c87299a716df42e2e5a3cfe0d6a3deccef175ed9189493a43ad7deeea45c38ae

Analysis

user interaction
yes
max time kernel
391s
max time network
393s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/07/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AR Launcher.exe
Size 77.0MB
Sample260720-x14cdacy8m
SHA256 c87299a716df42e2e5a3cfe0d6a3deccef175ed9189493a43ad7deeea45c38ae
MD5 c4ff0319b7c78b9d8745d158675c8ae1
SHA1 f0f63f181410fc1041c92f61d3f8fbb4243d40b6
SHA512 0481f38f44e32ec85d08996bf61497705f4eabdbaebebcb818ab950b17840b87de0d202edbb2a01d8a9e7de3d535e7de3cfd80b730513f626d9420ea1da8b090
SSDEEP 1572864:pu/U1RESsuvtD3ssKQM3b1+ga+24UOIOxXZNldiEYzQUTKs/GXrw7:pqk43kgRMANlE9zTThGXk7
TLSH
T10708336F617381A5CC254934BB219D1CCCA906D3436C9B77FB4EE0E9E8B45AD0E170AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution pyinstaller

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	WuWa Arabic Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	WuWa Arabic Launcher.exe

Executes dropped EXE 7 IoCs

pid	Process
1412	WuWa Arabic Launcher.exe
4240	WuWa Arabic Launcher.exe
4324	WuWa Arabic Launcher.exe
1184	WuWa Arabic Launcher.exe
4204	WuWa Arabic Launcher.exe
5588	arabicEtrdream.exe
5836	arabicEtrdream.exe

Loads dropped DLL 28 IoCs

pid	Process
2404	AR Launcher.exe
2404	AR Launcher.exe
2404	AR Launcher.exe
1412	WuWa Arabic Launcher.exe
4240	WuWa Arabic Launcher.exe
4324	WuWa Arabic Launcher.exe
4240	WuWa Arabic Launcher.exe
4240	WuWa Arabic Launcher.exe
4240	WuWa Arabic Launcher.exe
4240	WuWa Arabic Launcher.exe
4240	WuWa Arabic Launcher.exe
1184	WuWa Arabic Launcher.exe
4204	WuWa Arabic Launcher.exe
4204	WuWa Arabic Launcher.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe

Contacts third-party web service commonly abused for C2 1 TTPs 25 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
84	raw.githubusercontent.com
92	raw.githubusercontent.com
103	raw.githubusercontent.com
104	raw.githubusercontent.com
95	raw.githubusercontent.com
76	raw.githubusercontent.com
85	raw.githubusercontent.com
87	raw.githubusercontent.com
93	raw.githubusercontent.com
94	raw.githubusercontent.com
96	raw.githubusercontent.com
109	raw.githubusercontent.com
77	raw.githubusercontent.com
81	raw.githubusercontent.com
91	raw.githubusercontent.com
98	raw.githubusercontent.com
99	raw.githubusercontent.com
107	raw.githubusercontent.com
86	raw.githubusercontent.com
88	raw.githubusercontent.com
89	raw.githubusercontent.com
102	raw.githubusercontent.com
106	raw.githubusercontent.com
108	raw.githubusercontent.com
111	raw.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
5252	tasklist.exe
2116	tasklist.exe
2056	tasklist.exe
1408	tasklist.exe
6000	tasklist.exe
5744	tasklist.exe
1128	tasklist.exe
2052	tasklist.exe
4924	tasklist.exe
5752	tasklist.exe
2020	tasklist.exe
5144	tasklist.exe
2960	tasklist.exe
1120	tasklist.exe
5516	tasklist.exe
2540	tasklist.exe
4436	tasklist.exe
3128	tasklist.exe
5568	tasklist.exe
2156	tasklist.exe
5688	tasklist.exe
1952	tasklist.exe
4468	tasklist.exe
980	tasklist.exe
5212	tasklist.exe
5324	tasklist.exe
5552	tasklist.exe
5852	tasklist.exe
3536	tasklist.exe
5556	tasklist.exe
2136	tasklist.exe
2248	tasklist.exe
3100	tasklist.exe
3188	tasklist.exe
4200	tasklist.exe
5368	tasklist.exe
5408	tasklist.exe
5320	tasklist.exe
5412	tasklist.exe
980	tasklist.exe
528	tasklist.exe
4452	tasklist.exe
5616	tasklist.exe
6076	tasklist.exe
5180	tasklist.exe
5232	tasklist.exe
5088	tasklist.exe
6104	tasklist.exe
2860	tasklist.exe
2728	tasklist.exe
2792	tasklist.exe
3644	tasklist.exe
5356	tasklist.exe
6016	tasklist.exe
3028	tasklist.exe
3624	tasklist.exe
4600	tasklist.exe
3480	tasklist.exe
5940	tasklist.exe
5068	tasklist.exe
5368	tasklist.exe
3716	tasklist.exe
4248	tasklist.exe
5968	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
428	powershell.exe
2232	powershell.exe
4532	powershell.exe
5376	powershell.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0008000000010a06-1010.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5768	cmd.exe
4192	cmd.exe
6076	cmd.exe
5064	cmd.exe
5932	cmd.exe
2908	cmd.exe
5288	cmd.exe
5296	cmd.exe
5528	cmd.exe
5172	cmd.exe
5100	cmd.exe
5208	cmd.exe
6140	cmd.exe
5028	cmd.exe
408	cmd.exe
3548	cmd.exe
5248	cmd.exe
760	cmd.exe
5320	cmd.exe
1068	cmd.exe
5720	cmd.exe
1364	cmd.exe
3860	cmd.exe
1128	cmd.exe
4104	cmd.exe
944	cmd.exe
4768	cmd.exe
4008	cmd.exe
2800	cmd.exe
5116	cmd.exe
5980	cmd.exe
756	cmd.exe
4872	cmd.exe
548	cmd.exe
5996	cmd.exe
1988	cmd.exe
5204	cmd.exe
2216	cmd.exe
404	cmd.exe
2892	cmd.exe
1332	cmd.exe
6008	cmd.exe
2880	cmd.exe
2900	cmd.exe
2224	cmd.exe
4640	cmd.exe
5660	cmd.exe
4856	cmd.exe
5544	cmd.exe
2560	cmd.exe
2860	cmd.exe
5584	cmd.exe
216	cmd.exe
3872	cmd.exe
2720	cmd.exe
2472	cmd.exe
6036	cmd.exe
2516	cmd.exe
2656	cmd.exe
5468	cmd.exe
2000	cmd.exe
5088	cmd.exe
3772	cmd.exe
4780	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AR Launcher.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3080	msedge.exe
6048	msedge.exe
3580	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290493110124162"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	WuWa Arabic Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	WuWa Arabic Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	WuWa Arabic Launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{2ABF2A42-8D64-492D-AC37-9841179ADE64}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	WuWa Arabic Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	WuWa Arabic Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	WuWa Arabic Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	WuWa Arabic Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	WuWa Arabic Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	WuWa Arabic Launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{80A2C569-96E3-4997-BAB1-5B3C90AB0EB5}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{D3068FA1-5960-4976-BEB7-7F75B5E347AF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	WuWa Arabic Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WuWa Arabic Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	WuWa Arabic Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	WuWa Arabic Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	WuWa Arabic Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	WuWa Arabic Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	WuWa Arabic Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	WuWa Arabic Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	WuWa Arabic Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	WuWa Arabic Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	WuWa Arabic Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	WuWa Arabic Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	WuWa Arabic Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	WuWa Arabic Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	WuWa Arabic Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	WuWa Arabic Launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{B87C2179-33A2-4BF0-9C31-64D1488EAF45}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	WuWa Arabic Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e80922b16d365937a46956b92703aca08af0000	WuWa Arabic Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	WuWa Arabic Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	WuWa Arabic Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	WuWa Arabic Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	WuWa Arabic Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	WuWa Arabic Launcher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4204	WuWa Arabic Launcher.exe
4204	WuWa Arabic Launcher.exe
428	powershell.exe
428	powershell.exe
428	powershell.exe
2232	powershell.exe
2232	powershell.exe
2232	powershell.exe
4532	powershell.exe
4532	powershell.exe
4532	powershell.exe
5376	powershell.exe
5376	powershell.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1412	WuWa Arabic Launcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2404	AR Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe
Token: SeCreatePagefilePrivilege	1412	WuWa Arabic Launcher.exe
Token: SeShutdownPrivilege	1412	WuWa Arabic Launcher.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1412	WuWa Arabic Launcher.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe
5508	msedge.exe
5508	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5836	arabicEtrdream.exe
5836	arabicEtrdream.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1412	WuWa Arabic Launcher.exe
5588	arabicEtrdream.exe
5836	arabicEtrdream.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1412	2404	AR Launcher.exe	84
PID 1412 wrote to memory of 4240	1412	WuWa Arabic Launcher.exe	86
PID 1412 wrote to memory of 4240	1412	WuWa Arabic Launcher.exe	86
PID 1412 wrote to memory of 4324	1412	WuWa Arabic Launcher.exe	87
PID 1412 wrote to memory of 1184	1412	WuWa Arabic Launcher.exe	88
PID 1412 wrote to memory of 1184	1412	WuWa Arabic Launcher.exe	88
PID 1412 wrote to memory of 4204	1412	WuWa Arabic Launcher.exe	97
PID 1412 wrote to memory of 5052	1412	WuWa Arabic Launcher.exe	98
PID 5052 wrote to memory of 4316	5052	msedge.exe	99
PID 4316 wrote to memory of 2008	4316	msedge.exe	100
PID 4316 wrote to memory of 3080	4316	msedge.exe	103
PID 4316 wrote to memory of 760	4316	msedge.exe	102
PID 4316 wrote to memory of 760	4316	msedge.exe	102
PID 4316 wrote to memory of 760	4316	msedge.exe	102
PID 4316 wrote to memory of 528	4316	msedge.exe	105
PID 4316 wrote to memory of 528	4316	msedge.exe	105
PID 4316 wrote to memory of 2424	4316	msedge.exe	106
PID 4316 wrote to memory of 1648	4316	msedge.exe	107
PID 4316 wrote to memory of 2424	4316	msedge.exe	106
PID 4316 wrote to memory of 2424	4316	msedge.exe	106
PID 4316 wrote to memory of 1648	4316	msedge.exe	107
PID 4316 wrote to memory of 1648	4316	msedge.exe	107
PID 4316 wrote to memory of 4420	4316	msedge.exe	108
PID 4316 wrote to memory of 4444	4316	msedge.exe	109
PID 4316 wrote to memory of 4420	4316	msedge.exe	108
PID 4316 wrote to memory of 4420	4316	msedge.exe	108
PID 4316 wrote to memory of 4444	4316	msedge.exe	109
PID 4316 wrote to memory of 4444	4316	msedge.exe	109
PID 4316 wrote to memory of 3860	4316	msedge.exe	110
PID 4316 wrote to memory of 3860	4316	msedge.exe	110
PID 1412 wrote to memory of 428	1412	WuWa Arabic Launcher.exe	113
PID 4316 wrote to memory of 3580	4316	msedge.exe	114
PID 4316 wrote to memory of 3580	4316	msedge.exe	114
PID 4316 wrote to memory of 1472	4316	msedge.exe	116
PID 4316 wrote to memory of 1472	4316	msedge.exe	116
PID 4316 wrote to memory of 1472	4316	msedge.exe	116
PID 4316 wrote to memory of 1012	4316	msedge.exe	117
PID 4316 wrote to memory of 1696	4316	msedge.exe	118
PID 4316 wrote to memory of 1012	4316	msedge.exe	117
PID 4316 wrote to memory of 1696	4316	msedge.exe	118
PID 1412 wrote to memory of 2232	1412	WuWa Arabic Launcher.exe	120
PID 1412 wrote to memory of 4532	1412	WuWa Arabic Launcher.exe	123
PID 4316 wrote to memory of 4260	4316	msedge.exe	126
PID 4316 wrote to memory of 3128	4316	msedge.exe	127
PID 4316 wrote to memory of 3128	4316	msedge.exe	127
PID 4316 wrote to memory of 4972	4316	msedge.exe	152
PID 4316 wrote to memory of 4972	4316	msedge.exe	152
PID 1412 wrote to memory of 5376	1412	WuWa Arabic Launcher.exe	129
PID 1412 wrote to memory of 5588	1412	WuWa Arabic Launcher.exe	131
PID 1412 wrote to memory of 5700	1412	WuWa Arabic Launcher.exe	133
PID 5700 wrote to memory of 5752	5700	cmd.exe	135
PID 1412 wrote to memory of 2224	1412	WuWa Arabic Launcher.exe	137
PID 2224 wrote to memory of 3188	2224	cmd.exe	139
PID 5588 wrote to memory of 5836	5588	arabicEtrdream.exe	140
PID 1412 wrote to memory of 5932	1412	WuWa Arabic Launcher.exe	141
PID 5932 wrote to memory of 5968	5932	cmd.exe	143
PID 1412 wrote to memory of 6036	1412	WuWa Arabic Launcher.exe	144
PID 6036 wrote to memory of 6104	6036	cmd.exe	146
PID 1412 wrote to memory of 6140	1412	WuWa Arabic Launcher.exe	147
PID 6140 wrote to memory of 4200	6140	cmd.exe	149
PID 1412 wrote to memory of 756	1412	WuWa Arabic Launcher.exe	150
PID 756 wrote to memory of 4972	756	cmd.exe	152
PID 1412 wrote to memory of 4780	1412	WuWa Arabic Launcher.exe	153
PID 4780 wrote to memory of 2860	4780	cmd.exe	155

C:\Users\Admin\AppData\Local\Temp\AR Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\AR Launcher.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\3FD42Qf68rDOTP5tAJEqTrpEd1d\WuWa Arabic Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\3FD42Qf68rDOTP5tAJEqTrpEd1d\WuWa Arabic Launcher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Users\Admin\AppData\Local\Temp\3FD42Qf68rDOTP5tAJEqTrpEd1d\WuWa Arabic Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\3FD42Qf68rDOTP5tAJEqTrpEd1d\WuWa Arabic Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\WuWa Arabic Launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1720,i,9735455185687589176,8993904723431312071,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\3FD42Qf68rDOTP5tAJEqTrpEd1d\WuWa Arabic Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\3FD42Qf68rDOTP5tAJEqTrpEd1d\WuWa Arabic Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\WuWa Arabic Launcher" --standard-schemes=launcher-media --secure-schemes=launcher-media --bypasscsp-schemes=launcher-media --fetch-schemes=launcher-media --streaming-schemes=launcher-media --field-trial-handle=1944,i,9735455185687589176,8993904723431312071,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4324
- - C:\Users\Admin\AppData\Local\Temp\3FD42Qf68rDOTP5tAJEqTrpEd1d\WuWa Arabic Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\3FD42Qf68rDOTP5tAJEqTrpEd1d\WuWa Arabic Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\WuWa Arabic Launcher" --standard-schemes=launcher-media --secure-schemes=launcher-media --bypasscsp-schemes=launcher-media --fetch-schemes=launcher-media --streaming-schemes=launcher-media --app-path="C:\Users\Admin\AppData\Local\Temp\3FD42Qf68rDOTP5tAJEqTrpEd1d\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2448,i,9735455185687589176,8993904723431312071,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\3FD42Qf68rDOTP5tAJEqTrpEd1d\WuWa Arabic Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\3FD42Qf68rDOTP5tAJEqTrpEd1d\WuWa Arabic Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\WuWa Arabic Launcher" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2400,i,9735455185687589176,8993904723431312071,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://etrdream.com/game/wuthering-waves/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://etrdream.com/game/wuthering-waves/
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ff9efedc188,0x7ff9efedc194,0x7ff9efedc1a0
        5⤵
        
        PID:2008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,6713392097706374296,4153315265317916185,262144 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
        5⤵
        
        PID:760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,7698488692301242377,6040985711955558559,524288 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,14528636940245802742,6196329367912334538,524288 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:8
        5⤵
        
        PID:528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,14994445008696880072,8087233574228762404,2097152 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
        5⤵
        
        PID:2424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,6134344733353263357,7511025339780815320,2097152 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
        5⤵
        
        PID:1648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,11578226906097494492,3416887108497460683,2097152 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
        5⤵
        
        PID:4420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,1498601378538261006,3040880392233242181,2097152 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
        5⤵
        
        PID:4444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,11608728810159604111,10893824615157639504,524288 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
        5⤵
        
        PID:3860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,7651077229844850492,7669021515953722823,524288 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
        5⤵
        
        PID:3580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5564,i,16972619812785073254,228287124425478395,2097152 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
        5⤵
        
        PID:1472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,8582918483288795914,13815934992118102065,524288 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
        5⤵
        
        PID:1012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,12165276559695526803,16961737725964353739,524288 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
        5⤵
        
        PID:1696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,24471738786250448,4523724232867984302,524288 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
        5⤵
        
        PID:3972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,24471738786250448,4523724232867984302,524288 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
        5⤵
        
        PID:4260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,7459991103158929094,14122534648405115867,524288 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
        5⤵
        
        PID:3128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,17297625271720559595,10258186768332053405,524288 --field-trial-handle=2500,i,1907571060833962920,12312159877350638515,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
        5⤵
        
        PID:4972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NonInteractive -NoProfile -Command "Unblock-File -Path 'C:\Users\Admin\Documents\WuWa AR Launcher\Client\Content\Paks\~mods\arabicEtrdream.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NonInteractive -NoProfile -Command "Unblock-File -Path 'C:\Users\Admin\Documents\WuWa AR Launcher\Client\Content\Paks\~mods\arabicEtrdream_dx11.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NonInteractive -NoProfile -Command "Unblock-File -Path 'C:\Users\Admin\Documents\WuWa AR Launcher\Client\Content\Paks\~mods\Etrdream_AR_99_P.pak'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NonInteractive -NoProfile -Command "Unblock-File -Path 'C:\Users\Admin\Documents\WuWa AR Launcher\Client\Content\Paks\~mods\arabicEtrdream.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5376
- - C:\Users\Admin\Documents\WuWa AR Launcher\Client\Content\Paks\~mods\arabicEtrdream.exe
    "C:\Users\Admin\Documents\WuWa AR Launcher\Client\Content\Paks\~mods\arabicEtrdream.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5588
  - - C:\Users\Admin\Documents\WuWa AR Launcher\Client\Content\Paks\~mods\arabicEtrdream.exe
      "C:\Users\Admin\Documents\WuWa AR Launcher\Client\Content\Paks\~mods\arabicEtrdream.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:5836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5700
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:5752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:3188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5932
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6036
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:6104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6140
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:2860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:4872
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:2728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:1248
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:944
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2908
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:3844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5288
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2516
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:5276
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5768
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:3128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5028
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:2296
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:404
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:3512
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:1068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:4640
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2656
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:5456
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5468
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:408
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5720
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:6016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:6056
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:5976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:3548
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:3028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:5808
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:3768
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5248
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:2792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5296
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:548
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:2056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:4760
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:1064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:5060
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:4452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:5732
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:1408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:4968
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:4564
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:760
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:2408
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:5436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5528
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5660
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:4768
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5980
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:6000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5172
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2860
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:4568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:1364
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:6076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5100
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:3644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:4856
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5320
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:4432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2880
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:3128
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2892
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:4008
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:2164
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:1068
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:3024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:4744
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:5460
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5544
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:1332
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:4176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5584
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:560
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:6008
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5996
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:3860
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:5664
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:2960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5208
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:4612
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:3716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2800
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:4192
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:3280
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:1952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2900
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:2664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:1988
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5204
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:3868
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2216
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:3480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:216
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5116
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/snq1SaK5m_8?si=OpgEhdzu4zDt0JDU
    3⤵
    PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://youtu.be/snq1SaK5m_8?si=OpgEhdzu4zDt0JDU
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:5508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x258,0x7ff9efedc188,0x7ff9efedc194,0x7ff9efedc1a0
        5⤵
        
        PID:3192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,17164285382632365113,16763204109159519827,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:6048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,15120456845346461940,5117918099219121855,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:8
        5⤵
        
        PID:6044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,9065510131346539875,10158426587502896095,262144 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:2
        5⤵
        
        PID:3524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,12351050889002735661,9706537519412355849,2097152 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
        5⤵
        
        PID:4440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,636471899640465065,2548378908289331151,2097152 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
        5⤵
        
        PID:5868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,16910605097672181681,14011286935497777851,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
        5⤵
        
        PID:4148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,11231122935709405802,10586660186590702505,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
        5⤵
        
        PID:3732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5016,i,13856695958351724069,18426915694329746295,2097152 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
        5⤵
        
        PID:3888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3552,i,14815476860981679024,8044949738462852514,2097152 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
        5⤵
        
        PID:5080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,14473671230211620989,4313214902645098427,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:8
        5⤵
        
        PID:2292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,6024054895266079510,16239391811907651843,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:3620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,2418667888085129730,13630821001955465330,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
        5⤵
        
        PID:5444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,10278373384254896616,7522108399838681728,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
        5⤵
        
        PID:528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,4587876288065971486,8704803468107042096,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
        5⤵
        
        PID:2228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,4587876288065971486,8704803468107042096,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
        5⤵
        
        PID:3732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,10760726599397015435,3280640995678312640,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:8
        5⤵
        
        PID:4596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,8648547285514195415,11990593961640935850,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8
        5⤵
        
        PID:5812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,14466497332050726205,17231278232812844783,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
        5⤵
        
        PID:5036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,4586106555217627902,9155071783513551809,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:8
        5⤵
        
        PID:1856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,16220739149353398762,8758346845558953804,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:8
        5⤵
        
        PID:5744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,12896643748396283780,7577167578865929628,524288 --field-trial-handle=2852,i,8923042857239146255,9998078770116776234,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:8
        5⤵
        
        PID:5504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:2944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ff9efedc188,0x7ff9efedc194,0x7ff9efedc1a0
        6⤵
        
        PID:5076
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,15355346485336123313,16127321154414250303,524288 --field-trial-handle=2288,i,5947404729119563318,145719717211846560,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:3580
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,8807348073138296912,7605544813771051377,262144 --field-trial-handle=2288,i,5947404729119563318,145719717211846560,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
        6⤵
        
        PID:1672
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,14354455757716101572,7435806080429066841,524288 --field-trial-handle=2288,i,5947404729119563318,145719717211846560,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:8
        6⤵
        
        PID:5112
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,8859045118408839828,6449501004597263222,524288 --field-trial-handle=2288,i,5947404729119563318,145719717211846560,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
        6⤵
        
        PID:3848
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,8859045118408839828,6449501004597263222,524288 --field-trial-handle=2288,i,5947404729119563318,145719717211846560,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
        6⤵
        
        PID:5168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:3872
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:2716
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:1128
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2720
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2000
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:4104
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5088
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:4468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:6076
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2472
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:6124
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:3772
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2560
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:3100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:5064
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:4248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV"
    3⤵
    PID:4812
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq arabicEtrdream.exe" /NH /FO CSV
      4⤵
      PID:5440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4532

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
MD5 ed30ca9187bf5593affb3dc9276309a6
SHA1 c63757897a6c43a44102b221fe8dc36355e99359
SHA512 1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810
TLSH
T1C051DA313275A1E4C91A3F47192819C023BF8355FA98AF5CB65C521EE92740B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1edfcdc48b5dcecc2205fc405fa8b09cc584478478cacbdd80bc27e3e30dc0b7
MD5 1c828986cedadbeef3271e4b2c9b92ec
SHA1 48003895ecbcf6c0089d26ffd3d9485fe6d20529
SHA512 ca66eff9bfe9d1b3c0327ff898178f9f92f2345622b1235d8c3aac909832097a0c4c0dc066f46ffe2fddded60d00ed2fb812fb00413c2a79b891417a2b9f531e
TLSH
T106D02334B7396C45C7177431743CC711FB51A7D0255DC55351A0D01C5E740D8679F0A3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87b3adfef1c1f4b418ab7a8827716ba4cd352e0f5ddca32eb510a1c0faaa89af
MD5 694395732d3fdab2525635f9e247f102
SHA1 f73ae8197fafe45f2459dbf82ecad9fc8cafffed
SHA512 3c0bff591c59444e84f98a9b7d364e5a90b971c8cb326c054f0ccfefa5280402b1d2c816f39023f2120141593b8d53ded4029268612b4a971eba53e300e2bbe0
TLSH
T147D0A734BB39AC45C71774316438C611FB51A6D0255DC55251A0901C5E74098669F0A2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f581ea565cf0ece39a0cfdc05cae1573d34e8544d3d072c3f0598034de5e42f8
MD5 c80cb3ee13f62b490ae95d8bb68bb8fa
SHA1 a3baa3d078eae3e3de53faaf8b92df67f056d9e2
SHA512 f385ff91fe9914b069144548f6f36759de4228b81878118a49bc5d05a8f3055bf5724ef0be68d53b91691f095dc1736b8d3458eace80a0e31689f3d0c8f3f5eb
TLSH
T168D09B34F75AE445D1074531582C4711D9199DD014A6870B5160D41CABA401C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93429dd01854445fa133f0fbf5425cd809654805f254624b9069743c3234992b
MD5 efbc7950c0e260d639527fc1ce4ad67e
SHA1 6f24c544683aff957cfabd74d25b3f257ebc2530
SHA512 ee98b342cff91c9d6bf2cb507ac4d60051030bb4699bf53f8850a07dffae5c43e81bab58dc3b238edc4826c3ac94f7b8938f34246fa9ffbcbf59d28f5e5d0cae
TLSH
T11BD02338B73ABCC5D1391435543C4700FA155EE221A987476190C41D9E780C967EFDE3
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 56KB
SHA256 3f9b0c0a209ecaa2f816817bd374578d8ca9acbd0b1de8a110dfddf3c81435a5
MD5 74c2ec4bb46698ce9fddc0e5b0cbfcf9
SHA1 9692779807193c6df10eeb1151f533c670455f36
SHA512 a442dbbac7d346af3e65f78b11802953c38c63b2fbff4c413ac530d2972a1083218b115cc2a471ea5341730d09afc9da395deec45f97a989c8097c0382979a39
SSDEEP 1536:sgBxpaRRlGtjocgEAuoJl4/I4s3yvxs6Kk7C1UveOJ:saapGXADl8LdJake1UvH
TLSH
T11743F17BBE71F6DDE24201C25D132D6407129500B521A9C0EADAD7BE1B2D13377EA727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 275KB
SHA256 38616e03510afd2f23d60376ab377670f9df7d6df3cc1ed788500f1d1598ceb2
MD5 721cbe24c2e0d7f88a3ed8fb320e3202
SHA1 56d7d33b2221a5ee0112ff898d86953817a132b2
SHA512 b82e0bc6d6dddb7449338d7ec315570e26f08c773e541ff62e598aefc72b8deda5be889be8fadd2f9512f453701ddc3d788a86e15971228b9e9cf276a905dfee
SSDEEP 6144:CUYInrfflcBV5SWbazAhH8Z+id04/lmtxHUEr0yg8P7H9Ysq:jnrfflcBV5RbazAFsV0zx685Ysq
TLSH
T12854233EC5708A512CDDA50542D1AA2D1EC65A2CF25B71FC029F1AF36A323BCE5D7742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 016eff8aa61089f0361fbed1da85c3446869bdb9cbcc2f6d07f055db1b9883c6
MD5 806ddca660d093e1c92a5ea7db696880
SHA1 c8a159f8fb24e5ca7bce52557aaac5bc379162cf
SHA512 cc5ae9be78814a4d4a10a986b42d80d51501b55f651fda561c5a85daee303fd3a23786d8db516e3147993351388cc4d6893a0ef81bf4ee7993bb6953cd510a7f
TLSH
T1BC714C0F7AD25D46D7510232DAC32A837534E8B738D3AF6203D0E4B14A5EBBA20542C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2995c72c13a33001558cf6a63e3eb99be9c44f3a64d768b2e07470937d17555c
MD5 f9fa0927c57ab50170642166895d399d
SHA1 bd8478b5483727887574760c28357886a210ef49
SHA512 e04718c1fc665435ea6a8395591ff9f928f7bb5eefe3d2499e9c9423ed738e94327459006b55562ed0ba4b934ffa6f7f72744e015a3f776fb5269378e9a589e2
SSDEEP 48:RqAqO/vUQ+hKuDhNbQRagJBHn00i4E/0V/xEeRZjHUF9JeobcxWJVWIf0njTDVYs:BJvUnXeBH00i4TJEeH09HlJGn/DVmW
TLSH
T12791C61E7AE1598ADB910232EAC3298B3531E47B34D35F3687D4F4B50A4EBF630512E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 316KB
SHA256 9a78f3c3cca948630e5d01235ca2b0ed406fe6204bd53433b463c2952306c98a
MD5 aaa5807e159257e12739cb13ff1dab93
SHA1 159e579715c002a34bdfab035760dac73ec142d2
SHA512 26b3ca7f0e12ba237c17a56aba44196d580a196284145ae12be2bda20e65a7bd3d840e2ea9ce8724f3700c7b01d0421280b99c40d664db4f4012ec51ea6a1cbe
SSDEEP 3072:7p6QPYPbniXkxCVlyCo2X9LIyskk/YiUytFDRTvMk/TifqDYNMiw+PkePuBRvUN+:m+me0ectpC++M9B1iA
TLSH
T14D644B59A0A372E1D13D53761E634F06D3B9CAC876E97052BA62B60C67F7F002A7172C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000008.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000008.ldb
Size 26KB
SHA256 2775104625479b01fcbe866157119fc6cab83e2a495b909b0afad72ac4a7b3ab
MD5 2a12560874ce441de622a1b77cab6619
SHA1 2ca5a75a540f4e8b9e0e92a1984f2014337abb46
SHA512 f719f66d750b7e6f85e2581687b6bbb70da1f68237f7c251c7ae794a9952449d01c79a24748f301be3c1073a0d750381e3126bbfb7ce20812df21d4db469dc18
SSDEEP 384:8Fynyd/Uf3bvNDUW9eW/GGmNOjsDrJIvMcIYJiTl9vqfqitbwWUg5av3p:8lglXbOOgDrJIvMiJiTOCiGl5
TLSH
T137C2AFE64BE980C1C3AEA2F3D4FE1A4EAD28E91739E1E4FD3180314E657D126198DD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000011.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000011.ldb
Size 12KB
SHA256 57611f33de1610b144f1499731da082ec0d3d6f5923529dfac0015cbc460f2c9
MD5 6dd50ed435464527ae0f5a7fe255384d
SHA1 d32c4ba6bfa2393567669e582317b55c06182b0e
SHA512 fd48cbbfffe4a8a726b0d542753cc8ccfc8055545c09c2c49e753e7e41025f17818eec35cc2042ebbea2a7586c315e233ef631ff1ea1f658ad9fc0dfc026fb1f
SSDEEP 192:hveLxgqKw+XyVSKvs1qUbmqeEF9HFWqKw+pVmTeqUgQqqbW3B:ALWfdyIK/UfeM9H8bP+Ug5aWx
TLSH
T117527D768BED14D5CB2EE3F7A0BD0A4E6E20AD2124D2E8FD3084320D95571A1365AD3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 fbffb65a0dfb00b639620a8f6a7be929ff9f41e875af62223fc52862f5c1ea93
MD5 117976f0c5f7700747706175bd7ad617
SHA1 cc19e4f69529f4c0765a5a6b2f05df3dcdd8632e
SHA512 2b67a95b3735d169cd0364a2969acc042b53f81f3989b1fbfe295c3ae242de13401470935b8f67bfb98110a41898ec020262e2318fd8a0e9386db18f8af89a74
TLSH
T1F7E0C02885C8C25F912026EB1530BF0EE59B610EE7CCFE560F0ADC2075460C8F07D170
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 b7e662bbe0e9d2041763af01ffe355626f11811d1ad1f300aa62252c4aaaf173
MD5 15aeae20951b85b50a3af23ee9030e7a
SHA1 a198b2af3015c06ca22f8ba3002221f6d01eeaea
SHA512 03b0fc9ef4b49c9481fc27b9402d1e479858cf849ade83b3fe264bf185d93cf80ef9f8361af4711bc13cbf0a774da6c8531f0f090b57697295840c91b38c5550
SSDEEP 384:D9pHzfYUCSHEsIZueRfmWmyWjaSW5QJrXvBPIYUiiusknITUGAPmHr2rM5nfU9Gp:TN1PC
TLSH
T18A4290E7C7E8863EDC1126F4A7293E2EDE190D6493183D6BC9E5AF1B53E5431E20054E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 fb0393aa39d3c18fbdedf4e0068179679938e16a34b21ffae1a1db2f9ac90b8c
MD5 408d948bbb561edd3b542deab1b05a13
SHA1 2e0144a3fce187d044b0935652a869b3cc777b88
SHA512 b9bd71d3ee77c3ca0a0483385f317fb1d9a62d2dfe9e88014f3c4a25eaf2523ab1449379216c2bb42b7e75682f80d62704e928ed59f4266892ad1412776f6939
SSDEEP 96:DOOgFzaJmyBWMSaSW5h6JrXKEBzPIYUiiusewoUmmpp:D9gFOJmyWjaSW5h6JrXvBPIYUiiusee/
TLSH
T10DC15BB7C7E89A3E9C2151F57B262F2ECE190924922C3D5B89E89F1F93E1461E10194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 94355b735683b789915e772d17ed8759faf52f43e20a1af0633b06d38d4802b1
MD5 827684cf930b8e62a7896f7a5e88b506
SHA1 fcb36d5cf4103415a051b02a36302df3975d0c16
SHA512 2e9ae065cea696ed96abfb4275b01829ba2b133f16d092fb77c690486bad06724bd13b4e71385aa3fafb7e1729ec6721091adf193979984a8d8f4742c0697131
TLSH
T1B3219B9785BEA42750380A7F1E45388D1A7BA4351693B8F9DEDB913CB0C1CF71B118A5
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3294c5ea2d34b8f67e984e3d52a1c7c6b836a9d632c5a4ddf9eec865fd848c96
MD5 b85f831c04a56c152dac0f05e34ae62e
SHA1 c9d2b3401192ebf8f768ee34037a697a80cbb02a
SHA512 da8ff269bdf375efb8cd3866efee03afb7dbd165a28df41ce2153ffaa1588529c8a24e36496d0233fd65f362ea1381ec6a8cbd1c6e5f03a95e7485563addddc0
SSDEEP 192:sxZIOVrRL7yM/jK1Ml8c2jb0/f7RsGWpV8VKzIpYL6Edp8IOHW6+WN+I1I7f/eIK:sxZV3UY/fNsGWv8VKzjuHbY/ewrkyO+O
TLSH
T1CB62B617AA34597B8CDAD219F555BB13D6F60836E2900F44AAFCCE1C05E6AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f04af28ffb1c5052f44c86b6d27783427727d3ef93e1976e2fc5d69cda892948
MD5 c8626fe5f694f999c01d87848ea8ce5d
SHA1 ce1021757a9cc5801956eca933892ca7a59ecef6
SHA512 d1f99a0f0fdf634cf5a766009aca2a82094218cf44ba0f0d98abfdb0b9d57aeee8fb0d999b69c68b6fbc1411c9a817ac67bd2f1178b22c62efe55eef1beba8d5
SSDEEP 384:sxZLWUY/fNskCWvCKzjnJHbYW/prrktOYO:sD9Y/frCYCKzTJHb/td5
TLSH
T1FE72B657A5344D7B8DDAD219F550BB27D6F60836D2940F85AAFCCE0C01E6AEC2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 4a7245886ca3d12b62aca461a079504c593994e772170feea0c40b9b798d405f
MD5 cfa0ae5b5636ef64da20daffabef0791
SHA1 c1c35bdf8bb77aa27a62b28a833e837edf64fe76
SHA512 5778184ed0b52cc4e1624e44cfaa0ea9c3ec74486b31383d9b4800a0cff768dff047befd6a7c4131f246f3a07af38523c4a58aa1b3a5c99c9de12ef9c87f0734
SSDEEP 384:sxZLWXY/fNs4CWvCKz2sPxnJHbbW/prrkoI1J:sDaY/fbCYCKz2slJHbwtYP
TLSH
T15382B557A5344D7B8DDAD219F550FB27D2F6082AD2D40F85AAFC8E0C01E6AEC6203C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6609d172745b2aab3fbc1eb0bda9b4ef4ec04b42424ee15f82f6030bdb343d8a
MD5 66be86edda39c9a80f1285ceddb2a508
SHA1 58adfad8bf678ab41d50399a6d39d6160ff333bc
SHA512 7d43e38f861b516d14090f861bac8dae23b9c6074f380c40a647662f0d12983888335fb42803106fbe5fdf851cd4fa68a7dc3ad6681f56463e6f5e5046667e22
SSDEEP 768:OjgL66eWviSZq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6JLlZzaRYroWZaTccG08:OjgL66eWviSZqu1japJL7+RjWhcGT
TLSH
T167E20A3B680CCB7E4F840E5CED26AF976DD801CB6B984D9447FA494C03C77EA512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\272d0771-d16d-4510-926f-5ddbeef70ef4\index-dir\the-real-index
Size 2KB
SHA256 1eed82da8816d4084d4c1fee52c310d9d6483c928b166056657f6ac5fdd57f94
MD5 bc5486561acbbed3c0ec1f97a97c424b
SHA1 caf817e76d0495fcfe781810878106d8bca00708
SHA512 9791970b535b16da4d8269512626ecf7b5e7a2bea40646eb3d0f0115ded8740c0a86ed9b86d0dfb7d1d8f8c0ea2c8b8ce2db015bc75bbf4a2c06b235087e0e56
TLSH
T12351650CCD9067ADD87561FD1DA415F297752C38FC59C29181A4B2B17013A681B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\272d0771-d16d-4510-926f-5ddbeef70ef4\index-dir\the-real-index
Size 2KB
SHA256 f663db0dbdccd99784e1574fa1e3a5cab57dd6de860c3ff328cf02f48d33c2be
MD5 b5c18144e2094f3a29d106d615ba95d8
SHA1 53a50ae228f1b97704b183ea33a95f079d42a686
SHA512 1fcaacf6cc387ed16468d2502609cd6fc6bfe54194ab6a691d0d13e2abe680006cd756a7b4748f145125c66c355e940e34cab2c6b42b05f41a8e8cda5976c4ac
TLSH
T10B51650CCD80AB9DE87561FD299415F293762C38FC59C2A28594F2B63013A685B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5de5cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\272d0771-d16d-4510-926f-5ddbeef70ef4\index-dir\the-real-index~RFe5de5cf.TMP
Size 48B
SHA256 4c1d15ab3d479ba2b95f702841764137dbe1ec9310c3626963961c3b67d784c6
MD5 f06ad64801fc2b6350a779f2f4187aea
SHA1 be8d8257b84e99bbc9624f980e19d6c33a037e3c
SHA512 4160f525d57e6094f7155eba7957c3cca32dae1ea64f8c80f22f26881224d03fbcca6fe43cfdc934a1c47176bc5a3112e1adf3af1080be3aea02a3484ed624e1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\906d6db5-9d6f-4547-93b9-2c9b61a6918e\index-dir\the-real-index
Size 576B
SHA256 209da9ccdccdfe42a53e6a7a7ca6c68571a559b70a7fa0af8e33bb1861b7181b
MD5 c029725cd84a32fdc5ab23487a31b54a
SHA1 506b4a055bfea5585a5ae2fb908e033f6442118b
SHA512 2b29a460f6239379ff81df57e828600045a7560eb5720943ee0ad89697eaa40628eeaa75171f2f7ffca31fe4f8f8e622a87b74f9f9eb766ff6d695716f5b734f
TLSH
T1E1F0ABA039E745EAED8489FA012B163A5324E46A14595B4F81A9201CAE1F6070EA4114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e13b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\906d6db5-9d6f-4547-93b9-2c9b61a6918e\index-dir\the-real-index~RFe5e13b5.TMP
Size 48B
SHA256 a56a7b0d08f46fcceb58b2ba2558f0c70ba319183bacfad31946cbe86654a9bb
MD5 1483b9d7f17ba009bc2fc0964480ab51
SHA1 9ea4292b4d1f9d53411b7a90281a80e24a52e2d6
SHA512 6c6448e6e1821c951e4dd1657be157d0b37e58afdc47a4ec65dc2222d41717be5df47c40bf98a57515a359d9a3907d071456e6cc9f467c9b2bced9e5bbbe7f2b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 141d199e8d72e43904cfecd2dfafbcdfbd399e49c9520f1b346c823a8ba54424
MD5 254ad2a3360acd46bc2b48541c6fb585
SHA1 ee83f1472d57be629d46cfb676da791b05d8609f
SHA512 5e98160335a2909e1357776aa77d749bc3cbdafb195209f4541ea0f2bbc0f40b48c96e7b79a62632d9ce013cc7e38609a59edf0c641b8b2e6cfc577abdc04018
TLSH
T12ED023D7473544D72930DE655538A1DC441F4D4DDC9CCCE4480C70877078717C102775
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 58bfee56b23ce236d4df744b273a7b463dee7970455e4a5b4e161aaba62688e3
MD5 dc0372c4a85d84c00ad5b6b395bd7670
SHA1 77a64908fa89bcd3a6c44128aa5a0f3028f45ee8
SHA512 afe8a9df968a4d0167d71ff48c45c49746cef0db56a662d85e5c5f8a8130378e311ff06d337c8326c8003702fbf7d3bfdb2a652c647d859dd4189a6a78daaca9
TLSH
T173D022EA8B3084973E30EB886838618D452A8C89DE8CCCF48C00B05B71F871BC102B33
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 243B
SHA256 892b0219312a4415bfc5bed42b3ff951594778643c20cafb3883798a46f35783
MD5 69283f9362c1ef850fed5fa2c043f074
SHA1 8d88b41ec24011c0487912d30ed91e04a7d59c91
SHA512 1d9cc14c65d724445d4179e2a26b73c2184e7d21f4ed50215bb15d12db8d2cefc5bb341e2211f42248527e3ce389ffb363bb6ec57a1d12fe3347387041d697ee
TLSH
T130D0A7D32E6140871931EEE97734B69D850F9D8DCDDEDCA84B44714672B4A1FC026B24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 3e340511212cfcf580d8da7fe7f0fcdc2f47226f550435da458ac438d31cf030
MD5 5e1dd705685606378bebe8cf86d95bb2
SHA1 d5e3badbeb02fee696121533c4169a27358d40fb
SHA512 b3c4dd3101ed74e5b9a745f69efd287bf6454fc841d9268ed6876b0ec31b38cd20656923192ad6f712f40a3a61beceb7d10a8a87165d546e3d51045c14799e73
TLSH
T192C092E75A20859B1E31EEDD2438F75D9A1F868DCDDCCCF49508B04B6078B1B8402B76
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 9b05685efd0618a40b4531886f1be3f589aacb08e6f43a47baa375d9bed7bb08
MD5 8aa17755bd359249d26ca3f0411b8417
SHA1 64ca51fc70b525a4e1ccb7600aaade60a68ffaff
SHA512 f35adc6ea0417954a033d8700321eff6ad728229b90b536c70a84c257eb3035ab2373122e46e8250e65abbf32fe9454560b1502e8d871447519da2450cdaf7d3
TLSH
T147C09BE75A2045D71D31EADC6538B75D951F858DC9DCCCF4590470076264B2B8401735
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 8dd0472f85bcaf266581df0ab7bd6c8ea16af44d31d15479899f577bd9a794e1
MD5 38066071622e9df6c02b2d3838106650
SHA1 98d1d09eb6941e409c027f309d3bd8e5c0446342
SHA512 6a95ab7af16dc1a7aeb6aac19b69cb8e3efe9d2db831caa3313e2488cece905e449bf700bb59c3940d891795c984c694799d21dd5003b5e01664fcaef09226a1
TLSH
T12DD0A7D36F6140871931EEE83734B26D950F858DDCAEDCB44B44614571B0B1FD026B25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5dd96b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5dd96b.TMP
Size 137B
SHA256 04e08d2220f8980691b8ef8995090dfa087dcc9ed2f44dd5f7412b412a4db4ce
MD5 cacdc92da16e3ba7f646383b42683dea
SHA1 4ac9c8170ebd871471114dc19640cf0d3ae1c7e1
SHA512 851cdbb9eeb3e1162f9e783d585a198756ff7dfa733eef5bc34acdb7d50eba6ff7a49e997b811d46fdf95079ede9793bd962f1f07d2e2769c2725486fb877401
TLSH
T117C04CE6562045961E31A9895438A64D951A8D5DC9C8CCE4550970066074B1B8405625
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 4c75c1db89af7c7564229f44080efbf4b71f95b548e730654a1571934778805f
MD5 ccf6bd67d030149349af45a93536bc36
SHA1 6566dfb7528ff45bdc647c7df45c7b41a2c50f42
SHA512 192c0e4621600e2c1e208bf321dae9f89b81b7fb2a2f1c76f8c89c8dd1e32c970e74e54d6024af1d21915fb09a80e9a9210720ad45548af9af18a990ba52baca
TLSH
T11AB022C80CCC00A2CC3C233CC0820BCC33EFAC200A08008382FCC0B0803B220022B00E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e13a5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e13a5.TMP
Size 48B
SHA256 76c7cece727c6a40b38cb74f43ece150709b3b91fef13cc2e06ab2e55d760000
MD5 6c794d1fc1fbc133e193c559b0025fd0
SHA1 de503a2177fb46a7e8a366d0dc6a37eb4b938104
SHA512 95efc57420d59a04678c1ef5e3db584e4ca12b5f7651f09a056fa69d1d0d28e5a3b65d8c3e760d26c6b5f7e7b81b1deb39e2ed8ed33aeb7df8b0ccb7fe6b2cf9
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d2f6c8085bc7ae6d7f02a84f16706b5ac254afe7b6e1e84c6811268803edcfb9
MD5 fa04dd2237f7de001452581c690bbdbb
SHA1 ddc931333d22ac0605df43484a63c44c2a5d021f
SHA512 0e1290f1f6110bfbfe1174bfcd9a3c7d75fd04a0c76ec50400381017104ad0a43e31349177166e861321e721121ab8482dd7ada6fed580b267ef7e8fda11fd9d
SSDEEP 48:KsWT8Ae0k1VIRIIqo1K3E/u1r2lQ5YqIS6IfKnqs/yZMI/KF2c6GnimgYY+moxlT:KwX+KUsWqt6gKnqeKMQKF2KFSKGkig
TLSH
T16AC15411713F0242387D2808A6A2857B9E8231E77068E96F7BBD55B64E27E114FFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\faedf56b-7343-431e-b67d-fea3bf70b3de\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\faedf56b-7343-431e-b67d-fea3bf70b3de\index-dir\the-real-index
Size 72B
SHA256 f1506af06def7b3c77c83d3b6b5da8a023f875d199faa4a9de8ecf596c828e74
MD5 849d447e5bdb2c9f02891d64f17b7eaf
SHA1 c9cfad774c71c65c2c995cd8264d7d0859ec9a9b
SHA512 dce7581cd9e26b5155e7a0c4553d6149f34aae6520a01bd1201ead010c54fc4b67082c06786fa6b70d68630deb8d410a17303522f1fc3efd780b8884fcd4b54b
TLSH
T125A0022981500240D84011B15497417172625960E814C742D0D13584C8D11D9525727C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b466c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\faedf56b-7343-431e-b67d-fea3bf70b3de\index-dir\the-real-index~RFe5b466c.TMP
Size 48B
SHA256 7e499dff519a051e9922049067101f43c433aa2b9fd6365ff1f26e64f44d14b6
MD5 1d60fd831dbea81cf39345db9e1666f5
SHA1 e2df74cc23480e96e4491ad97426b87e8e2af500
SHA512 77884f9f956a6db0a74d4fcf041612c74bdff40fd24113c2f1bfc30a1f5b630819f9d86b700f9de2f1dd811278f9e50962cdc9d9c7c86457719e12bedf3dd57d
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 78B
SHA256 080d17539c27324fd9503d697263005cd80fd17404c381fe79f773fbc0d2b054
MD5 3991376ee64078ce45f95ba541464ea7
SHA1 758c01a3968fb4f647b546409c70fcadcec16ff7
SHA512 e9c67559b5941ce6a93dae7d41f6b1a90168c800a0e759d349e75deddabbe9078facbd9b2fd3bd8da36f540c51daeb8304a7f4cb2c014542b75b127f130252bc
TLSH
T168A001B7080591AE6B70A8E83039B31DE04B868D9CC4CDF0850884422228A720013C64
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 159B
SHA256 1e9210c9b7159916c2b9aef81627fbc1b886266f4cc623a35d57c0c75d4653a3
MD5 f11e95fd7d0054e5a4e0558a4bf3a00f
SHA1 4e4a2d250839ab6149f4a0123c5ac127d7b488aa
SHA512 015f4eee1e579f3b25cbe1b589ba60973e4a9282a46f5e28b3a46d93e3a4d74fbe80fce8fcd23bd7d8e07bbbb867cd85ad3f69b4de181c4dea2aaa9dfd9167e1
TLSH
T12AC08CA70835158A873069E83124734EC10B8E0C4CC8CCE49906B0052278E274907A28
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 153B
SHA256 66129f09bd1074d23165a64f28af16809cd1b7f2d9e43b842fa893a42ca21a6e
MD5 ac9fbb1048fa8d2fb82eb56780fc5d5a
SHA1 c6e50f9820122f782303705f6f2d52eebefd43bf
SHA512 546bbaaf522be697a9d2f80042e0c3751cb9fb3ffe1b620cbac619fc75f15fd82106b4cc2b59ba82bae50f965883164d32ba4018637be758e1520a49c099c83c
TLSH
T1CEC02BE70835559E8F30AEEC3128738EC107834C4CC8CCE88905800522B8F270C03F38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5b3b60.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5b3b60.TMP
Size 162B
SHA256 f29b79dee264ca4dae3b588d2fd335f755d5a50e52dcbcae1b34a7ef168dbef9
MD5 8340b24106e1a64173c468875e227af1
SHA1 3c95d228ab75d6f7748affb7d008a4a8d2140d94
SHA512 06ced41dc2a4cb89dec6644438552aa61f902c838a537f5521a43c159ae652a16d10a646ae996c0b04417e34e064419f0555f472cc6914957881cfe7a0ab6cd8
TLSH
T1C5C08CE74576659A6B30E8E56238330CD0039C49ACD4CEF98802B4D131B8E22910BC28
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

ca8ab228-bf5a-4959-9ced-da03693cb8ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ca8ab228-bf5a-4959-9ced-da03693cb8ce.tmp
Size 414B
SHA256 e3e9d5b30e316b0182c0f73c17997883f0991458d143517a893917d87e9851a2
MD5 2b24899d9ac81986a02b0b7f54b0a23d
SHA1 efddabb496b1823919276e023eb316d1ac181af6
SHA512 6a737ea63e60bb5caa56afefffd0896ffa8d74d1ad0cfc7e753cdcf7a116df2dd1e2cc52eb9009936490e5ce54e371c9a22065ac12a077253667cece0376e269
TLSH
T1FEE02BFAC950DC2718FC5B2D50650785E640132B5790498F3E3DC70C4FF8576064581C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a1ebf728234ad5fd4ed494d73981d042ea5a0bb66456fe44b40ad5067e129d4c
MD5 2fd09f9f23097c3492ecbf27a34a82c8
SHA1 c4ffb440a03d005882f6f695b8b80d78e4ba0081
SHA512 167a0789688928fe9862e74528bd7b07755b0d6e10bfff114a35c1232bdedd3a516029612fe52b52372fd46add5fc176faf22d950a7d347c9e965d0ed1eec6c5
SSDEEP 192:YONR6LCWtDQmiUyIEI5ILSuOCzd82+jsEJQ6nU6:YONR6mg1PImuO8r+N6IU6
TLSH
T11C02E93AA82C6C779EF27E45B5873B276FA51037E9902F54DAE82F0C05D764C2306D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7eaa032ed131bcf85277b99a1d376996073545f432b211b7d86e79b1d1b89423
MD5 4f361682fc883d6235d06f5b68fd61ff
SHA1 f62e8d76b8b0d533cfe67049a4d455440144c0d4
SHA512 1763a01480f6bd7dced0ad69c387c3285f3ab49ae9b0c727cc85111070a40083de3d3a2010deea64ebb4765c59378f5bf9e417b73bd93deded9cd6eb474ae6b3
SSDEEP 384:n9tNn/s3n9SfsNxkziyfPg8Lej9uO8r+SY9XYoOeQOObjI9G6w7k4HA/7IzB:9j+9UlixnUTYhWeQ29MkY
TLSH
T1E2928D3A6C199DB34DE76586F69B3A6B6FF41037CA801F44D5E86F0D05C729C230791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 18f439dd54767d63137d3ed86ad39233f4b90d2f2394fdf4c517956932930e7b
MD5 3c4886aae1b160e5a6d50b8a46cdcfca
SHA1 0d95c4739d2343fbb15059f92c48eb29dfbbc742
SHA512 bc60fac7816846c8d679491db38ac03c9f125932aeb16c234228c548404f4e0f2d5771652dc418e962999060b52ee1453551ae5c386fb3f8ec4c042bf50e616d
SSDEEP 384:nQtNn/s3n9SfsNvkziyfPg8A6j9uO8r+SY9XYoOi7JNf4TCukIWUOObjI9G6w7kd:Qj+9ULJxnUTYhWi3f4TCxU29Mkd
TLSH
T1F6C26C3E9C144C3F489E7B49718E393B4EB8413BD6B41A58E7C81B0DC6BA59CF342A19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5c314a5ed587306e1e67bb82e9b56fc36cc1c6f33fcee40dd9ac709e142755f3
MD5 862f3c84171e301644b886bd5e72f7cb
SHA1 60159ec0bdcb3432f470cd28c21b6e1b3cf48579
SHA512 6b8fc66d220a2f6db7dfddbac26eafb7a8bf8e57e42dfad3254e860990bd3999aee3ecb2efb44d65a6dbaff4044a7dd761674757962c0c834da7c7504bffafbb
SSDEEP 384:nttNn/s3n9SZsNxkLiyfPg8rIj9uO8r+SY9XYoOe1t38jYlKRIx+lMUOObjI9G6g:tj+9C1cxnUTYhWe78wKRkZU29MkY
TLSH
T15AC25B7D9C155C3F48EE7749BB4E293A2EA9013BC6F01A48D3E51B0EC2B658CF342516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2ccbe2cb131c0d1bb104993f85a92204234ebb587aa6b454061f2aed1ff9c08f
MD5 5a9af42fa58d7110b2478d99bf58e1c9
SHA1 c4ac19ffb6efe90f71438ee17de3cf696f8ec1ec
SHA512 6e9952390944e4181e247f04b552b81870002b498a694c0de76d8267664eb76bb25afd50d27867449f5f46c83f7efb65e8fff259b4acc142e0df902f0b40976c
SSDEEP 384:n9tNn/s3n9SZsNxkLiyfPg8LIj9uO8r+SY9XYoOeQOObjI9G6w7k4HA/7IzB:9j+9C1sxnUTYhWeQ29MkY
TLSH
T10CA28D3A6C199DB38DE76586F69B3A576FF4103BCAC01F44D5E86F0E05C629C230791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c221ae115ab2906b6a4b6889fba3a101cb48726befd4d3ad4017346423b255cc
MD5 720d6138636faaf5cea4d6156fa887b1
SHA1 b276b3c5fb406e6adf9afa7f341833be3dc2f971
SHA512 f598c1865e03eafa1ce50c8a65fc244d8bc13263c2ec5a24f63de58b3c5a0c9509e22e72b1bf5cb93eddb2fd0fd50d0cda17a5d7f048087cc7e300f4597a256f
SSDEEP 192:eGONSj6LCWt6WQmiUyIXI5emLSuOCzd82+SY9M8PwoOjI/JEqQU6:FONi6mgXsxmuO8r+SY9XYoOq0U6
TLSH
T177121B37A828AC675EE27981B48736175FA44137EA843F54DADC2F0C06EF68C230AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0c86b8b92499f2f05456fc8c31fa053c063cd48212005da135161dcc1fa13589
MD5 a350248888fca1f021f478e3580e58a9
SHA1 f84471599a96cec422ccbec0cad9dff0326fddb5
SHA512 86ecd25522f1c2cc06b1b6c71c9e771c7b78a96b73ca2421e054259a3f2c2e1154a85fce4f6e711e496a40cfbe94998f135d957ef1fdf108744d5daea8200846
SSDEEP 384:nttNn/s3n9SC3sNxkLiyfPg8rIj9uO8r+SY9XYoOe1t38jYlKRIx+lMUOObjI9Gn:tj+9v31cxnUTYhWe78wKRkZU29MkY
TLSH
T18AC25B7D9C155C3F48EE7749B74E293A2EA9013BC6F01A48E3E51B0EC2B658CF346516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9bf6280e-2453-4406-8ca2-3acb125dde85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9bf6280e-2453-4406-8ca2-3acb125dde85.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f9642bdd48462f2df6e346d50c71424b72de0000c699f72516b04a59d975aa30
MD5 c083d2164b7af9ae886f4008fee73a95
SHA1 b1523947cbb78b211735f1a5c560b7ee87b8b25e
SHA512 7bc01738e0b715fd021a6b286f9ee00c8b3a049e814e21d9dd0b47f3487ca1c14c1ca87c47296eed1697dcd5c17ba67e083414966d7c4cc1ffba4fb863abcf6f
TLSH
T14741099CA6EA1149B7776F5A9BF6A86D487FB9673E0BD09D10110E4F0762A00C861733
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d952c495249dbd5dfc6eb26d0531229f79540f497156fc1dcbeb42d237718640
MD5 e54e9ff89bab43ab28b0ed9a33bac1e5
SHA1 99e899224c90d045ba6ba1fd818f332e11f54a6d
SHA512 277892c92504083531c7fe7c9cb823e3cdc8e9a51bb248c54fca0de2fc0d052809da4864b8989d54ab99ea76b3d28630463d1f156bedee50ed1f1d61ad97629f
TLSH
T171115723B79CC961CC89453B409D9D6175B6D7C7819EDE9F6FC4C209A07F598CB211A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ea593d0711e98aade96282090be0c35adf5eb8ce7df3a024437b267754e5cce2
MD5 5f7c09c72ba5740197b14d6b3e536a5d
SHA1 10e0cb277ab2d946e58fdecc831adb5dcbc144dc
SHA512 1160f3c8aaf774b4902888c30f55079a4aac0b64e59243456ccd53459019bc5047cdac3750bbf90651da42efa4e061e74e8ab6b168f3af9304cd0169905172d0
TLSH
T18C115723B79CC9A1CC85553B409D9D6175B6D7C7809EDEDB2FC4C208E06F598CB211A0
MD5 SHA1 SHA512 TLSH

Submit Download

3afa5d91-6567-4951-a97b-9bf7916a6924.tmp

Path C:\Users\Admin\AppData\Local\Temp\3afa5d91-6567-4951-a97b-9bf7916a6924.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55882\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
Size 211KB
SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
MD5 2ff9d894ba5e8f7880f0031866203995
SHA1 dd594003fb744f4b2b944e1b10b78a7026e72104
SHA512 461ad7a749cc6131a77883de4108f20922d85618030f5f640da22e95df7db61fe358790e955204bd71efc873b726c130d71f9fb5193e91ec82718d8d19b43a1b
SSDEEP 6144:B8O7Q321soEr5HXN1GY8DNExkP8VXaVHaT8fyFmiGJZMzIfAf1+mrlpL:BT7Q3ZH98LnYlpL
TLSH
T15324173951580061ECB74275CD67E453EAB2F222473192CF09E0CA761F2B7E5BE79B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI55882\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55882\_bz2.pyd
Size 85KB
SHA256 a4be36fffeefa8b24c1234d548da8f05558aba53c2ea7d1d2614776eaad8fbf4
MD5 a0946ac3236b70d27de6046ccc467977
SHA1 84f2aa56e58849cf30e632e7eaab4901a681f08c
SHA512 02429781f017b534918657e5c152ea022b52bcddd15ecca7f8b4629940dd4367a09af4d86a1f05d946ca97f2709718b136003693088c480d9b791e4d18361174
SSDEEP 1536:vZAVNz7DkEvkmFfR/l/kM4KPkM/gg8IWRbG3II13VAyvcvR9qfIk2:vGVNzUERn9R4KRg7NlSII13Vk
TLSH
T1A2838E96F3B552B6F59B91B886840793F730BB860750A3AFF14882853F13BD06E5C369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55882\_ctypes.pyd
Size 139KB
SHA256 f8a9f7831e81b2bfba12456e589f8198114f24986bd527ac231a844565afcddb
MD5 03fb3055ed0c56155bbf030596726e03
SHA1 fba03bbf844c08ccf20854d717a84fa62ab291fd
SHA512 9ba8f50f75b37858b3d81d6f7323ae981ae21f57a9897955142bc53098ad74c8ae119e61ccd0bb5cd0071e092e8c2bbb5c146688e29f2cf7d1d3740f47ec9117
SSDEEP 3072:HDpx2Lp7KRmFrkdOJWWcovIMzTF4FyxpEI1GPny:jpxCdK8r8WDvIMn+8xpx
TLSH
T160D37E4B736841A6DA678138C6739E47EBB1F452261087CF4264C99B1F633A2AF3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55882\_lzma.pyd
Size 157KB
SHA256 f7ad11fbbb7aeaf7b6566a532a3243e3ae5f92bac480dbe5c2ef300fe2c1dabe
MD5 1dfaf924b4576f551f6dfe3cae50b230
SHA1 ef19846989f337e600c8f9ccacbd4276cc4d35f0
SHA512 2df6a600ecd03de76f066f87a8dd13bf138a51f89fe745813d7a00418fb716c670cb04a9b5573d2b852fc8885acac8b960ba4c42d38fcb7e9a1d2aa2e84f90a9
SSDEEP 3072:z+0m6DKDYtwipfxAbDcoAL+Uznfx9mNoV+dREOII1I1+ZgTT:iTCKDYvNoopYOyGOjeT
TLSH
T182F34C86B794F0D6F3628C78D6618F53E7F5781A0320929A01CC976D2B1FB759A2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55882\_zstd.pyd
Size 491KB
SHA256 536a3b521a3c42d2827ece0ccfbe40b83a2fd96a0f5496cd60b943b10e1266d4
MD5 b89f5d1345ef95f80ddcbe5b3e4e5bb3
SHA1 2daee236009cc3efe02dc9bbbd8c6faa8ac56478
SHA512 fc925424ad4bd8bdfae04b95fdadfcdbffcac76270997b4ce365be8a47d4c636b7e0b31e78d785a3dc6c9b2dd0f108aa716a92ee4f0506f3a0329e4a424b48e9
SSDEEP 12288:X/WcJlzAwk9mH+65GRRfODoHWDTrWl93mFgR:X/WcJywk9mH+KGRRf2o2YR
TLSH
T1A5B48D43F29983EDE17BC4B8CF465A53FBB1780B1214565B93A5CB943F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI55882\base_library.zip
Size 1.3MB
SHA256 1a963cd6794f965ca807d3adfb9deace89693b5439db42ae8263b4f0ee7bf3ed
MD5 6edac859612411b55866c63acf6186ed
SHA1 825e0d974c7290a40cb59a4b43d79c12dc1e46ed
SHA512 5459ceda1274df3f21974b1c500448dffdce7fc139e6705d5950ff4041b10c25e5bc9bea8355c9a764c4c6f3e07760c4c29ae5ced25f53acc22138938e1ec4f8
SSDEEP 24576:bRp0LH4QeOdP2m2dflO6uUFNj3slbNjdSN:bRw4/5uUF536d6
TLSH
T107552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

game_icon.ico

Path C:\Users\Admin\AppData\Local\Temp\_MEI55882\game_icon.ico
Size 388KB
SHA256 49b2e98cc5c56c133a25536345242fdc3f1c59fba6ddbf5d983c881e7731aa3f
MD5 040558a276a46b28bce9c6d115090f12
SHA1 8a9f3b2dc35a3436bfac13e4c94011daee1cab11
SHA512 e232c1abde632d05281968c42a09eaa8f7c8ce54762ed1af925a31ec0c8230e3d4bbe274c063aeeac473aed39cbac868ec1420566788559f923d5e1068ceaac6
SSDEEP 6144:JhhtIdh6j2/OEDgZjmhz34zVIiQ29ksIsD0oUC7+gnmO1wmm3uqpzDtSUl0BXcq:wdhLOWgs3cy2yk5KgmcnYuqhsUlac
TLSH
T1F98449A228D48A57CB1E4C75642744ED00E3BFA6F9C998429DFF7ACA6D356C461333B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI55882\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI55882\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI55882\python314.dll
Size 6.4MB
SHA256 1ac15e2224581fc678bbd17728b9aa538d47b891b72c76499ef07e54cd74f151
MD5 5bc0adc1fed509f353832bde6b2add62
SHA1 b2204b0bc93877fcd186d72fbe5006130aa0fb88
SHA512 7b1e52aff81e5e79872d9a22c0218dd8fc46e99cb33adb69d277ea07b21eee0399f0a6a72d190b91f26a96e69aa63a23a06384b9d93db44355f3eb1d7f727650
SSDEEP 98304:YvvKimE4QWS5v+kr/YFboltx9E8rDvQHDMiE2hx0S:qdcQWS5v+kLMolGmidx0S
TLSH
T107668D26737505A5D8BB8076C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_uj0b3hir.1sb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uj0b3hir.1sb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

e21528aa-c0c2-4289-bd22-8489bad5e950.tmp

Path C:\Users\Admin\AppData\Local\Temp\e21528aa-c0c2-4289-bd22-8489bad5e950.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb135ca4-8658-4c44-adca-6461e19cf4d9.tmp

Path C:\Users\Admin\AppData\Local\Temp\eb135ca4-8658-4c44-adca-6461e19cf4d9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\LICENSES.chromium.html
Size 9.0MB
SHA256 dc2878d9bf6ef5fca45737536272a7a1877e0c6f89cb9578cb0f956781102986
MD5 11ee9d008e924e19b33e0b45fdf145df
SHA1 140773241b15513e9d7a7aff4d1c1d8f7e0b7e41
SHA512 4acd065ffee81972fb1cfbe11507aab75c883aa94e359f3c455f87813925bb2d3416ce440561b430d6dedcc2f566d5cb74de139e181da68507ad36e69a672662
SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmf36k6T6W6r656+eGj/dBIp+:oABeGLp
TLSH
T15796A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\chrome_100_percent.pak
Size 148KB
SHA256 7dd5485def22a53c0635efdf8ae900f147ec8c8a22b9ed71c24668075dd605d3
MD5 cb4f128469cd84711ed1c9c02212c7a8
SHA1 8ae60303be80b74163d5c4132de4a465a1eafc52
SHA512 0f0febe4ee321eb09d6a841fe3460d1f5b657b449058653111e7d0f7a9f36620b3d30369e367235948529409a6ce0ce625aede0c61b60926dec4d2c308306277
SSDEEP 3072:iz8JCGIdkwTPaNkx0auKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:iz81Idk8aqT5K18Gb0OV8ld0GecQ3Er2
TLSH
T1ADE3D0E773F4ED7DCAA756F7621600B1EDF3462D0691024A168ED8363A66B48DCC8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\chrome_200_percent.pak
Size 223KB
SHA256 2408969599d3953aae2fb36008e4d0711e30d0bc86fb4d03f8b0577d43c649fa
MD5 e9c1423fe5d139a4c88ba8b107573536
SHA1 46d3efe892044761f19844c4c4b8f9576f9ca43e
SHA512 abf8d4341c6de9c722168d0a9cf7d9bac5f491e1c9bedfe10b69096dcc2ef2cd08ff4d0e7c9b499c9d1f45fdb053eafc31add39d13c8287760f9304af0727bf4
SSDEEP 6144:3DQYajN6svyABnI86fTugx5GMRejnbdZnVE6YoppO4:cfjN6svyABOa6edhVELoXO4
TLSH
T1F124F1DB63F89D7DC9634AB3662601F1ECB2113955B6420B03DFEC357A95B8988C9383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\ffmpeg.dll
Size 2.6MB
SHA256 113ccc8e701157d0d59283baa5dc1fd3b0eae2571fd825084d7a4d58697a5ec2
MD5 64f3f2ae25b14f5d2d168ba6aae49ab6
SHA1 f43554aeb7a1b20b6e9dcbe5408cc004eb7db27a
SHA512 3ffb531da6ef1955f7b71c5f6e9e3322dafce78735aaf9b245c46bd5ccfa8a6a4b282b31b3aacb4e3b423412b9ab89f792ce37f3a9e6eb83983adfe7df38bfcf
SSDEEP 49152:R1nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYF:RJsf83Sn6Ox+tP5F
TLSH
T1F6C5AE12F6D640DDD02DC074879F9623F63038468B24AAEF16909A243F6BFD42E7E765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\libEGL.dll
Size 470KB
SHA256 01b8a8c2875ecb9979de339500ce0e0b7ecc3c5387053ce27bea51e6a09e2d72
MD5 b12e3c1e72935273492da1daee50eef1
SHA1 3f93237b71ee1328cf25f8223e685de97d01d773
SHA512 12346000331cde78ea08e9c0fef4635c77f6e85fb0e46706bbec1f23b0d7a7ef99e3930475324306ab4a46587d382ee3beb18d703e2765a8c1b7ece144c57983
SSDEEP 6144:Omi12qlTgeUDsnkcM2nDl83BgENhYCqNSfY24M:Omk2qxgeUDsNnDcgENhYRNSfU
TLSH
T1F4A48E1577E444A9E02BD134CA574642EA76B4820F65FBDF02A493392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\libGLESv2.dll
Size 7.7MB
SHA256 fb6ea924fbb9417e4695ce414cdcbc299f13451dbedd2d9adb55479bf1cbf57f
MD5 5082e41d7a57506fe6b4bd58f87276b4
SHA1 2842372c18f49c0e1fd8123891be8587cbf13146
SHA512 9e10d0d3269939f9a497f0b0937f0aeb9ec44627d5349cee589b676aaf95dde11c996e2eda158cf8e79778cfd948b10cb61538c9cc056f7b899a057e7e959f76
SSDEEP 98304:DPqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O:DP4m8TDyluKGugmO
TLSH
T1E5868B03F69680D9C04DD2B5975B9227FA35B8840B34B6CF265423253F77BE0AB7AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\af.pak
Size 494KB
SHA256 e2470090a09ca500679e68bb5e3b1acc35a5873fea4f93af25a23c82122f2c13
MD5 e48860fe82ef022ffab38cbc4c96dffc
SHA1 a832fa66bfddabf3ae7f219cf379f66d2903162a
SHA512 e4d0973ca7e59091c482d2acc384aa48ec87d3ce72d8d42a03a183b230fd209e085a4e907473a05d02d41e15ebc527df942774c23b4804c150367fcd727af7b1
SSDEEP 12288:VoFfnK2L9o38a6qyC/GT3q+62+H2JynwaD4IJzio0vpI5gJ2aU+tBHr+21s9YqpQ:VoZK2L9osa6qV/Sa+62+H2JynwaD4IJS
TLSH
T124B41B06EB84273D09E07696FA0845B7FB9CA26CD770B2B6DD9D82360962EFC017D1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\am.pak
Size 800KB
SHA256 4e15946e86a578eeff41feda808bb291d81e240fbdfc96cbe2efe692ad35eef5
MD5 d6e8c344b2b40a9c671304f6f252d51b
SHA1 c59ddcaad921b6d2d3f70b7ab07026c35e5d1e08
SHA512 018ce2bf4beb4ce066703b2ac7413c6517759be68f889f27990de5d6694e9f84b4027f9861901ea4b15abdd1bb570e5a16651c935713feafc4d16cd57be0b911
SSDEEP 24576:bSTZhZyOqxlXGaj+WRezan5zYgMBgVTq+XG/6uUqPZx:bx52
TLSH
T1D005BA547EF9F7570F8E8A19A4310E4EA594AD4652803C38C35AE3FC2B2DF1B4DDA219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\ar.pak
Size 874KB
SHA256 5cc02570e5f61cbca791309985df3a29584e41583b3344f1d9fb6b04ce423e6f
MD5 f6ca56d15814dd5afd5e7ff985257880
SHA1 ef236d7027cb50a188c1e771527e6628702311ea
SHA512 46c0436c110d6f1a8f3ebe962226c51af525228262cd56744e4d89aeb05d1eda614801a294bbfd2e08598e355750d7a2d200b3e7b594da03dd26ece4cdd31e3d
SSDEEP 12288:Fs7XCdUBjhU/l/RBcEX4YvPU5pbRkSO5QNpJQKDBAGd:MXtG55mQY
TLSH
T18C157AE21B2984720B96DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\bg.pak
Size 913KB
SHA256 97ef7984074775282b68dca5d5a469efdb2b22474ee6669fdfb5197d3f1b3768
MD5 e6608ecc589e87a6f78f9ce553ec2609
SHA1 9fdb2ff6291549df773ba243b3a92b984b15bdf6
SHA512 25450b23acc962be85977ef08be9b484c2a9127775039c521158c1801cd57d5781bcd8d5b8784f8a8b9403ce44b59964a20dbe36ce181f1d239143b22b53d5e2
SSDEEP 24576:7wCIvq65SLYazQkEC/UTVbOVHv373ZfM3aAKZyVDuZWlumpfd2yo5ybXFRoZQ8Eu:7wCIvq65SLYn+UTVbOVHv373ZE3adyVM
TLSH
T1111524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\bn.pak
Size 1.1MB
SHA256 1aba82aee8c985e5e370e7cf2b35c9ec20cbe5174db5fcb54ec7d19ec5d79587
MD5 57eab375114893a5ed0de36a516e8252
SHA1 16f23ab3eb62bc7a2525a7a5d86139fa88670b89
SHA512 895bc282484ed028f5f023cbbb6e2755091f036e540c531b6ff639cf9e0ae5da02801dc81d7910eb141edd5c255d8b088d1abb531b152fbb161d6c2bf9615f4f
SSDEEP 3072:8JwgtHnTLCGplsOmf9MCxQ6v2cq/jOxdCfYa6CHXk1cJrWBbY0QH5qYsqvA1:8SuHzsOmlMCxQG8HXycJrWBbs5Iqm
TLSH
T10245DE209C6E91B2A8C5CDC9434C6370C5236E9B9B61F74DDC17A25938ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\ca.pak
Size 556KB
SHA256 b3d5dfae25427596b1f14a8e13d6bcb58532c82554229c2367779ff5c42b28bb
MD5 7474c8e0c3285b97f1f12792964b6824
SHA1 8b9381be0754fc3df2f4f13f8575bd4abab90e9d
SHA512 4ad524fd530bfc72d72edf04ba4890e06ca0a20cc1d5c2c3d95cda746b1d884a62ec2d4463ad7be9cd01c7529b41bef65f9e669c62719808a83d3c70f9475d43
SSDEEP 12288:yMio0be7tREIDFCieke3Rj5PqF4N3Mw2juwHzejm0t3lvyb1TDn/RCHYwjcXI2lF:yPbqBosfRUFGiMNb5z75iUBaM
TLSH
T1A8C4F9239FC93B6744D2330AFB45C217E48CA9847B16D254F4AE1B1A22CCADCC677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\cs.pak
Size 572KB
SHA256 7d7b701ce510b2e4a18e957e500086db590aad8bf5acd37f82263a676f0b556c
MD5 582fde87aac61961e4f7955f16d31769
SHA1 3a8eb832317dd7e07efaaeeb5885c32b9d381622
SHA512 adb04ccce5471d80182f7ca73bf1a2e4ce63a4980d455837fb378bf679a0022d4ee6f9fbe148d6932fad83f458c76ac229229542092e0cb9b271c8d44639b11b
SSDEEP 6144:uoShiN4gvDM0eqcNRZhAy8B2ACnO58bCoMbdNOlfzSBlpByI8Q8:uxhKvDBdKnhAyQl58bCoMbdNOZzSnpBI
TLSH
T10CC4492EEEA36425488002487BBA4128BD5EC3540B2FB5BB6CCF9C95217577ACFF4D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\da.pak
Size 518KB
SHA256 3430c0f1946901dfa24190ca3989f72171ec564bc7c523853e6a1f531b61b5ee
MD5 5f8f09aa98ec3a4c8122d64c5bc6610e
SHA1 08a6dfaa3a11d8c994da90460e78ce0a4fcfb644
SHA512 9c643eb6415cad6aca0584d62211aed5ed21a0f8d71ac4f692bd420a4a190a9781add7c874d0f56bb5c1c0f65d543d932d0f50caf127e8d014c05d015ae61ca3
SSDEEP 6144:gHUinoklzVZs15uHV9D1se8KnwlQGyJwiVobR/0aHtG5VxvdetQid4YF7wv:Q1nuEVCKRWo5Vtdy8
TLSH
T1B6B45A4BDC9C732F89A94B65F3108EA7EB5D543CC684264F65D8943A09CFC6093BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\de.pak
Size 553KB
SHA256 662496eff49febbe49f0a03cf2c51acaa743cb2237de3c41014556e16f3d8e2b
MD5 d1a513308f9de55b6c7bbeef7c4fe90b
SHA1 a4a5e99fe73d5f9df2e508c3c8e9b73dea03a76d
SHA512 9756e16255976569584a3a5e2a17421a31bc8f9b158c0ad3d30f6fe624ecd0e77c255571e46554c03c54d58b06d3f7b0fc77d347548f435547eb1ed9173b30be
SSDEEP 12288:nXez9VW6+3K7UpygnaAgykt5RMDU/+/CO3:n4O6+3K7UpygnaAh45RMQWCO3
TLSH
T169C40703ADDF621EC78673607305CDB77B19E36BC346312A88EDD12B654B5B283AC526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\el.pak
Size 1001KB
SHA256 162e51bc7d682e223e498f4ff8c81f019d136d857bd25a1c982d4a1084a8c840
MD5 34c6150acccd20c7f260b269bce06930
SHA1 277b6d2387f600c84263847d6fb2342fd4746cfb
SHA512 58308b1f4f92f1eb26af8516351194b96defa8b40f26cca2776aeb9e804e585fdb9918bd2acb9c6318b63c3768c29893574bd0a4fc18fa9dee96b9112732ff94
SSDEEP 24576:0fYcaPdGgxh1hxFGiYX9wH8JXDsSLmqHB3D2Np6Wkj1m1mVT8yiRNQKPCt2rDQuV:WYcaPdGgxh1hxFGiYX9wH8JXDsSLmqHo
TLSH
T16D25CFEFB4582DED8046950785D8B07C6BC62D6CE749CBD86629CB60BDFC0718A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\en-GB.pak
Size 450KB
SHA256 7df934906a61c0ae7a952f9ed058f4a06cd3989663a7d9f50afc3c9f830135bb
MD5 56bdf77ab3487e28d354a8b0f9ba8d2e
SHA1 b10ee918320a50a417b1ee6a28cd4b05a5f77238
SHA512 8d74c79ba3a554d69f26fb8c20210c9a339d85c0e9a9af445901e8a5c7ea544ea6ec713f9dd2db7b8bb5cb0afb0fb385236d4668a73af37dc9ef8d2f73c57fcc
SSDEEP 6144:2zyvXgRSCd98ZxE+J1RMP9ePsHDfaYIx556S5xTxVBctRVod:9oRSCdaZxdRMwsHu95NxZd
TLSH
T129A43B1FF784226A069311727B09A6A2FF26D06CB35112667CBD802C33B6756C3777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\en-US.pak
Size 454KB
SHA256 41123d72bd8e289e85bd35227aabb4cc61fe1de02b5cd7a7834e5ec200bc2078
MD5 5c52a86b21633b55b383c20f16859b2f
SHA1 126585e68cb17f241351004e21c1d30e65de1cf6
SHA512 2a1b6a4becfb97d470cd7de74857edf2cc9cd4a77f377ccd9bf60c30539862ff1ac3ed6cc849632a3ed4ea0e5b92679f3cc5b4cb26cc7eaaa2bb2f4ae9974a6a
SSDEEP 6144:4U0NFUyUGhhA/4miMP9e2qDWfaYe1Vcg5xdxOng5H/thTwB:4jIy1hhYiM9qDvn5zxZTwB
TLSH
T152A44C1FF7441229069352A27F09A5A2FF32D06CA35112567CBD812C33B6B66C37B6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\es-419.pak
Size 547KB
SHA256 ec922f8ca16b7e7642fc73369ba7b75ec950cafb1dcadc6c88426c034382d483
MD5 15d1e262602e54d76de8bac02dada000
SHA1 54e93995675bcebc595befaed6b73c9ff5e6e735
SHA512 a232eb97021f17fde322697db2c00423cd70e9741772912c5f7a41849b35dcf3e2fe84001ff0a7902b2b54305d1f805f53988e421e192be0d5abd157bf8b5f1f
SSDEEP 6144:SGVG1UtiPz9gqpuYRwqro8U5zivZ+XYidR:aqiBpMq65ziB+FR
TLSH
T118C40922BAC81F5310E2A389B743D753E4989545F408C29BE8EB876562CCF8CC977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\es.pak
Size 547KB
SHA256 0385e6776de5a0d8a3b30b7bad44308ac4cb04e2bcebd573d3c7938b68036573
MD5 f90d43351ffdc63bcef25bf634c1fd35
SHA1 f80df8034cb64df1ef62e586891275a74868ab6c
SHA512 7bfa70a5de14652063d261c28ffd3df89ea5e38877cc7977ab27f7280c48084a4ab1e5bdad0c2f624a7434a5d975feb9d8d221c010e24963d3c42921f5a36e65
SSDEEP 6144:jXKFTiBFIeuyHYc1RDVFa7bg5H2p3+mc8uM53xnjJ5Jp2dCFaZ6PZcHu:7KFkY+xFRWp48uMDnjJ5H2gF0O
TLSH
T187C40722AACC1F6350E39389F743D753E8949585B408C29BD8EB876652CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\et.pak
Size 497KB
SHA256 ba4ec85d2306a1f1f178a017fef4d340b77b33e10bbee07bd359a8e0ff8ea461
MD5 3cad945e9ae6e31cfe66c89365e5d353
SHA1 43758cb523d60d936b9a417123f337b8e123481c
SHA512 ac07e7f72b670a2e8b7a46a672fefedc58d9384d4773a6f220c231c619c1134613ff68c0ccb0dc9e03eb5f47dea7ac57de318af5f3f242d6be7ae43071e2d947
SSDEEP 6144:qICqnHGj1rurkyJ1HNR5oSPg+sy6/Fb0smFoLSdDWl/P5io50WxH5vMJRyiCKMLZ:q0He1KkQoWkPpmForMWxH5vMNW
TLSH
T147B43B42A27D771B582412F9E337AD23DC9EE7D8B4000D966C974A1970EEF8C38B6B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\fa.pak
Size 813KB
SHA256 f1a7351bf0d8cad475d2761b9edf970c3098836e38aa98106a5e04a41002b7c8
MD5 7851efacda8438c041c9a511f4097de2
SHA1 64cba381a17ef0ffae2dff5135d57fd1f9300ab1
SHA512 d94fb1d04630cc292296ad6033c6beed1a00dcd4c11eaca04a7eacb50c238269b21e4d2a4002836f4d41e0f6d951624beefc95beaae23530eccded4569ff1869
SSDEEP 24576:GfX8u313uyqoT+seq+LRmX1loTUOmdAQifaQ2XxFMJGk62YhwdrigHMX4qOzUrWS:Oe75dk
TLSH
T13D05C3956AAC9AB16747CA0341D33834C773EF12D34DFE40ACA1076609A5B139F5EA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\fi.pak
Size 508KB
SHA256 11b0b9b0f74d01f16db7aa49be9dceeb55fde9da56f17419c4bca159cdcae274
MD5 6d7aaddb1365b3efee94d4c510a3002e
SHA1 2a970204894c5ac163c980ec0fac2dbd1711e5b5
SHA512 f44bab9cee552dddac17d4ac1949870943cf138b3fdb0e649e8827acb6de9528dd9cf738757e5b495587e165d1c750b8bcc6205bdd029a01eb92aecab22ba49f
SSDEEP 6144:hjtSFHk5y19uAA8r87LSzrFSrRUysLk+hOEcraV2LN5RwgUH06nIp0Wac9ondnHa:y5Gy19nAPWFIaW5RwgUU6nIp0Waq/jYM
TLSH
T17FB46D915219C22137C8D28E79B0903EF6E5E3DC8C284D96E847C7D849EE9887D7277E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\fil.pak
Size 573KB
SHA256 d7fdc7fd08dcc421bc8aaae3fdc72599c60a3b96f05989a3e46736f0de06e745
MD5 c744b92c8feff1c026034f214da59aca
SHA1 95780d3374841efdbc0d8a46cddc46bb860a26e0
SHA512 eeefc73474642e75da61056f2841e7cfeb8d8475be55a39852dfe7de8a972f7d86e9d1df4614b3ca3ae4fb01b68e5ced664bc8e46ccfc94f44b06e29a5035b43
SSDEEP 6144:KoCySmeMLtmQ3zGvjQypDQFLCH2MYFGTdmb5SYw7jMoQcAsNqK:KcRmQjMcb547/
TLSH
T15AC4B715B7401748DBC352E51360682FAAE560BC3F82386E4FBF269B7BA7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\fr.pak
Size 591KB
SHA256 1f6cc56e04bcbd6b6ecbe500bcb0a5702551ec80d79e624642d0c7d9758d4424
MD5 79d945ef9b8ebc7d39fd03d05d9b2f27
SHA1 6fbcb748515f97056689d4a747e4df3a830fe049
SHA512 f1a26715ad9399052b664c71fb60b6eb6f965fa80d6d8d6c47e0b96ad0d4a4d2028c3e19dad49e008bbc29edc24e656777ce073da008d3f4dfdee4c8f2212a07
SSDEEP 12288:NFVbb5yhyjZLqyluvpTZF6QuaMVWXKzEtSlZsZFMYnYFfLR9ujzl4m8zxpJSWt6P:NTly/VUVg95Px
TLSH
T15FD4F75FADD432CB1AC21277FB12D663DD348248F216E340D89F4295129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\gu.pak
Size 1.1MB
SHA256 087e99953eef9b5fd736e3dbd98d702fdb01dc614593a4c575cb619159688118
MD5 e884bbc8ded4f5f059211fbbb85ed351
SHA1 8f4ecb45ca73902791ff5e56e0b272252c08508e
SHA512 50837daec40a2624097cf36dfd7beebba4db748fd9cc470bf71b526e612c1aa6c88ead7511ba751e370f6f5d28ad9d6338dcb3581d7e3d53e2672741915b952f
SSDEEP 3072:3E8kEz2sb3JSHbyAoIwjAwREJKVMjNiT7llj63rFulPCpMi5eWWiMJsW5U/GQoyj:3EqzTkl0jNl55qPhB1XFR
TLSH
T1FF4518D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\he.pak
Size 713KB
SHA256 20b1c80f8b2bd5130a1fb372814fb9c9ceac15305da3da0cb29923960a94a934
MD5 ad6af80367f0b5d408bbe2c7b32ade48
SHA1 9dd4e4e5a63e50e9d3715667b8149edd8d07a52c
SHA512 95df5ce7f7885d0e72b2d89e1794a3796a1ab407fb27174219db22c668f74a8c3ba1f680cbf990be533c35ca0b2136b1917c0cb92d4556e3ff2ef3447c55efbf
SSDEEP 12288:PY9uJ1Qh43XyfhR5ir+yc/XWqu/DK6oiAC7XbDeQCajL5n6ltE+t+hO5xNmm++nV:31PR5b+D
TLSH
T186F49AC4B2D452255231AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\hi.pak
Size 1.2MB
SHA256 9c6d8d93278a6e375405142df9829adefbcc8ae9797a4f589591b9784b2b71c8
MD5 66ab509000cac52c805d6871ca6c1f25
SHA1 e3d3e7bacbcfaa7538ca89d9d26218eca06c01f1
SHA512 356642a19f044c6e192f658ca2bf8764431129cdf7c9891b5b5bf4e99f6b990a1428c1e483487b619865e7f2d31cb5c9bbb3b49ed25fa81c4374de3e8e65519b
SSDEEP 3072:8/exXUYA+bcr7In9GOcffQ3ZV/BB0ZV1dKuulRLiW3VTOEOTByntDPtDlYpRYs4I:8/exkZ1r7w9LcA48y5eKyhVy
TLSH
T19545060CEBBEF3B55DEC3C8A32890D37D59D3674A3E5525348D5B3DB9844CB8046A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\hr.pak
Size 551KB
SHA256 afed35643df24709c8c5cc9b8158b3d9a2266fbfeed132e98ff254ced4086c5f
MD5 1973723b9c45b9d971c97229e7a441cb
SHA1 2bfa4922bf2084486681af45cd7f7dedf95b2d66
SHA512 6a1f35435b01ab187cd93b376b76444dff575284632fbf37bf8b08e6cfe7783f985d0fad2425df3d3c332aad2278971412455a748e83c2d6fabd0f6afc3dc292
SSDEEP 6144:3Q4YHBQ47wMbxflwiXwu2hSwt+5jhYe35JMK:3Qlh5XtlwiXwuRwQ5dYAkK
TLSH
T131C42A7DBEB397090897A386EFA643447DBD08DCE52597BB684F532E0003F4D6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\hu.pak
Size 595KB
SHA256 b4e6a1135de8bdc42c04f4db4eb1ce48256f18eb46a5146a21010b6165a90e7a
MD5 2515bb367f56f282657b3dd3b9ffcbc3
SHA1 8cc350e359f1cfefdf0ce3b016109dd483d45a8e
SHA512 779a77b3380f08dfb1d1e9bd65806f3d5ab56619d040bd6ecc9726c17944f4d0c3a619edee06d638549250fbf4c6a2be46cd6196a3a8862d184a68d45d6f6d72
SSDEEP 6144:Fr5gRptZU80LM9rHs21fNAAbkit2V5RlVFZfpAaYGN2enVeWvRwnjDi54RYsR1tl:F29y/SAjV5RlV28HJd5kA7S
TLSH
T118D43B779376945AB8AC179778647F15492E481BEE3B26F72883886D30A078D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\id.pak
Size 490KB
SHA256 a21f9474a19fe2d7f26c59f5ba8d6e72801a8a057b7dbcb8b3f96471043d9059
MD5 91bad2312491410c7f0393be512b895f
SHA1 6e4e9cc985c5b96eaaad91787f8bb7f72cddb604
SHA512 5c0e1cd1741e78fff90f3ec2be02bd47bfc669e50ad0cdde975238a74cb4081536faf80d0a28dc9fea6efda6548dcca4e569c54b903f5c2773c17f72000a99e7
SSDEEP 6144:9kLp+Sz0NKaVCGwlxDpuQgif+eVnjHFvTmiZIPk5V3pmwkK53vCqHi4pH7:C9z0N6BXDxgKVnjHFrm8Ic5V3pl7
TLSH
T18EB4F8632ECD310C4A4842D5B2CDAA1E7CCD233BAF05B76E8E748F7055A67682716BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\it.pak
Size 539KB
SHA256 33652aae78a486dc3ce4e5affd1b7f72e1248f6f9f3e62188afe3b5d73bd148e
MD5 591113bc491e5c388ee3876de4aab3a1
SHA1 a63c2a18eb92fd03445bd237a5755d557e1cb593
SHA512 66f1e79c9bf179f19942352258181858268a991b42d4a79747ca580df3fa219c2be71ab6597cec4ba7bd4c691a5e1328aa03a565b3eef442c6e2216f0d82653c
SSDEEP 6144:STnsPgjGeSTx92/Fzw6N8uESIqRRxsO1St7VjRT9TjeUaCnfxLUAppznw9fLwwXe:usONZf+lZiC8WZT91K8/51ZIw
TLSH
T13DC41B3AA5D621155A976359E221B045FBAEFCCCFE417218C99B431C23CFE40E2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\ja.pak
Size 659KB
SHA256 c5692ca739c31569ae2431fd58f1028e6c8c01af278b76656ee0bb65b79e9985
MD5 412bef3ec11f53c2aa6511ca139b1f35
SHA1 8b42655c2b62edc13c61a4625f55c961cefd1c49
SHA512 85760c2a0dd4404a2d41f0d957c9cf8962d6b80389df838cd2d85b6a31a54f4e50c5f19ee73d2ee66e3e61a8809aeb5b493e7170aceeef9bda53e135ae02bc42
SSDEEP 6144:7dciDmQZ6rLcuiebgLA9NlW1XpZaQ2dVgbs5zQpeV7:7G6mQZsNiogsmXpZaQ2dVD5zQI
TLSH
T17FE43F7CE3C569369D6153A22C0E36E57606AC5FFCA23A3A442DC034BD70BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\kn.pak
Size 1.3MB
SHA256 a6ecf1dfe4d99f6ba0926c696b5b23b77d234fa8fd03da9825b074ecc640d508
MD5 a11d186b8eec7362a280abec3859107f
SHA1 966065cc6f69c3a222751d2191a0efeb6049cbdd
SHA512 099e73977453a5dca329b1d8a8cbc612dd2739bb3db034b7509af35877ede6ee12450875302ff3f9351fc7096b60be1b2d8ccbec89ace3145eb264f25946d46c
SSDEEP 12288:7RT+Q90Ez9Q6to4QOnyFUjY77K5OxWO4Dl1bjr:7Rl0QVf5uW/
TLSH
T13855CD186DBA7D301BD5006B24EC603EDFF16BE29CAA07D2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\ko.pak
Size 557KB
SHA256 3fa72d61a997c36f9c093f769f4bba60b290d1fbcb71d5544f85e8e1efe51d07
MD5 965ac0d213ccdfd83ac4970de23a8f11
SHA1 8326841ab80c40a7ca8b13589a3f5ff54fc15827
SHA512 5eaf14ce5c493bb4704716add07428edc6569f2dcb721679e140916c0e426cfa8e8ce27a2c38c48ae6e60461a678525e48e42c2938ce40e488b59d3f97a2f9cf
SSDEEP 12288:Bnxe0CptS2NHOXTTSIyxxMSAG0GlzRXfwb30t8OQ4E3heOGY5yCqhog/75d6L7Uo:NC2Yr51KeHXU
TLSH
T113C4D7F238DB23CD1193C982AEF4FA198382D976F7530294ED44CE54DE245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\lt.pak
Size 597KB
SHA256 a1257d10e673311747363e6929832e70f36668b1fc0d6a5ddd550fe88007aa58
MD5 20906aec4a21bcbb8bc8bab067075ba6
SHA1 369da9c1567d4376852cebdb87cd9213dc4bd321
SHA512 8d1ee40bff980b889af83b95fa408bddf2ff5d257f532d2da46bfc3ddbcc31b9cf14b473fdfca1a574c0316fd689a424ae241e9bcc533b7dfe0c7203d4b252fe
SSDEEP 12288:zT2knvNMLM8rPedJaH9qs50zjGwaRpw6SNM:71M5KVs5KGdRpr
TLSH
T137D43B0069E3AEFB9A4463C982A4CA78DEFD50005727BC61EC69C79AC43BF4525B4F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\lv.pak
Size 596KB
SHA256 33fdf706f6d3f06b485c5115a7c73a571296dac41c582fc9d0dbb371d86e8653
MD5 a999e734f9addcf07c080f9861c3c170
SHA1 522bb12a0cd4e5232570001684aed84f421abcd0
SHA512 ecb92c4ddf7b252a3216059e63b387c6847f6eccde532c300b74e6b04ab56da0208c2ecbd00ab1d5e48acced909db74b1aabf88e34d0d5928b89320f45200dc8
SSDEEP 12288:hCNXRaq4s+zN98JSvHkf5mF4TV5AzYg19:hCNl+zN98JSPkf5mFTzR19
TLSH
T17ED41A959EC68FAA4D508DC7732AD123A9CCD740FE06E112ED7D4B3A650F12432B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\ml.pak
Size 1.3MB
SHA256 87384db1ddcac012b0b40ec89daf47ebbbcf1497705f023a6983fb2470e4abd6
MD5 39d4a5ed8cf7c8e0df946220fbfc0f68
SHA1 70794849b41d00f2b895f1211a6baaae3fa7d261
SHA512 ac992b9cebc2fd51f7477b36f1aa4d9157a84c3023949c02ea236d909c78fb5ccce28dd213c089820131ee3f669164529daf58901766630ebcf40546d33e132e
SSDEEP 24576:q5T76ZRKuKfGBP1tX3tD3e55HY6bXaS3t:6Mk55
TLSH
T1F4659D5BA036CD3B0FD102257B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\mr.pak
Size 1.1MB
SHA256 039f4e0176c38867fef57482825d043fa63bf1356c85eab0fc665f118db125e4
MD5 649e76b6666096a2258b942745ff9fe1
SHA1 82edf8ca68dff0caa36b17901c1e12a17172fa51
SHA512 92f51140416cd6dd53109ddcc1ee24c1d26999de5cd48a11e6954dbbc985298c1b90c0b4a7bbd8701a2737b71340e8a257e8b1ace85ff3b4876b714c60befdce
SSDEEP 6144:b17lQq7uu0DacX+KZmCneDsQcVgL5UmGQ0I:bB2q730DacX/ZHeDsQcVs5UmGQ0I
TLSH
T1ED35D14DF77AF3685DACBC8E36580D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\ms.pak
Size 514KB
SHA256 2f0c83b5b3bff8f624d78e0670a31c509e7f1d5330f72aaede471b2e97c956e2
MD5 9fb7c18f376b46b254ef9a960e08655f
SHA1 31cb060fc606d011151f1b5464e2a469372113a2
SHA512 23ea07d917bc0cb9a2f530f985c4c1930d31eb6e8271804709126b8b0f5266dc51636f679944d2e3d8dd7b603564defe85c1088a33a922e9fe15c2073b509a8f
SSDEEP 6144:fUEy7ZOTdVAPt7BtWMxsvHN3LrRlBJdG4UcuS95b8AAUGIUZf0Vf+:Py7ETedBRxyHPlB6I95npG7
TLSH
T1B8B4B5069EDD3118045843D9D2DA6A1B7CDD3333B705AF2B8DB08FB016AE7A53316B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\nb.pak
Size 499KB
SHA256 887a0278971d6ba61e2f24c62029a3087a46c4962c4357412c28ede12ed6da15
MD5 de04250ff403e9af66a1351598d2a64d
SHA1 4b7a5a2bf48d988f95aac6e85b11a8c2b2fd007e
SHA512 71527c025205bbcd63351283b7b123d8807c05bc68f2f7555f10386e330e052d031b9986ae2c1f0398bd174e67962657e0b8d4a57a07d167c233390a4e6c5556
SSDEEP 12288:+DUl1gBIbnw/5Op7flIxJb6RgbD5EKQbW7pDtvt:mmczYKb6RgbD5fQbiR3
TLSH
T19DB40783EE46B72EF69443A4F42886579B7D942CCD98199B54DCC63E08C7EF092BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\nl.pak
Size 516KB
SHA256 619c61701b3a142733d23ad8c7117bc013867a842d3d1d572faa56895ad8257e
MD5 d59fed8986eee2b9d406ad52d88cbcf5
SHA1 f7e409e17723e21174361bc81e54bcef269f40f7
SHA512 234aaddaa7677b39667b4078dc3a630d67b4f2ab7df5ce763d509183a4d88e8f7bd1a231113b8a51418d577e4aa630860a7f2735c34ef59e0f65966cef825597
SSDEEP 12288:+sv5HlbJ9WQuskxgb521Ex5btIQzbIrqqn9EOTy:nHlbJ9WQus9521Ex5biQzbIrqqn9v2
TLSH
T14CB4FA17AC5E253E59C0A385F6094FBBBF2ED22CC26CE67D94DDC1381443F6882AD499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\pl.pak
Size 574KB
SHA256 f2a7dcb69a433c2a898866c555b82c26e3515c089f500e7748b9b11ec3047786
MD5 8d4db26e2ee5181afdfdd513053f3c17
SHA1 0da427a085927a5c02d2a67c424ea99cbf5e6b02
SHA512 bf441f501d746f1fd996c21e5e2cde643b9031bf58bac31474e68a72ea6993447f8bfad3284351bffc94d6a088e183e0b24d109398d65dac0edee8826076ee21
SSDEEP 12288:dhbDxZoJTGTgWoOB/kce5XfQfu4VUd6HA9btHP3CUdRe3mTUpMAml1QhqGY5T1sc:dh/xwGTghUMt1QhG5cc
TLSH
T101C45C0D56E58A4E4DB008E6F2E70B7CACDCC808F109D35FE46F852A615B19ECABE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\pt-BR.pak
Size 540KB
SHA256 5ff219be32f9178fee40e8966ac5deff2be1f2ff259a66cb9cdce81c2e90a7e8
MD5 b4183914f46fd63a7bd32d715b8629f5
SHA1 d0295b556e55a74e357f932473f9dd2bb1cd2f51
SHA512 3bcd37cc49a827c03fb5b3a97a5eeb863ebb6f071fb2af697ebfc4f57dda676227533cc6a2fdb00505cb2395aae685dae087970ce13af113260d856b845a985a
SSDEEP 6144:06EIk/O7P0GYlsw2mQNBXBLQ9syyV35vnXRCrEsRn/Nqs:BEk7FYl32j5fXZsR/NZ
TLSH
T195C42B2A6DC9136605225350B74EEB03E5885745FE0ACA8BDCFF4B05A3DDE40DA33BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\pt-PT.pak
Size 543KB
SHA256 02ea290fac25b414a1d4ed78cdc159cf6c73fe5350824c2f36f032e426a23364
MD5 03138b2e4fb822b03713f6c4f0fc67cf
SHA1 8f6f6585743676177eaff5a582d18691e3386bbc
SHA512 b000f1b8fc952849d1ada21aab665cbb97989fc28e892a75077ae9a24c4ef1d15b7d5cf1c5aca89d27d40a01c64f343a08f790049249fcfed43a1a430b4fef9b
SSDEEP 6144:fNc5PJmPI6Lv6/CieJVJJxhFIKpcfV7Z5Ij6ySRxi:6PJ4pLoZ5IjFSRM
TLSH
T11CC41A296EDA136605135381B70ADB03FAC86655F809C687C9EF0B0672CDF84D7B6F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\ro.pak
Size 562KB
SHA256 655c175903a791d0ff56264a487c53f7bd09ed037cf04cfa6e79eb8be5b677e9
MD5 cfd7cb2444248216e12193689ba56c10
SHA1 0a9d65fdbc68688bf1624a8c98fd42673961e0d2
SHA512 7ab384dfe93c4de0d82d3a581d0c4b988f823f49848cedf081067e052be2d43c42389899588839dbc7cb35ba70617648bd0c7c199900e78c487f3dd77e64b4fd
SSDEEP 6144:Dl1456eMxkXbf1WgAbyFopxwdNijkHGpq5C5+U6Ys2tE/bBO3:RmnIkXbfZAGFoPwSACq5CcUXE/Y3
TLSH
T1BFC43C2391C81A972A9152B2B73624D3EC8D105DF641D2CDA4EEC97D10CD9DBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\ru.pak
Size 924KB
SHA256 4babe5f20caafca33867ee263aa9dd55ed271704a062e4372fdd133eb359a558
MD5 46fb61aa9515e97293969683fc330764
SHA1 5bcc41716976eefb65870ba2a2b230238f7e53d3
SHA512 c3acfc1c902c651e5fc0501a7a77358cbb99daa020597f7f6be9fc81ee53509dcb0d63c6bbc5ae308c88d95dace7099f024d698b6f364dc7db4ae2a7660e5b31
SSDEEP 12288:Oqgi74CVfQjRo4YSWKCx/KHizJ9ZF1WAaWlapqSvDs/uTXb3YHVeXN2hVO3j/LSa:Om4Mz15W3sC
TLSH
T1D1157661669E64DE1101F01BDD08BE093CEB45FE3FABA35619A42D7F35F2024C63E61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\sk.pak
Size 580KB
SHA256 89f984a67cea3997c704005fbfbacd3f6f5652248626945c2ab1c3bcf24e6623
MD5 5d41e75bf42cb12d7674986f4e5dcba4
SHA1 7c3375226997e3f69e3c9a3a5ed762ec40d24973
SHA512 a2b91c888ea3dc2e618bf8faf7ac9f0fe562ff16c85d03afac0778ed671b1868a665b892aeb2d588e7f5bf32a7eba57b75e2e15f2c51fc9264e0db2f95d804d0
SSDEEP 12288:1Q+gClqsxkldrM8ixiq845nH7wM6IzWTjPxt9cU:+ClqsA/ip5bwcGtWU
TLSH
T162C44C3FDFE6181E8E8D0148EFEA7110FD6E46508A4EB0A5D44F364714E26EDCAB8E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\sl.pak
Size 556KB
SHA256 458b15bf249c1e6fe9843725c42443274ef6e09dcb15f5288c916c0561aefc47
MD5 6c71fa576a41711dcb351abf92a65ea4
SHA1 a0281f6b9dc363628e7d6045f7dc2904149c9dad
SHA512 258e49b51ee65bf508d05a5b3286a8937d3a876a876635b59b97752c5171e89458b9d23d9d7178153aa16b6fc908cc011a8e855c6d3a0152c919b40349cdf4fc
SSDEEP 12288:QFEa1zRkPcB2e+ojNK5eVfnWJUU+i/fzurqc:QFJbko/NK5eVf1i/fzuN
TLSH
T1C0C42B35BAA79E0F0D9AA2CAFEB602007FDC044CD256E6A1FC8F336D5015A3817BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\sr.pak
Size 859KB
SHA256 4cea4c83b5e887463dadbf470a9953b8175149f31fd07b83406a6fc59acfde41
MD5 eb8ec452c7079ef7dc24bc7975513ed9
SHA1 4787250292b8f2040c7ec0b265f60edcfd1ffcd6
SHA512 3ab2eafd3f09627efed8263cc2d59d5780b6a856a6d1299be511bbb5c1350fa05f98b0e77c53c3707ada17e7e44b8801b191802e2cf5129548e279703983a8ba
SSDEEP 12288:rH8hr7QuzIWUISuGSDd5S0Gj+uJPPX5Y2EsuexNHgb37DVebd/k/q:rHAlPURX5FuI5
TLSH
T17E1557A19B9E64DB0501F41BD808BE093DAF41FE3FAB975215601DBD34E20B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\sv.pak
Size 501KB
SHA256 105460cb717104d82f99cf8c5e2c51ff252211a605bd1c98bf75981f100d619e
MD5 819b5e4f2b7734ea4677f6d579d72f84
SHA1 aff3048d8e35fabf68a756513b67efedba59f85b
SHA512 3e1ff5d934c7e0656dd16265be697420c31b191f88a5140c3598b4fe37a6bd3031f50d45ac7e961acaf0886934951a48230f7b10a53d85e015d6d5e1602c3eff
SSDEEP 6144:0qvFK1jOrdxwhaqqbCAxLUxlsWG4RFcz9RtGdJ2qF4ivMJSO8DE/xJuZpV5YiUr4:0hOdxwSCd95srSQEV
TLSH
T1F5B41C438A20F526FBB2130DB508115B4AEDE25CE7E2958DB8DD883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\sw.pak
Size 529KB
SHA256 f0fccf2e3ad332846736d816e254028569f5f84918573872442987a8bc9bba58
MD5 be2bc09130635406f560b95e789f9a81
SHA1 f189cd6eb6c844e2d96ffaeda66fe4d5f1453130
SHA512 f651ea959066a5966f35493788b9833597dff653f649a5bc8b09a8ed748bcf086bd0586a36e1f4ecddd361d04774253e21d67801760d0988f3e17f0c6e1121cd
SSDEEP 12288:Xzs5IvVSRflncfD5WBqMCBfRd8FU1bQWNs4METOIQp2QVLKhzgKy5yvTCs0LMMkH:Xzs5mif/5ml
TLSH
T1EEB4C6629871E0191233518603DDFF732BDCED5C2D2B29935A46BF0F218F98857ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\ta.pak
Size 1.3MB
SHA256 1cebac8d758298ed2763e62b9bdfb17351831e691ff3e1ba85252c9a66d66242
MD5 52ee28471f2f9d01ef3f57233496554b
SHA1 abd7dd9989fac90636626a41f007eb6aa5ec7a2e
SHA512 af2e9593faf60319244c90e9c06604dd3830705f14c18cd380dc2338aaa0c1e137bf751603ab9beaf7f1783839f83bcd4fda357b7cebc66ee94155d560b6f691
SSDEEP 6144:T7IDhn9dvYUVLK9VHPAQF5isBtRdjtm1vYpiMyp:T0DDNYAYhPxF5isTtm1vYpiMyp
TLSH
T110550CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\te.pak
Size 1.2MB
SHA256 8264244c6de861817f5b19cef282844a18ed8cb7d4e059451489652749fe931e
MD5 3a71904057869c23d1bc108f1e8d0d31
SHA1 6fb6e60c80bc332a2bb66d02a1e3db69961a9c41
SHA512 7248058b2d357c4a8b9c2e95d580a2000a96d9a5adb0b822adeeba5c4422e08cc12ef84b9b9a627a1f6cd07a08698ec000510885d14d64afd40c6e8d69376022
SSDEEP 12288:AJlpcT7U7McKNOJI0ydc6dwIIRT5EbNQ8W8thBk3p1FZ5Kitlb2wsXgy3PiorOTu:azI7cmT5D+Hti
TLSH
T1435591023A6AD310DAE60273752CF66C49781B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\th.pak
Size 1.0MB
SHA256 647ad394e92e7610bd0f6c4e08d28748408fcd5a816a35e4622ea7f71cfa7a9d
MD5 879a881174501e22c3de65b9f80bc19b
SHA1 a2e020d5ed1be7dee50a495a2f8581e751cbf735
SHA512 b8961a90036b94340283237da57659cc277e65e545764251f7d3e406dc5f70c9ae29366184d0aa8831aaa0a7cb5c12ff825078bb87528606cae223fba58c73d3
SSDEEP 12288:ho5WEVQN9LyZYAPTJz1L/L1XLJ7sgU6yaiW+v/K5U/afL3fgj80RUIwunRHpG4L0:C5W8+56Np
TLSH
T1E3354CB37247DDD479441B5B262A7789673DAE693F73F8E00089215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\tr.pak
Size 539KB
SHA256 f58ed19be62706fb4fd797a6bfd3af5c6ad4b39aef994a577cd28968fcac0291
MD5 414b557adfe76e3564d43cb93f513c5a
SHA1 f775095f7c55e834a777c7f25fdfb81f1e63ca08
SHA512 8b1be522ef23888d46c13888a18229f4c9cb6e1c6e6730cca79d9b13d71eb86ecd3d0c172ade6f70ff63a7fb5242e4de7d9742b93376669d13c77de0cb622f94
SSDEEP 12288:s5acoqN+y4HzNs7DxqoOF1n1BXl35M7Je:sNEysXl35EJe
TLSH
T124C4FA8178EF781C8BB9278FD6E90666F89F0766B331F4469A16863A774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\uk.pak
Size 923KB
SHA256 13e40208e2c9f4f4b83dcf422610dc82314a8f99ba50acdbd286c508f92eb232
MD5 241fc33569b22647e7d2c4189a8ee7bf
SHA1 f56a73cc81b1e96560b74ee5e73d7af792720ada
SHA512 ad16f84482f0c7c3d3c3fb98caa3dbd0048138f361aa6eba2b6338ff6e25da4c3ab39450354f2a86a53d655cad99e92fab2c030b5771d7e6a25190617f1a9385
SSDEEP 12288:lw+oY5IMlh3TVIsSr+Oh7+4w0ZZDSIHmBm5eB3IjCHA3brUkcuhLNiXEvqbz1TX:lZpK15Prw
TLSH
T1CA1599A19A9D58DF0106F05BE84C7A0D7DA741FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\ur.pak
Size 808KB
SHA256 60310f9a3457fae0395b447a30646211ef4160ba84bd7c36d291af4c8ec2b79a
MD5 fb978b7d211112a0774ce09ca54ca96f
SHA1 fb0c69801230437dcd20e3803db81ee60fc042b0
SHA512 abde8d79f46b27e0e315034025837a3126d6e5d2bc52504d49c946fe96828bd9b20cc4a5c05283fb9f8813e6820a28249cfd68b30cb27fba216970c16ecc8d44
SSDEEP 12288:VXiP4WLa3w8PYsR5Nimy0ciU55eOmEhuCEO5xlKQYrbYOwadcJKwUSu9co/9Njjw:VX8wI50Cs4
TLSH
T167050FD2E6BC96B25A21D92780D33C34CB635F13D34BF286E52246C54E9A0135F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\vi.pak
Size 639KB
SHA256 fb9463d5655e73fa69cace9800d95f8cd077ee9284fef3bfe162d2bfe220c257
MD5 565abf3f9b296fcff95fa5b169a7d598
SHA1 24de1221b2adec13b5bcc23c4a54b8e987e9f12e
SHA512 53bfe0c1c289ecdf48114048e15807c3143dbbe357736753cb845a31a6a3fccd0dbae652294508706076ca4b30e5da00e53bc6aad11b06fffbf2621997e7de36
SSDEEP 12288:ewR2TuFaVN+cywJ2roEsGV63wueX0Fxzn4xs9FgGhx5a8hI+8qiOXLziKHhv0ZiB:ewRlGN+cywJ2pVPuS0Fxwto5a8u+OOXX
TLSH
T16ED4741117E1702680AC553EC6CD540E6FCAE42FF7C18FE56FF429787A221A45F21AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\zh-CN.pak
Size 460KB
SHA256 f0c0ba53c954325b3bbefb333ba23f7fb40a7a4e506043e9f7886089f611943b
MD5 3fe312d9859b299c3a332373172c33f8
SHA1 ce6a99d79dcfc363bcf68bdb1ddd4e6862236020
SHA512 488a6043381834c9d69a906edd9e3273da01b618e9f3351a89082e6a4727f9f882e435eca3d590cb30336cab289fc71b109322d43804ddde5fa038a63a0b84f7
SSDEEP 6144:U6mVxC6vh+uQ00tB2HwWzv9O7F56Sb4fa1DZ59x6m4kIk1Nd9Mlz:U3/hQtBUfzlc56Sb4fMZ53b4kIkz4
TLSH
T1BCA47EA951ECBCEC014640E03729627D7C40B50BF667AF76ADD248DD2AA2F9D0717E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\locales\zh-TW.pak
Size 455KB
SHA256 d4033cb3264c7c4cd2636ea2a202421650c449e5bfb10f29949e4c44e91ca93b
MD5 e302e1102f3f5a21860f38f41b3c30f8
SHA1 78b5d1c451cf674a7641dfcc815f966fc920cf57
SHA512 1f96b197eb7ae6b7983ed38d4ce33ea0c845ffe527fedfbc9e53a6009871dd3c39084a04cd1d43fd6dd24e7f26e3ec4845d4225df828de0b9ba346cbc98efea4
SSDEEP 6144:zKOBV6L33vWecZM1uJJVI23uNw+H05exvnknN+nHE/ehTq:dV31ZM8Qw+H05exvn2Ok
TLSH
T11AA47DA608FFDAEF0A01F884B7CD522FBC8B746CDD773636FC8918D42D6AA540661149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\resources.pak
Size 5.3MB
SHA256 a5908171bfbb738ac015e7c9903c838d93359ed12c3b7d86545514dc1f0e9d62
MD5 84df318c3fd9ab693dff15582132fc65
SHA1 6b436939d3dd3d5300af46c238c085276bbf1b55
SHA512 189fd83f008c29d9b38e5024975050c8e3dfd5e99a0c5eccec06fce54e865f0d8bef03a4bf3dc3564f2bb640f38259957f8f38e0d39599aec6ecba95eb21f848
SSDEEP 98304:5N9bNj3xZRkPe04srtXK5EmXJfnimTgK5M/AyrwreSjujBrTAVD:tbNTxTk1rlK9gKckreSjuxTK
TLSH
T1B346330677E1913EC82ED33C42494F76169CBA730665712B718C6269FF391AA4E4E0BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\resources\app.asar
Size 7.8MB
SHA256 38592e4e628e1fe4be5ddde1814a844e289fefcdfc693271290a045349da9455
MD5 57b18e5f4ac61fbea8397a14558d40a5
SHA1 d1d3fa2304370625a89389ee78869e9f23825d8a
SHA512 4b335a951f82d0af1046df2dd75b8331b40a3f47015784fa7abec14d307b543bd3e73b11ea86761d793ef601bce95edf4a45dcd051198c379f556c93210f2b40
SSDEEP 49152:sUMGc1McMBEmu/qKVRz7fG8U5FV0/wGH7e3tv1pP9LuE7FPQb4LcitesQOUrfh3v:spUPnKVNzwGJz
TLSH
T107866DA979F321324A6320B94B9F6445B7788017211CD9B0B88DD39C6FD853886BFFD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\snapshot_blob.bin
Size 302KB
SHA256 22a46de643045805a3e588f9a18ebaa377f9fba3dee46b2d60f3ae300a09cc4e
MD5 62b9e00c46ed829e06d0c2494aa994af
SHA1 988882632b95bb78d80db60e4787c576e48338e4
SHA512 03b7c57782923ca3a011fcb85f74e865bb7ff9976c89152758770be3bd3d40684ebd216fe34f0d0050936b536c8bab5eafcaa35fc26e893d30a108e36687876f
SSDEEP 3072:O639kvvDaxLwqU1pedJ/sK6VrKe5VtZW1P3BU5qt5IiVboVKdc5:O62vvKwqIu+KgV0PRU5qticrdc5
TLSH
T11264D884B780CF56E8292E709DFE979A2239F3DE6E07825BB245032D3B7D6350E0654D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\v8_context_snapshot.bin
Size 646KB
SHA256 a8bd22478c4f85afa836c89d3a7f52c606b17872fbbefce268b499bedede10ae
MD5 a62fbbb671bf975ed46b42d9cf437bcd
SHA1 408b595b1dc6658533e0db1d35f509ab9ee70525
SHA512 87c934670df70afcced0ea5c73449a17ad27d5b6a25cedad9eb61634aaff8a42b713f578e861c2efbc77593793bba240a1495822b69c99a8ecaef64b07b6a62c
SSDEEP 12288:f97k1vtORkeGWFDjesZeLEY4QUH7zRpA8W:f97k1v42eGWFDjZ427/RpAB
TLSH
T1A0E4B5A2B784EF56E1DA6EB0DDFAEB923234F5D99E0B419B7149036E323D7242D0450C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\vk_swiftshader.dll
Size 5.2MB
SHA256 7005598f9bb8559101458ddaac77e3a23f9876c0a1aaf7136a11f2d1d5173448
MD5 15d9ca6f1d87f15f5c67740df2bfa874
SHA1 6d84c52d33249b216223e02cb445b886bea6b45c
SHA512 24796d3aded0a49713489b285b9d38fd041a7376e900684053c1df106a509a315db9e646c7286fd59c79c664557e6d4e6843a55828abf04fc04d8b307829fc6f
SSDEEP 49152:IgQpJ5yZBtfCp00oSO8hCsDsbJQk/tJ4q0nLhII1ytiT45z+WEjNHsRLf7OFJOMZ:4n5yZBXLxkf5FJIaye
TLSH
T15D463903B2858099F05DD1B9474BA623F632F8801B72B6DF52A41F192E77FE06B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\7z-out\vulkan-1.dll
Size 938KB
SHA256 45adc3dac19684ed3af159ae3914fbbf2426a879e5a4c1e678e3c9b451fab01a
MD5 8bd643a9f7ef2619b792cf2544f27a8c
SHA1 8d5aba34d852c9b9f62a4dca5ca138dbc458c931
SHA512 8a81c4edde9d20ee24d3390338915f096a27956bf57815c443a37f15bdb4072a0c959376721d2354fd565045efb3340922a9a22f3293bb3784cc6df6a0ac353b
SSDEEP 24576:gawxZ1onv5Sp+D9R6StDWb36Z5W1DYsHq6g3P0zAk7Mh:dSSApY90IDWb36Z5W1DYsHq6g3P0zAkw
TLSH
T163155B23AA94456AD476D034D9828603CAB178911726B9CF03B81708BF6FFF4777DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5508_102227441\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5508_102227441\CRX_INSTALL\manifest.json
Size 626B
SHA256 279bf453dd0572dcf4a326cb7df9fa9d296a2921ef96abdb1956a813268d78cb
MD5 b9d00380c0947d7ba5fd1efcbb8a7347
SHA1 fa8ef5bce53e46999cdd957da6113b37d04e116d
SHA512 577b235564c77be3050f2aa0e1b6986bcd3d38b09a792a01f943d7d85efccc43bdc9659aaa3b81311bddc1bcce47faf4f3d3eca77d955ee2fe93fa6b095f0c13
TLSH
T17CF04677EA1D482746F057A4E864B189FA22175FA0A05C063AFC542E0FB01AB0A03B2D
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 a7d11de028be969828fab6afa77701684853db75af0a62ead03138e6ff063059
MD5 5dbb34cc3382af7f41dd0e24be9338c1
SHA1 960ffb531479bf7380cff46dc812ff1a9196ad07
SHA512 31ca60925d1ceaeedb15bd22e64aa365145968d128e53ec5f1a7a04af2a7164974dc0cbe9a19ec53272e89a143a2d869dd7676e72ca6e14a298c933280c92583
SSDEEP 96:ao+miCewVuFukvhkvCCtgcDQHoQfcDQHoQM:T58wEcgcDHQfcDHQM
TLSH
T184D1B01023F7064AE5F68F39E8B6A720A231B801DF07DBCF125051099C7561AF97576F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 2528e4b432f673bfab8c481c8e53933f3240920c7864c46c471f4e5b668f8ba6
MD5 89bd1b8ada8af9bfd33f9ea625918e06
SHA1 933b50d31a5bba4bd61cfcded149adc8ec2aef8b
SHA512 2e03021b1a913641c7f23bd18ee7a9655b6a2d335f39d990b0552338b78bc34d0a3ea6bf6ed34338e867909f2a8d752c0b96b0ae67f0cb5b1f47d27389a8ec20
SSDEEP 96:P/o+mMCcwyxFukvhkvCCtgcDQHoQfcDQHoQM:Pw5YwecgcDHQfcDHQM
TLSH
T12DD1BF1053F7064AE5F68F39E8B6A721A231B801DF07DBDF12509108AC7561AF9B572F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 0022e33997ed2c5a841331128b60be29d96d7f22adabf75b26d3ec2731148aef
MD5 779ccbd2844fe7fd35a78836d6b9df6c
SHA1 c3f9cee17d4360f479e7d2eec43c7a907579f75f
SHA512 f76ff7ff1e6a58aea882cb29ffb573bf069bd162fe33fd191b01884e91e9a22d3bcef13569ef706e67df47ce1442635701e8fb8452728ba6b674ce3e63187469
SSDEEP 96:Mo+mMCcwyxFukvhkvCCtgcDQHoQfcDQHoQM:95YwecgcDHQfcDHQM
TLSH
T1ADD1BF1053F7064AE5F68F39E8B6A721A231B801DF07DBDF12509108AC7561AF9B572F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 afa097773a2df83dbf347a45f43649f704358db4a4d8680daf66452d3b5f1b5b
MD5 2fbc3343f86515d213f3b03de356a1e6
SHA1 c3b0eded3829c78622e9acf95b76af4ba2d2bc32
SHA512 22c3925f72ceb1fe9c28d74df653c8e330f5a8f42b97ad1520eb325aa8c9860951a3c3b19a332b9ea73c0d4bcafed1343fbce3d06572f3de2a5e1a0cd730b311
SSDEEP 96:bo+mMCcwyxFukvhkvCCtgcDQHoQfcDQHoQM:85YwecgcDHQfcDHQM
TLSH
T178D1BF1053F7064AE5F68F39E8B6A721A231B801DF07DBDF22509108AC7561AF9B572F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\WuWa Arabic Launcher\Network\Network Persistent State
Size 855B
SHA256 14a943cda4fba2c3f3c148351073a7d432109c9dac8654dee2fdbe5ed443786c
MD5 c1129fff285f89dec99559bcbed61056
SHA1 031652ec9402c7d2fa287254b4822159aa50b060
SHA512 e01e69eed16e07ec3a0b1dba2c60db3a822c5ffab0e7bafef0a9542a174216ab707cc024f95a0a1bb779da34d5f65c08f7097f03d7f6ee94f06140b9268a53f5
TLSH
T1D3116B97C7D8897E4A5213F52A253D23C5BE092853293D03C8D8EF9E97F5876560054E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5985d0.TMP

Path C:\Users\Admin\AppData\Roaming\WuWa Arabic Launcher\Network\Network Persistent State~RFe5985d0.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\WuWa Arabic Launcher\settings.json
Size 148B
SHA256 7a1a216509bd1cb5e849c0bc0098aa9622f634a04cd506a6d48c19cd9f70297c
MD5 e3a54a826b275e0bbe43f3256674e286
SHA1 dd600341ccf76e1d81884a209bd5ae90066d7247
SHA512 e32494cd6b201ae9f094320c9c03eae02107457be91554b0c4959b02c188a8acd95045794edd0dcf2a9d4c93f9d510acd3a0305cfdf49f987da2885a01d63ad3
TLSH
T1D8C04C106221953725E463201232558E75505ED631A47578F766AA157A8C8BA04BA51B
MD5 SHA1 SHA512 TLSH

Submit Download

arabicEtrdream.exe

Path C:\Users\Admin\Documents\WuWa AR Launcher\Client\Content\Paks\~mods\arabicEtrdream.exe
Size 30.3MB
SHA256 1be60bb02e606972d13e0887ecb1290646ebe2da622c7c36cf5d968a45165f03
MD5 dd3584f6842c7db863f959ae5cf0054e
SHA1 f6662085480663e020fbe9f73b1a2064fc5dbfb3
SHA512 4258ff53d36c218bffb8bb8088a11abf7e2ffd030d828d62f97319b51a0f27929df5a102a5d8ae741c2ad3009a972846aaa0ca3e995b4f2893a3fdef4d0e3c17
SSDEEP 786432:A1znxv2JL0ZnlNLA1mKvuToWAGWqNg1ZtAXyoSAZpW/:AlnddZnk1J0oZ1vo1Zp6
TLSH
T1066733D626D04847EB5E953955E605FA82F2BD20EE60894B0BFCBA982D733C4DD32770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/428-700-0x00000239FDE20000-0x00000239FDE42000-memory.dmp

Download

memory/1184-425-0x00007FFA0BD00000-0x00007FFA0BD01000-memory.dmp

Download

memory/1184-426-0x00007FFA0C1B0000-0x00007FFA0C1B1000-memory.dmp

Download

memory/4204-490-0x0000020C67B90000-0x0000020C67B91000-memory.dmp

Download

memory/4204-488-0x0000020C67B90000-0x0000020C67B91000-memory.dmp

Download

memory/4204-482-0x0000020C67B90000-0x0000020C67B91000-memory.dmp

Download

memory/4204-481-0x0000020C67B90000-0x0000020C67B91000-memory.dmp

Download

memory/4204-493-0x0000020C67B90000-0x0000020C67B91000-memory.dmp

Download

memory/4204-492-0x0000020C67B90000-0x0000020C67B91000-memory.dmp

Download

memory/4204-491-0x0000020C67B90000-0x0000020C67B91000-memory.dmp

Download

memory/4204-489-0x0000020C67B90000-0x0000020C67B91000-memory.dmp

Download

memory/4204-487-0x0000020C67B90000-0x0000020C67B91000-memory.dmp

Download

memory/4204-483-0x0000020C67B90000-0x0000020C67B91000-memory.dmp

Download

memory/5376-1009-0x0000017062020000-0x0000017062AE2000-memory.dmp

Download

memory/5836-2355-0x0000022ABC6B0000-0x0000022ABCD9D000-memory.dmp

Download

memory/5836-2056-0x0000022ABC6B0000-0x0000022ABCD9D000-memory.dmp

Download

memory/5836-2055-0x0000022ABC6B0000-0x0000022ABCD9D000-memory.dmp

Download

memory/5836-2054-0x0000022ABC6B0000-0x0000022ABCD9D000-memory.dmp

Download

memory/5836-2053-0x0000022ABC6B0000-0x0000022ABCD9D000-memory.dmp

Download

memory/5836-2051-0x0000022ABC6B0000-0x0000022ABCD9D000-memory.dmp

Download

memory/5836-2050-0x0000022ABC6B0000-0x0000022ABCD9D000-memory.dmp

Download

memory/5836-2046-0x0000022ABC6B0000-0x0000022ABCD9D000-memory.dmp

Download