cde44481848004511d41ceecf272da72a8d840b4efdbf4aedabb4d89f7140d21

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Krush.exe
Size 78.1MB
Sample260705-eaebfscy4p
SHA256 cde44481848004511d41ceecf272da72a8d840b4efdbf4aedabb4d89f7140d21
MD5 8bd221e1a94ec07453176915c61948a5
SHA1 a63c6f77ca25d42de5ae633ee2ffd145516bb6ba
SHA512 16e79f3b571062391498bff78921887318189d41f60c8c5dcf301e865f61adb9a62354d0cff033ca316df393a7662875a93bc67a8382080aae60c6dcdd8584f2
SSDEEP 1572864:paa8pPK1eSIxHu5PJ3UNqOJr5bYoJAOeO72y908brtTwb/YKzRj7F7Y7:paTPKjz5PJENprZYoJAOW8br9uFju7
TLSH
T107083353B5A89C8AD306B4BBF728588140F51ED614E2D2BD9FD8100C6BB79B279CC36D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1732	EAC.exe
3400	EAC.exe
5156	EAC.exe
1388	EAC.exe

Loads dropped DLL 9 IoCs

pid	Process
6024	Krush.exe
6024	Krush.exe
6024	Krush.exe
3400	EAC.exe
3400	EAC.exe
3400	EAC.exe
3400	EAC.exe
3400	EAC.exe
1388	EAC.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	EAC.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1583714739\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2868	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Krush.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5244	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276988096895602"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{7A73A461-943A-49EC-B9E8-4E5623DDC248}	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2868	powershell.exe
2868	powershell.exe
4004	msedge.exe
4004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeSecurityPrivilege	6024	Krush.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeShutdownPrivilege	1732	EAC.exe
Token: SeCreatePagefilePrivilege	1732	EAC.exe
Token: SeIncreaseQuotaPrivilege	2868	powershell.exe
Token: SeSecurityPrivilege	2868	powershell.exe
Token: SeTakeOwnershipPrivilege	2868	powershell.exe
Token: SeLoadDriverPrivilege	2868	powershell.exe
Token: SeSystemProfilePrivilege	2868	powershell.exe
Token: SeSystemtimePrivilege	2868	powershell.exe
Token: SeProfSingleProcessPrivilege	2868	powershell.exe
Token: SeIncBasePriorityPrivilege	2868	powershell.exe
Token: SeCreatePagefilePrivilege	2868	powershell.exe
Token: SeBackupPrivilege	2868	powershell.exe
Token: SeRestorePrivilege	2868	powershell.exe
Token: SeShutdownPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeSystemEnvironmentPrivilege	2868	powershell.exe
Token: SeRemoteShutdownPrivilege	2868	powershell.exe
Token: SeUndockPrivilege	2868	powershell.exe
Token: SeManageVolumePrivilege	2868	powershell.exe
Token: 33	2868	powershell.exe
Token: 34	2868	powershell.exe
Token: 35	2868	powershell.exe
Token: 36	2868	powershell.exe
Token: SeShutdownPrivilege	1732	EAC.exe
Token: SeCreatePagefilePrivilege	1732	EAC.exe
Token: SeShutdownPrivilege	1732	EAC.exe
Token: SeCreatePagefilePrivilege	1732	EAC.exe
Token: SeShutdownPrivilege	1732	EAC.exe
Token: SeCreatePagefilePrivilege	1732	EAC.exe
Token: SeShutdownPrivilege	1732	EAC.exe
Token: SeCreatePagefilePrivilege	1732	EAC.exe
Token: SeShutdownPrivilege	1732	EAC.exe
Token: SeCreatePagefilePrivilege	1732	EAC.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1732	EAC.exe
1732	EAC.exe
1732	EAC.exe
1776	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 6024 wrote to memory of 1732	6024	Krush.exe	89
PID 1732 wrote to memory of 2660	1732	EAC.exe	90
PID 2660 wrote to memory of 3700	2660	cmd.exe	92
PID 3700 wrote to memory of 1548	3700	net.exe	93
PID 1732 wrote to memory of 1128	1732	EAC.exe	94
PID 1128 wrote to memory of 4432	1128	cmd.exe	96
PID 4432 wrote to memory of 4456	4432	net.exe	97
PID 1732 wrote to memory of 4676	1732	EAC.exe	98
PID 1732 wrote to memory of 3400	1732	EAC.exe	99
PID 1732 wrote to memory of 3400	1732	EAC.exe	99
PID 4676 wrote to memory of 5292	4676	cmd.exe	101
PID 5292 wrote to memory of 624	5292	net.exe	102
PID 1732 wrote to memory of 4884	1732	EAC.exe	103
PID 4884 wrote to memory of 2868	4884	cmd.exe	105
PID 1732 wrote to memory of 5156	1732	EAC.exe	107
PID 1732 wrote to memory of 1388	1732	EAC.exe	108
PID 1732 wrote to memory of 1388	1732	EAC.exe	108
PID 1732 wrote to memory of 1776	1732	EAC.exe	109
PID 1776 wrote to memory of 5564	1776	msedge.exe	110
PID 1776 wrote to memory of 5244	1776	msedge.exe	112
PID 1776 wrote to memory of 3708	1776	msedge.exe	113
PID 1776 wrote to memory of 3708	1776	msedge.exe	113
PID 1776 wrote to memory of 464	1776	msedge.exe	114
PID 1776 wrote to memory of 464	1776	msedge.exe	114
PID 1776 wrote to memory of 464	1776	msedge.exe	114
PID 1776 wrote to memory of 4284	1776	msedge.exe	115
PID 1776 wrote to memory of 4284	1776	msedge.exe	115
PID 1776 wrote to memory of 4284	1776	msedge.exe	115
PID 1776 wrote to memory of 3636	1776	msedge.exe	116
PID 1776 wrote to memory of 3636	1776	msedge.exe	116
PID 1776 wrote to memory of 3636	1776	msedge.exe	116
PID 1776 wrote to memory of 1968	1776	msedge.exe	117
PID 1776 wrote to memory of 1060	1776	msedge.exe	118
PID 1776 wrote to memory of 1968	1776	msedge.exe	117
PID 1776 wrote to memory of 1968	1776	msedge.exe	117
PID 1776 wrote to memory of 1060	1776	msedge.exe	118
PID 1776 wrote to memory of 1060	1776	msedge.exe	118
PID 1776 wrote to memory of 5352	1776	msedge.exe	120
PID 1776 wrote to memory of 5352	1776	msedge.exe	120
PID 1776 wrote to memory of 3984	1776	msedge.exe	121
PID 1776 wrote to memory of 3984	1776	msedge.exe	121
PID 1776 wrote to memory of 4836	1776	msedge.exe	122
PID 1776 wrote to memory of 4836	1776	msedge.exe	122
PID 1776 wrote to memory of 2456	1776	msedge.exe	124
PID 1776 wrote to memory of 564	1776	msedge.exe	128
PID 1776 wrote to memory of 4256	1776	msedge.exe	129
PID 1776 wrote to memory of 3172	1776	msedge.exe	130
PID 1776 wrote to memory of 4708	1776	msedge.exe	131
PID 1776 wrote to memory of 4708	1776	msedge.exe	131
PID 1776 wrote to memory of 2776	1776	msedge.exe	133
PID 1776 wrote to memory of 2776	1776	msedge.exe	133
PID 1776 wrote to memory of 2140	1776	msedge.exe	137
PID 1776 wrote to memory of 2140	1776	msedge.exe	137
PID 1776 wrote to memory of 2644	1776	msedge.exe	138
PID 1776 wrote to memory of 2644	1776	msedge.exe	138
PID 1776 wrote to memory of 4004	1776	msedge.exe	139

C:\Users\Admin\AppData\Local\Temp\Krush.exe
"C:\Users\Admin\AppData\Local\Temp\Krush.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe
  C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3700
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4432
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5292
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:624
- - C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe
    "C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe" --type=gpu-process --enable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\eac-bootstrapper" --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1748,i,10113564219669214804,7879496158626937466,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2868
- - C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe
    "C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\eac-bootstrapper" --field-trial-handle=1748,i,10113564219669214804,7879496158626937466,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:5156
- - C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe
    "C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\EAC.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\eac-bootstrapper" --app-path="C:\Users\Admin\AppData\Local\Temp\3FEhb5SzL0jCiejzBOQ3NRCs03T\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1748,i,10113564219669214804,7879496158626937466,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://myloader.cloud/download
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffe24c5c188,0x7ffe24c5c194,0x7ffe24c5c1a0
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,12403131680653573626,1722474038937498986,524288 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:11
      4⤵
      System Time Discovery
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,15738670076649226330,16453075805684452186,524288 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:13
      4⤵
      PID:3708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1920,i,10759444895956253175,10837485731906402951,262144 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:2
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,12905844592274939122,8950267114194404612,2097152 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,10997976388825416601,2307259888060281976,2097152 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:3636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,4615622605090864293,6850315600546156863,2097152 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
      4⤵
      PID:1968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,16428429396178986273,6934750526973429881,2097152 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,7100171831599131954,1891049401932751684,524288 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,9844592296068054858,1811289791206257063,524288 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,16451071986378956495,17775809325777355145,524288 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,12519999917098918938,2589591102731916754,524288 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,12519999917098918938,2589591102731916754,524288 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,5587457476333919566,11411626984431872346,524288 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
      4⤵
      PID:564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,4081601165379706800,15438165456430731772,524288 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,12875500976145631338,7234799921306234062,524288 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,9246419774913257558,16887442100469122792,524288 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,5384865670555902480,13841962771801706819,524288 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,17161716002683786256,6987801559530160778,524288 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,5182981429755083259,231066399013226354,524288 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6696,i,17237435328357809474,10473874489091109495,262144 --field-trial-handle=2520,i,11639840106146803224,5860530178238266678,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6f2ec3da5a55b94951d91a6f68f09f5b5302626e9b44f9c5ae85087d4b011ce
MD5 8b9572b87c690bba0911ee169fe3145a
SHA1 13949d8863f21886aac212914e50a63f98fc3bb7
SHA512 7e95e8da9da23d57209d6c9e77c4f541610f40a846f3d7f4e86fa753400725decbbb597f6f5a37185d9772cbccee30e292f8166bd22e61b5a143ce28a34d7562
TLSH
T110D080303B15D404D684303B68E1571377258DB124F587495151F12FDC785D5735F1DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 285edd241c61b650f4ebb0af692fa8c3d423cd90ceb6cc13a4b1822090ff7f06
MD5 1ee4bd81bebf6a852c6b54515323121f
SHA1 adf27a1ea63272fb43f4920a3b1a89af6bc47898
SHA512 d0806667d6103fe42ef7bf71acd230ca635df50a2173225c0edf389977fa5eb0e18b2e196eeaaf466f38c23aa14f637dbb68a39dea3ce483c41b7f120f6ac9fb
TLSH
T116D012243A159504D684203668A05613662589A164A586495151E11FDC68595635F1AB
MD5 SHA1 SHA512 TLSH

Submit Download

1e242949-cbad-4a21-866b-98d84464914d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e242949-cbad-4a21-866b-98d84464914d.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 34b4cbdffe872e9f4e8eb4a78346068400091e0112707ef0f001b6f262a9648d
MD5 3fc4cff761eefc6c94c772cd9a93e6f4
SHA1 ed6ccd65aa9e60ce0da30122af96e65227c63568
SHA512 61cb21580a1fe898c5210ad8590e84d68097514aceafa9ea987c53d961dd6a1ef918bf5f6ebd86b989e7528ec7adc52b923f35b1ba7bf57e0367a7a34e340021
TLSH
T10B6193A155A11850DB340D7E05F27D7BFF70B6913523BF090024BFFB1B06B887891A62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3375.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3375.TMP
Size 3KB
SHA256 8bc992acbaa015b5c1cd9a59aed34937e527f7144ed4a4d8863aac44f75527a6
MD5 029f698da160b318adeac3ab470ceafe
SHA1 04265c204c97e1555affed8356054c9b9c266f3c
SHA512 f47b7c7c9997b2748a8d9b6ec4e1477b71728f9256f9736ca0f6fd6e6d87d253f3f7d643a75004fbb32fdca322818fa978ae2ac3e63b506abe48ec5c0dc5c636
TLSH
T18F516EB616A55951C7350D7E41F23DBBFF74B99229277F090068BFFB1B0AB0470826A2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5024832e078f68a1d828b89ee4e9d112ec39787b2d4742782d470241f106068f
MD5 60039daec33f1e30a5a04e694119efb7
SHA1 e9862bac1d7d3cff240fc9491bc9006b83e55877
SHA512 66f5982870d5e1ad62a8a717f33c6e34a7898aa6edbbfc91e18befc0ab0edf2a198425c7625a81a5e498b710e54d764c396fb2e35c9ab89c3a7746980a067c9a
TLSH
T1B16178F7C2E8C62E890196F0AA146E1FCE1D0918532C7C5AC9D4AF5B97E3472E241A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 66f928a66e6953d78b166f6706cce293c05e1fa8e4cf00b14ecd25a454e00c08
MD5 c6c46c2b5992771ab90f3e683f64a06c
SHA1 588197dad50d477ff3451950917c5d91c491528a
SHA512 ab1bf5c42d960dcd1a5a474fb14fb9bfc2941207276f702b39a723fed0ffa1ca7ff510f09f6d1c3e0903abf8293656f063277ed6384680b9ca1bb04b779246cd
SSDEEP 192:sxRERqyM/jK1Ml8wcj/fP+sO3ceH70zoA8p2T/g6+WNwNy/Yw7BGMIgFJ:sxREMCj/fmsOsebVw/5n/Tv
TLSH
T1EE62EB16AA245A77CCDBD209F9557F53D6F91573A2900E44AEFCCA0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5747320b9729bb6fd648c203f82b83aae7a36e9991601aaf86a7eaed38b333d3
MD5 a4df16f60a5e975ecc7dc967d8ff33fa
SHA1 62a2c792e626edf4eee1beaf668e95905f928714
SHA512 782d61c6d087ddace07a41bad7188323d4495635ef66cdebd8d68b835d52ca76816eaa85a91ed090f074d65746aa26333eab9709afc5d1cab84c9cc9e518a22d
SSDEEP 192:sxR7RqyM/jK1Ml8wcj/fP+s93ceH70zoA8p2T/g6+WNwNy/Yw7BGMIgDwJ:sxR7MCj/fms9sebVw/5n/Tw
TLSH
T17862EB16AA345A77CCDBD209FA557F53D6F81573A2900E44AEFC8A0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3fcef856486fd552be0ad78202fd754829f307fb8b5b85399f48bbb4f75aede3
MD5 26fe15551634d8fb45cd248ef805c5b7
SHA1 29593077a41dd603199dd34a043abf482522c14e
SHA512 e1839263c6318b3e1cce0286082cfc90a86df2269364100907d97363d1be8da4b14ac4dc0255c8ba8fb4d7e969d83b4ef45373d27143867404c09413772119d8
SSDEEP 768:Ra7VjA7pLuL7wZWgmofLk8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsd4vrroIJE:Ra7VjME7wZWgmofLku1ja3avYGE
TLSH
T153E2EC3F680CCB7E4F804A9CEC29BD9A6DAD01CF5AD8895447EA840C03C67EF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 3f4d9953c273484d15a9675db11ea62ccf78e56379089d0b22b68033541c4920
MD5 948e5876af89ee0f0530020811e29a70
SHA1 01f68f7040f03fa19bdb38fd742fb1f23c1186dd
SHA512 884671d753839555fe530d765080abac6de79e50fc4dd19330b4b7c24025b945b5f2ec5ff95eeef25e2336e6ee2437315d421e94cd7f591b445ce554cc17db31
SSDEEP 96:Ks0gKp6aiCkKv6KwBUAyeSIWWLbgIIK4Ng6Icoob6AFHlyLf1vzKWkB5gaKK4/gT:qv3zwBUAyeSfWLkIMNg6noob6AFHlyLq
TLSH
T1EAB14390707A5700397D290D937DC41A968270B23099E63B7BB811F23F66E125FFEAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5acb21.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5acb21.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 95830d07338fe8203346b0e59c45e4ca2cb5168c68f2786f1f352c44b432cbc6
MD5 717d9c31c9cf55a5439b6ec12fae82fe
SHA1 ea1269fc991c3d372e2c2097c1b308b1272b1aa2
SHA512 c0850dcd7cb301c0735fd1aff9c5f3cb0f2f45f76bbef30c63956999a91ba2928cccd6922bf148a6cda79219bcd32a8e8db6d5a1162213c0e983ebb5a789b996
SSDEEP 768:oF0j+9Q3nwguuSiC4Nq2dlcnSl0bCTwZW1b9M3:U9Q34iO2dynSl6bGb+3
TLSH
T1C5038D36EC45CB67ACE28784B74B3A4BEEF411A785C95DC8CDD96E0D01C36AD070AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7a48ae5076f21afbe8da2abc84b2c1c528a5ad23c89cb51380920a41ce4acd43
MD5 9580b606e643af401c2276ad7e0c9ef1
SHA1 db91bbbbf921ca2000d662ba69f46fd65319934b
SHA512 6c9841c506d9063861736780563d75504cdc48fe973c814c3a43693984fde64aa660ad9f8d4c9dec49e733bdd09352c50ee385e079e552975e4b7fe661bf321d
SSDEEP 768:Jrv+4UNbdr39A/jy6iCzq2dlcnSl0bCTwZiE5+8rEnk:Jbsbl32if2dynSl6blDrEk
TLSH
T19103BF31ED189A739CE28684714B3A17BEF8519355C60BC4CDDE2F0D428B59E231B977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e517cb6a911548fcc72adae003fff868b5990e370b775a9ac85079f259e28026
MD5 872e85c759b6cf8760ecb453139439a8
SHA1 757051d8834aa1576c216d0ea06fc61ab70a2765
SHA512 3242cc8cc1fa7b91a8fdbadddb9c0102e2cf1a06b2ee3b1dc97b5f6249b5289fe1fde3771d94ee5d34aac6608d73b6140f0b85c3c907f68c020aa04b654fce46
SSDEEP 768:Lrv+4UNbdg3l6/jy6iC4vq2dlcnSl0bCTwZW1dr:Lbsb+3AiE2dynSl6bGd
TLSH
T1A703BF31B818DA739CE2C248B14B7A57BFF4116355C60F98CDD96B0D028769E2B1BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 417b71628735d163dd39dbc9208c5f3975844ffbee264e50a24d4911f2e58618
MD5 b16de48600cb9de89d96e7ffe9436465
SHA1 b6069ca1b4dc283e4fa5bc7b909943e930787cc8
SHA512 114cc67c676e26558d185496f7da26ecb79609ddbbdfc6f0f4e050f98cb6862a4a708b6aabb2f7c19043f239f43d0e4a8a4b911e1e0fc655bc7f9f94507404b5
SSDEEP 768:5j+9K3g6/jy6iC4vq2dlcnSl0bCTwZW1b9M3:k9K3piE2dynSl6bGb+3
TLSH
T16CF2AF31BC05DF634CD2C688B25B3B5BBEF411A754C51F89CDD9AF0D028366D1B1A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\LICENSES.chromium.html
Size 14.5MB
SHA256 a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96
MD5 b5e57572cfb5efa08f55f46772a42ded
SHA1 51db84dada057af72e2fb8acca3ee4436e4bd3ed
SHA512 288bcbf48f928866a0d2910fe57cfbc040f23b533bbdf4ef6fa43631edf6035d689ea41643b3afe833cb7476ecb2fbb932f137f3734df8462898c4837f6096eb
SSDEEP 24576:6eBHJjZ6vobjZ6Mt3jK6DCHwR2auHxKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61J:6er8aeUSn8mMRx5
TLSH
T184E6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\chrome_100_percent.pak
Size 163KB
SHA256 0d27d5591c72721ce399133e104114aa802caf3070814570ad205987a51a8ff7
MD5 5020d2dd753982c72f6a0ce6e672c4f2
SHA1 d8130a00ddf7126e2cf0c4b4c5c63a6f557013cc
SHA512 434e9b34105186d9b673d12eafa1fd03981920493612ed2124fa4a643bd568a2cf81d4d2c80b43854b03c11699fa139852224f25662178a9b2a0d3049fb927ae
SSDEEP 3072:d4PisCv+/P9NebGz8LI1TwuLjQBHe7YAP1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:+YWFUbGz8LI1TnjQBQ5K18Gb0OV8ld0Q
TLSH
T13EF3E0D3B3F4ED7DCA974AB793560171ECB30B2D0792124A5A8AE4752536B88D8D83C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\chrome_200_percent.pak
Size 252KB
SHA256 fa1fce57396b3e21776659e50fb1c12fd4c010c9f56f161be6f4437207d21241
MD5 239e222da07ff7603b06d27e150723fb
SHA1 843a373fe4d1f770e497586fb84c292dfe40f0f9
SHA512 c87f9f5586d6b35b451fe8ecbefb7ed88ab110a6dc40feb05f4c3d9363eeeeec1c8e6e08cb8c62eabc4c9c7f2feca41f31fe86c225cf44bcb68865dcc4db9ab2
SSDEEP 6144:uGQ+N6uSZQDQYakvyAkcjQBQugx5GMRejnbdZnVE6Yoppx4:uQN6uS/fkvyAkcjKQa6edhVELoXx4
TLSH
T1F044F1D773B8AD3DC9670AB3A22600F1FDB611290AB2115A569FDC397955EC888CD383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
MD5 1a7544f942a9a9de9354e7a0f9060e3a
SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
TLSH
T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 0d21de0f4497f126b9aad67c57b045225185c70aad2308a25db01d6086e4d5a7
MD5 fb6c1c85f451d6896853a6019bd9c68b
SHA1 8bf561af8b2e139726971a063ba01bf5f6584c49
SHA512 07686e6a16a5bc71738536298b306e3a193315fc54713894e544c09f5612b72c996b4bec8895c5ab536dbc532659f6c576eeca9a799ae654cbd5ec8062ba8dc3
SSDEEP 49152:BsKpBOHzkKJhXq/5QkwjyuwKVmQb9Vvdx5j3CXPTZnxEHzhl96Rc/6BOOPxwmetu:Bsfwl/5QRyozDCXPTZnxEHzhl96Rc/6b
TLSH
T11AE59E02F6D650DDD029D57097AB9313F631340A4F205AEF2A804A253FA7FD86E7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\libEGL.dll
Size 492KB
SHA256 dfd53ccbfce55510f2afdb52703037452370eb5bdf33143829a8b06253015625
MD5 57bc15efd99e4459efc44584d9ab227b
SHA1 cea68bcd7533d1645d1316708fe6f5b3fca08a75
SHA512 16296efd6ebb4338c30a859af994775d51a0b888b4662345f698fa849818c9b5b51a2f52032b75af07f95aef6ab30ed5625de59fbab4b7432545f28963ce9296
SSDEEP 6144:WKfJzspvplL6HFFneUk5uEJds+Bwmedeh3xc5WedvIe+zzKx/H:F+pvDY2UkBdseedetxc5W6vIe+U
TLSH
T195B49E15B3E845A9E07AC5388A434603DB76B8560B65FADF03E093792F37BE45B3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\libGLESv2.dll
Size 7.7MB
SHA256 b348ceedd275843cbe344a29dd8550b18e5d433abff695cdf5658470c1e71c67
MD5 358cfe0d819a8bb0651e3ce274fc667d
SHA1 41968bfec59f21a1509379b52149b0973874f673
SHA512 48a3a1856efd9bfd1995d5be30a2fc3c9c722aec5fdd646c2822a0348ea873460645666923b94722e254679fca5df8b93334734f7bca195229148a7c22bca7fa
SSDEEP 98304:R9sNg++Z3KDUJEiqGZxGtBmhbqxQ0BRHTSeX2cXqwa2h:X1KDEI4c37eW2Tw
TLSH
T19F868B03F69640D9C05DE2B897579227FB34B8450734B2CF2A9457252F67BE0AB3EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\af.pak
Size 562KB
SHA256 7efae5393f523d0b23dd355e5cb165a14a4a5eb9d102f8fd7e1592fde0d81590
MD5 83c706ad4dbf04888276deea6317232b
SHA1 c5a01488cd59d827dfdc78c60c183e6016b0d366
SHA512 a5a76074376a32aeaa923c7a05b85b687dfd296e46d39d7ad59de8aad168c4667f26b5612a6d49d98292e2467708150ab0eca6837456dc6915e10a4c4c05247a
SSDEEP 12288:1zOKGMqyJFlRPBxtRGtGdnNDRwvNS8Fq3G8zRFo4H2JynfN+Bn8IPUYo0vhNIAgB:1pG0FlRPbtRGtGdnN1wvNS8Fq37RFo4L
TLSH
T1CCC42B0AEB81173D09E076D6FB0845B7BB9CA26CD770B2BADDA982310566EFC117D1C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\am.pak
Size 911KB
SHA256 108ac040ce13b53af88bc45f3e5b13086c1d435839dfdbabb19d6877d9daad96
MD5 5e2189048cf01d941871f8f679c7478f
SHA1 9e84b86a399183cca7a793cc242b75c9ad762912
SHA512 f31ef648bfaee3377cf82cdc2ebd867a8f2ecce4512d4dff6f1abd1fb59930c4698b9716415b7fa52ac70b87e5e20bc75e5cbd58eece90479f117b33a9d45942
SSDEEP 24576:ibyU2Ts1z2hTCMDyCDxYnUkjKtDCzJdXvu55oiiNxVYq+XG/6mZvPpW:DUY5v
TLSH
T1D015BB547EF9F7570F8E8A19A4320E4E9594AE4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\ar.pak
Size 1007KB
SHA256 69a43e3592c8cabfe8fdef53c963bca7ee137e093d20f12767df89862c0eccd8
MD5 dcb24b1756d4894e26bc4e799a094390
SHA1 ae2e391aed795d8547495606cdb2a4bdbd6f1e09
SHA512 2fdec556315ba9264c4c2925d722568ed39d884168a0ca77b553cad024465008ff0fc966d2db88d4877486617e101f99615e3cdf697ceb769f5ef59a316f89ac
SSDEEP 12288:Y8lb1GTehc4G9qBn2iIjRPCRqveUoOCMdJ7fcuSU5sdNDFQEM4MxwQZ:vlb1GL51E4
TLSH
T1C9257AE21B2584720B96DF0FD1E23668E872BD23EB4BFD3124934A1156D7513E78E638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\bg.pak
Size 1.0MB
SHA256 f4e5ceabc00d8d66a100f78540d81762e67bcd7482df116ee2545507a45de25d
MD5 7caf6af4bc5e6184101f96add266709b
SHA1 721420ea23910f13eb44355414ea22d5487bdf52
SHA512 0081c6dd68a175dcbc5e4fa7fff321825651e68a9559a6383951eea5d8081f61ff38783a31c8ed568c7f5893da2d9834b47a5df153f5690bf1a73ce2457b7ab0
SSDEEP 24576:e9WoebLYyzQkECtUfVb6ex2dS373Zoz32jKYmVDQpz74u2VZ4EE5edkFjtJco3Qx:e9WoebLYf6UfVb6ex2dS373Zw32ZmVDL
TLSH
T16C3524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\bn.pak
Size 1.3MB
SHA256 66e568b1fbb31391786dcd2af632866894fd6a23bef0b408a59587a144bd0353
MD5 02207984d6a3fd680186c30dc0467a83
SHA1 792b936048af4e14a9413808ef21a0b6b89f20d6
SHA512 2169e5f8308ed7be6c9d7d91486c37aada2c76fd4a805c6e0b1c079eb812c6c74c0fc7b2cc052a76e3efcab1f83ef510ca160ce8e1a94723a0004ac1d86ae6fd
SSDEEP 3072:STxaW1lArCdjpEWT12MoFHwGU+2X/rGocaf1bGRMqU67yh5Bb+3Qd5RakwEL1:lzrCVOW6FabqU67yh5BbB5rwq
TLSH
T1FE55EF209C6E81B6A8C5CDC9434C6370C5236E9B9B61F74DDC17A25938ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\ca.pak
Size 633KB
SHA256 bdcc6f6404dc686148977e41330461e89d5739afcf123f03557239d93b911e03
MD5 c5d7262a601fd52b1a6df934db2eacb9
SHA1 b2bfff6d065b791884e737bd2b01c1c60940fed4
SHA512 499acc2f19bf452b82b3761f79ccd86b041513d4b45272f629818cf81926e08abb30511af2f01b89a661b90c4dbaad17f3e2245a7e4c4b54135f1f10e5599e7d
SSDEEP 12288:Xgyo2MK9BZVW7hjAlCiEuNDQU8p5PsFBN3Mw2juwHzejm0t3ltb7TtzJtPw9Lr/P:Qyo2MqPN/GLyqj7bMNyNO+5fWhUZ
TLSH
T185D4E7239FC93B7704D3330AFB46C217A48CA9847B16D254F4AE1B1622CCADCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\cs.pak
Size 654KB
SHA256 56b0e1723259bcf6abdda080ece8877f4b1586b49d3c13ef8908619e2a118972
MD5 83c05fc7fee2540c8d7a18a277718519
SHA1 61f86e0ffdf2ed4c8da26604279ca72a8908b938
SHA512 7ee4f5ddbbfc861a30d6562cbe3e8321df2bd20603508bf71e6fb4a07c1c9cd0d1157936999389461c04f996c60740a7b9b8c15f7c525486c73629ae907a1e60
SSDEEP 6144:o8YNErkxp6zGaBIIIQI+ZU2L5AzRPWAW/O5xzm6dZ8OjaJSBsg8Qz:wEIv6UAXL5Az5D5xzm6dZ8OmJSN
TLSH
T1ECE4491EEEA36435488002487FBE4128BD5E83540B6EB9AB7C8F9C95217677E8FF0D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\da.pak
Size 591KB
SHA256 c7a554e9644dda72071d7af1dcf077b783b52af926e99b507d79a664df4acc33
MD5 417894f64814d8f5ccaa9e79cde9d900
SHA1 3e3065506e7f0db358542fa973d29afaf7dfbc22
SHA512 fce5e1be209961e5f21761512a09eed2134d413ee881d4050bc8722de615376ff4ce1475747be5bf41762025a0b18c785980f95b5087f6163ff02b76d5db09e8
SSDEEP 6144:pEyGNrrg16+wYM1zVIH52Q1JrE/ecJvwlAfOJwf/ob/dGaan5djVK5Es/hxbd4dK:prGtE6+wJy1kJT8a5djw2sx7
TLSH
T12BD45B4BDC9C732F89A90764F611CDA7EB6D543CC684264F65D8943A09CFDA093BE2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\de.pak
Size 633KB
SHA256 de5422f48522a52248ba835d4e7ef860a734b54d2ee41c9a87cd73e7e947c318
MD5 38243ea90c882b99f075509763558cf9
SHA1 02409267b75ae7dc1526f5ef070af26be6ed29d2
SHA512 d76c87d4e71c25bfb9a53eae6633c351335f69602410e4e521e6adbb89bc90f55df1cce2fa04b26a764183b1008f481addaa8f766a836157d90240272bcab771
SSDEEP 12288:1Dz3KLW+0xLfH3K7Up7gpaatCvT6L5fkMqU8iFChu:Vv/H3K7Up7gpaaorM5MMdChu
TLSH
T1D2D40703ADDF625EC686B3617705CDB77B19E36BC346322784EDD02B654B5B283AC422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\el.pak
Size 1.1MB
SHA256 aa9b5d10422054e87bcd6068be5a2b085b8fd3ecb1d998eabe282a72c6520570
MD5 d54c4dc62ab44a3fdde5c5e610fbdf3b
SHA1 03ee5992e89ed2f560b6eec18403696f99746426
SHA512 9843874e03fd6934a8af18356c0035b1c79911311d52406f59147073701da2151e2953b11896958852a06aeb3690fc5ef5216c7792ba280280e3ed580ec7a5f2
SSDEEP 24576:JGHWFbr4gsYP9dk2tDZuyIJXDsSPSmH25gpqO2gBXZWtyjdHvFzuVoyNJdIWYNQn:JGHWFbr4gsYP9dk2tDZuyIJXDsSPSmH6
TLSH
T11445CFEFB4582DED8046950785D8B07C2BC66D6CE749CBD86229CB60BDFC0719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\en-GB.pak
Size 513KB
SHA256 e2eef21ab7b088c122b6990f66dd22ce0c7e1191c64e9ac8424435c3a6749cbe
MD5 f0fa25c92174e286f29327d1bb5b487d
SHA1 1a943386eeecc5cf63b1f7855e1dde46c172b787
SHA512 763aa28ed71a3b39f6ec71e40a553b8720d775339941c7695aadeb7c331836d41b2d815fb3663c6578c7470bd53e00d4ed4dba76a531539f1b11c53e3cdf9016
SSDEEP 6144:l97yibPERc3HGJEFGy6XMP9ZQqqRfaYoRp6jhc5bDDW/BcCRkJ:7zbPq+HYXMvQqqyl53Dr
TLSH
T184B43C1FF784126A059312A27F0AA662FF26D07CB35112663CBD811C33B675A83777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\en-US.pak
Size 518KB
SHA256 3cd05f6512ed5d09076253dcdfd4ccc5eedfab44e1703cf3e015597dd31220c1
MD5 619246667b4c5a9e6188df5f0633de25
SHA1 566902ede79dfd30ca10d49822ae93d86537be0f
SHA512 1b2ffaed636ae22d0a9b5ba4907243b81e53d5d5f931790c5ff73ca15141d8d3157d0d2209ec2c0b325e88d8efe1bf32877d57690c1221c2a3ee235ef63da0f2
SSDEEP 6144:95PQBlZIhNuayCIxbeJUtbKhMP9JQZtOfaYPMUAdB5PXjmlngH8/Xfwf:95POZIhNjyPde5hMvQZtaI5Pj2wf
TLSH
T17AB44D1FF744126A05A352A27F0995B2FF32D06CA35112563CBD812C3377B6A83B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\es-419.pak
Size 624KB
SHA256 3fb38e2a38ef336a407fe91813986522e89696bcf3d6f78c68d60c921f741db4
MD5 ae4cbac873c976ebddace03281815fa5
SHA1 5663c07a556783074a117c444ee1828b7f5d908b
SHA512 306d789f85094bd03249dd919f19dcafc97f9b06855143b1f694ca7bfb5cebe38bec9e9695591d1106d63400700a9a7a41b3cdbbb91c68287301f0de87e7b078
SSDEEP 6144:k8kznjqfPfwKkmjrHj7CY6CIoZdDu5ie5r5A82GzCl:fkD2fQK1Tlw5ieTADl
TLSH
T130D40922BAC81F5310E3A389B743D753E4989545B408C29BE8EB876522CCF8CD977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\es.pak
Size 622KB
SHA256 e381793151b6bb9e87e954d2ead53fac523dda92912d4d14ecf46885f86ce441
MD5 5245c54f21e50b506769d542c00f2bf5
SHA1 6093ada9ac0df1532eb542519d2864be70ea6cf2
SHA512 e0b946cc97efa3c193dcc3ee9fc03a55a66c8a31398bfae9ce11df8772b3257941e93b1f88e460c6a2afd5e5b2dde5a2ed9796bf70e1c9c378db95c46b440ddd
SSDEEP 6144:adKILuuvQLUOcyO1h8/NNgIuw+YiugBJnu8jf5JRcAJE8vJkb86PZOW/:al9QQC/NP8ugDu8jf5/hJXviwo
TLSH
T19AD4F722AACC0F6350E3A389B743D753E8D49545B508D29BD8EB876612CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\et.pak
Size 567KB
SHA256 19245d259d70ec459d210cc01eb6e6d05298073dead915e164aa7aedf3b873ca
MD5 fab4ff28ab6bee4827940102a3e486da
SHA1 9a12995ef33d6041f681d7bec4eb027cf47dd840
SHA512 e5e7a9ce1cf9b09ffe4b129c5a2fbac19c1345cea78c8bb0e2f5849bb47144ff3e17b107cbc6d8424bace0bb98f20e2e38a4cdc734cbd670519dfb70b17cf92a
SSDEEP 6144:EUCrVAqbf9tCi+UUZdy10wnFt1zNdNpNoaOTQXtgPjUim9oOOwhl5vyqmIwiCKMi:nkXKGUZOnFt1zhtA1OOwhl5qqDr
TLSH
T1CCC44C42A27D771B242412F9E737AD23DC9EE7D8B4000D9668974A1971EEFCC38B2B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\fa.pak
Size 933KB
SHA256 bab2b590f945b1d864c38ebcc7167b74ba325b0ac7f3d611cd1728a53a5fb99a
MD5 4fd20603acf48def5f9ac48ce9ab36de
SHA1 b1e7f04d27e4cf2c01c93272ab7ffebf5595cdc6
SHA512 0d8b0f60c14d49511846540f6046465aff3f38a1756ad6d5148b9cec1c729baebb344dd8780b8d042133a5625c82bad05d543dddb9bc001df6078a78488dcbad
SSDEEP 24576:+70d8u313uyqoT+sLqaRmXXloTUOmdAQifaQ2XxFtCfGk62Yhc8aiLYMX4OOcUNG:+v50I
TLSH
T14415B2957AAC9AB15746CA0341E33834C773EF12D349FE40ACA1076609A5B139F5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\fi.pak
Size 578KB
SHA256 41137434ee1d2b1aa3603fc134e8cd52455731dfb3eec44bd7f3e36df57e4f15
MD5 6ae805ea5192957b77c7ee26e8dbd28e
SHA1 672d1a2ce79c4c900584e288a3076b336f909fa6
SHA512 5a89d2db7bf4c747a9164fcf23ced52e6928c1ca660570127fe3c5f9c036ed4b7bccaf856fdb64547741b112ee28fcb09c0685ad445b56e03226d99d06d12460
SSDEEP 6144:ASVySaAY19c48SXa4mSirjhg+esS0+OERHU/aQ9L35ZP0dUH0RIIp/WaIh6FdYRg:ASVf219JLujTam5ZP0dUURIIp/WawFNG
TLSH
T131C45DA15219C22237C4D29E7DB0903EF5E5E39CCC284D9AE843C7D849ED9887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\fil.pak
Size 655KB
SHA256 8a9e1a72a7d067654df9e4a761f5c06cfac267680e00c45d9d52a929b318b435
MD5 48afc5fd91b785f192b872689be7e307
SHA1 6125e64370ae35149ae021722d9172832766f461
SHA512 d2cea77d864449ab1a2940365f978a058ae981b07384509d1bc2fad5b2bf03bfc9acc43fdf2ad8fbc1be1837a800ea3a9dfb7f96c16cd5b3d318b01b3b02fc4a
SSDEEP 6144:sNAvNJsOWKV4lr3PyiDQrVvBKtzqhnA9t5QwwvdRoFoV6A1VOO:IAvPt5fA5uvV
TLSH
T17AE4B616B7401748DBC352E55360A82F6AE560B83F81386E0FBF269B7BE7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\fr.pak
Size 674KB
SHA256 477771211fdff1fc9c8e002476e2440c1c14ce4ce69976a0993c99f2f5b47505
MD5 56987b13bf27898154fe71e1777d5b1d
SHA1 0014c22c4462b3c757d32f8543c9c4dcc71e7d31
SHA512 3b7cf0c908b8746486fe972146b517dd7fffd61f03b8d8e16e679d2d62f3c0cdbca9aaf0a20c579b15b7ddbad5b4af0e060955b868d72d0bf2cc56c118d1eb98
SSDEEP 12288:4ok/umo2VPZLyma5FZb2ZCh6QuaaV/LBxezZO62iZFMYnY6b8jw2wTq1DznSrxpM:pk/VLbVVZV5bd
TLSH
T1E9E4F66FAED431CB19C61277FB12D663DD348248F215E300D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\gu.pak
Size 1.3MB
SHA256 51635a11ad7349ae131927156c50f6935c38cb6628cd8d2f8a5fb6715f6140e8
MD5 bb1a1c97867d615b69befc72dd456c96
SHA1 322793750d509510891bd2c38a568fc45202845d
SHA512 00daf2d8b6a7e04663a29d47b7c6d6aecdf9be4e0204b1ba03f8979508b8ed064778ebd1e01945e4fbd18fbafe4f3f919b71e0f8c9da6c200b896c4a313ab6bd
SSDEEP 3072:sf+PzeQZBu6/QJ9ANonY5jNLuHn4RG57S5PjAwREJKVMjNiT7llj63rAulfcSi5F:sWSn6+AyWZLOn4E5Ppsqc5qlDCR1Kssw
TLSH
T1165519D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\he.pak
Size 818KB
SHA256 0ecf199553289880d0fa590fcab56d2165e4e571de0b77970619a244cc0285f5
MD5 25f694586822b17cbe882863e11f3d4b
SHA1 c3d1668cb12afe594254a945b4ef58c46f730310
SHA512 962a55db62c94fc6096910d18e10e4bbae2bb4b3644ab54af040141ec9a9152607a6648effcda878a22a8f43f44035885f3501c2a046a0659b266e8ebd3e1ca0
SSDEEP 12288:I/fJUwjSoDYQLA7jvPpMgqw3gpy4AlCZreOL+V9AM+g2XPReQCa7z5ylo+3aK0aW:m5Aal
TLSH
T1A80588C4B2D842255131AAC39FA5FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\hi.pak
Size 1.4MB
SHA256 5197062239f1780dff514326ca5894c39e4e4e2b4bb2c6e73f619122db31630f
MD5 e55a24a076578aedefba0af5b390f75a
SHA1 c9b8efd792f74e54a59727da1edf7342cbef8c17
SHA512 ba2b06919d4df669929563bc2bcfc9211bd96e4e953f27c002e9b23f1b3da50f137df9e8c353ffc21b34e72e01e519da9c5425287b71d43c4c5a05a314ad4952
SSDEEP 3072:dy++IP1js3vI4zlIVV/B90ZV1d3uGlqvN3dgwJEOTByntDPtDXejn1s4f4/8JPgC:d3+I9jsw4zlI1Vl5p5qdRh8D
TLSH
T19A65F50CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\hr.pak
Size 631KB
SHA256 ea68d33fd264a2a3cb0c78f7b92ac79af7cc1ca27fc50427ca100fc468ae40ec
MD5 f8a63ea83d73e551d31a9cd4067d191b
SHA1 e3e69f76928e6ed725d64ee4b2170cbd75ceee98
SHA512 10b844f5dc17438201c8cd3d3e4cf75f9d4b6cce4caf16a1574a75350585c09b35bafcefc8dabdc565caafe29836962de49f8be77ae9df734f3de99cab769ab4
SSDEEP 6144:H2ShVoxJoGRNFuz/w6iKY2CES5AACOazlyzpJ:H2SiCUFU/w6IJ5AOcsJ
TLSH
T1D8D42B7DBDF2970A0897B346EFAA43447DBE08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\hu.pak
Size 678KB
SHA256 91d754bd252cd411fcc3513e04513d5e4d8165f36eace12f88d84fd7e352e857
MD5 536e1db029c477984e9ea25e4b83d459
SHA1 6da13ae3aae84d81978327bfe7ed8b5e3043fa44
SHA512 412fb2347d6ac0c77b9db64796b596345d8df296b0e90d7ac355661387a955c489c50dc901f79cf2d03706253e95c8f1f169c3d1c6abb60112b416246500eaf6
SSDEEP 6144:NOaysddgvd/LTUHk7QH6wRbA46tsu8U5kTT8QZ49FQYhHBwgnOe/2InjDl54RxiY:NOaPGIA0U5k/83b55ZJO
TLSH
T1CAE44C7793769059B8AC178378643F15992E481BAF3B36FB2887846D34A178D0D83CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\id.pak
Size 559KB
SHA256 e78831cb31a4d2ab77cbe47bcc5439be3bc7d66fba7799779d5ab3e1d004115f
MD5 149c3f46d790ab34ab5152ee134be53a
SHA1 293776d0775f43cda01fc68ce90d3c3cbc023729
SHA512 113a4c06c3905ef361527a8fc6ff16f494ea6091e21db5ec9c797cd58728f90a8433897b362ffcf11bb308edcacd7b164fd81e6b996de5a9b9740ed9a84cc168
SSDEEP 6144:y2bZei0vZZBpLuWefjlTFjlFBXmBzbuIFJ/5o66HROBKcmIiT8l3yHV:vbQLZZ7veTFjlFBmVbr5o6664V
TLSH
T1DBC4F8632ECD310C494843D5B2DDA92E7CCE233BAF05B76E8E348F7055A67682716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\it.pak
Size 614KB
SHA256 c5feff891ed9a00cdd7e0349b187cc2d26248ae468f076a09099312e04b23c21
MD5 77e2e42bc45dde344eb18bbddec0f22f
SHA1 744f5ab9f2577fe6b36fc536899104a4a4df1ca0
SHA512 a07b28a1fea4e4546b9fea47a408ff6af17a2c054d2e7135b7018e6f74a635d2c9b7de64064ee2f6ea700f111aa0bec6c2961d9dc191bf9baeaf8b6715150ec3
SSDEEP 6144:rgngW/QABJ092B7EmiX9S22NI3nSIqBRRs61wto/RT9TbOzkg79CYrvAqpzSj9f6:52BmWaWZZUS8iWAVZ8B5XeSl0u5
TLSH
T120D42C3AA5D6212519976359E611B085FB6EFCDCFA417218C99B031C23CFE80F2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\ja.pak
Size 747KB
SHA256 30ea0122899ef914ee799d92667af4ae54c18cdc6e5bb780719a3f6a5dfc6435
MD5 c1478afde47bd7b6073d359247c2a154
SHA1 1e76f9f5994766d33cfec43ff12ff8fe9df33faf
SHA512 913b3d6d7c2426f2b1071dc3a792f840952c24ccbdb3fc11484b412b735577bd2086006bb9e056689b729cfb6e959e5c653633d75cbd9603db257db5979473a7
SSDEEP 6144:tNnsgGQrzC8nxR1uHLZzQ2qxj/hbS5z95BfpzV3:ThzCgsLZzQ2qxzg5zjBfT
TLSH
T128F43F7CE3C969369D6153A22C0E76E17506AC5FFCA23A3A442DC074BD70BCEE415AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\kn.pak
Size 1.5MB
SHA256 b00058366c4e2febd46df14debda4ef777ddfe2c004d08f528dd17eaf8d4c17e
MD5 d5442a2293e44e73f51d650a13953f29
SHA1 6e4aaa06fe3c4d2abec39cdcee299a0451bbe1d9
SHA512 d3d7a68c898743805e47321fae99901cd147108a4afb4ae77acb7adecda4cc70dc76bd52d26097c397035ff99c9be9cf0216653427115a89ddf56b13ccdd1fdf
SSDEEP 12288:5bwRDOSK3ElzVHdkSJs96UuEMMyY7n5wWMMf44JyUWi:5iatpX5yMt
TLSH
T17A75CD18ADBA7D301BD5006B24EC643ECFF16BE29CA907D2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\ko.pak
Size 634KB
SHA256 2f26d1e6f3f505d95c26dd0a4d61c2621d8109d871bdb30fdb4718b802f10d20
MD5 071076e3bf799832dbd9a56b62f3a631
SHA1 ca022fbbf30e379d89af9539079fc176867bc118
SHA512 e11bef718ad540c8b951274e72f0fd87a10b3caa704c7fc47b0baf91fff824a99f745b610f2bc5bb87b730d4e89b356a2f54f90c965ac564e8ccb0fa6cf44b25
SSDEEP 12288:vBiGSBduBB7gN5MifYj4ZGRyvIeYsga5JHdTCJXIA1xWSbGRG1zLhwOtyYt8SnMP:vBzBGIFbI5r3+AuI
TLSH
T130D4C5F238DF63CD1193C982AEF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\lt.pak
Size 684KB
SHA256 473fb2217995c4c4bafc23a9d418b3cd393604248ed19d06588e719519122c2e
MD5 b4693939785ecad236620c5bc90ae86d
SHA1 d60a8f09709186b0f0074323f05a58faba01d358
SHA512 8bb2c4f555e3d549a110b67c6d02a40947425c1231e8a8a16e8d7a9bbe12221c512d450d3d3a32abf354ae821617b0111c5662c3f3f7c1fc7548b5675a657410
SSDEEP 12288:uIio4BMoTnAPqevWtSto5j7rbIL0P6StA:uIiTMFVro5Dbw04
TLSH
T1FCE43C0069D3AEFB9A4467C982A4CA78DEFD50009767BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\lv.pak
Size 683KB
SHA256 7b589f1bc446b15d315fcd81b446b47e15ec533043abe56b1d060ab4a727b56c
MD5 f603def47b0b192e3cac3893f6ee35c1
SHA1 3c5f01a9c62ffd8ee65ecde63143be448e9564df
SHA512 cfef83a0471b77542e01190655e48006221b6f5c517b0b17bf3e55378486749276faf20915d23c9705bbad6706c09bfcb99446a25f9ceeeb0d4d33896f648602
SSDEEP 6144:K+npVaTWOV6n28/E0xukfN6tVFxu9qyHjAxWZBgVbORM5rmNnaLGc7T6GHqSZQRu:JnvGWOCEOcMFHMuCIRM5Ec7T652Qdx5S
TLSH
T1A1E42A959EC68FAA4D904DCB7326D123A9CCD740FE07E112DD7D8B3A550F12822B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\ml.pak
Size 1.5MB
SHA256 9b874b08ffe56813efce14d03e840f948f6e0ac9fb5fdef1163098d0d7ddf91f
MD5 01793d46b0904432447ce77e1a74ca74
SHA1 d141d4147dfa2435494ca66bdc073a98f4dfe05f
SHA512 0dcf24fa8539ab237b1f77ac678269f5d05203fbe717b39cd9e78ad84f0baa1698553b4e7b3a6acc021a6d727e7c7e5b35167212dd7fd755059c49297203c897
SSDEEP 24576:PI7+9y9XBkx/W8kKfVBR+zX3d+v2sit83/5Iami7C3a:PT5n
TLSH
T161759D5BA036CD3B0FD102167B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\mr.pak
Size 1.3MB
SHA256 ab04bcdd9287640b1ce017eec44b6701e44a2e050c51eb1c9859b6367759d848
MD5 9be42fd8b7380a8291d36423c1f7f5fa
SHA1 7b58500ba59031470d7f1282ebeb236515acb3d9
SHA512 eed263e45620644ef70b647e0dfc2f7421f10fde0c3bcfa5c10a1b60b311f3fba955b31b8e082c382a617eb0703bddeb37ba5cb145bd837076223738b50baff2
SSDEEP 6144:nNOc6hnaJ6ORtYwfiWUUn01H0mTPO5jmdKp2:nN+Z6d5z0p0mTPO5jmdKp2
TLSH
T1A255D14DF7BAF3685DECBC8E36540D3BD8FD21B1C3E9925648E1B3A74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\ms.pak
Size 588KB
SHA256 7d408f4f45fcdb66efcaf7beae9cb07e0c42a26e237461500cfc4403cdc88690
MD5 0ccc45c9a3689c3480fba5870a6154a8
SHA1 f04ae3d75df7c3635bc75055a0443a5d48d31ce0
SHA512 4b53fdab65d82ab9fed808c36bd1a9f21814e43871e16587e9eb56af0d21f7d1076aca89997f283ee436dd3f6e4d136179c85eb9ed79c0a26b1d298af5a785e3
SSDEEP 6144:7GfBR2XDia6CM7oV0n9W9Hxbbhj/513hHuqw5P4FFTVo8Z5bYTVl4O3BDMT:7GfBGCCuoV0nWxnhvxHuqw5OBZ5Wl4H
TLSH
T12ED4C6169EDE3118085843D9D2DEA91B7CDD3332B705AB2B8DB04FB0126E7E53316B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\nb.pak
Size 567KB
SHA256 b44a1be560c7138a4d2b6b08a93fa529192e54a2256dac2695c901019cc66bce
MD5 f1fc0fca004762df41f8e4eda6eec06c
SHA1 3c024cb43bc36a917669f65428c5ff80c33f6f90
SHA512 6c9fa1d02145a9efb5920357095da9e4b5f3099cabc582a4dc77e93fd7d621c14a1d8178260b6bc89adf7091d02d0b5ae0c7ee99decbf65ca4c5cf00481264e0
SSDEEP 12288:ehE8WC7VQT8LgjOp7fj4uQM4gq+5wBvBThKeOju:eq8WCDLjGM4gq+5UvBtBx
TLSH
T1A7C4F883EE46B32EF2A443A4F51986579B7D942CCD98199B94C8C63E1CC7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\nl.pak
Size 588KB
SHA256 262bf074055e830d0e4d361ca24e74f0170cd55938236163d96c6b48929b6d26
MD5 128b8d551b6c003f94de7a062f9eaaeb
SHA1 5adac7972b01be841e5bb6f4c0179e1b2e442cf6
SHA512 3eaa8771a69111076e12e74ad9e1e3e24668b0891d2f223fbe8808710796ccebb88fe9a837d916ac8c118d6e79145dd4682e6494ffc816cc41c62b69fdc37ad6
SSDEEP 12288:dZ/UJcjlbJWQusSU0n/gz5WGUcp5btaydWgqHnGDDTF:dGmlbJWQusSUf5WGUcp5bAydxqHnG3R
TLSH
T11FD4F917A84E653E58C1B349FA098FBBBF2ED22CC26CE67D94DDD1340443FA841AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\pl.pak
Size 655KB
SHA256 4994a5ad97534bc91b73ad528abc1771628848005c950bbac279d5e2b3e03465
MD5 917a07cb2dbcd0828fc6377eefe4285b
SHA1 3b9552802816f41b1837e49d223fb2b8748b9389
SHA512 77ddb4f298e1e4490d57ddd2525cfa843a4994e577951c5f041b82ca2683b393ec6dab3daaabeca036907622fdec5b3cc0eb0b0a7bb5de53063f7e7302759a94
SSDEEP 12288:JrksATQeQBWoOBAKmd1wfQfuzSJabZKbegPPpCUdCe3mEUbKMHmm1Qh2a5RRkyok:JAsATFad6gAKMX1QhV5R5
TLSH
T1BAE45C0E5AE58A4E4CB008E6F6E70B7CBCDDC808F108D35FE45F852A615B19EC9BE594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\pt-BR.pak
Size 615KB
SHA256 e90d7ca40487d8f5299c85f86b5f20f7188d94c3f0e8b5368495f9a73c29cd40
MD5 3980e8679c7a6996f358c5ced43a7430
SHA1 144aeea1e7dd484b4e76a36e1f76867301316b2e
SHA512 67016c98c595eb7e06d070e184c0e94cfd8b8ea7d4123d2201531181a6ed944af41a8835ced5e7f62d619ad40f697b99ec3156375b0f5ddc10fa37f7b8d918f1
SSDEEP 6144:OSrWwPDOGeLNBXBLJDC8y3N5aEe3hc6asRqJCmM:OSrWAjeU5aErnsRcCd
TLSH
T181D41B296DCA136614226350BB4EDB47E5880645FE0ACB87DCFF4F05A3DDE40DA23BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\pt-PT.pak
Size 619KB
SHA256 97b06698596cf084533ac7990ae73cd72b3b851927e0fc5747cd0cab4f681079
MD5 499630de400bcad29853ebefdd2f4163
SHA1 72e7d52c6b87acad42740cf2bbf7ed155cc87cc3
SHA512 17c42477720a7cc57d9da76967163062026e6f996f507049faf104b9e1096a1a7c4c2feaebdca13d4e9055cb08deefcccdfe5a9255b69f97aa7a8355aca65b34
SSDEEP 6144:yWjU34jLsaOFACHOKieJVJJxhTv7hfw2fEqi5Qnv/s7mSR3d:yasBOCHzi5QnvsmSRN
TLSH
T1EDD41A286EDA132605136381B70ADB03FAC85655F809CB87C9EF0B4672CDF94D677B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\ro.pak
Size 641KB
SHA256 757990528d01554f5a1e476929ed3b4fd0bee20cbae07db442923cb477358d9d
MD5 73dbe97e8fcab8fc35c36176fed69c6a
SHA1 90c34009216d673054ff976659b9019faf450300
SHA512 f7f386b6e1d370c3521d5f241964bde65aa0698c06a5059364c4393ef2de659e616b552da68407f427d5efa553abda420a1c8d7f5b602bee3e7d1b0fa98def17
SSDEEP 6144:IZtg9KAYKEUeXoRwK9e/1oBPvgJyntk+wpG0J5v7sJ5XtXW279a/grVf:7FE5Xoxe/1oZEwtDmJ5v745dFo/Mf
TLSH
T170E43D23A1C81A97299153B2B73624D3E88E105DF641D28DA4EEC97D10CDDDBC52EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\ru.pak
Size 1.0MB
SHA256 7aaf8f96500bc8eb8883e46a10b84ebdc17ffdf34fe3d972cb3d69b29ed04776
MD5 5c0d258b09ee8f36b2d02b7e712fc0a9
SHA1 7fc3989426bafc31713cfc286969ba7551d8117f
SHA512 88f973c59161b8ff4509f1d2718e616f82f0f30f15ef29b51904c148cbc8c27ab2e13de4ba4611195e7b2a6ac6c1cb10ddbebca02d89afc75b0e648b20fed4e2
SSDEEP 12288:yg+RAfQeRo4YwIsps7zJ9hF+a8anDX86HzW/oqSvus2zTFcvgA8NI6dwYHWO3j/3:tmf758ole
TLSH
T17C358860669E64DE1101F01BDD08BE0D3CEB45FE3FAAA31619A42D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\sk.pak
Size 666KB
SHA256 1101256328b7dce3d388abfafa44e27ca416136187f366809ada6fabe1def449
MD5 bca69064ca2a21052cea35e679b80925
SHA1 4a82fc2f1824a38a41e8b8aac62db1316b7480a7
SHA512 976bddb17926dc4bcbdc115682776b7c88d458dcac5239ffa993e272ab5aa893d5085ab82ed0052bb8bc84d5721e5179c2988ff7f1e6c74ebec12e88c634ca72
SSDEEP 12288:buoW/ZtkAaB4WAEi+iQbG5Bn35iYs1qEpTjsxt9oe:buoWa4miD52YvHt+e
TLSH
T160E44D3FDFE7181E8E8D0148EFEA7110F97E8650864EB4A6940F374714E26ED8AB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\sl.pak
Size 638KB
SHA256 eef2f7c2f3aa5572456274004104d0c79911834f002fa1fdcd5063b60a3225a5
MD5 45cee0619a036c9335dd5fe6f7d6befb
SHA1 7312b0e4fc93217a531cd58c795d3c0da252f884
SHA512 118468c303a85349f078ae6decedf776953b4fcb5a3d27443bee1956ec8a098e99076e4c84a2abd45d07f0cefe30d75bc7c1be8db4184045c01ce1de2bf34932
SSDEEP 12288:K3ySP9Mk8/cB2JIhB6W5yGHy8WOqKzyi/fzPDJql/ad:CP9D8QB6W5yGHy/i/fzPDj
TLSH
T17CD41B397EA79E0F0C9BB2CAFEA606007FDC044CD252A662EC4F336D5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\sr.pak
Size 982KB
SHA256 9184460cb3dc15e5babf7d96c0816d4068e411a376dc7314e84c722761788538
MD5 2207e971c839a6673353f65e2c473d95
SHA1 b6953769bcff46f9bd5619c2c0449b62f940000d
SHA512 3e6ab66727d8bcf1b51eab706b2524b1d1231e74e3b3ed7414565c0563028d679b7cdc4ab06bf77bbadca2e6abe62a02e1a9cbf7c3491cd2a20f090b3894ffb3
SSDEEP 12288:Dev2ekZ3KIVFlSsd4niSi4USH6vU5YaW/XCvxEG537yMuNU/k/D:DqJDhH5kCiV
TLSH
T1EE2557A19B9E64DB0501F41BD808BE4A3DAF41FE3FAB975211601DBD34E10B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\sv.pak
Size 572KB
SHA256 bcc5a1a2405dd2cdb4adcdc0fd9236645de378ea179ea558b44908fdf708f93b
MD5 6b381769f806d3979afe785abae770d6
SHA1 0af02ba55170ffe130f4c5291a7ea333a275226e
SHA512 b25b7fe65ba045c16895935b4bc18745ee466f2c2770d45b9d4a881bafd6c0f3ec30641c4f6a0d31b65f6eec61d468a40e4b7df76562ff5b1ef1fea8b61f6ec3
SSDEEP 6144:8VObm6kbyQxGeAcQZHFKKOKTd2XxPXklScBLTVRFcz5RtGmP+SM4WxFMaySOCc5E:8VOK9EeAlZld21j5vi1RXX
TLSH
T138C41D438A10F526FBB2134DB508115B0AEDE25CE7E2958EB8D9883DAD8BD5805FF347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\sw.pak
Size 604KB
SHA256 dd7ec69741e67b471df0555096dcf3affe5a40f68753ccebae75d0cf11b07c60
MD5 f3dcefe45720921536033f16f5e7c528
SHA1 ec880ee4b5f27f95c5b146d430c2eac1223d3725
SHA512 7fc0490f4f0ee90fb64f2e254dbbaddd3a4664e00d31abb934a0cf75ba72ccfbeae2471456be075f717c82f06502cb15bc6ac872e0f045086eb88a3fd7726e96
SSDEEP 12288:2/YTD7MKxGN2qg35FmedqNGjRdpTb57bQh4FCaoLCzPFCcSeV4GFeNANUiiPgtBz:lcGFkiq58WC
TLSH
T16CD4D6629871D1191233618603DDFF732BDCEC5C2A2B2D935A46BF0F218F58C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\ta.pak
Size 1.5MB
SHA256 70a31eee3dc00ae51d9ae04945ad3db12de70f44a1fa913d88d599506e27c6b8
MD5 919f8ab0ac64673d12097a51a02d9b63
SHA1 eab8214950ce5668b76dc81b5c4437a1e40fadbf
SHA512 dda7a88ae3a9b75216c67e80beda030be1c3b73331e8a35c6265035d48132305cee9324efad1e208c392a535cc53f99f7d7914bcb91545989d0140d164cd0f73
SSDEEP 6144:ctitpBj3b//jpkB1POGP6J5OqMtR9utm1vYpiMyI:VpBj3bjiJOGm5Oq9tm1vYpiMyI
TLSH
T109750CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\te.pak
Size 1.4MB
SHA256 1447c02054e3d9ea084311c86c010834b44d7b0863f515cc4b83ce43201787e6
MD5 c0dc66267a073476c1e7346f3e91d16c
SHA1 a753c135d44032a9c7ae3494a9bea2cb2bc39789
SHA512 1c75d946bd6ebf435816c831641d25c113193e75873e8e73eaf856b91772e16397d230d9733e51f9a7734ff4c395cd4452493260441167c37f5ca3b37facc567
SSDEEP 12288:Eo1JREJPK7McKNYyX0iPF6026gIC8ymoRRT5hb8G52CPWus6Ju3p1FPnY1NAC/lG:N1JRQ0o5T4c0k
TLSH
T1A56591023A6AD310DAE70273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\th.pak
Size 1.2MB
SHA256 426a8e74828089ffb36b6ed19462eb645e407ae0352906f7f08ee19a3a5eb97a
MD5 79c2f17cb86d24987ff579d92bc556c2
SHA1 b80adc90fb0c91e21fb2f376e0430db2f78c3631
SHA512 13bc4a7f0f70843ee5cf401c5a281002893d8a44bd8ab7d8cebca5c0c63ac89423c157668cce5f9e083f49a64d9eff575b505957d1680c661a92ee8118a285ad
SSDEEP 12288:HYAAN9LyZYAhzYLkpms3hSkJUsNPsO5eXffpbDF0S6Sd2N+xylO1qsl5UtVFd1Lw:HYe/5rs1
TLSH
T1E1453BB37247DDD479441B5B262A7789673DAE693F73F8E00089215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\tr.pak
Size 615KB
SHA256 62c8ace3604a27fab3455e5e86a74f4eaca0a80c1d25a6c24a9656d0e8c37ec5
MD5 48195776e21319e7b8a5ba65ce68a56a
SHA1 d3e123e46c0d3c00ce334592023cbf3dcac3dbd9
SHA512 6d14fdafc7af1d9fbb2e14212441602642ad17fc3c3a1c7215a66ec35132efe22e95ae003f098b582f4e2479c6caf2dae135039273b74b37a9ab5d03caa7c58b
SSDEEP 12288:J2v4+ZJixH2wsaCHzNsgNwVfZFk9GMhRkt5MO4N:sv4bpgRkt5B4N
TLSH
T15FD4FA4178EF682C8BB9278FD6E90666F89F0766B331F446DA168636774539303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\uk.pak
Size 1.0MB
SHA256 e8c4c4c982f28789f7e710ff7e941b37179966cdc6b9a480f60b03bef866886b
MD5 edafecb7a63e15d8ff05b51b16eaa6ff
SHA1 c1878dad7ab9119c6bb9bb2495292fa34ac8925e
SHA512 7ecae958809d3531f719546a506f25c786a0a6619ddfecb3bdc81ef90ac92542bfe5ad27c5dd77affd22c6e99f3746dfcc7ffb6deed5272f229316b27379f04d
SSDEEP 12288:RTwibNomID99q6gFQAossSr+EfhVuL/9rjBtIVG/i5iNClIAve8/PEulLNiXETql:twiAMT5y8s
TLSH
T1D93599A19A9D54EF0106F05BE94C7A0D7DA701FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\ur.pak
Size 923KB
SHA256 7e8c8a47ab450c0165602160712d0430fc751c5703de655c0d543558e54c63fd
MD5 f18ca0305f845821eb8f63aa1bd15ff1
SHA1 f4d060a68f202a0295262fa13f5044d26e1371b7
SHA512 aca3037d80aef2b981b99e35e869a0548e09353a5107d9d83c37066d14665f2e45edb0de265dad76e5bc6da6319eaf493bf38f56f63eadd8426f5b3fc920198e
SSDEEP 12288:t/PbvLvgoq08PMuCjqtdQjDJ3ydKqC5hd5EhjGQOpRDoQYrWUYjwadcJKwUiuqc8:t/PbvLvzj54Gkx
TLSH
T173150FD2E6BC96B34A21D92780D33C34CB635F13D34AF285E56246C54E9A0139F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\vi.pak
Size 729KB
SHA256 6f898771f587d9c7742e3f4779eaa23fc0db554803701b698965a672dcdd6e04
MD5 757e38f3ad622b644c98e035fbf58f58
SHA1 63e4df84c9b8d9abcf8d44de4c4bf74920793dd6
SHA512 ffc0137a6ac64de63364f45399a91230b0c60ff58cbea4c89df2a2f6be7bf4613f16bbc3b0969c009313f04e7032b0404947f5b7db15344c9e3781f300de5511
SSDEEP 12288:bWc8z3hWF+c5IyoErsV/PwHKU00gTVN5CFA5TbaJXZA5a8iVecoINdZPjXla6ziI:LkWF+c5mVwHd0MFwPP5a8JStTlaMiuea
TLSH
T1ADF4851216E1302680AC553EC6CD540D6FCAE42FF7C1CFE56FF429747A221A46F25AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\zh-CN.pak
Size 523KB
SHA256 622f645c6b0a9cb8df6fc92c7a8e52ab2f5118a3f1b324d1910942ce34d180b8
MD5 d6632dccd41c310409dbb160b63d3cc3
SHA1 b4d4781ed3c39e76f6673c398eb0d3ffc45b5b61
SHA512 09e180d3787eaa1d3586081babb971ea28fd677012e15e5e08aac9263cb3a7b4c2ff7a9ccc3e5d655b7c987388048596069f768f9dc195602e92f86bd1b43f54
SSDEEP 6144:GG1fsxwP5ZAIZbvUn47UcUYEU0qq59XvdXK30Y42VZUykwYplA:GLKXZbsnDcUYEU0v5hvckY3ZEO
TLSH
T135B47DE821F9BDEC004650E03729613D7C40760BF66BAF756ED248DD2AA2FAD0757A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\locales\zh-TW.pak
Size 518KB
SHA256 da8923f485868aeb83f57a1b5991db7ae6474d2418e389d71512e3e5227367ee
MD5 8d4d3961ae369e2c38de349ae936d0e1
SHA1 597c8d9a314df125d53f93b46d32c9ed96b7b7b5
SHA512 5a29e7dc140f059200566df09aec6300463dd19fd6d764a89eb4ed32d4f61d4a3cd1233e39bba35c4088a029af03ed57d40c5ca964fdcf968bd50b1f4a4e4a12
SSDEEP 6144:kw2AsdZhSTewR5cwVJKXawK2duibyQi5XYfoH0DCdFvr2h5m9T4:b2ACfqe6c3XD9byQi5ofoH/6X
TLSH
T13EB47DBA19FBDBEF0901F484B7CD523ABC8B382CDD777636FC8518D42D6AA540A61046
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\resources.pak
Size 5.9MB
SHA256 ca47fceab76d2220a66dd5c55a444bbdb1f2300b1bd3b180693509327442b292
MD5 388137ae13e395d284fea2297099895f
SHA1 ee7c237320b267243c66a25093baa3df090b4f45
SHA512 76d31a0c498e00532121605889b0b323db239da33ee88b7aa22b606f51dc3cf236cfd7724b4f61a268898fdda005610d7fd04e221f7cc80bab33da20417f0c77
SSDEEP 98304:TNZPYiPJ1/7R1l0T6WiS9FhLrwr7gHnzDmJzkAbSig02qzPF72yWYTjzUxv:vwiBdTlWZ9nkr7OnzDuwRt02qzPF72y2
TLSH
T1035633A23E54A81BD24517FFC0A1C1344C2C9B943592A19715BCF01EFD662AEBF8867F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\resources\app.asar
Size 8.0MB
SHA256 536ead6560750bea0d1a6d6d4943f25ee2a0a772718d19deb0ef18c2d0174917
MD5 231874f1a169e38dfef712e33cb85345
SHA1 afe0ecb0f79a30104d8a06b441f4429854621fe2
SHA512 2c745f4a6ca6497a5165ab5557f2e88d3b8f874948d3e2f51d8f221361c9a3521fd1448ede4628d019efb6c0c94983ce0c4fb80a02c32636c283b3b855ce9665
SSDEEP 49152:devMOHeRrR400wlEHz4sz2MZiuzFDuZPHzpP07szX1ZhHzolnhBTCzFzYWXEZpg0:gwlgNlnh4zPEd
TLSH
T1ED861A2211F3E523F20793BB09EA8862BD609807380859457E8C9B4AFF57F36B9F1D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.manifest

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\resources\app.manifest
Size 988B
SHA256 3e45567a13e37ef4cbaf23c197b8a87c5c88401f41d70134bbaf22d188f3d34a
MD5 9e2c1e1ab9a0a82c975c37656d5638b3
SHA1 31dcbcfc9d0041b6b4d81619e2e9558622f2b2e4
SHA512 d238cfa23e4cc620e298eb388cb6ca7e8a7c89b0691ac6755f6edbf4dd569372fee47174640b937b2a4f0401274f9c0ce1968b68940b3347b2441cca70efdcbb
TLSH
T146111090C8D8D052A73101973634D94CED31D7AB488D46EC70CD676B6F139D5CAE3170
MD5 SHA1 SHA512 TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\resources\icon.ico
Size 12KB
SHA256 e444d1dd39b41fbb7ea75daf034556926c04ce1ddb8225d5679063d983b3b25c
MD5 d76a3a7bc35ea577f04e43b02f0b5174
SHA1 817b13823b3193fa46a4f8a119bba4bf847af1fb
SHA512 82bd90fc6a39d5552de18b3a8ff8318ec3713e19a31dc012354d1a399f6189df156baf7b9b46112b2491da5edb30c451247bac77124f3b55f7541457fa631f37
SSDEEP 192:CrmoQSBF/nIOL0RLHI8Nc4t8XTPQhYhuQKBS8plESQIHNeSc1B5iSV:CZF/n5LGLHpc4t8Bu48wes
TLSH
T10742BE8DF55DB59CDAF7C9BC2DABE2E54290810CEF50A67B3C898140F849D0006B7FA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\snapshot_blob.bin
Size 329KB
SHA256 9a10e7b6d4a4a19e9e825217b2eaab2e47df86fe85a70e74e6f660c89ddb0fb6
MD5 009b2b24bfe5495c57fe01c9f19cc5b5
SHA1 19accdd1ec77a54860fab54057ef32ff4612fbaa
SHA512 8e3a4ff7ea7be71232fa9c3587089ce16ad7f83e7f2286d0e89a5479ce207b9150c3bcab335a7b2ba3d5eddcb5a54ac179bb3a77221d6b62670a6e9187a52042
SSDEEP 3072:etjRKkOt+xeReIyhOwvNDZOYQ8eZwDKUX/xjsIlkx/LnVmr4FIGvqT:KR4t+OU8tzZ1CjsTxDVmMFU
TLSH
T10374CB06F319C72AC459267E4CF993893234B2CE9F86A21B759943FD38B153D4D22B8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\v8_context_snapshot.bin
Size 695KB
SHA256 546db668f31be13f2a70cb2282f8073a88ad51be77eef468e1ad7a9450738da6
MD5 f1e554f9d27fe78543eb9dad4e1015b9
SHA1 ea7b6c1a63f91329bd93c1625e45658218702ba5
SHA512 aaf4515a334c99b251a288de67d28579113be17fbb7de7ef133b07b0c53cb06959d0da88ac1683406f2c3069bfdcaea7ac8953a2c21d740d8d8eb69cfa201b9f
SSDEEP 6144:XS9cowVafAdRjt+OUjIoZ1Cjs5vN8bnecHRWSmMFImJpz6nl5Pbp5QCV/xdFzQ6S:PowAAlevN8HRWSxmQz+bp5QO/xdNS
TLSH
T1E8E494A2FB1ACF2FC58D267E5DEA86463534B08E5F4BC25B715403BC38B95780E29358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 c753107d8827525306b83d3c35da988b0954caebc4ab806d4ca6f27b7a0d8bdf
MD5 c2c4f00a3c333cf3adb925450781f4f5
SHA1 53188a91f51db0d2f727a5ad8df0f49c65fb7887
SHA512 6c7c3af14cca712a6ae578193a7ee6bc3bc66d2fcd8a1bff21a0a36324149aae364e6928323c0fb45943460fee216777f321cbb7b36e10f6083598d8f26d0dc5
SSDEEP 49152:anydgpxuaL++kI1sj+CaAnxQ/J2NBbFckI3TKUqVMo6OFLfediIqXSbhcKBlc1x6:aydgpSX5O2h1+zJ12e
TLSH
T14F462703F28680E9F05DD679875BA622F631FC814B2276DF56A01F192E77BE06739B04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\7z-out\vulkan-1.dll
Size 917KB
SHA256 40e39b8cd62c3292f7c5ad6a2d863f6e3bd3d2c0b1b3a2a0e4d41a61d2a8f758
MD5 191d4f97be05c52720f41b6d75c45c82
SHA1 66677c339dc93f3f184be05d0c00cf3b9e80a941
SHA512 9f13c89c4a07b7b2aa5a94ced747b7ba75d464d8969fbcbdc4c64fa9478c192d3a659f7b50df0591051ce34b51de5cddea911f6cb7806a1c05b68cc53af9a31a
SSDEEP 24576:MKQWGPJTps7zeRlp2MOi88y6Z5WGcSDYsHQDi6g3P0zAk79oOHHW:h9aJts7zeR5b88y6Z5WGcSDYsHQDi6gu
TLSH
T102155B1396958569D57AD038CDD28607C9B174822322BACF02A857087F6FFF47B3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl910C.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_1658119248\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

toseina.bsp

Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\toseina.bsp
Size 3KB
SHA256 511305df6941fa05b76f83b9d80278f823a0024cb8d91cb9954e129e29c80141
MD5 c54eccf527d4061580d5c4d98839259a
SHA1 82387ae3807829619187e3d756bb4271effe1e57
SHA512 175ba844fbf25078ea35b47b16292a222e9181e9ab1cf977fef0f60038dae8046346d351660d1d8e6d8ea67f097bdbe8c3fa0c40d361900887edd532abda5d76
TLSH
T1C7612C010736BC3B6BA6439175C6F9C28BF8B1A63F91942B008697147B3A437673D5F1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1388-453-0x00007FFE471A0000-0x00007FFE471A1000-memory.dmp

Download

memory/1388-454-0x00007FFE48140000-0x00007FFE48141000-memory.dmp

Download

memory/1388-637-0x00000124E4400000-0x00000124E4AF6000-memory.dmp

Download

memory/1732-772-0x0000040B29260000-0x0000040B29985000-memory.dmp

Download

memory/1732-636-0x0000040B29260000-0x0000040B29985000-memory.dmp

Download

memory/2868-414-0x000002365B720000-0x000002365B72A000-memory.dmp

Download

memory/2868-406-0x000002365B670000-0x000002365B692000-memory.dmp

Download

memory/2868-413-0x000002365B980000-0x000002365BA32000-memory.dmp

Download

memory/2868-412-0x000002365B700000-0x000002365B71E000-memory.dmp

Download