12940911154521590891,16371264362666698903,2097152 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,10261247839725779366,10841852480175624031,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5360,i,5276255935337800848,14067250507259399936,2097152 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,9351837133187052461,14002208788993413094,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5592,i,8287702752389027229,8262361660643805649,2097152 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5752,i,11010451718556561383,8526008633958850033,2097152 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,9903025652315814776,7304728265792505489,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,6023321735469608156,12431516685674360344,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,864753674630978165,5985920165859337134,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5160,i,5100043739454409420,3271576467927286320,2097152 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,15782838508863262860,6328817046392686423,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,15782838508863262860,6328817046392686423,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3736,i,5757678733992812422,1206145900133279426,2097152 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=120,i,9563583358988806,6543968264517856982,2097152 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,552269839292847870,3992234595232708723,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,18009465774363756569,2733427755243047501,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:8
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,10086130304585095784,5599118518388291467,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:8
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7896,i,7030023636032325126,5235767379185454583,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=8092 /prefetch:8
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7856,i,6346031510989687413,9771263092163037437,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:8
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7724,i,11552131597730971814,14703501232728303409,2097152 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,402218041783160806,12723079428727626399,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3580,i,4891458533967994002,8274949497481982799,2097152 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,18140899229691598575,5789100199772624181,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
      4⤵
      PID:7092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,17556422941728584213,4038018902701323094,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:8
      4⤵
      PID:7100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,6181121128279691147,6505966916779286115,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:8
      4⤵
      PID:7108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8160,i,15879446896506710017,2952779864951700281,524288 --field-trial-handle=2268,i,16061195819752166276,14712168374707863462,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:8
      4⤵
      PID:4264
- - C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe
    "C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe" --type=gpu-process --field-trial-handle=1636,4172255217343001485,11183517837937600778,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3652 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:6992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6160

C:\Users\Admin\Downloads\DiscordSetup.exe
"C:\Users\Admin\Downloads\DiscordSetup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6720
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:6776
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe" --squirrel-install 1.0.9239
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:6172
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9239 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x504,0x508,0x50c,0x4f4,0x510,0x7ff7125ac074,0x7ff7125ac080,0x7ff7125ac090
      4⤵
      Executes dropped EXE
      PID:5544
  - - C:\Users\Admin\AppData\Local\Discord\Update.exe
      C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6224
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2140,i,13798541502132860830,13074015415552129346,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4448
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2140,i,13798541502132860830,13074015415552129346,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:3
      4⤵
      Executes dropped EXE
      PID:5308
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f
      4⤵
      Modifies registry key
      PID:2188
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:6580
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:6620
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:6672
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe\",-1" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:6480
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe\" --url -- \"%1\"" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:6656

C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5224
- C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe
  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:3764
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe
    C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9239 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x4e8,0x4ec,0x4f0,0x4dc,0x4f4,0x7ff7125ac074,0x7ff7125ac080,0x7ff7125ac090
    3⤵
    - Executes dropped EXE
    PID:1996
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1912,i,3916457335549535099,8908280822561975368,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4492
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1912,i,3916457335549535099,8908280822561975368,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:3
    3⤵
    - Executes dropped EXE
    PID:3676
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:1424
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1780343351139775 --launch-time-ticks=661713827 --field-trial-handle=1912,i,3916457335549535099,8908280822561975368,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2900
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2700
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe\",-1" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4260
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9239\Discord.exe\" --url -- \"%1\"" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:5284

C:\Users\Admin\Downloads\DiscordSetup.exe
"C:\Users\Admin\Downloads\DiscordSetup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6328
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.ico

Path C:\Users\Admin\AppData\Local\Discord\app.ico
Size 278KB
SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
MD5 084f9bc0136f779f82bea88b5c38a358
SHA1 64f210b7888e5474c3aabcb602d895d58929b451
SHA512 65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb
SSDEEP 192:uz/QWppKvrIXANuBox26FIeSyyEh9Y1kM12wngfi3TjOueN3/R/l:E/QWppKvrIXANuBc6gq3TjOuevl
TLSH
T1D25444E56118FF0ACA31CFBC08B186526C79BD17A923640777453BCD0A77ADB5232D92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c84b0b96ac63768d057645348446be68c55adab73245de7400c7252788c5dfd
MD5 fbb22b05056938451028373f9ceac730
SHA1 2100181bf2ca147788018c0fc0d8176277267d56
SHA512 442697f514aafad71c10367ec3739b9ccede8ede2df732f17e276001281f5e3b6c20a630f00f705ef192d793575ba29f973ecdd308fa577707145ace09368f31
TLSH
T1B8D022B6AFA29AE1E039353F292543423F9C45320346223B1E6D5C14DCF58CB88D8DCB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 db829dc96d7200bf20d2107bedda54652aeb35d684b421a131d827c674a6a7dc
MD5 d676596ac136b0c320ee9c291344e43b
SHA1 1a7a171ef758b4c13a553505803ba1cf05edf1eb
SHA512 87f62d51046d5676956d51c7ab2b8a7e2f537bc786dce56d0475a48dc44c811ff18fd5c6d4ed20dc369ee9462e63c2aa57b4f2e8dd2bf5e8ddb2efe122f19a5b
SSDEEP 192:16NZiAB1n3MTgeoORFs5oVRGEzWm9XDly4vBoiXs+h6YhwQ56QZJF5zpOCsU00/0:16NZiAB1n3MUetRFs5ojGEzfRly26i89
TLSH
T1FD02A91523CA6861CF80043CEAE4EDA8367310583F135F675B661BBC56EB7CA4C599CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a3a2c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3a2c.TMP
Size 3KB
SHA256 d5150107d8c176dc08fbbe2fbcfafcc3de5f4e8f0f5ce47937e2ee576bc6fbe0
MD5 8fc060de3d3927391e9f7d8491270f09
SHA1 418a67e10961f1f495993c07b3a3147665bb758b
SHA512 913d08a47bb0272b044af48910d66340710826da544a89596a62fef7746fdb2e1f4b4173a90972f346a383f3fc7e8afad9f98cbf274f30748bdf864c908ad5db
TLSH
T1C271C3653352A8B1EFE5493CEDD24AD979B0B0880A139EAA00705B3D2BDEB5F0C201CD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 82964d27740f854a270f3aafc0e82561a791e4f482de46abce211f51e400d21f
MD5 b29bda11b1b5eae844d3fa25aba7d279
SHA1 19a1da8a246aa934ec1df79b84f2113f9dae833d
SHA512 8040f68d36edff9b2e3b93d06548f9818941e3217bd9ecd0edba72f6aeec29035831cd7532b12b01822c8fd14a408642ecc592d1ac91724f5201339e3ed2121a
SSDEEP 192:DnbMLk3qz9Gri/Gb1O1//hb75cFFgtjkUruqii/grCRryU54rXTgrvqx:DnbMLk3qz9Gri/Gb1O1//hb75cFFgtjC
TLSH
T1AB129BF3C7E9822DC91152F0AA147E1FCE2D0955436C3D6AC5D4AF4FA3E24B1E181A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 67ba74c396741ee99144708aa21b21e34c27fce5cad2fe13c00db83f7874e8aa
MD5 8d6427a8198097cb057c8f77e879151c
SHA1 868f86f09e0383168c821545f67b85b55fd517c8
SHA512 eac8c0e1a965eece88bc20ac2b7d4ad08db93b96e5abe0690520a506d75ed25706d830cf7ed0f1cb6ad00182fb7763e908a1aa43b1e080dbaf7fa20711e443c8
TLSH
T1EFD02223220A30F6A76C3EC148ABBC8FC32B41200842EDE450D0E8ED4633C6D0A17282
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5a0c75.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5a0c75.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 5dc2b75330e033ff11a72dcd752a3664a91489c7b77466fcc822c499ed390816
MD5 2a3f183abd59e5bf63cc5de1d7545638
SHA1 2b03de10c5bd9cc458617da6babf0ade26ba5cee
SHA512 bad2bf6431df61489679fd2912a42bbdee8d4ca249c27d93721ca7c0fab7f58d7d1ebfa3e7c749569884121ad4162c794b3cf17995387ee87fdcf1307d67bf7f
SSDEEP 384:sxZcp+qm1P/fAsk+fj75S2gHboXF/m8w/AnlwU:s07m1P/fQ+fjtSXHbUJw/WwU
TLSH
T16E82D756662489B78CDBC508FD357F22DBF814639E504E4CAAFCDA1C04EA6FC2512C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 f4b20bc4bf7f3dcbf79d5fedf96c597584a34c6fdbc297d61998143fc46f220a
MD5 e205010449d43579f66418ecf71c8a67
SHA1 d5575d779591c0d7ea1073a3a288ec6738ffa305
SHA512 f45f3f2e58f9129024bda08fd8808eb68ac314164f1e0e70677860f65cfdf60fba6498080521ddb1fdb6d96f86893543d89e6f8cf1bd92aac4d840c1e6fe532c
SSDEEP 384:sxZcp+/wm4P/fAsfGWv1+ReYc75SeHadHbxXF/emmw/AnlwU:s0nm4P/fbGY1+R2tSmadHb/e7w/WwU
TLSH
T11EA2D856652489B78CDBD509FD357F22D7F814639A944E4CAAFCCA1C04EA7FD2202C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 e31e41e6263c5c885445f5bad83903f1350d952193e5c5037b04cf1f96b7bb68
MD5 756bd3d37cdc4d5a133af6e51b1a7258
SHA1 54ac67ce930b4775bb960f1e1e865f30a6558c37
SHA512 6c885aebfc70226052235f3a5a1ca693d1945a8086143097022341a721a40463d7c40453f37b44bb9f17c3187bca3eb3c3af03c4164a28dd3fb93c7711364ef3
SSDEEP 384:sxZcp+qm4P/fAsfB+feYP75SeHadHboXF/eRmw/AnlwU:s07m4P/fbB+fBtSmadHbUeEw/WwU
TLSH
T18392C856662489B78CDBC508BD357F23DBF814639D544E4CAAFCDA1C04EA6FD2112C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 71352fcc087528a8f900b1719957801f05e30c8201c9978a704edcf38406b574
MD5 e943df6e8f72e3aec2e885b7cd061345
SHA1 21c10cdf0248b4c6ead107e82146f43cc91cadaa
SHA512 14d51cdad416b8c3a3d12cc7d691fa4f1c69a20b4821cc61ea6d31697d8d82cc3d78d5bf5a12b8f9fa2bfc734d5b90dc4b875e37387f76093a7c35edebd1aaa2
SSDEEP 768:pF8iJANWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8ALl6opdwroYIkrUnM:pF8iJANWvx76ru1jaDALocdbYHUM
TLSH
T118E2FA3B680CCB7E4F844E9CEC266F966ED801CB6B944D5447FA890C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 9643c65b3613d0a5de8cd3c1e413bb6d5cc9bb9754a4d299772c1e468c36fb18
MD5 a5e7d23dbb7018f22c85d0611cb22090
SHA1 280956e5b551ffd88ceaf3abf887f44e5262acb1
SHA512 27e38ecd0d99abb30dcd16c1dee5a558b671250cd6408af768a4b89525fcd207b96e164f032b5cc538b680ea3dd16692d32640fc34fe8888c10c7cdbc7d4a629
TLSH
T1FDA0025427C08201C54212B52AA6C34636D27D552305330E61E14044C8727C9494602C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 3ae01048096bae465ea61d636e9d2be3d3f158a9743745e31eb4010bc0a96fad
MD5 fa83cdf65b3fb47fa2c1ddd71e84293c
SHA1 1b57a17a831b98337ddda3706ff7260edc006204
SHA512 8823dd5a06e60cff1d78a54001fbb9ca18f90bbfc64ab8cc31f897764f97a09627ee559fa97aa3b5fa523f216e1c4419c60b949bf47e72fc34cdd0c0f62179a7
TLSH
T15DA002101380C1D5D02215F59D925345B300C9901104170740990058DC50C50CDC111E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 3KB
SHA256 624c8d18ec86bf372a47dc145213091f5a380bf29454b21177c793bbbb91a47f
MD5 de8b5241de6026531521a8fd493c382e
SHA1 ce3c14c7a027ba5e60cf554fa1be494e0376f457
SHA512 bd2e501ca3be02fbedbe01d74d336d62f7e11687eb6b1238406e5f2646735101f5398b9fccf6fd078a7e0403919267b44095f10bbf734cf7d329d0bd5761fcf0
TLSH
T1E351DA0E4C923796DAEC01B284B30C443B7894DD2B418D3BD8FC4074AD873252D7D718
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 1KB
SHA256 c646a45fa9c74886edbfd539eab53c0009a1d35acb1c1d013a0b43a6712fa0e1
MD5 309af825e5b390bed2e8c97e401f647f
SHA1 f1957f8e87f6ca726c66733d5b05af0abc747aa7
SHA512 ed053bb6df60294d7940d2b7ff63c4a912c8033e3fe5fd99557d644527e6ec48960284ed1e352a6bfb2a410d26870475ea10cbfd888d8d673ec49ed0ab0ba42b
TLSH
T1B43142484EA19DAFFDA045B21272B4B073B184DC1215B713AC3C31323E2775A2A079EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b02c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe59b02c.TMP
Size 1KB
SHA256 f795d8609b18a10cc0543d4fced70943531ffbee8be0c2c9e3926930facb87c9
MD5 ab20588714ac81c513e43f90d11acc56
SHA1 a7b9134b51fc1c9961b089a58520b60027a6e47b
SHA512 c573481e3c31faff8e138aa443ca22ef94b3298fdc1d6ca267680940ff5af08cd6cc80327c37f7f0c92394c963d356641b9cec28697b2ff160bde0d5a97dbd0f
TLSH
T1B231254A46D54D0BE88450BB1D67B4B8737188004311B393997C26399D25B9D1B4F0CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d6ff13e7a996044bd4d0c62fce04093a71beba70c113d2c9880de3da616a109c
MD5 38f227f2176385ca846cb42ac25a7743
SHA1 eea6d04ab9cac4e535db7762357840a25c0eae9b
SHA512 a6225306c8a00497587a361c92c20a42e4db1f7f13921e2232fead89067631b6b2066b9b2ef2c01058238d29fddde3aee74f8d31222515d9963ab0f0097fa0b7
TLSH
T174E0C0F72EF72C84FEBF63E50571A8A00282B459D544BC8F2416EBC32461352340AC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 19ff8534f6b1f6a74de4e040b3e99b7766866a6fafdaebbb1ffe2a8b1001a451
MD5 dc1bbd7844014987e07695c120a2df09
SHA1 3a1dda8eb8a7fe23d62f26c61dced04ca4c680ba
SHA512 474e3c33948bef9c27b63ce31c082e99707d23bbcbb3eb99ae5848d74fa9c482ccfdc6bb5d804ed6e9067795f6fae326d7969ecdc2977f557074ae988d9603f8
TLSH
T1E1A0025381573082C32412B8D05603C5A71198909705263582E491A8F8D13905112104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0f63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a0f63.TMP
Size 48B
SHA256 36fa343a61a18ca4583f46ef935a4d8590a3d43dbca7a22d7f2578ecd6a0ffed
MD5 a65685244f68395feb7961a68df74623
SHA1 02b17f80fad2b4ee0d5ce209a4da42668204039f
SHA512 87b1acec75bcb0ae6daa84ccba6b46a29cac4b1c2aa943ad453f9bcc1685b5d47b0de819f032b2e64184e33b1a19681d82e49448fd568f24b9d6f98709d9614c
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f57dee1289fe09b9faa16ec15144c9c61e830695e454a453f2b9d708ec2289ff
MD5 df8e1c5797a8f4b1f62bba26958f8ff1
SHA1 e1f6890740ce9e2e53391446c0ff6c87d269629d
SHA512 bf9d2c638ba2761c2dd872c7184f4d2a0cd48c9cfdd1ed6404a853b94ab7ef5cb45b5bbcdaa4d8d53ea95d1e420ebe7311010087b0ffda2fb980f7fae5d878e7
SSDEEP 24:KdQf3kVaadCC+4SO+lIjY+Kitham+1EwuSmEMt8ofyXYtfo7Sa3df7z4Lv+CIjnn:KoZIhKy00DyxCI/KnqIQsI3KBG0byFz
TLSH
T1A1918452317F06823C7E294CD2A4876B9A4272733419B42B7BDC21B28E67E251DFC9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 8a2d2370651f2046b39ce743015b0bc5b1175b67cb5e7d4d70292fe88a55270f
MD5 b662167d19e67522041ae2841fa1676b
SHA1 3f7b350088a8a372a6151d05a718ef0436ae617f
SHA512 5bdb86f1b341f806a096d18226f792022edfaddf500af5df0d626b340d8e5f8ad628400bf246ddb6577f101b4211dbace5f86f95e56c4ae7f17bbc1baafaf40f
SSDEEP 3:MsEllllkEthXllkl2zEkltsTl/l:/M/xT02zn+/l
TLSH
T1994404047FC04405C51110304411C35413F0DC5017115743375304535DC75C10C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 776268c121a6d68cf0e14199ed9cb4a922e427299434eff235e71a3b04230983
MD5 05884d6752eee4fd591d8cd8700f8d61
SHA1 3ab80c0236f98c0dc1eaa28e957e9e42a6871701
SHA512 fc5091bf270d9bb3c4da0bf1e415a84a3c39626336de5f2fe92b4da8dca74919dad2b094d0bfb506ac2cf43a3b9d8292a277bfa53b1ec3fed0c8b17d10c08827
SSDEEP 192:zYLsNIOTQmbh7mvFHmiU1AvB8Bk03YHHN/LILq00e4:zesNIOThS8aB2kVHtUEe4
TLSH
T17242493568B99C769DA7A506F48B37239FB85177DBC42F84E5E85B0C00CB39C270B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 25c680b4a760b62033ae87a1df6773927139e4cec5b5ce1d51b7097830398769
MD5 1c85b67b707acd420830237e1ced6b9d
SHA1 174dfad8c051f77d02923bb00f71285e1c8b2ff4
SHA512 c8f018357d209e5087ea39c96a36a798ed61368029d04e949cfe1438487c2759456f4f181915e20ba9c2190ebb41e7f2e07b8d7869dec927abc478c1e70ab3d0
SSDEEP 384:y/tNnNnb9ysNmiThSbUcB2kVHtDEcvzVSB38WXUs1BxKeg7M0eD7DRi2AI19INAH:8jZb8pBXRxS71PKegQ0+N9I+H
TLSH
T134C25B71D4A91DEB4892D4C5A602F5172EB84237C6CC2A8CE6F9763A31EF1FC5316426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ed0dfd06a8e757a0c215b381b7791e007d8b997fe2f044079d8993d3221dd60
MD5 2ae67ccf7fc7554cbaf1d2e8820305b4
SHA1 ef6a6780ea7d828208121915a70ddc28608fb9d3
SHA512 a55b96c9e0171b7aa3413589e2b5211f7480ced068123401cce5befaf4fe38ddb58677c96bb0e32921b661ac4cb1fe00952d097bac80ac4731ffd072fe49313a
SSDEEP 96:ZqONkhQsjpfmUTcK5ih/cIPURHl8h4otop5pf6DWBWPwivh50xy0SFYKRAxcbsaJ:gONh6kxQmiUySGQ903YHHNNcRLq00U6
TLSH
T11A12283568BDAC6B5EA3A405B08737279FA81277EFC56F80E5E44B1C00D735C2B0B526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1933c2bdb5cda4e41011b6796ad319173f810dc1c9a48befd50c95e72f2f28d4
MD5 2a737528badb0146c68ec7d8a8078834
SHA1 c801880ab84377855389f6ee76800c4e6ffd60ce
SHA512 765881ca510c34ae621ea7eda06c782f8a8b3716e5c375678c0e7e87621e142653296f4a23420b8267553fddbd0099fc7be5cdc1ce317a633248dc9fc9776d84
SSDEEP 384:yutNnNnb9+sNIDThS8hB2kVHtDEeD7DRi2AI19INAH:HjZbE/BXE+N9I+H
TLSH
T1FC929D36187E6C6759A7A616F04B37476FB8016BD6C42FC0E9E85B1D00D63AC270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 043ad68cd8a921743923b7df00cbb20a46f368722abe7c93aefb110b6978c6ab
MD5 5ed1d87005dcea39334a5ac482da3aa4
SHA1 1314b913b42a6ecf1b9c56c2c8e70555ef60dcd0
SHA512 891fab9bb4e463ee33458ccf0060681aa34e7d9f0a07eb708b5d503c404dca1d5bfcdee17c87f97835da671750f07f17e95ea09cf4e98a4423c38bc1cef9b23a
SSDEEP 96:ZqONkmGQsjpfmUTmDK5ih/cIPURHl8h4otop5p5DWBhPwivh50xy0SFYKRAxcbs5:gONp6kDfQmiUy7GZ903YRQiHQU6
TLSH
T19E02D935687C2CBB8EA3AE49B48737275FE9112BEA952F84D5E81B1C40D725C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71c7abd5-c1e1-4be9-b1d2-51b3f9705226.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\71c7abd5-c1e1-4be9-b1d2-51b3f9705226.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 98195443ae272570ddaad7c3f0a070b0c66a4f8df2330b90542b25a31c46d65b
MD5 3d15fafe58e9be8adfe9cca4b01a11e8
SHA1 29ffe763ee13bc128cfcbd67286c42b6e4075366
SHA512 6e356a9e32a2652904df09446e9e3b1afbcd107229fb1b07a98f86cd4d7f6374f76daa03261737f560974bc9905e263bf97246d74294acc8b7c0cd353d1e08c2
SSDEEP 24576:rBJkrlr7AiOlwOpJeYOdTNK9RgIM/aR9Gl7MRHB:rBJkAlwO/X9Glmh
TLSH
T15C753911B7E88A2BE4AE57BAB071016547F3E5866376F78F6A4CA1781FD37804C02367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\chrome_100_percent.pak
Size 138KB
SHA256 c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
MD5 03aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1 dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA512 c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9
SSDEEP 3072:igKzw9bpyZFM5fgm32Z8Gb0+VRLf0ld0GY3cQ3F2DExm/KLQ2I:nKzw9ozA4m3m8Gb0OV8ld0GecQ3mExhk
TLSH
T1F4D3D1D3B7F0ED7DCF6752B7B51A01B1FCB342391A92425A468AD8316A27348D8D8383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\locales\ms.pak
Size 97KB
SHA256 83248a2aaefb87fc19454afa34bf5df99b95b98f823b534de0bae552c8260d93
MD5 407dd10484a99b21ffdae6016132bf26
SHA1 d1d7a5524fdf026a49391522c42d059406bd0442
SHA512 908b71411e34ec56e77c5837a856898f929dddc81d95a7e2b6d47f4f4e1d72b499d627a8cec7233e4f39292f592b6a90354e6325aafacc145c994abea1ff6f64
SSDEEP 1536:Hcy5Z74bI/tcHEry1GQ/ApwYXBSBYOYSjfhos036Kw+8uDe:8yT4bIKEGqwYXBSdJo76Kp8uDe
TLSH
T1F4A3D8029EDA3218055843C9D2D9AA2F3CDC3337B705AB575DA48FB017AE7A53722F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56fc97aa-26d4-48da-afd5-9ecd19ff214d.tmp

Path C:\Users\Admin\AppData\Local\Temp\56fc97aa-26d4-48da-afd5-9ecd19ff214d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c189ba9-d47e-4932-8465-dbfcb5b87a4a.tmp

Path C:\Users\Admin\AppData\Local\Temp\7c189ba9-d47e-4932-8465-dbfcb5b87a4a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\LICENSES.chromium.html
Size 5.1MB
SHA256 fc2a256467fb4d4ff72be6c423e5961e98b418554deeec296aded0e757b9a585
MD5 6b84319ee8a0a0af690273d3d2dcbaf4
SHA1 857ca353e0582d100dcbc6cb6761bb4430d0cb90
SHA512 26f9842bfdb429ef132cc1a930da9187071a339927eda402e8d54b5eb9e03067612cdadc3a2dad3d0977f8e6af18c05eab6ac91720221c6a0104f96638f85a8a
SSDEEP 24576:yd97B+mnLiLsrDy2VrErjKCqzkU98wwg3QeXuh:0P+mLAqHBCuRoeS
TLSH
T1D046D66BBB49037316F282626B4AA4CAF31E903F375A1514345CD15C2B7BA2483FF69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\chrome_200_percent.pak
Size 202KB
SHA256 b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
MD5 7d4f330a5443eadf32e041c63e7e70ad
SHA1 26ce6fb98c0f28f508d7b88cf94a442b81e80c88
SHA512 f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d
SSDEEP 6144:TDQYaF+9b7zA4m0k5GMRejnbdZnVE6Yopym74:gfs7T6edhVELo374
TLSH
T14914E1DBB3F49D3CCAB34673552A05F1ECF6123556B6424B42CBEC347A56B8988C9283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\d3dcompiler_47.dll
Size 4.3MB
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
TLSH
T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\ffmpeg.dll
Size 2.6MB
SHA256 39293258d5a2418841edb5ccf9ab3ad23064fb95e1ddfa7a3c6295a24c272a08
MD5 7c3c780de9ae5cc4abeccbd7cb6b367b
SHA1 bda27b3c0b1ec023e2a0a97099a84b10e04cb135
SHA512 80a79f827c3154461158ec6f466db0c2ecd9ce9ffd7728001644d4cf382721d09c0758f98f73d7fa548e4e220ffd2b8842303d67a43e79b9146e8b882853658c
SSDEEP 49152:8MnbcrH9v7eCZPxX+qzohT99hDoapghnshy43yBcxnyKbZtjB0HVEMGJSj/8NOv:dCZpX+q27saesDSjbv
TLSH
T17CC59C17F6A644EDD02DC57483AF9233F93078454724A6EF2A809A252F7BFD06A7E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\icudtl.dat
Size 9.9MB
SHA256 6e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
MD5 80a7528515595d8b0bf99a477a7eff0d
SHA1 fde9a195fc5a6a23ec82b8594f958cfcf3159437
SHA512 c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459
SSDEEP 196608:+UGwSv9AAQnt6liXUxR0rHa93WhlU6tcCLhl:+oKlQnAliXUxR0rHa93WhlU6t3Ln
TLSH
T1F7A63947A2FB4DC2F9FBAF30D8F452679467BD496E32805A11042F3B5C373A096617A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\libEGL.dll
Size 429KB
SHA256 23046e7fe2bbf76ee2c5596b6beac723ad465fdbaa44266486102cdb292148a1
MD5 b3017453d487a7d33445c1d2d9b9bc13
SHA1 7e643ccb8984a4a92dd439eeb4bdaaeb62bd8862
SHA512 fd583f4b95aa974d72628bcc548feb22bc86c5ab0fd1536995bd796e28422f56e6799d60e2c3bef9aed9a1080eaf12338a3b29b8c3d40ba5166030a219572baf
SSDEEP 6144:67Udu1o3YnElXvzYhRk9o+3Re3wpcOQy5n+t7dPs:wUdu1NElX7QR2osJ5+XP
TLSH
T1B2947D15F79048B9D076C078CA634642DE72B8DA0F64EADF139492692F7BBE45F39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\libGLESv2.dll
Size 7.6MB
SHA256 dd74029716da56a0e4b64bc5cea0c169e1c4b31143ff39213d3c544792e8f2b9
MD5 dd8d815769cbf46af41a41931e9b4572
SHA1 f242fcc4cfd5030f3f543c22f141185cd86e7142
SHA512 69a12f862157746ffc27b637941261a0c5c494175c3e674c7de4d0c4452a5b9358735944e8e0568b7279a7791cf178c9b1afd5ea4a781e93f28cd775a0a6096f
SSDEEP 98304:p5a6GJCIf2Knqdu5iIBIcbWwYSqARSHoDNSv:pKIwBqARSH
TLSH
T1FC866C07E2A040DDE00DC1B9875BB222EA31BC491B64B6DF269477112FB7FE06B7A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\am.pak
Size 150KB
SHA256 5f323c0bd185d5bd5f7ea737018f14fd6ea500ba5440bc74f5c09b635518eadc
MD5 5c617f3833923fca5717a549fa57adca
SHA1 0102ac3c8041fab6a1a65a3bcaf7e79c0b7fd719
SHA512 87034e798355875f3459567ed1f11e5455fc5adc9634eec33e9db2446451febf7f35f617709a9b09bf3bc52f195edea0cb47d474d2c11ca93a8b5383142d45e9
SSDEEP 3072:nJ1NSM/92t7Rh4rgEkDvuHq/VoZLokijEG/yZJjh6oVjUWRSuo90kef97ZVt1nnu:nzym+u9QfCx30jH8+x
TLSH
T1E8E3CE547DF9F7170F8E8A15A4221E8E9594AD4693802C38D35BE3FC2B2DF1B4CDA219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\ar.pak
Size 153KB
SHA256 e7f9a474399c0ca0daf28c6153f6ec7ae87423e66c8ffe0849407471d20b6237
MD5 8f9c8dd93b03202220b5e226c6956025
SHA1 8290dba9b8dcc89928821ead04f7cf599c0ba557
SHA512 3eb0b80cc7243ed646cfc7be31eb27f0aa15f2aa8a5d2c50c3e5efd8a81759637e3f986c5c294262ff3bc94a939bb3803268b4eda46b3cfe224f596bfb4ed00a
SSDEEP 3072:91mmOGHNSNRZaJTGxRh+7iMuxHSM2uZtE9yKBZ1F/R2bKSI1+/BI1Iir2L2p:zjOlNRQs+7i0g/BI1Zp
TLSH
T1CFE3EEE21B2984720A56DF0ED1E2366CD872BD23DB4BFC3134930A2156DB513E78E679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\bg.pak
Size 166KB
SHA256 bd3a3aacc3cee9864404755eee9542e0f21efbebd4a71e5333d15783d4ce18c9
MD5 00d012a55a50bba5de8b2fc2e0d163b2
SHA1 89163fa9905876167a0c7d3446bcb0bd30f88ef4
SHA512 3bd6c774729f3531d316917deb7d8fe977c5bf5a3e85846f061c4af5fb6c45f79d8a3557a47d4569ad52819b3ccab13d386a9f5c1801e25e969e194a956d40a2
SSDEEP 3072:P3504qAG1u0PSFq8HyyW4nSpbBqjnUmIKW3RZzrzCLy8Asgiamd3vNgT72eM+sUS:P35vqpTPaTo4njmZzrmLy8ADINW72eMz
TLSH
T19BF343A1579A68DF0501F45F98087E0A3CEA44FE3FE7879241642DBD39F10B487BA25E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\bn.pak
Size 216KB
SHA256 b4ed891e8b38452623348da12d325b52407446114cba664a8e25a26a7cfaf773
MD5 80c804a82c617e7e0fc1e7f0df63290c
SHA1 a81f3ac6e92785e4c96e7dbd01fca8bfd446071a
SHA512 919856917f185dcaa6204a0b990e49498ef59b72cf93f8b6da44785f4e889b70c0b05300ac15009260ddb36a8d4f06fee5d8c4796e60a43c2957ea436f7316bf
SSDEEP 768:fPjRXprzuB7CPIqPp2nKEZ3UzKoZ4CfrNuduY0Jri0CI58JRKgqZBiCYWY0PnxRB:fbbNp2KGCDjr58JMgqbxRRImv7hfUHm/
TLSH
T1D024DC209CAE51B2A8C5CDC9434C6370C1236E9B9B65F34DDC1BA21578ADC7C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\ca.pak
Size 105KB
SHA256 9a4e286a58bb9a58e9e30d982783663c9bce40730cb6dad4c37980038040919e
MD5 79ec325651589f138c7840c61316d8f5
SHA1 37503edcae710e2d61f390064fa2d9893d4b9c8d
SHA512 f00a9354871c77947d2b99e83b54babcb46b5a45c24702c1b5f750156abcb2a00d12c6b4c2e15634d4d560de0afa5b9c368d31f08cf447f2209f51c0b8ef6384
SSDEEP 3072:Em2DPcgrI54tBL8l/oq7O5awat8PU02he8X/FS0bzRhqRRhnAkpxlCEtT3nRA39u:EvPcgkoqO5a78PUzhe8X/80nEznAkpxl
TLSH
T1F7B30C23CFC93B7604D2110DB741C76BE58CAA887602D295F9AF071623C89DCDA77A97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\cs.pak
Size 107KB
SHA256 c00829fc57c7e1e5419fe3202f114d394a590b8b32b1e55af42772c93755945d
MD5 0325d16a747cca73a3a2b0c94fac123d
SHA1 e5989627742ecee5f8996001002e97627bfbe10d
SHA512 b824297df25c097251432fa72ae1258092e692ff3e4c527599897d7d3e71007cbd80e300de54b87146889f71d537c7d297c1b3cac04b6e08d7ce29132ec9e5dc
SSDEEP 1536:6G+wdXqt5qYSP7ymjLEwoVD33zSYoYlBw/dhRRkP+8QUQdbiE:JvXPjyfaYl6/P2+8QUQdbd
TLSH
T1CFB33C1EDBE771258940020877EE52396E2E86881B2F94E77C8F95853276BBDCDF0D09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\da.pak
Size 98KB
SHA256 6da77a20fd6fbb228b2de5f197225342da18cbc58d26ebf542cf20d23e00f033
MD5 29f37a66ad8035d0657a1c7176330c40
SHA1 ebf26afa557b44ff5248207425083c750a397f49
SHA512 4c360f13c499a9b4b8e2b6f29efecedcc571130b90cb93a3c21486642704711db0a182b63b3be307b39c382de73787269822af76af9032e4f9c4a5596eae8e50
SSDEEP 1536:mjAsKH2oFmMFyHlqByQxTdofWfZg5Q4+xEGqZ4w8pOmPEFh/j4O:mM9WohFyFnQBf2+xgL1/r
TLSH
T115A33B87CC8D332F89E94729F7119EBBEB5D503DD540214F79C8813A1ADB9A087BE582
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\de.pak
Size 105KB
SHA256 e964d841b9588b7412f1ff86f004e6b052f993bf2153e4dc4bee6c5536be1744
MD5 5f9f5187b2c3a4bbe6077a329ef5c2c1
SHA1 68ab6991f89f5c41c055b07fd97ea6d394d87f12
SHA512 560a90d24c5fba776ae526033163ce61662978599c4b171f0bdbc80c72206a9443ed1aab58819ae71345ecafa795527c0673c12b73ba7ac381b7def7bbbee118
SSDEEP 1536:hHbausrKfikXgkNahUnNqRPIYvfrxWRQNCLubXpkHxQ1NlkGfChxCPQl9v83Opra:pinhUnN1dLq+H8Nr40PyqyrsS0
TLSH
T161B32B03A8FB268E4782A3143301CEBB3B1DE36ED346225A945ED137635B67746BC467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\el.pak
Size 184KB
SHA256 b624633365c19e6e3cbe200b39889711994809796dbee7988883165d0cc1d6c2
MD5 f4083cf1c56edb2d8701fc1809c9d8ec
SHA1 909337883e1f898c98de9b35f7889d257e5455b2
SHA512 27726b5cf51760d6938c17e3b1346f0f9c36940a94fbb9428d9ba8809598e07d7c5429fcfc3ec56ea795d65555b4d19676cdc299d0f8937c503d92cb87b80ee4
SSDEEP 3072:lA6xGMCiJFTYkDuTX9yGwSREF3IVMRm5ppFFSqu/EFMeELO+niKh52hfZPXYlXSG:lAACiJFMkDuTyF3IiRm5ppFLzFMeF+n/
TLSH
T12A04DDEFB4583EAD8045950785D8F07C67C62D6CE709CBD8622DCB60BDF90619A22E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\en-GB.pak
Size 87KB
SHA256 4a5e6439c6731a5273970c8c053b4a89018c57f1d9be81d85f24978233675442
MD5 b8b8de138e6cd2ad1eee182f2befc905
SHA1 acb5fbb8d3026d2cf0d5afcc0b2407f7dc7f7cee
SHA512 c5575f68aee1284a82a47e4d412df6175550bde1d8ffd3845d295f88687ece4a7c04f0ab9fcab78182fcabb6876ccb9a1f6ee815b0abc0eb96fe59f5ff849e4b
SSDEEP 1536:c1BQQyiGUaBWTHjrDXApScz4RrgasTX65iBxgwSOiJedMJrV0h5BvVfm3ggl+qRR:c/QJDU9HjHBVsdBxgXM523ggl+qH
TLSH
T15A933C5BE3C51226069242627B07E3ABBF15A07C931212967CACC12C37B7F958277BD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\en-US.pak
Size 88KB
SHA256 781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
MD5 af5c77e1d94dc4f772cb641bd310bc87
SHA1 0ceeb456e2601e22d873250bcc713bab573f2247
SHA512 8c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c
SSDEEP 1536:lnI8PwZKfs9B0fYSED0TI4RVQ2trM8M5Xx5dBxgZSO0JedMVrBHhBeVfD3ggl+CA:LEKE2YStRdMLBxgsvBq3ggl+CGwG
TLSH
T16C934D2BE3C41225069243627B02E3BBBB25A0AD935211557C6CC12C37B7FA58277BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\es-419.pak
Size 103KB
SHA256 2e1cf9d3e3eebe607da44873cfe37b9a84615962e3450313c3947920d4de4fda
MD5 84a1995559e8fc00c3e46ba63eff51a6
SHA1 24b57babee3291419fc29aab9c9a2fc0fe9c3d8a
SHA512 1b8453367bbeb12f237f850eb0ef67d4b6caa973f2e6accdae6ff5b7b3991d5be2c5d76f787d2c7ca5a10d2d0a92b47fd55141c9d900c850f80cd916abf5425a
SSDEEP 1536:Y1zfcN6nwhQppC6SGDYjRbqZrtlaUuzHjqXGiMdePcHYD9KeO0KWFsMH5BthDViT:ahnwhQu6Psl6pMFmI2Be
TLSH
T177A32A22DEC81F5200D2924CB383D76BE5C4A549B408C2DBE9AB536563DCE8CC877ED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\es.pak
Size 105KB
SHA256 b927984d25359f3d7a20d71aa4b16d2ec4c574461177825b5221865f416d1e71
MD5 4acad14261fa458cbc61451f4255c891
SHA1 bfbf2429190b85f692bc97d12822cedd53a70742
SHA512 24a71134f5c8f3e03b29491e11d0d0d2b9988c2528593c753893986c6db6ff2bd88e2e5389b086e0785e24141894441efe3db976111e2ad5ee5afbf7374fec1d
SSDEEP 1536:CPOLX5pxZkWBvJdYx/TFKYM3vtdThgFW9XlhgoThoK/rh2L1w3Oy:C2vkwcx4v5F1tYC3z
TLSH
T1ECB32A229AC81F2240D39248B743C76BE5C49589B40CC1DBE9AF976652DCE8CCD77EC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\et.pak
Size 94KB
SHA256 9cdefc472c67247e67da040b984e800cc8b903a1b39c742e6962ff5c423f391e
MD5 3f2f42e0e8ffe5c26295f5e15480edca
SHA1 e183e93fe99145ce0471687e930926018b1fcc19
SHA512 bb61da1665100b59433d03d05fcd074d36e07ea3c29f2f7c5305e2b560e2a2a8fc508d38b45798d98cd3c1987165667cd723726397e3d1e4be006c17efe11c3b
SSDEEP 1536:BnHIHEpX0aM3DS4xyGXcen6dg9NzuLECchVjpsPQHXG:BnHiEiaMe4x06NyLiV2PQHW
TLSH
T13E933A42A17A7B0B186041E98736EE3BDD8FE68DB10009D27857970932FEF9C6C71E65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\fa.pak
Size 147KB
SHA256 7e8f7f42300178f001ea5f74c63db25d813b7c25989114dc7673c76fd92a72c9
MD5 0fbe88d360abc020ef6d511ff5cb70a5
SHA1 8abc47bc30bb0128b84ca4335dc09a67b051edf4
SHA512 1eb2f414521b4ead4eccc26305cf89eddf2a9e26bc5e8d100946a8b442694e48df6fdcde858197b23cdd47c83ed7c316d280a642017e7516c5db73c3322fba26
SSDEEP 3072:QXP4Rawpa8C96NS9/W2ESEmGzR2XQmN4o6TwNv7fizfb8YIO8jdr8TwatK/E3oLF:QXP4Rawpa8C96NS9/W2ESEmGV2XQmN4s
TLSH
T118E3E2856A6C5AB15796CA0341E33438C773AE12E349FE40FCB1076609A5B139F5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\fi.pak
Size 97KB
SHA256 4e538a14f1dbc872a85fdb4be1e19145553ecfa3b07ee7c810b690c52b889684
MD5 0c5f18712c639646e37fed054781b147
SHA1 faecb7cb6838783e15bc52c8dc019736a334d59b
SHA512 ef9f1158c35045bbef92fe70d9006cd7dcc3c834f5a4beba5b269ad6c16f9790e316b7e2617100567919ad647a1353cfa8b80d5ede23cec9e5f7ae9b4e49c154
SSDEEP 3072:6EsQoWFTTTqWU9S0JEji18vlhROdA0EjjNM1TO9mRX:6EFf7iE218vUd4shX
TLSH
T1CEA32D929256C21237C4C14E6EB0D03EB7D8A28DDD5885D5F983C6D807F69C82D72E6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\fil.pak
Size 107KB
SHA256 cb536b478feffd3b55ec53676cce84cefc9e000c1205273bafcdaf6ee6edd381
MD5 249ac7111d6310c67b42e973f6aa7646
SHA1 db19f2fa4eeeec09906ed31bf6295e7831bf9e2c
SHA512 e96d000925be9fae898602f5d62ae3e642e91aa2957d723ffdfe9cac9bd277ba2155be31620fbc326d5cc43d47a0e08314fe27688a6eaf786491d6b39a52a00a
SSDEEP 1536:3NqmgtbTGldYzVgQNjLeyspz4NvuNpEWnGkuljgOAM64CzPEchYkZzk17PaXmAMD:sbTEd07PjgOAaCzh7VSKmAW
TLSH
T1A9B3C411A3402708DBC296E51250A92F6BE530BC3F4128AE9FBF66973BB7CD4D670587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\fr.pak
Size 113KB
SHA256 f3bfcd6a297a7634c24f2fbd3de96f02588b0603d4a7618bb7588f6c091beb2e
MD5 a9552c30b27aca538388ba34c2374d75
SHA1 39173220e9da4c3d591bdb1d0dbba77dc8fba6de
SHA512 f6d01a2b0c03741092858b7616de8b52662b73a00e49b2d7b5e1a05195eddae507c432557b2bf8697ec0b8e3b620fa3f38ba577a7edd909556d73498fcffb9da
SSDEEP 3072:40CdiDv3ixbJPRQUClLZky86mQKyIwKByroFDuFcZYjlguPyNn/Uv:4/sPixdPR3ClLZky86myIwKgrwDuFAHE
TLSH
T1BBB3D84BD9D4218619C242B2BB02D767DE34824CF215D344E8DF42E527A6CDCD3AF6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\gu.pak
Size 207KB
SHA256 1d4d407233a4c78d5a9a242b43b21aa89fb68a0632bc52b0a515d69491632e85
MD5 cf428ecec583b73172fa789ba3f9aa6b
SHA1 9a7456009b5a53c4f6470a370319395da394e462
SHA512 2f86f9679e04b8188d7ce44bf0a7bf4b998d9771e9a8a83b4be4dba5e5d21ebf6a00091792896d9a8d4ed38eaecd43d8d2cad920237af1ea702dadc0341be9c9
SSDEEP 3072:vLx83is0a1A626ZO8n308LcKHdO3C362oY5maBeQOo5qP2G/KO4ue5GS2TsfWsjE:vL18qxv
TLSH
T14E243AD0D3B9F03119DAAF7E815E512086695213D67E230051CEEE898811DDF3EFEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\he.pak
Size 129KB
SHA256 4a9862ee8e139ae74e6336e0207d484e1a1ae0f689b5f1cc06b6fea66d2090d9
MD5 a275c3557e819c6e9fb029643e38fa17
SHA1 8c005cb081417ff2be0d7d8fb6356519a96f5703
SHA512 72936ffb29ad5b7fab17357286eee7fa9a6b933423fc8618b19fdd841b37d9cc613a35e04614cb74f69f49a4e8bf7a8b48bb55a10e160d8363dbdf697bc314c6
SSDEEP 3072:IH8reuJQWaOKXLpiglHN58nX3XTnw2FCC9V:DeuJWhXLpiglHN58nHXTnw2FCC9V
TLSH
T1FED3DDC4A6E45225513569C38FA4FA396FF3CAB53CA23512CB18526CAC774F0BD630B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\hi.pak
Size 213KB
SHA256 06424570167c9bdd7e13b115a632d6ab58de7a4fa14f8d094627bd12d85e9318
MD5 eb017ac26477d54c707d3e965ec352c5
SHA1 112001c7a38d9b95d3d0e422e10c585079356018
SHA512 8dfb1f8b18ae62841a40de244ce725b9ad865b4de7d250c0d5799f6896d274276e73672e3de455d0312a397d20598c768462895e4a768511b7ca530717611837
SSDEEP 3072:+8UrfNIncwfKSIv73cdEVhkAovrCFO/S/+fm2BfvTH+f+aJBKfzzruE3b8RLljlB:/Urfm+59R
TLSH
T1DD243C0CE7BEF3B65DEC3C8A32490D3BD5AC3674A3E5525348D5B3DB9854CB4046A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\hr.pak
Size 102KB
SHA256 cc48d7deaf73103e22e3e5900503396e2a2c9e5bf1450a4df8ce94179b1e47a2
MD5 551026fcbd640c1b911ed5b4cb7ada68
SHA1 3aac7631c7f23e15a1abc4fa1cee98acb695aadb
SHA512 7bed851acc8a137c481968902006917c6eabdf1476c4cd74dea7bfa731bd45eff6b742c4b4ef48ba9c9eb4b2ba86c09c14878c05ff797bf56da075da9e53bfc9
SSDEEP 3072:MMN0LeqtKRxAGCyle77l/XpUa+tbakWlMMoLu87R53Kkx9i:Mfyr5nKp
TLSH
T1C5A32A3CF6F267090C96D209DFA6836A79FD049DE515C6FA788F571E0163F0C2AB8606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\hu.pak
Size 110KB
SHA256 61ae4e65474cb4ecf5edb2ec9bb9ea2b7a47bbf769f81c8fee1282c13b209783
MD5 e51afbba3250e655bc01e424a29e3162
SHA1 d7aaf2f2f9629ba9f7cf8a513c2905a13d0b6a8f
SHA512 57fc72149761cdf1de5c021bf7e63d79d91ef2e54dea57b9bd9f659dbb2c2f76dc43904c53518c00fe4ca80b92b6fc57489e275fd0006b2295f31dd45c0618ec
SSDEEP 3072:srCzB7nRkbJiKw7UiGKAWEc2dA3RdpEtL1543ICJ:srCV2bOUiGlc1RdpEPu3ICJ
TLSH
T170B34B7793B65049B8680357A965BB291A1F580FEB2F21F63987C87830B178D4C53C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\id.pak
Size 94KB
SHA256 e07be6b1a095f235a4babb2ad5e8018c8c1b2f7cd6feab170124d25898e764c6
MD5 0b9e5f5651aed9d1299f3246597ac182
SHA1 62aa835853c07e66d027d129265429adc6779491
SHA512 9d4c238f9506f41a43d531a762f7b8426db83ae093433e075237ec5211451ea6f888ceb14b8a055b67e5c6be43c0087d1c35de558cbc6d828da96043b98338f2
SSDEEP 1536:M+zgmloUhrsGEKhU95/SWpEmNUwRKUEJ4eI8B4X1CPXsAzb2ZghlrRajcCdAbJ:M+HlukU95KWy4eIn8XsAzaZGlccCdO
TLSH
T10D93E9525EC9310C0E4842D8A2D5E62F7DCC233FAB05676E9F74CF7026B66791B22B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\it.pak
Size 103KB
SHA256 4e2089d3fd90977f9a3a88b2af7fa9ff3b9864969d2f4582431626ae1f37c158
MD5 fa6eceaaa453fb66bd631aa9babe0026
SHA1 790bfefc29597d09f313c08e7b23ff298d60fa23
SHA512 88eb70a25a6b76e5b3272d4bae0721f23610ddd1284f54cb991eef3ad78eca13f47c6a8d79d5fb73f8fe171d5abea770b6902d0a1541884cbd5677f3dd4920f5
SSDEEP 3072:Ub5255TLQ2Vxyi9yN4tA7kxA78dgDufZfW01c:UFw5TLQ2Vwi9yN4tA7kxA78qkZOac
TLSH
T193A33B76E6D211151E86532DA221F196FBADF8CDFA017118A58B430C23CFD84E5BCB97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\ja.pak
Size 124KB
SHA256 275307a3a9708c0698565f10941c57d42e1d2f55709a025d37e588699b5a985e
MD5 932a8b529d16e79c1471fb8c92109eeb
SHA1 4cec50af799472bea97fc1b1a127c31d9d08b176
SHA512 f2ddb70f819ef08b51c73748f2898ebc987d1d46dfa8e8ea00d2309ac51e37973310bb4f2a3503bb7ad5ef68150b01f3fe5492470d1e30fab374159ef44f8f4b
SSDEEP 1536:T0gtNfSwl76rsWg4AkDiQ492E46Tesg+ahB+nLi0doNHVQ:Ig3fjl76IWA+4TiiAB+Li2oNHVQ
TLSH
T170C35F7CE3C965369C6082A22C4E76E97546AC5FEC623236543DC070BDB0BCEE915AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\kn.pak
Size 237KB
SHA256 1a3fa5261b58113ae1a5cf140abd93e812b4a866a19a4c54929fffee5f42b18b
MD5 9224beb43327caf18c4fde76482ae12a
SHA1 ebaa89421838c093e36d74cec8bb3521772f29cf
SHA512 2c3ae5fd43607f34562b935bf6fb5dc62d083073f430959c4d883c188f744f49ac38d3a3bfa8c3e61113a2e4813d06fcb499ffe3cbfd07979b405b0cd6eb2432
SSDEEP 3072:VwI+rxPrIbgMkipVLe4wrZELNm7SIY/u5ZDu6oSPE7JQO5/d/OACAGAfKI:OI+B0bg4m7S3+ZDu6oSs7JQOV5GAfF
TLSH
T12334CE189DBA7D301BD6106B24EC643EDFF16BD29CA907D2F49DD7803C62C6A90829DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\ko.pak
Size 104KB
SHA256 0a46cce08401a72e44178349a61cdbae5fd78ca4f071bff2bf5f2e8c877a25f8
MD5 d6c5199671535c5b644d730c9d8c9063
SHA1 7bc876a53b0da752fc93a088af1ecd043dea6ad0
SHA512 71f8c2a676c7e672476d578ec36d8e9b16f823fe257f7da7c22b84dcdebfb7c18480fb52a386f14b9d60d2aac6c322aaede7d61f3032842d3bf713edda8cf857
SSDEEP 3072:L6jlXiuY72PcT5t4CuAJq/4KiWgDqbYSwnT:WjllY7e6teKQezSwT
TLSH
T1BBA3E9F278DB23C80652D946ABE4FA2E83C1E97BE7430294FD44CE54DD245C7484A9BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\lt.pak
Size 111KB
SHA256 225e5784a7a616f83d81e6f3fdc5510e975e9fbde741b673deece5ded1604a9d
MD5 29aeeb61df906c770e43ed477160f5bc
SHA1 d3224dff1967ddd1618d1573d91c3149ded8ae3e
SHA512 09f601216ef230c20e58391c566caf388b0ed5421cacbc06fd50bef242acac599e09f92fe63aa055dd314e0ebe9985b76016d82d32b426e51b1f63c7b888ac9a
SSDEEP 1536:RmrvD38onfyORY5gaJzU5R8FYlKUxnaJGN5c0z5PEAy6K5rmz3MWbhg5m1NqF6Sb:Y738oKGyQfKenaIcApbXdtrqF6S05nI
TLSH
T1A6B34C0196C3AEEB6A0053C982A0CF79DF7D60046636A991FC6EC357C4BBF451974F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\lv.pak
Size 111KB
SHA256 d58b6308b64a1cda4ee0b2b395672728ce7abb73c44961fc911386569caee60e
MD5 ce3cb88e12f86eb6f6ad23a4d34f49e5
SHA1 31ed4ddbfe6befa49c6c28089edb1b1617d896bd
SHA512 5db77b4e3fe2a2c76fc15134b7db1c4acdcd08cd296aa1657a08b55871353fc7f911222ff16078379a8596d401a66272a431fa9feff8bda5bedac9d7479d02f4
SSDEEP 1536:0rv+yaMchZGB5nDJSM+hzyez0YNUc8YjJ8I4WSuAhaIphcmE425BaYK/faVdX1:0rvdapZGTmUc8Yd8ScVfaVdF
TLSH
T144B34CA1DAC29F954E505DCA7327D233E9CCE304EE01E116ED6D8B3A621F524127AED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\ml.pak
Size 250KB
SHA256 e51d9a02ad11cb9825368da9a17af7294b7e6bf11079e2072e4bec028ecaf20f
MD5 aa549352ce43c7f3aadcf24db4b28039
SHA1 52f9de28a67e438a4b055b0988f2c4dc480a61fa
SHA512 d220ac779b5aa363e4837430fb66fc3833fe0331fba3c634ad920f8dba8dbb1f32fde0eb6da26cabd9c089326a46252df22ade62299d6bc37c9b0f3694e8ab51
SSDEEP 1536:ipt3yrxsIaPEL+YBkW4m/rvFdq2C1TmHh03m:mtGpaPk/XJdPETS03m
TLSH
T1BA44BD4BA035CD3B0FD102257B4E2FABDD5B8FA140AF668B5869F2628C59F7D0C99431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\mr.pak
Size 204KB
SHA256 4293afacf1c4dce2423c368a45fec4b33aac7232e7b7c1919aa8a5a20fb026a1
MD5 896759a28d38e5d8f415570dd6f4d85e
SHA1 23f55cde464192839434a1e727ceb285b8b1f82b
SHA512 4392943394e2ebc257ed230f993d6f0280ad4106e2623bd9a498c8cbb8dcaf05a49fb998f855fbba637030f43e68d15dc429d71604ef285f211a9c86480c4e60
SSDEEP 3072:LM82qbqMB6D/W502ZleTc7eegSZhBFvWSLQEDE5dEBZt+TYjDR6KAu:Jwtu
TLSH
T12A24D24CF7BAF3694DECB99E36540D3BD8FD31B1C3E9825608E1B3A74884CB405596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\nb.pak
Size 96KB
SHA256 21f3efe54a2a0ed9e2f618b2a50f89b44957bc7c779e7f88c1f10b310cea8bd5
MD5 1bdfc009f54c1e5bc8eeeb5017f9de53
SHA1 7427d3f37771886af1c0af1d20468960c524377d
SHA512 eee4aed543d30c7a74a64350cf67b454ec4ad56dc6a51f88dec648b80a33146f5bd3ffadab16a1f0b8e1ffe427f56f58a86da748ed1b118ea7fa72610d84c07a
SSDEEP 1536:gom2lbcn3CeEFoivwBiXEHZqFdIm8VUvCAchEHAxF:gc4nymDHZqFdIwC7F
TLSH
T1DDA32B83D9867729E69447A8F129D52F9F7C842DDA8405CBB48CC23A1ED3EF4527E1C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\nl.pak
Size 99KB
SHA256 e94551ca94505f068ecd0619af676b7b3a869f6068af87f0f537cace8055ba4b
MD5 fa16e91633aa0f20e49b7e19bb57aacb
SHA1 595d392d20df35ed71f4461cd5c85b77a68612f1
SHA512 d3fa50f247cb216e07d4905bfec4ab39d15bbc9b60cf0e3dc733bdcd2a0cbb1f8513589c40111335797248119e59ab2d2d46c2cf18c496796fd4b7233a829a30
SSDEEP 3072:u6KTrYE5am7spkFjegH7IINejowGTielwo6ytW9:kNjeKqRmUyc9
TLSH
T142A30B03B8CD252E19C0A349BB018BBFBB1ED22CC258E9BCA4DDD1751553FA944BD987
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\pl.pak
Size 108KB
SHA256 c57c2e534da554e42388815cd3e848630ed46e1e61e640a6f3d4fd7cbdfb2aed
MD5 da0bfc4ef754490879e8dd567961064a
SHA1 f331c571422c5bb85f90fe915756ad9787103c24
SHA512 1ccde932c1354fc0880afb7eb1fe9a8b93297cfbb21e0dbdb78a07b116b951672a2d1dd25e0dc94fa1384ac7bb22a007b468a391457851bf8c88efb9708a7f37
SSDEEP 1536:t8ZTz/RoRMa8odxIQW6AeJJzg349OM4oNsNYyhIi+3ZyL5kA:t8Nz/eIQDg3Y4rYIIi+3Ze
TLSH
T17DB36E0E82E19A4E4EB045D6F2D75F7E9CCC888CF205815BA45F8037617B15E8D7EACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\pt-BR.pak
Size 102KB
SHA256 ed9adacad575344216ee986e9c04908a5093aa7a0ebfbf2549df4c668a35f356
MD5 31e00c1fdfb9f86d7f5b5b285689cff8
SHA1 c5131466499d78c7282f29b3b12f8934a139991f
SHA512 b36b87330b29f99ca32d781175f1fd485fa034eafa2458f4191b70bdbfb2866fd56edb0e97ce7232b0dc3135b939eb7ac1161b1002d9322dbc7ee016b8069f09
SSDEEP 1536:TTEl8e6Vb//PtDjipJtpm/QzrKj0Y0X4xhBc6x0xGUY3yDeMTwO5e:fEl8eyb/XR9/QrKJL5XMTlk
TLSH
T16AA34C195DC9171604229310B70BEB57AB88164AFE05C6CBDDEF8F06A3D9E80CC77E5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\pt-PT.pak
Size 103KB
SHA256 da64b5178bb41be0684cb3ef1204becb457520fe4960c3252f5ccd6a9ee9e29a
MD5 f33190e2616875ed2349115e128a54fb
SHA1 27e44fb2cdfecc19f5c91ff2f2e69956cd59be57
SHA512 3020da0fdcf7984557ef7af1c9f0e7cbd1bf364a8841e6671cec4b517ac89e9c4bed680a2a2e76b18db5e2d10c7f1a41c5758306e3f20eb248796b2be6e02fcb
SSDEEP 1536:tcJdPoUL5qsr/y2VfgE5fcBw4d6hrxz2qKHWhLtOAZ12kR9C:+ksrbr0Bw9VtOAz2kzC
TLSH
T141A33A1C8ECA1325052243407B05EB57BBC86659B909CAC7DADF4B0272DEFC4C5BAF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\ro.pak
Size 106KB
SHA256 99730524e53ca07481f8cdbbdace228aed42abc19d2277d26c42f47653f3cf07
MD5 4c4112b99fda13b8fa5373d379f476fb
SHA1 2422afa9ea5b204fe84cc241cf6eda2c8b319fa2
SHA512 c663a678d0eeb66697f430e785c32fdb021a40c6456807f3842fa0e2c9ae3450fd59c3ee15e9a0975b8d100fc7c7118a06afd595404a29d777780106c8e1ad4f
SSDEEP 1536:pvGWGGi3mp16a3y5/zOSoPMyVwPgJe2DLpsPlJtWIhx5h6/uxFDv32B+A:purMpsIFJe2iPzx5h6/uxFr38/
TLSH
T1C9B33A13A1C45A572D814271772272FBED8E204EF601D1CEB5DEC97811C99DB8A39ECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\ru.pak
Size 166KB
SHA256 ec6654ffd877ec62d8afcf90469ecef5790e17c7306654cfe4b905de449b06d8
MD5 5d77bc0c2aa843ec5be6a3614c062359
SHA1 0b22c3376169a5bbb4697d586e4a0d3094739dd5
SHA512 a2cf1ff9f7020ba1998a7091b802dd1aeb59bf2b800a41ff221152e2d017435372bfcd52ec454db543e856288e2dc381dc46a7926d4bb4b917b8749657fee0ab
SSDEEP 3072:KWFppsemP4lV+TQUXEmOAdOiOFIQgIvZfbRrK5VH934RzDqa7BLuW1LV2Lle9X+p:KWFpp9mQLPQVOAdOwQgIv1RcVH9IRzhM
TLSH
T1EDF38761669A64DE1201F01BDC08BE0E7CEB44FE7FAB935619643D7E35F2024C63E61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\sk.pak
Size 109KB
SHA256 d7baa6b1c0355e1ce9088c6eb508235c7a640ba70cc7ad84c9ac607026400495
MD5 ba56090d9658733694473c7861d04040
SHA1 dde05b47d06fa81abadc1b8f74e5993d0ea61ca1
SHA512 ed49f76f2ef4975e105fe13850258a51e44d0ffa7167a52b398276898237636aa50f62209757dcd756e3faef5581e314e261baa3a1e46b183a3b93af68605c59
SSDEEP 1536:ufxhFgi4HHK9eDpYaQWQtTe7hukM+zBHCYaiggGP352wmQPE:hBSaQWI2ukM+zBHCYauGPp2wLPE
TLSH
T1F0B36F2FDBE6584ECE940108EBD6A234FF7D05D98A4DA091A80F724724B3ADDCD78D46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\sl.pak
Size 104KB
SHA256 48e9004441f8afb200601ec2843a03892076deb1706e1d3a7bbdbfcdd137ab57
MD5 b1e33bbb0abbe113a024694bf4608c5b
SHA1 a157c8578685f5084fd805c9d0734bc7646d77d9
SHA512 94854eb7021ab112b710332a410af53e59a42c4a501eb02098a41004613e5b2f7727a192c74e2a1c17bfc584a85477e75bd1eea0187e79db1de83c8253bec322
SSDEEP 1536:RU1M1nublajdqz6HYogW4xVivgnUhXaA99DqJdIqTCORahNNi/fzU1BwwRqt:RUpZWqzon6x8DgIqTCO6Li/fzMwoqt
TLSH
T1E1A33D35E69B1E0E0CABE28DFEB253657FDC045DE241E1A1FC4F23685021B5427BCA96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\sr.pak
Size 158KB
SHA256 68a04bae37629675c49d9aaeb68a1da974aac427b61151a18f3210499702202d
MD5 c56d29bcf5fb38ea25ab1a855690f9a9
SHA1 f3161f2890971ef929473c58654dac0718983957
SHA512 551a72041772737139190894f5dee50963f5597a2271bd2e94af390cae34967cc435bf5504601c061cf6c2ccccd19e7bb708538a6789f185412fc715e85d54be
SSDEEP 3072:u6umjOFT3hFmGK7vVsY+f1GX20Dl370BQn0yh9K3Y+Nst3r1GLTL6itWYJ/k/Zp:HT+TP0B7XDp370+n59URV/k/Zp
TLSH
T15CF389719B9E64DB0A01F41BD8087E0A3DAF41FE3FAB935215642D7D38E10B446B935E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\sv.pak
Size 96KB
SHA256 c63e812fee929492974c9b5dfa14a7587258e6fabed355a105015b296246b068
MD5 2befbabeabbbae5e7c57934acc5cd41f
SHA1 d48e9fd4d73627f4dcc57ec31924d97f6fd6b8d1
SHA512 8e06850701c6bc2a4a5ed8b9d59f68b68d631be7b037e2df2a738b5a44d36a37b1419e739341a00ee7681249a434ca69ba53bbc58ff0f204322f7dfde2d43405
SSDEEP 1536:49G15Swi3ANlCXU8qwJ4Ey9HdSfvlALur/WLdP/ldO12D2CMqeLKBqQOPXE9b3cY:JTvi3AKT8OCbU+Vn3
TLSH
T1FAA30842C660F525FBB1470DA605116F0BDDE59CF2D180C9B8CD893EAF97AA805FE24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\sw.pak
Size 97KB
SHA256 8b07bfafa5c97be2da9b6146535b7848d88a44d43a45ab06dfae286d93fd64ce
MD5 2490296567a1cd3c7b0852e1ed7d115d
SHA1 04b527742cea9487344ae08c463d6fd4ba16b1ce
SHA512 b930c14847012e12bb19bf217c79516c569fc163204d9c2b21a36f6f5061a50c3ec057882970517fc3bc4beebcf3d1b1402ccd521404cba827309940a5496b3f
SSDEEP 3072:AUaDx9XlYKed5nDi5jXmQtVPGoHLeH+jKHw9E:AU8MnDiZmIVaH+jKHw9E
TLSH
T1DFA3E8A2D8B1D1140622919903D8FF7717DCED5C2D2758932A4ABF4F228FA8C1677E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\ta.pak
Size 245KB
SHA256 22eb9d73331e92c898b27546a9e775fa8df0fdada391734a9291b2a016662652
MD5 8c8b63dfb6dbf75603d3e2e4fe981f9d
SHA1 3e7c9a1a01526367b016df20822a41e430328e94
SHA512 978af09738b4e00ba58f91b82db6cd455ffb3cb4951c25abaf79b8159c6fcd9212348373ef5a5a421f9ff5b4604a3f5b54aea3257dcf566807b6a84824ca54bc
SSDEEP 1536:ow9AvDLcYemZ9w7towiy+bvnTDE2k4ca6QVW0LlGJfB1okotPttRmL+EG5aIAuwA:39I/cXmHw2tRBp
TLSH
T1B2342FCE913EEE890E93288F0319536952987155C46BE3A27CB65F1198ECC5DCF342BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\te.pak
Size 228KB
SHA256 2dd8a542ee0778ee39639380208c584d9eec8932d1307bd5563e1eab320fe0d8
MD5 c370f82ff93880c0f32e63ceca8f1050
SHA1 a1190895ea7e699621f930c9b4b672b786fe1d9a
SHA512 be8febb9ce42731f6f3dbe0775d2bae10267f0790ce7bb8b437c4dd5e736fc28772812231b0a4a39b28dafc63d54d27fbbfd94375dbceb317fc43debbd566844
SSDEEP 6144:O9cJA6UspbDcUSanSBXvQBgIiCQvWSsxU/dUVo9wLwxEE:ocJA6UspbDcUSanSBXvQBgIiCQvWSsxU
TLSH
T12034B2023A7AD311DAE70273352CF5AC49681B4261D6732C1EAFA357FB87D6E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\th.pak
Size 195KB
SHA256 cffd61f7954ca10038529d14fda6a4e34c8ea1a9f202ead0b0c2db93143ef485
MD5 f265ec50e0eb62893fbc187c1c962dd9
SHA1 5a60ff7287e5d4e35f000d229a4cbb37db76acc0
SHA512 696140d16655b6d1c17d59b3e280f3f387adb8ad58c4a0d369925bd01cf03a3fd934c3b8e02e9e868bb64f81e7cfbfa532e732d1cd705c52c7b0f588765ecbea
SSDEEP 6144:aMMGozCJFkcSCkIOBrQrUXFIw3reJZK8Q9w1p7ETsGpY0bhdxPtA0kC5/0:aMMnzsFkcSCkIOBrQrUXFIw3reJZK8Qm
TLSH
T132145E733247D9D479481A5B262A7789662DAE693F73F8E040C9215A73F071AC432EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\tr.pak
Size 101KB
SHA256 b1b66bfec0aff21c64ec8ba3f19008501f196f80e7e41b2e8ae73114357df458
MD5 d8373d7bc1bdee4cfb48d85694a78ff9
SHA1 323408e39b2c953728420e5f21b1d1eb25de6c2b
SHA512 6960d7c0481985e0f151d66d047a02e7c31cdd670afd71a0a3949b9b0ab9e083a5ca55faa48e38c8793ebbf1218a4503043867d1999b163a923e5afce8058888
SSDEEP 3072:uTJeZiainAmSngesR/Rv2NEiOwi1PNpskBa5Y8GKhEtJj3:bZMAe8NEhwiBNps2r
TLSH
T148A31880B4EB281C8F78274FD7E1466EF98F165AF232A446E626D726379534702F760C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\uk.pak
Size 167KB
SHA256 fa035595c375522d09f9de5a545f5339fcd3ddb224fb19f1828a7958b7dff3e8
MD5 e87cbe2cffa7d3a95a8f837231d6f44f
SHA1 40f7d1602b47c7a7ad445fe04377e3145f8caff7
SHA512 4a8b970b50da8b92b824c92c6075c8b4440826da5a581c91ad6e5b78bc65e3b80be0080e4fbb20ad91e3ee30f8a3a05ca6925e93c76c8d2474cdb9a8825acc74
SSDEEP 3072:fxJB3IjwWDCj+KU/TI7Yf7/QLNiXMMQOCqbCEb4UdL+v:5JB3IjwSrILNiXMoCqbbW
TLSH
T1F6F3AAA19B9D58DF0205F05BE8487A4D7DAB40FE7FA7431625A53DBE39F2024863C31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\vi.pak
Size 119KB
SHA256 044c48581c2395a8eb0f85b5905e1b4cce1fc1fef2196710cef06e197afdfa99
MD5 dbf8363fe244c7d45d44e987d7194566
SHA1 c3bf0058f956fbd6fa0ad89218a22c7668964b30
SHA512 0953c455581f045a17e2ae35712487f36603b942f754805011047e4dcf531062d1dc1c8755f022177f7e21b7ab52fa71db5eac7c524424e1e5a2563429318e34
SSDEEP 3072:2KqJQj44KMPnMpPiz+sEqOa2WYmc/14Ca1bNeqhzi5OZpW8uTtdLpFeSZTzeNQ:86Zac1bNjzioZWN1
TLSH
T130C3970117E1302680BC553DC6CD941E6FCAE45FF3808FE16FE825787A621A56F35AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\zh-CN.pak
Size 88KB
SHA256 690dafdeb5be360e8b3a84c711d0d48b3cfc74c871b89a8f03f8058738ca9834
MD5 d9fb680d115846809114de2b35ab4ce3
SHA1 d1f68e0181233c98ffbe91b09910b9d87c1e35eb
SHA512 5968bba15bebf047df19b519da87bde959ccf1e564012043ea390b3c1e572bbaed79b8be6bfb884f4f9da8f1c25f3e6709d6620c582910deaf723906fdb04525
SSDEEP 1536:fS4xPz13JLazuzqWI3EnkHhE9vcolEclL:K4Zz13euz3+B8pl9L
TLSH
T1D4935D9D41E9FDEC058184581726D23E7980720FF213DAE6BD91889D1B72E960E6BE0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\locales\zh-TW.pak
Size 88KB
SHA256 8187e67cde3292c6f18ea0a40f8f8d3f2cd604e62feec9ec40c71b5d2bcdec9d
MD5 d0141fd3e851cdb790549c069a76abcd
SHA1 3da3787a8ea94aa066c5e5d17e42481330e0caff
SHA512 947e19e8fad3a761e5e1d0380547a8f9bc06f28cf8103d80865eb9ced9e3ed3d601bd92710ef1cb9fa68d56eb62ae95c1aad78145d455bcb6dda1b8c280f4162
SSDEEP 1536:Nx0gkZ46QB0MYZ2wcxAhdmDMQ+23mVcb7/8sfjkMQP1Rh5u/UxLiow5No4V3XiP9:PXkZkaMs2TAhdmSYkg35N/9XiPm45ycd
TLSH
T1D49349A948F6DFAE0510D64873C9823F3C49749EED33B7B6BC4D48A81F76A414E6580B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\resources.pak
Size 4.9MB
SHA256 a30b8269e588c6cc2cea5fd4685da3012fd10451edb59a283005116f8e033182
MD5 91f8a4b158df6967163ccbbe765e095a
SHA1 95db67f0a2352fd898f4a4cfdfc860f6a9c58c87
SHA512 6450d75d53f24d11e1c1e7e3cacfc57ee9dd09c00ca0dc2ff30f580b59a6b17e7ad7d96682195bd7d806b49068653538c77ca4200491560cecff128a0b012d92
SSDEEP 98304:L300L4ikWDclBYMiqOs7y33cJIVh1uiUdrwrAUFJ7rK5zkIFvd4XTI:z0Q4ivKYMDJOh8iqkrAUXrK5D
TLSH
T1F0360112E4783EBBC2CE213B74BE315366A118C341697E7E77CE518C4F99D0611BAB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\resources\app.asar
Size 1.1MB
SHA256 3d7238e82378728ef0ed95ccd60bec5a8de8e0a119bde38d9e6876986ee850e4
MD5 aae9eba7beb3890fe33e5fccede068d3
SHA1 c61ca37b8e52bba61ab0ccb7ff47615abf8b3799
SHA512 302231b4f52ad8aabf32fc33545c1ede651d90a4a2cc6c19ebbcb24c938d15a11fa06686e44226e7ca5061ec1c7047454fb172af798342fc9f8b72f077a3327b
SSDEEP 12288:7eom4/+j0xsrDIFpVpZ3uQqPjSFxfPfViQtdYCOx:7eomxyrltdjs
TLSH
T16E454CBB77B29635299617EA0BDF0184A2384116A911C858F81CF0CC37B5E2AF1F9DDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.icns

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\resources\assets\icon.icns
Size 46KB
SHA256 a4dc3ce7a64207d10d15c4c537599f47b4ec1f16b53dbf3a92466d050ed4fcc5
MD5 8f80ca9ee10705d617566a041ccfe010
SHA1 531c952d46864e1a295c765e236d31147c5b7dbf
SHA512 ad1184a361b1645c6ec9be311bedf46f1518060e558da758e01fb56d7668b4b611bb1b320f8664c53958d6192c5f3d16c2f7643c2e99246fc6e1fe41bec72ad3
SSDEEP 768:DEE/FGBpID9deCikSY4CbB5k1yBte6eLjjuX5V6S/00wnkKhVLXCe6sP:YE/FGBpID9dvhd4C95Ey2HX0N/3mLXGy
TLSH
T1952302310C9D3DE51886013678E33327DD7847218366D8BCB29541F93ABE1A68C8BDCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\resources\assets\icon.ico
Size 49KB
SHA256 c079322ded8d8ebb655b2b93be10b18b2a7a5080dde945da6acf517caf3acf3d
MD5 d0324f3206be58e644b84524df1e5c0c
SHA1 10ced9e31a93e8edbd039f802d3e73eceb142b1d
SHA512 bc3e85cb853f19d26a3b4650aa842f8219db3d04ebf99ac7272ffeb40cfad8b82917bb1ed35c86570065c57fa501cfaba8a1b1d3fac93c40c2777a581d8172a0
SSDEEP 1536:vIBDu4tcgVKcGoqmBmZS3wg3Vp12l4F0rQRXq6MbIc:vIhBfRBKS3wgI4Fd86M9
TLSH
T1D63301BB48D7A98C51C0DE886C19D4D8F385647C66CA7C62D16607C2F5F8EEA80E93CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.png

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\resources\assets\images\background.png
Size 297B
SHA256 1d370406c3b0c6bfe109feb76229fd4a0fe1d4171ae2a77655a0fd3264558d2f
MD5 32338b60ff8368fd431b32109eae89d2
SHA1 7a3a844f2e6371c8f3a08a142e2e792a6e77105a
SHA512 be71b3dcc24cea203d59e08d8a4082dcf253eb02a971e67034f8cc0930f6af72830b1e35430cc861c08341082156585adcedcbfc788a83ec35fbd78107e20f2f
TLSH
T19EE08C929FC22817BD774A2A58361360B96542B6C4F4DA1853F68B3318920E927F8297
MD5 SHA1 SHA512 TLSH

Submit Download

canary.png

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\resources\assets\images\canary.png
Size 2KB
SHA256 dfd3446ba31a55a11b45e0196b4eb2800e0271749c99102660d0df59f2ad9b85
MD5 a2636a83d1e5d412d1459b3134f0a3e0
SHA1 ad04552d42a12e0aad79995bba521d163f1c6af3
SHA512 c51cf43252083bd2c5a31510f8a1e34bc08b3c142484d40f04d4979bfd334c9c34456f4908ae881e90de355551bccefecf88de187383dc0a0d8e9d146917bb80
TLSH
T1FD413AC650765F80C64EA633AB2D4720EAF01A8376E0049F9814FB7DDAC7FC9AB46084
MD5 SHA1 SHA512 TLSH

Submit Download

splash.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\resources\assets\images\splash.bmp
Size 564KB
SHA256 c14a86e456f5b9783ed3e2118c9e97de6306fbd2b40cf9cd0dfb821b945c3569
MD5 ab867e66abaad50036f8dca8bcf3b63b
SHA1 ca0bd657610ce7b5b86514adde57e2b0f18a83b8
SHA512 24b122fd7f8a48e03b387308e91ec1ccc6025a44f3e65404a12679ed50ce7633ce9f6c5b86efbc175cbed716478bd015e42711bd0148742f1ddeca5e3dbb1863
SSDEEP 384:V6sr5D9wQM3Qxu6QejY8RGEHsDf8CdvCdXJWaTlnZIWYvylfQTexJ3:VHNaQM0uhSRGFD0CRe5Wa5OWwBMV
TLSH
T1A5C43BC05B3CCC4E95180DE4AE9E2116611C3CA89FA8F3582DF87F4D9A3F9D94A3A5C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stable.png

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\resources\assets\images\stable.png
Size 1KB
SHA256 b5b0f8076b0ac106fcc8f172b5e81516b69387f4119ca54715bd00739861fa27
MD5 d17d46244937c3705cccfe590b5a3d0b
SHA1 318949d0fd6d1638c7e0bb170e59b8d2f3662e34
SHA512 930eee25bddfe72835f5ebf6d5bec2e05e2e3a8740a588264efb8b7bb1dd7b46d3ff402206124b5a9878ce317bc64cb53d7fe0611e2a20902e9fc129760dd861
TLSH
T19A31D6D2227CD3C8C017A6B10BB04656E3B3199D41F69963BC68E20D1D1639433D8C4F
MD5 SHA1 SHA512 TLSH

Submit Download

license.txt

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\resources\assets\license.txt
Size 2KB
SHA256 2fb8be2f3179643a2b3f34dc48cad358abf273168d2f2d617034af24b129a4f0
MD5 eada62d1bedceb5443eab7908d263909
SHA1 e9e17466a02eaf585e553954b10de32af19a8123
SHA512 7b54aa1c0ead230cdbfa7c31c464a9d20164df9e70eee18f97403af2acc537e0805907c6cd8c923e42a2fd797c94b219cb06bb24dc4dcd272b25b950fc825106
TLSH
T19A51867CB3A54372159A02A466AAD0C5E31E1374B3AF57D06929C0393323DB142FB9CD
MD5 SHA1 SHA512 TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\snapshot_blob.bin
Size 47KB
SHA256 e03a33c2feb3cd9fd04fb1aa086febd0a6fdf5c680f48b6c5c80ef75767863d9
MD5 cc9eb6d1baf4870ee6425bd055849d44
SHA1 667e22f52eeb7a4962d6fcd220c5a0bc50570651
SHA512 49402c4624f67e93b2176c8ffc79f9911dc6cedb7c9704cdee5af380d69d697dc4be85aaa7d41db7be6e116603b6d5f8f177c09fb077a5ca5f85baf8fa6481a3
SSDEEP 768:uvYp69HfvGeQDvexhigYXcHl6zdOulbCmWGw1olf3e6y5GUx0y1p5iv192D+vqku:YYkVfvGeEE7YXcHl6okzw1o56iIiN9N4
TLSH
T10B23F15B7700D09B6F42832C7EABA60C0C135AE88DFBE73216E44905D3D6A2FF65900E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\swiftshader\libEGL.dll
Size 448KB
SHA256 b1054e0dc2ab31a7cf3cd7f3dae07b1ec31acd42c157be13ce47ea870840f0cc
MD5 038a73114d439bfc94be4732b2794998
SHA1 4b7a9d52da1bd808af979cf5cfb146404494317a
SHA512 8788e43de424e1d7a163d0b7f4d719c36bf8fdee9808d405aeb05993c446d4f2a595741cb4d98f5e9611cd16d09de9445bf72176a799f4189168bb8509b115ff
SSDEEP 6144:/H0B/LCOJ7lTp0k7zKd0POc37Tta9pdEp2si0xnLB4Vz:/MCOJ7lFx7zxt6dEY0VLSV
TLSH
T105A47C16B7A044BDD066C034CA538A53DE71B8960F25EADF1394926D2F7BBE46F39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\swiftshader\libGLESv2.dll
Size 3.1MB
SHA256 2e10d308d0207835b07df3bb38bee88300aa57fcb214051e8654d29587257744
MD5 38ec86347b3e467c5868e35ab48f89f2
SHA1 4db17d065cc330b277a70f9fb8dff0c4b426f314
SHA512 2b2405ed51ea1d232f2d60072e4f57e70f36f1a8f9d0a935772bfb9a3be50c1d6136cee496fde9fb3dda1f0d2f1c643cb9f162e0b68828ff854645eb1e8216f4
SSDEEP 49152:EAtfKpPXV/5DdijA29+0QdjwSx+qovRYFDguXfol+4iduejy3bEW2ehvxLTL10dO:nwNynDyguydMVW5v1
TLSH
T18FE55B43E55980D9F06DC6BC874AAA2EE632BC81177272DF52A06B121E37BF0173DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\v8_context_snapshot.bin
Size 161KB
SHA256 09686ad5bf03d95de7c251d204e60a8e3824bd6420bedddee80b2c6e5609fb26
MD5 e47426f88649c7f8e27b8a1516cc0137
SHA1 5452aadfddbc55d6c5c18b801087e39529859b12
SHA512 f9647a35ff273ca622b3db4aefb9aaf75075386c42a31e085f916fc82f3a18fed25b0e05dcc09e678ca419408f59f0c34fa5762e5f945db35f9c6f67b7b94bc0
SSDEEP 3072:hbeR82w8b1nmtMCRZLbp/UR2+X+4e19ceUvHCmmKUi:hbeRTvnSb9qR2+Xy1yFR7
TLSH
T123F3120B358005E24509C8F387388F77592A5A252C8FF2F923DCD77665AEBD50F85C5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\vk_swiftshader.dll
Size 4.5MB
SHA256 cc947f08b87f4636213211b22328c32d1986d49abc96a619799091fa6a15c851
MD5 0d3deb7dc62ea45c6624aab2b1ed8071
SHA1 0e4a7276784e3d8e6d6440669a65bd88f840b078
SHA512 38b674e0a0fefe1fa61ae144e6707b0eb7cfb73a8d01315f2b984cd1ebeb017cddeb89e39daa0f5806cc295a540e826a97422a677c361ebab3f8e4767228e5e6
SSDEEP 49152:53YxjaP0AETYj7g/yaI75j/7wiSmQEZLT/lbMnP3cuJUiId+R9iETUjdCB2KmGsl:UAbIASP1aRldQ
TLSH
T1BE264A03F6558199F02DC67D8B4BA622E631BC811B72B9EF12A03E051E77FE06B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\7z-out\vulkan-1.dll
Size 707KB
SHA256 26460b9250e904a9db6e5e0893e746a84ffae21c02e083e3f33a913d7cc79111
MD5 3cffcffbf394159458566fb79b9abd3f
SHA1 7e0f09e9ea67e9e587305e2f740c8620dad12595
SHA512 93a73aef9237d52119f9886ca6eff7975cdd6931d12087ea4c0397807b19c6195e24045d80b606bfc45f754c58ab5b1f789d95e91250828629724b9446501c55
SSDEEP 12288:Dwc+2rLfirhAu07HvM5BSNraGMiuvo52Ap:D82r79KBSwBiuv
TLSH
T1DFF47D3A7E94015DF5B6C038DA074621EA71BC620B64B5DF13A0131E6FAFBE42B7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc6F8F.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5a43b1b-424e-4437-95be-5275f3e5c980.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1532_519754395\d5a43b1b-424e-4437-95be-5275f3e5c980.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1532_57580639\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Nightcord Installer\Network Persistent State
Size 249B
SHA256 e247d5046e84b69e3f15391838d510e672222d50e5643488985756170a31d13a
MD5 6f80201b0846a23adcc443c8507d0836
SHA1 575389da53105e5af0b6288b98ab45b6e6a9e21f
SHA512 8acb078ea4808c148a10c3b981544530cdfbc910cc48e43359311bc9e10fe2525c2967f015fb47d172dda5047352bfaaf828bc942f7d254004d62769792fcfff
TLSH
T1E3D097BF17302CFF4342C3E4A5163A13C6FE004B125CBD4FA928372E41328BA880884B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59c625.TMP

Path C:\Users\Admin\AppData\Roaming\Nightcord Installer\Network Persistent State~RFe59c625.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\discord\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\discord\Preferences
Size 122B
SHA256 3489a9fcea842f7bd4152b6ac5a20d493dfba1fdadaec75b503c8e5ffa0d9042
MD5 c2211c33b4af50e74d888ca4d28f3fad
SHA1 804e6bad9e0d0deb2d4cd221803d362fe2c310fa
SHA512 83d929bb34348fa0552897b526eb97fe3568f5d00a04b2ed5d9e4446fe68f1ed38fc33c7eeefa02090cf15179fd3d9337b783ba0dbae2434ff745d60bfbd172e
TLSH
T104B02B03B4005033020A16A40007CF0A28AD00341D07F504D0E0F2A82429C4C084701B
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\discord\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

memory/3608-605-0x00007FFF04C30000-0x00007FFF04C31000-memory.dmp

Download

memory/4448-2622-0x000001BBF2260000-0x000001BBF2A1E000-memory.dmp

Download

memory/4492-2713-0x000001A93F3D0000-0x000001A93F85D000-memory.dmp

Download

memory/6224-2581-0x0000000004A80000-0x0000000004AA0000-memory.dmp

Download

memory/6776-2602-0x0000000007F70000-0x0000000007FA8000-memory.dmp

Download

memory/6776-2604-0x0000000007F50000-0x0000000007F5E000-memory.dmp

Download

memory/6776-2600-0x0000000007EF0000-0x0000000007EF8000-memory.dmp

Download

memory/6776-2384-0x0000000000750000-0x00000000008DA000-memory.dmp

Download