hxxps://www[.]blockbench[.]net/

Analysis

user interaction
yes
max time kernel
89s
max time network
86s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.blockbench.net/
Sample260722-b68cmaxcjc

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
57	4996	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Blockbench.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Blockbench.exe

Executes dropped EXE 6 IoCs

pid	Process
3064	Blockbench_x64_5.1.5.exe
3076	Blockbench_x64_5.1.5.exe
3636	Blockbench.exe
5252	Blockbench.exe
5452	Blockbench.exe
5512	Blockbench.exe

Loads dropped DLL 26 IoCs

pid	Process
3064	Blockbench_x64_5.1.5.exe
3076	Blockbench_x64_5.1.5.exe
3064	Blockbench_x64_5.1.5.exe
3076	Blockbench_x64_5.1.5.exe
3064	Blockbench_x64_5.1.5.exe
3064	Blockbench_x64_5.1.5.exe
3064	Blockbench_x64_5.1.5.exe
3064	Blockbench_x64_5.1.5.exe
3064	Blockbench_x64_5.1.5.exe
3064	Blockbench_x64_5.1.5.exe
3064	Blockbench_x64_5.1.5.exe
3064	Blockbench_x64_5.1.5.exe
3064	Blockbench_x64_5.1.5.exe
3064	Blockbench_x64_5.1.5.exe
5252	Blockbench.exe
5252	Blockbench.exe
5252	Blockbench.exe
3076	Blockbench_x64_5.1.5.exe
3076	Blockbench_x64_5.1.5.exe
5252	Blockbench.exe
5252	Blockbench.exe
5252	Blockbench.exe
5512	Blockbench.exe
3076	Blockbench_x64_5.1.5.exe
3076	Blockbench_x64_5.1.5.exe
3076	Blockbench_x64_5.1.5.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
1432	powershell.exe
5464	powershell.exe
2512	powershell.exe
4792	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2980	powershell.exe
4980	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blockbench_x64_5.1.5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blockbench_x64_5.1.5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4996	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Blockbench.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Blockbench.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Blockbench.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Blockbench.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291584019890893"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\.bbmodel\ = "Blockbench Project"	Blockbench_x64_5.1.5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Blockbench Project\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Blockbench\\resources\\bbmodel.ico"	Blockbench_x64_5.1.5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Blockbench Project\shell\open\ = "Open with Blockbench"	Blockbench_x64_5.1.5.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\.json	Blockbench_x64_5.1.5.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Blockbench.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Blockbench.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Blockbench.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Blockbench.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\.bbmodel	Blockbench_x64_5.1.5.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\.json\OpenWithProgids	Blockbench_x64_5.1.5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Blockbench.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Blockbench.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Blockbench.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Blockbench.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Blockbench.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Blockbench.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Blockbench.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\JSON Model\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Blockbench\\resources\\json.ico"	Blockbench_x64_5.1.5.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\JSON Model\shell\open\command	Blockbench_x64_5.1.5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Blockbench.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Blockbench Project	Blockbench_x64_5.1.5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Blockbench Project\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Blockbench\\Blockbench.exe \"%1\""	Blockbench_x64_5.1.5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\.json\OpenWithProgids\JSON Model = "0"	Blockbench_x64_5.1.5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Blockbench.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\JSON Model\shell	Blockbench_x64_5.1.5.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Blockbench.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Blockbench.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Blockbench.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\.bbmodel\OpenWithProgids	Blockbench_x64_5.1.5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\JSON Model\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Blockbench\\Blockbench.exe \"%1\""	Blockbench_x64_5.1.5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Blockbench.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Blockbench.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Blockbench Project\shell\open	Blockbench_x64_5.1.5.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Blockbench.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Blockbench.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\JSON Model\shell\open\ = "Open with Blockbench"	Blockbench_x64_5.1.5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Blockbench.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{E6095B4A-5FB2-46C5-9D5C-51BBAD6F4930}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Blockbench.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Blockbench.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Blockbench.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\JSON Model\DefaultIcon	Blockbench_x64_5.1.5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Blockbench.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Blockbench.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\.bbmodel\OpenWithProgids\Blockbench Project = "0"	Blockbench_x64_5.1.5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\JSON Model\	Blockbench_x64_5.1.5.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\JSON Model\shell\open	Blockbench_x64_5.1.5.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	Blockbench.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Blockbench.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Blockbench Project\	Blockbench_x64_5.1.5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Blockbench Project\shell\ = "open"	Blockbench_x64_5.1.5.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Blockbench Project\shell\open\command	Blockbench_x64_5.1.5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\.json\ = "JSON Model"	Blockbench_x64_5.1.5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Blockbench.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Blockbench Project\shell	Blockbench_x64_5.1.5.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\JSON Model	Blockbench_x64_5.1.5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\JSON Model\shell\ = "open"	Blockbench_x64_5.1.5.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Blockbench Project\DefaultIcon	Blockbench_x64_5.1.5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Blockbench.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Blockbench.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Blockbench.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Blockbench.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2980	powershell.exe
2980	powershell.exe
2980	powershell.exe
2512	powershell.exe
2512	powershell.exe
2512	powershell.exe
3064	Blockbench_x64_5.1.5.exe
3064	Blockbench_x64_5.1.5.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
4980	powershell.exe
4980	powershell.exe
4980	powershell.exe
4792	powershell.exe
4792	powershell.exe
4792	powershell.exe
3076	Blockbench_x64_5.1.5.exe
3076	Blockbench_x64_5.1.5.exe
5464	powershell.exe
5464	powershell.exe
5464	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeIncreaseQuotaPrivilege	1432	powershell.exe
Token: SeSecurityPrivilege	1432	powershell.exe
Token: SeTakeOwnershipPrivilege	1432	powershell.exe
Token: SeLoadDriverPrivilege	1432	powershell.exe
Token: SeSystemProfilePrivilege	1432	powershell.exe
Token: SeSystemtimePrivilege	1432	powershell.exe
Token: SeProfSingleProcessPrivilege	1432	powershell.exe
Token: SeIncBasePriorityPrivilege	1432	powershell.exe
Token: SeCreatePagefilePrivilege	1432	powershell.exe
Token: SeBackupPrivilege	1432	powershell.exe
Token: SeRestorePrivilege	1432	powershell.exe
Token: SeShutdownPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeSystemEnvironmentPrivilege	1432	powershell.exe
Token: SeRemoteShutdownPrivilege	1432	powershell.exe
Token: SeUndockPrivilege	1432	powershell.exe
Token: SeManageVolumePrivilege	1432	powershell.exe
Token: 33	1432	powershell.exe
Token: 34	1432	powershell.exe
Token: 35	1432	powershell.exe
Token: 36	1432	powershell.exe
Token: SeSecurityPrivilege	3064	Blockbench_x64_5.1.5.exe
Token: SeShutdownPrivilege	3636	Blockbench.exe
Token: SeCreatePagefilePrivilege	3636	Blockbench.exe
Token: SeShutdownPrivilege	3636	Blockbench.exe
Token: SeCreatePagefilePrivilege	3636	Blockbench.exe
Token: SeShutdownPrivilege	3636	Blockbench.exe
Token: SeCreatePagefilePrivilege	3636	Blockbench.exe
Token: SeShutdownPrivilege	3636	Blockbench.exe
Token: SeCreatePagefilePrivilege	3636	Blockbench.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeShutdownPrivilege	3636	Blockbench.exe
Token: SeCreatePagefilePrivilege	3636	Blockbench.exe
Token: SeShutdownPrivilege	3636	Blockbench.exe
Token: SeCreatePagefilePrivilege	3636	Blockbench.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeShutdownPrivilege	3636	Blockbench.exe
Token: SeCreatePagefilePrivilege	3636	Blockbench.exe
Token: SeDebugPrivilege	5464	powershell.exe
Token: SeShutdownPrivilege	3636	Blockbench.exe
Token: SeCreatePagefilePrivilege	3636	Blockbench.exe
Token: SeShutdownPrivilege	3636	Blockbench.exe
Token: SeCreatePagefilePrivilege	3636	Blockbench.exe
Token: SeIncreaseQuotaPrivilege	5464	powershell.exe
Token: SeSecurityPrivilege	5464	powershell.exe
Token: SeTakeOwnershipPrivilege	5464	powershell.exe
Token: SeLoadDriverPrivilege	5464	powershell.exe
Token: SeSystemProfilePrivilege	5464	powershell.exe
Token: SeSystemtimePrivilege	5464	powershell.exe
Token: SeProfSingleProcessPrivilege	5464	powershell.exe
Token: SeIncBasePriorityPrivilege	5464	powershell.exe
Token: SeCreatePagefilePrivilege	5464	powershell.exe
Token: SeBackupPrivilege	5464	powershell.exe
Token: SeRestorePrivilege	5464	powershell.exe
Token: SeShutdownPrivilege	5464	powershell.exe
Token: SeDebugPrivilege	5464	powershell.exe
Token: SeSystemEnvironmentPrivilege	5464	powershell.exe
Token: SeRemoteShutdownPrivilege	5464	powershell.exe
Token: SeUndockPrivilege	5464	powershell.exe
Token: SeManageVolumePrivilege	5464	powershell.exe
Token: 33	5464	powershell.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
3636	Blockbench.exe
3636	Blockbench.exe
3636	Blockbench.exe
3636	Blockbench.exe
3636	Blockbench.exe
3636	Blockbench.exe
3636	Blockbench.exe
3636	Blockbench.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
3636	Blockbench.exe
3636	Blockbench.exe
3636	Blockbench.exe
3636	Blockbench.exe
3636	Blockbench.exe
3636	Blockbench.exe
3636	Blockbench.exe
3636	Blockbench.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3636	Blockbench.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 3492	984	msedge.exe	84
PID 984 wrote to memory of 4996	984	msedge.exe	85
PID 984 wrote to memory of 5052	984	msedge.exe	86
PID 984 wrote to memory of 5052	984	msedge.exe	86
PID 984 wrote to memory of 4508	984	msedge.exe	87
PID 984 wrote to memory of 4508	984	msedge.exe	87
PID 984 wrote to memory of 4508	984	msedge.exe	87
PID 984 wrote to memory of 4152	984	msedge.exe	89
PID 984 wrote to memory of 4152	984	msedge.exe	89
PID 984 wrote to memory of 4152	984	msedge.exe	89
PID 984 wrote to memory of 3940	984	msedge.exe	90
PID 984 wrote to memory of 3940	984	msedge.exe	90
PID 984 wrote to memory of 3940	984	msedge.exe	90
PID 984 wrote to memory of 3604	984	msedge.exe	91
PID 984 wrote to memory of 3604	984	msedge.exe	91
PID 984 wrote to memory of 3604	984	msedge.exe	91
PID 984 wrote to memory of 708	984	msedge.exe	92
PID 984 wrote to memory of 708	984	msedge.exe	92
PID 984 wrote to memory of 708	984	msedge.exe	92
PID 984 wrote to memory of 4408	984	msedge.exe	97
PID 984 wrote to memory of 1860	984	msedge.exe	98
PID 984 wrote to memory of 4408	984	msedge.exe	97
PID 984 wrote to memory of 1860	984	msedge.exe	98
PID 984 wrote to memory of 1548	984	msedge.exe	100
PID 984 wrote to memory of 3960	984	msedge.exe	101
PID 984 wrote to memory of 3960	984	msedge.exe	101
PID 984 wrote to memory of 3960	984	msedge.exe	101
PID 984 wrote to memory of 1732	984	msedge.exe	102
PID 984 wrote to memory of 1732	984	msedge.exe	102
PID 984 wrote to memory of 4780	984	msedge.exe	103
PID 984 wrote to memory of 4780	984	msedge.exe	103
PID 984 wrote to memory of 4780	984	msedge.exe	103
PID 984 wrote to memory of 2360	984	msedge.exe	105
PID 984 wrote to memory of 3092	984	msedge.exe	106
PID 984 wrote to memory of 3880	984	msedge.exe	107
PID 984 wrote to memory of 3880	984	msedge.exe	107
PID 984 wrote to memory of 3880	984	msedge.exe	107
PID 984 wrote to memory of 3064	984	msedge.exe	108
PID 984 wrote to memory of 3076	984	msedge.exe	112
PID 984 wrote to memory of 2424	984	msedge.exe	119
PID 984 wrote to memory of 3256	984	msedge.exe	120
PID 984 wrote to memory of 3532	984	msedge.exe	121
PID 3064 wrote to memory of 2980	3064	Blockbench_x64_5.1.5.exe	122
PID 3064 wrote to memory of 2512	3064	Blockbench_x64_5.1.5.exe	124
PID 3064 wrote to memory of 1432	3064	Blockbench_x64_5.1.5.exe	126
PID 984 wrote to memory of 5216	984	msedge.exe	132
PID 984 wrote to memory of 5216	984	msedge.exe	132
PID 3636 wrote to memory of 5252	3636	Blockbench.exe	133
PID 3636 wrote to memory of 5252	3636	Blockbench.exe	133
PID 3636 wrote to memory of 5452	3636	Blockbench.exe	134
PID 3636 wrote to memory of 5512	3636	Blockbench.exe	135
PID 3076 wrote to memory of 4980	3076	Blockbench_x64_5.1.5.exe	138
PID 3076 wrote to memory of 4792	3076	Blockbench_x64_5.1.5.exe	140
PID 3076 wrote to memory of 5464	3076	Blockbench_x64_5.1.5.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.blockbench.net/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffa0554c188,0x7ffa0554c194,0x7ffa0554c1a0
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,8000783732120113243,13142556187953080092,524288 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,17731230623563173059,9371588361729371543,524288 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,16621773928657563867,3140035091908346017,262144 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,10386996407173617710,7120489079539997950,2097152 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,3642743026710578781,3927613490689029808,2097152 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,2517409207733394180,10072604255321088113,2097152 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,13835919445549561479,8349436581163312776,2097152 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,6355897927266949808,17046993685367120587,524288 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,13052995897492190864,8829485297097343695,524288 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,12271653281574229414,15069664106184461344,524288 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,12271653281574229414,15069664106184461344,524288 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6312,i,5701746500826777607,2346738072375157134,2097152 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,12133510302568825991,11865532473285492019,524288 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6300,i,12292153384936608570,293296937913708173,2097152 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,6570108131711898120,10292917442539794377,524288 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=124 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,6570108131711898120,10292917442539794377,524288 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=124 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,12904850128625986651,8912766938694689903,524288 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6396,i,11587419608862382956,10310990761970833491,2097152 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:3880
- C:\Users\Admin\Downloads\Blockbench_x64_5.1.5.exe
  "C:\Users\Admin\Downloads\Blockbench_x64_5.1.5.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Blockbench', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- C:\Users\Admin\Downloads\Blockbench_x64_5.1.5.exe
  "C:\Users\Admin\Downloads\Blockbench_x64_5.1.5.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Blockbench', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,14982478401927680581,13449238299334709166,524288 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,8894713136267999894,7880315606513145942,524288 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,14987290632463597989,10824397830312729092,524288 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,3008804098940623010,779857071054741127,524288 --field-trial-handle=2308,i,8634869154440722839,12648924320474317954,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1704

C:\Users\Admin\AppData\Local\Programs\Blockbench\Blockbench.exe
"C:\Users\Admin\AppData\Local\Programs\Blockbench\Blockbench.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Users\Admin\AppData\Local\Programs\Blockbench\Blockbench.exe
  "C:\Users\Admin\AppData\Local\Programs\Blockbench\Blockbench.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Blockbench" --gpu-preferences=SAAAAAAAAADgAAAMAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,11204612016242815929,13437755884540032525,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5252
- C:\Users\Admin\AppData\Local\Programs\Blockbench\Blockbench.exe
  "C:\Users\Admin\AppData\Local\Programs\Blockbench\Blockbench.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Blockbench" --field-trial-handle=1836,i,11204612016242815929,13437755884540032525,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Executes dropped EXE
  PID:5452
- C:\Users\Admin\AppData\Local\Programs\Blockbench\Blockbench.exe
  "C:\Users\Admin\AppData\Local\Programs\Blockbench\Blockbench.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Blockbench" --app-path="C:\Users\Admin\AppData\Local\Programs\Blockbench\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1836,i,11204612016242815929,13437755884540032525,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2544 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 c03c91dd74498cc33a32d616fb3050ad954ed4f57e671e2e9651aedb7b128ff3
MD5 d30f23b777856a4a772cbe961f7b3343
SHA1 7b4f11fe65abb9620e0dbfeee619097a4648e70d
SHA512 64fa5e6ca5021734b620f79ded479d44ce30d4bd58ae9cdbee49fe1b251d6bd779a3b62708afafe90c37491259efc348d7fb2cb774d74668671c6295dca793d3
TLSH
T1E4415C303221B8D84D436F1315286ED5A3EF478AAFA89F5CB569231DCD2A45BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 897d3503e47640b248fc82e97b0f84e127c9445832d12e41743d850c242c2be2
MD5 afbd644700e26cc385793dccd4e87a51
SHA1 5d54a3346d74ab1667bbd18c1e17d9e548596d21
SHA512 97e2c9c0cce06787fc41abb01dedee34006c0e60414d2bbeba0c3322e499412885d54441cf816bbdd521ef6e34ccdf687cd5a027dd19d0f2ad0ffa970c013384
TLSH
T19871F736223100E3FF31417639C16215F87CADEEF6AFEF2A5954C8B71D59711D2A8508
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5884fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5884fa.TMP
Size 3KB
SHA256 a4178d16bdaac07955b9c7f2c671466831c016dc00441eb78af7124f5b7c21df
MD5 f7e6c24481553fce4522caad4495f039
SHA1 7f3b8973bce7d2acf3bfba188a1eecd6e9750184
SHA512 8221647ee7f611ddda63be544b62e1cd2d6973cbfb7bf39f7acb328280c676b791c5b616a7266b9fd2de6a06d347f2a483b8538e5ec5100c6e15eb49f457b5d2
TLSH
T14071C336222100E3FF31417239C16201F97DBCEEF6AFEF2A4964D4B71D69712D1A9918
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 41bd904324dff659355c691402352e700eda9de50acd26d2b8076c0cb00f0085
MD5 c5f09bf6f7e7c6dbe8aafd1529daf3c9
SHA1 422d75d17bdec3fa51a8deb8ed928f5ff7879b21
SHA512 7f7fd65a2a0d9da7698276ba882c363967c22c3d3a37e000cc76fb221e94ad2a1bb272687515575c396122a3ae854f5f3b891625b1c2681e0ed576f7ef251162
TLSH
T103419BF283E4C66E891116F1AB186E2BCE1D051493283C2AC9E5EF47D3E3472E10175B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 281a6080bd06915126737c467c21e0995e62a51c78e023f1881a38a0d0778535
MD5 960024255446f47a39bd9133c01590f4
SHA1 93a527ae26509d16f6784adf41490e65e1872827
SHA512 81b8bafedc778f2a8bb93b2345bb12659291bfa7dcfb87ae41d32ca3cb0a957f8c6d74eebea8f0fb2a96ddd1beda79fa0eea0b30851e6d741b844457f411cd04
SSDEEP 192:sxZLRVyM/jK1Ml8M9i/fks4TFIdpnNHW6+WNbbR/YIbSNQIgrJ:sxZLP1i/fks4T2NHbZ/n9
TLSH
T18252E816AA345977CCDBD209FA45BF53D5F90472E2901E48A9FCDA0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7dab751dec681099650593fb4f59ed617b277e1041d8280906c6696c294ed224
MD5 0d5c48626314d5abc33080fd1c3bd68a
SHA1 f829805d9739a7ea46bf8e2a1ce74215c31451d8
SHA512 015ad7cfd9a5cd9db9cfea230102b1789861157aca2146dbef292e24fb719bf1a193c33de6e622033cdcaa18575fc37e786520893dbd795719c9188d7f086eb0
SSDEEP 768:WQsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR95rozfF:WQsqxXlWvJD6Tu1ja54LAs9yz9
TLSH
T139D21B3B694CCB7E4F840E5DEC266FD76ED801CBA7988D5447FA880C02CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 63c8e82e154554b68aabf7dd7b403fe4103343392b563bd2e949a27c590e690f
MD5 bb42cd245cf371ba8bb3411e5065241b
SHA1 c5efbcc084dcdcb40cc7a60f275a828a90b05825
SHA512 ac35484a908449c6c7837408ace501ae11425f675718f18ed9853132a576cf55e448d6f81e59b240d11ca11afa12d217f9492ddb7c2165baa7f52a4661735683
SSDEEP 96:KYbaKYIKmXGKwg2uzCnTRZZezpoFhzeKZrhFe9bzg16yBmSgYI2qYX9IS2KwTIUl:ExN9uzCnTRZZEpojzzrhFYbzg18ldP
TLSH
T158E13A2236770202397E2908E3AEC5779E5376633418E46F3B7850615EA7E222DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6b4794fbbe660a918cc305c7c481a9a9c81673c286e5ddcfa18e9a058320a9c7
MD5 7ba3b4804a65ef637d21a527020a4509
SHA1 70c36bc2cec5654e7ebacc4aa4dc6a0d81c6dd76
SHA512 ff187e6e7d631253a614cf2d88d7083467b3b6310940d5bed65b41624c3b99b9d21af69a02c3ef1c0c381de40e8856120dccfb8aab4d3429b7443a2c0446c25e
SSDEEP 384:OtNn/s3n9SmsNjv8bX7T2VRNNOE+l9R+26KScjmwYzI:Oj+91RTUHNOEI9Rl6K1jkk
TLSH
T1B0927C377D285C669EE29546F44B36178FB890A7DAC52F80C4E86F0E01DB6AC431B936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a7f41ac5548845fe9ade2458f22f31be120eb2a780b190b8fe615106aae39c89
MD5 ca02571b9b89d68075c7460ae206822b
SHA1 b02c62d397706c6e5d60091495f92d47c297b00b
SHA512 860938c42d68bcf6b0767f75dc7e5728439278a095f5f4118672d3046b9aaf22f0808587ef5c7e0efe3c7fec8e25c1219170b08234715db5fe13451f296540a6
SSDEEP 384:ytNn/s3n9SmsNjg8bX7T2VRNNOE+l9R+26KScjmwYzI:yj+91iTUHNOEI9Rl6K1jkk
TLSH
T17B928C377D285C669EE29546F44B36178FB89067DAC52F80C4EC6F0E01DB6AC431B935
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7ad978ca4367c086251ef15f2443a79a7dfef3d30a791ed8cee764ddd6cfa9c4
MD5 09c26080831a5458b8d6f0995d181f96
SHA1 6023e162738f84775f416ec3674dfc87886ce50b
SHA512 ca71bfaa3a2db2fdf065179b67b782d2b571d9a811c674244588c9f97fad518b3845b85b96b5d3d7589dabb1dc848b57b4fdf3c90d34066820a4401fbdd1dd50
SSDEEP 192:tON16JkRtQmiUynzW+RNNOmz+ih3YRIU6:tON16UrYW+RNNOE+6vU6
TLSH
T13402D9357D382C7B9EE26E05B58B27275FA8203BFA856F80D6D81F1C01D765C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f098485f9e5ba7988c5bfd274946fb638460095e9a4717961a0eb08a44322527
MD5 0636054a71a9280e928851af80a96edc
SHA1 44f9c2aa318227358f59ccacf736387cbb59bb59
SHA512 60a87cabc8383caac6252caf6639dae27e3ed50cb273c29e50c7412910c09dd84d1e52e93d735aabe99eb9474c315befc0350b9088d54f866f794fae0377e5b0
SSDEEP 192:ukLsNjEtQz2kRbtSdQmiU1H1T8BVRNNOmz+7R9R+27SRsqutU8:fsNjC8bQb7T2VRNNOE+l9R+26KU8
TLSH
T1B23229367D285C765EE2A945F44B36139FB8402BEB892F84D1DC4F0C02EF6AC131A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5ae2db6de4be36ea7702cd4d3ed79e1de2879289eaf667d55d6b1761256df0a0
MD5 5d89e6414cd71d2a4328d8cf9bf7e50e
SHA1 37f4c82c50748adb75377e3cc3e0905d59aec909
SHA512 49179718dd123c54a64f8b1f324384f0daa6a98d7e5b5df20b346e84fd17f5487d129204c505faac6804f8ed598345d3730aafb56ca40f61c05162acc1b91f20
SSDEEP 192:ION26JkRDQmiUy7zu+RNNOmz+7R9R+2aVcsqutU6:ION26U1+u+RNNOE+l9R+2NKU6
TLSH
T163120A3679285C775EE26945F48B32174FA95127EB8A6F90D1D81F0C02EFAAC134B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6bd743008a8c83e0ffa55d75baf1540cc2e0de7e423fe3054f524c69bf9b1c4c
MD5 ec00073e549ca12db2f04813f9b1a540
SHA1 0134f4aea1992c95afcec15fbcc744890fa54ae9
SHA512 34799c1fe3b8d28619388101aedf6a217b55abc6c9fd8eed8b5f998aebfddd6ec361508375b625c476acfc448c146d5fb9865a83793ecb26f23268eccfaa6bf1
SSDEEP 384:SiFktNn/s3n9SmqsN98TUNTUlIlg8bXFT2VRNNOE+l9R+2BKScjmwYzI:ZFkj+98EwgXTUHNOEI9RlBK1jkk
TLSH
T124C22AF359D74876D9AE4B47B73E2E128EBCC063F5815A40B3985A0DCC9A1BFC306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f8d80ef-c1ea-4260-bf24-f5ff2c506006.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1f8d80ef-c1ea-4260-bf24-f5ff2c506006.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d4cad2bc26d12da0208df855101aba8e983918f7c4672259bea130fb6a553c7f
MD5 ad8c7946caf4cf350bb499ae630118e2
SHA1 b461d6e681239c8c5d91a66e663f4e2b6d20f13c
SHA512 c013fec43848bddd93929315f06ca98bcb5f97bc4365de7e046a89d22a361467c4ebe0b1c03315098c565718576f57f24b0d613c6400d8191ae6ca5791e79225
TLSH
T1BE41D658B6E95148B3B36E5AABF6A86E447FBD772E4AD05E00110D4F0662E40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 bca0b4d737a347aaf2700abe27a22babbe4688b59ba2b0b2cfb0b10fa2d23482
MD5 e6254dff9cb64077e73d4f20a63be51a
SHA1 69e03bef18eb9a9e0a951b10ecb08a8eb2aa08cf
SHA512 0ce6d51eba57ca12419c31642b8cc1267dfa9e27f68a558b980963b67cb761c661b08fe888fba09bfba14269e58b29e46c6f2bce7aa7df67496e832fa29a6585
SSDEEP 384:wsf+Fu9i+G0qtGqm3VQFzk+o9o2TpK6seY2wE/uv3KoJhf/hEacj2m:9fu0qtGvVAIjo2TpNPfUK0BEaC
TLSH
T15972B4AE610F16C3C8961378D10B055FE4F2DECD531A03D9BA5A9F3B4EACA5E943C188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 5f1e8dfd7409c5132809206e905bf7231a5d7ae8808e397b66e15bbdfe65a5f3
MD5 1388afd942e70cc44d43cb65f5710047
SHA1 3661e51904df1b24e9ba906749c060af7ed83c8c
SHA512 4c450377ea770cf192be834aca605cb9f0b87c86b793b7d8d0f5f9cb6f1c85450eac6f0909671f53ff901fa376b0069b0f4779ae74bfb268d8ebfe0f1dae784f
SSDEEP 384:a6++S991RwChfqpVNho4UL67UkoFfjXi+P7QdMDPdS:HqRwDXNFULaUtFfri+EdMQ
TLSH
T1FF72C5AD622F2296E16122F4C4268BEFF9F05DCFD38446DD6780893B06CB76554E81F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Programs\Blockbench\locales\pt-PT.pak
Size 641KB
SHA256 1001af3f01e2e52b535b8c9f9e37f356998b597ffe6bfa90d23a2500d0efc3a4
MD5 cfad5cb76c2a50a33aa6eefdabc1f8ba
SHA1 4c2041fefb3bf9b7142f81cd95f325174b7702f9
SHA512 015c7364b59f01137a3edbc3c3c163d9b0c376b242e6f82e5ef2614275c47f1529fd89ed29fa7eb2055018663762231e8c9cb98c7e769050e49f3707e218b78c
SSDEEP 6144:kMHX9cyaSq/TE+kxTieJVJJxhLREWNh4fDA9nBis8zSRnC:dNc7SqnEZ9nBczSRC
TLSH
T1A6E4192C6EDA136605135341770ADB03EAC86685F809CB87C9EF0B4672CDF94D6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vkn3opq5.prx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vkn3opq5.prx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\LICENSES.chromium.html
Size 15.3MB
SHA256 1145a9faaadf10f97ab6a1d0c5b7f74c6a2eae46b532f168a233b9a5cd7d52cf
MD5 632ae2b84ce5a7ae5c51dea5d5b66de6
SHA1 62d8d66952166c8c32de54aef13ab57bb7b6afa1
SHA512 f17fff1ae50d99b2454429bdb5ec5d39b9d5d9ac133297a5c8e16ca3451d35e3a95305c3c0588c0ea72eb8ced419ca62f0d42bf067e99f305088fae011688361
SSDEEP 49152:/NQpqPgnqRweTYp2kGYC+O3r8xd2zJQf8xF6D7gQdGxw:0
TLSH
T1CCF6B56BBB49037316F242626B4BA5CAF31EA03F375A1654309CC15C1B7B92483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\chrome_100_percent.pak
Size 112KB
SHA256 cbe052e9bd36032cde9d0ad7496d611c6a3c98a130b960e1298d490254be1159
MD5 129f8cee761c5bb414b2270356177f6c
SHA1 0a10b55daf24c7f9fff1b22f853dd87a98433b7d
SHA512 33f4ceb0ed18b2172e2f6d203ccab2954dd900592b2e62ce4a1019ab9404889ebdcf462a2479f1847c01b2835473e83859c77816e83ef76ee133990be3d55eb4
SSDEEP 3072:DS4PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:LYWFUbGz8LI1TnjQBQCrC
TLSH
T136B3D0D7B3B09D7DDA460BB783560170FCB31B2D06C2120A5A9AE479652BF88C8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\chrome_200_percent.pak
Size 182KB
SHA256 6593ba8ece63001a3fb77bd1d872566edeb26213a1be8e852dd956f6d0e2c93e
MD5 ed7b4e5eb15a086ce7e117a3228e3f15
SHA1 bb6debc27ed4e2f20149a17e36a24ef4482a96a7
SHA512 7278e0acdd8a1806bbdfd147d5439f7f849fbf95f1be1ffb741ea84cecad2557469e99f91cca66ce36349a9aa55d0107e34b9499b8fcb3e7fb3a8bbf84c1e911
SSDEEP 3072:CJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:7GQ+N6uSZQDQYakvyAkcjQBQNd4
TLSH
T1EB04F1D723B8AD3DD9570B73926610E0FE7A20291EB3110A5A9FD8397925E8CD9CD343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\dxcompiler.dll
Size 24.4MB
SHA256 ac082e3da7852e20fc434370594f485b181173e0b31d59bdf049cd698a166c30
MD5 4dd4610da8cb8493cd5ef3c4dde42cb6
SHA1 71403f9c8689a7006a5ba40651764ddd4aa1659c
SHA512 026145662b47f1179c63535cfcdd44c6a50bfdd4557b4527ee52de312d7777a2b76af8c7b79d737dc5bfe9fb5e7270b08ae1cc92d48fd4dc2d021c812d85c904
SSDEEP 393216:NDo0qtOp5zxtGlyWOLynvTWcRedqlB6P2RJ:yOPxBQvlk2
TLSH
T166473A122646D49CC059C879C7678B268A6C30E73FA7B9EBC0F451252B79EFC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 dac252b5f8305bb16b7cff7e9b345149d815fd7103b253b10e680fe6f9b18bf6
MD5 7c69d24304fefbacfb40508184016dba
SHA1 d78fed931d846be33fd2a505c73a63faf335db3f
SHA512 5d89c676896e6a36208adf31db2bf318e7a71e57fdb1bef195e41558379c48688d2e7657bfe35429584c9c4fcf5314ca6cf2736a3d4873f149484bea544976e2
SSDEEP 49152:TWP28bu0s6grWFv/iGOjeaGgQbalS199aJLKIbk7k64aoijQrNoJdxljA6iPyfI:T028bu0CKiGWeL1bal9ZrNoJaL
TLSH
T179E59E02F6D651EDD019C034979B9313F631780A4F209AEB16905A223F6BFD87E7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\libEGL.dll
Size 500KB
SHA256 7a5a93f4348142303fc1617b3751b922266ba1dc0b18332811bdcb70c0bd50d2
MD5 8a357d54f3d6a6aeddc3350046851873
SHA1 cb68378213af69be56255c55df9d50ab5d91db1a
SHA512 cf9b40bb4f908184a7e5c053f4876d9c964c79be705513bf35dc513b5b02521b916a95d15039d01ccf055744480f723a799d5a6300d9abdcac0fbef91e316892
SSDEEP 6144:RwKVOb8lys73EbAi3uYDbW1XJ5aihN5Iio64haxiVNcPPmWF3PdPN8kygV:RBKA3Z5XSiAaxiVNcPPmW1JN1
TLSH
T171B48E15F3E947A8D07AC0348A538646EB7574960B65F9DF02E052392F3BBF45A3E324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\libGLESv2.dll
Size 7.6MB
SHA256 3049c87eb4ae02a13a22de529d66d6fd5627e659bffbd6ad82c14056b5013f1c
MD5 5cdec47d0c0bcd5e5587b01ad6b4d687
SHA1 630e139cc13f9a23d962668d26fac5e48ce4af1d
SHA512 c46efccf10c7bcb685c4d45b1fbe75fadb1fd7cc180a1d8f9932e82228eb2803d420be1ecc3836a0fcd2ba1b84d856cf907ace12fa7e24150daba44d4a4fad1f
SSDEEP 98304:PZqKv5yzkjFgW3WkQ6HqVokbPdzix7ZSYm:BqKYkjF46Cokbsm
TLSH
T169866A03F69681D9C05DE274875BA223FA35B8450724B7CF2A9453252F6AFE0EB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\af.pak
Size 582KB
SHA256 f500ba115f773738d84feb12a909f8e9509f94b1d45bc86ff6eefdca6c7f1fa7
MD5 f1978bab9ca51bb7ca7c6bd7b240bbb1
SHA1 bec1cfc82a629ab6944a8015ec0fbc9326cae292
SHA512 422a06b47838df8689c0caf52d1592fc194f28cb6b2bbba83e7d65fa92048f66b309f19afb7fe2874cb300dea482c6a0a788f2fb5cb9c56e7ca95db41abcd9b0
SSDEEP 12288:CQbZNFR7xgtRGtlo/znPwlNBEKLF3GO3KL4H2JynPN+DgTALXkno0v/AImgD249D:DZrR7utRGtlo/bPwlNBEKLF3JKL4H2Je
TLSH
T15EC40B0BEB81173D09A07696FB0845B7FB5DA26CC770B2B6DDA982310566EFC11BD0D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\am.pak
Size 946KB
SHA256 4b2dcc369fb50860cc87929488aa9b6e35d973a5234b77ec907e2fe2a8790931
MD5 d2605307f09e91cdfe64dda22536961f
SHA1 d4a0b408703255d702a2776b690cbcbd211e235a
SHA512 9c7c3f64f39e804e9a178bfc807f0fdb799633218687fe326cb2bc36a2cb5466ca3b2b6b6eb723be88f3c7c7283fb6d984652b11b6b028fba717b9aa9ba54ea9
SSDEEP 24576:WVVjTe1QAQhTCKFyGtxkWjfjnLFTqzeHX2glFiJdVmUZWPk7:gw
TLSH
T188259A547EF9F7570F8E8A1994320E4E9594AE4692803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\ar.pak
Size 1.0MB
SHA256 71d8f4f3a910647572ccfaa9b75d1cc158073c7aac9fa4372578160380f71475
MD5 b323e56013b93243f7466c018c0ecd45
SHA1 ddeb150eba12660fc7c68dd5f535f7fc001b3027
SHA512 8498d936560b815b43b9f55a9f4cc55742a6ed53475a40ac896de795739982b776e6775634ddc448dc890b00cce65c1da8cc9155d6d3a419cfdf722e681c3803
SSDEEP 12288:n4z0YBtdp7N09HGSpIwjd0uyK3v4UC6Tkz3eSZlNjb4EtSnxi+:n4z0/Ei
TLSH
T1F4358BE21B2984720B56DF0FD1E23668D872BD23EB4BFD3124934A2156D7513E78E638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\bg.pak
Size 1.1MB
SHA256 7ab64589cb8b221ddccd0bba60cd27b57445dcfa1d1bf282a908afcbe24f8205
MD5 bbb06e83d39efd91d2d34727a1af176e
SHA1 55c6ecedfad9a9e254a2fe374f97737036f11cd5
SHA512 c1c6c5f3383c9ca078e4d39615e5d7d8cda3d3a174309e797fe232d2779fb1f8c67b2da02524f7eafebc4d282b8e32a15571885dd40008a9b789c0c9c4544e2f
SSDEEP 24576:WcxJDWaydLYezQkEC1UcVb6tM8dl373ZGmUG3GjKnUfVDOUQe74u2VnsXGgqnx91:Wc/DWaydLY78UcVb6tM8dl373ZGmh3Ga
TLSH
T10E3535A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\bn.pak
Size 1.4MB
SHA256 fca72236cef1f37e81a0002b18473237e1fd9c170bd809f2d82dee5617abf082
MD5 7a11bb1ea1684f9f6501b5e39e15c61b
SHA1 d8319af0853bcd8189ed471b9dea9efd32a3aa8d
SHA512 54495fb6878b25299d438a7e1e3bd6df2e92f4bc7d553596fd076f58f5a66e4c3dcdfbe0ab324d3deadf1496422d03fcfe36af10607f06e2e3542fc34d17becb
SSDEEP 3072:GaF9YJWTVKFujJBC7kpZlLqeRwrVp5qB8720OcvQagEfAhKHRYn6jEyWyBbDgQ0A:Gy9jRKFurCOLqeIrQ80zn6jEyWyBbww1
TLSH
T1A065EF209C6E81B6A8C5CDC9434C6370C523AE9B9B61F74DDC17A14938ADC7C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\ca.pak
Size 656KB
SHA256 8076fe9de4102465252ec963dbd26149918bcd4c8c71bc16ddb5b691f78da14b
MD5 5049f6dd430ba07cce2c32516bcfd333
SHA1 9324b84de13dba1fc5e183814c38d3368b264268
SHA512 16e038c47d235944b29bc5bd1cab6ed9ebd91356e47c21411203ef18be9c825f387d8fc4b45253c7a93ba363a5d92bd415bef08ae4db2a10399f5232dd4bf458
SSDEEP 12288:fdtBg7hjRlCizLapQU8t5PsFlN3Mw2juwwPR9zejm0t3l7A7T++LwdvwTLS/fnWJ:ZccGCLop3G+MNsZFV+XUg
TLSH
T1B7E409239FC93B7704C2330AFB46C257A48CA9847B16D254F4AE1B1622CCADCD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\cs.pak
Size 682KB
SHA256 d3043f0ea0a91d7089b9bd46ebd2192cfa77a1ad9d07d6dd0e72db2f03307db4
MD5 ddc31700d157563c13620b8de43dd100
SHA1 a7c9746b72210f9fb69db6e7fee6f487a1f6ee46
SHA512 790e952c3452d8a82d3d8b6039e34b39d24575e27809b8fab32f20586cc3dcfa56767a6f74f659b6dbd4c020f1a9ebde457a24b5ce9ea1b32a80877bad35368f
SSDEEP 6144:dxks9Tq5VKPuvSkDvh5Ak0jaAmWpzpoGZGOzwJSBuf8QS:dxnKVnbh5Aka3zpoGZGOsJS3
TLSH
T179E4381EEEA36425584002487FBE4128BC5EC3140B6EF96B7C8F9D912675B7E8EF0D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\da.pak
Size 613KB
SHA256 4a80237c4e8761925583a5f404f1eb9fc4b0591724cbef057b50c935e67f9893
MD5 b5b5333213bcdc10c8c789a281d834a4
SHA1 278da65eff3c92f7e9842d2d9c6f4de212ac0c84
SHA512 1b831c2a246d696bb3fbb2720f639f43ac2b9dc1962364b7d2506093ec6d7b3a554415c9c6cb0465a7cbe81bf1c9d6f7d19e14f29ba22985774c40b20ad9a386
SSDEEP 6144:+s5c4lqFIibJsYn+QwASzVI2Q859FXbcQPJVE/esoBwlASDJwezobPvNSavmdccd:/cX9bmM+QwA6PGo60NmGUsu9
TLSH
T140D44A4BDC9CB32F89A94725F211CDA7EB6D543CC684664F65D8943A09CFC6093BE2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\de.pak
Size 657KB
SHA256 b0fcc971930feebd20752910406a251ab515dd8377c926efbf0730ecdadac00f
MD5 87f68f0d1f1ee847386c62a9db39ac9d
SHA1 53bec8a005f17a5846165dcdf5f29a0988ee93dd
SHA512 c94de36994e57c55c44d6701742bc728d3d3c5051b75d97afad1ac0c299f0320b39e1bd7519d65317127c9572cf637df180ffe21e5f2678aa78e4e373350029c
SSDEEP 6144:kNyDm26RDI4TcI3K7UpTb8g4ax7EQY4+0Ir5w9QRbsJZVYMI5Gnm9Uj9MBeN6C6l:eQ/wnt3K7Up0g4aSIaw9wb/sYUDN6C6l
TLSH
T11DE40803ADDF625EC686B3617705CDB77B19E36BC346312788EDD12B650B5B283AC422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\el.pak
Size 1.2MB
SHA256 1079cd78b3cbaa80bc5a1068dde1201eae8211f935a4faa8fd1b2e881ddcfde1
MD5 ca3f2fdcbf02be3602f12d8e96f19fcc
SHA1 087016858b49c4ad48c61c27e419326104e79fa1
SHA512 02dc15cdf5b5fdfb8efc6d50703c78e9141317130a4602ee4f51d3452bc8f66bdc5f45c3726d99d34c44de7679ec68155bbc64a862d9cb9f1576cc52e7ee54dc
SSDEEP 24576:iCVHWFbrlk5Yp9yk2tRZu1xJXDsS5A5m92kd7QB2oSk0RBucuyjUHvDWQVoyNJm+:iCVHWFbrlk5Yp9yk2tRZu1xJXDsS5A5H
TLSH
T14145CFEFB4582DED8046950785D8B07C2BC66D6CE749CBD86229CB60BDFC0719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\en-GB.pak
Size 531KB
SHA256 d7ff81e2cb2956bc159b6ff806d39177b1f886f6c0de88e5e3a42655b3b0b2c3
MD5 8baf00c88d7ebb228b7e69a5e509e9cf
SHA1 c3d98a602e2c05956b29150e30b2d70a66c5edba
SHA512 6c0be1d71dded35abd55cda3034dbf9372fdbaa4992792576b542a1e3396c6697c13e2e6b0f83701a775922e051a12b518e6a7d220e8ff71e72f817e9b3b31bc
SSDEEP 6144:LjE/xfJuWc6jhJxhKEBIF0/2aMP9JQzXafaYHDLjZlBDbpBcERU4:LjE/Du9Kxh2aMjQzXiRDN
TLSH
T132C43C1FF744126A059311A2BB0AA562FF22D07CB36116663CBD811C33B6766C37B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\en-US.pak
Size 537KB
SHA256 ef30389492cc2d31bc5c162056fe68c27a5d57b0a69f5f878562325f795c5185
MD5 0604e26677ebd9417c7de4c421f6254e
SHA1 ed023212b6951afcd80ece283d6ddc68b663e079
SHA512 8af64b75a40a6dca6ac5feef06ab5e8c898bf30b50be73e480df923461d42e2cc417bad5151eb957c9606540321e0dea48820b2c5009408e0420e1ebe1b01a29
SSDEEP 6144:K7dq1yx5HfUOQkbaqMP9qQ0BFfaYQDp9I3AjkgngP8/I2wf:K74k5HfCqM8Q0BkTjzwf
TLSH
T1BAC45C1FF744122A059352A2BF099562FF32D06CA35112663CBD812C3376B6AD3B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\es-419.pak
Size 647KB
SHA256 0f5af329aae315473ef60e4e9e4cf2168af9a5a53c24c5d6367dd87b7e3f146a
MD5 fba2a1dbb1d77d68d888440cb7efe921
SHA1 2c68d055f7e8e07dd55d8ab46e98ad6c398e387c
SHA512 29774a168fe2f0bb0f00e04143498a61c4be380180646b7dad1a52ab3aca5b4e416fff0668b921caec1ed4a5374b69077d7a885b6d7f68fdaf850fe57b778dc8
SSDEEP 6144:myla3/s3ZzAvpWZE1qWSYmkUo5aNne5a5AFosjI6E:U04GMmZeSAj5E
TLSH
T1D0E40922BAC81F5310E3A348B743D757E8989545B408D29BE8EB876522CCF8CC977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\es.pak
Size 644KB
SHA256 cc3d7c3f694333f8b83127131b665130705598ab1ad7e1e16a0359ad52a73aa6
MD5 d94259fcae165cb976d0aacf9146699d
SHA1 0624a0765776ed85e3dff2dbd3e2d326c56d8c6b
SHA512 76899a0e53a208474b65fd6c5f65f8041cb5f764dfd0db9d865a3ea3e2eeab5ffdc6d0286dd8aadd81333c34118763afdf177f53bae8dd28a6977d82e7980514
SSDEEP 6144:IlgByU1wcl2NpgWqM+pDfkgZj8jdOMVJ6lvJGkJ4z6PZCF/:cuye2ND6fkej8jYOJ0vUk4Tl
TLSH
T1BFE4F726BACC0F6310E39349B743D753E8949545B408D29BE8EB876622CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\et.pak
Size 588KB
SHA256 2d9edaebd948a518ca0074ee9b3e0840bdfafe4391ec8435a1f0f7072d88ac7d
MD5 3e6b06980ae0def0f6387897fc07b963
SHA1 189ee469f464b7870997433e92d31ad9b07bb543
SHA512 37bf599bd117c0e1e43ffbd280be0400e063aa61a02096ed6580aeaf9756390acfd27cfb5b552ee09b48381a0b8d873c7be311bd3852975401e59dcbb2d2abab
SSDEEP 12288:RPU9tia/SSN0vFxDunFatACMEflgAXqEr:4iYIvFxDunFatACMEflFqa
TLSH
T156D44D42A27D771B242412F9E337E923DC9FE7D8B4000D9668974A1971EEF8C38B6B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\fa.pak
Size 975KB
SHA256 d26e6e0cf1786b01e3f7257469fe048871218113db5c51b9f72a5fa0d242e8cf
MD5 a8f6c88fa42bfd9152834663025994ed
SHA1 72538f957eafb06d430453e1c3f6448790360f1f
SHA512 ca08ad9bc4ebb0a478ab2b1abc2f450e01aca268770f67b5bd78562630cd12c31d2ded664ecbb14e9abfac0208730565d68b261a0f41f8592f598136836bd945
SSDEEP 24576:rV8u313uyqoz+sE2iRmXnloTUoXtCfGk62Yh686iTE8MX41O4lURikc02mkFUeH9:bC
TLSH
T13925A1957AAC9AB16747CA0341D33834C773AF12D349FE40ACA1076609A5B139F5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\fi.pak
Size 599KB
SHA256 b87cbc298d42619699a207cec6bbc34567528cc0b37ea2059f48cd2c63b857a0
MD5 5126a065496f96cb6922f0a0387b7077
SHA1 6db444c48b373240ebdd25a9d4ebc6c3cc80be02
SHA512 dba709eaec35c2f67eae2a60011abc2c6da4f4e1890d5730e4e5dfedd2efd1a513dd7ba77fe95e4d81a3ad0bde2ec81cbc91f375435a31f5d9dda76f668cbcc6
SSDEEP 6144:2VUKOT+VgQBer19cj8bb6a1mS0r5tAgieswCaXOERHq7aQmLy3wmHPIZprWaCLnJ:2VU4VgQG19KA45uam3wmvIZprWa412G
TLSH
T1C6D45E915215C22237C8D29E79B0903EF5D5E3DCCC284D9AE843C7D849EE9887DB276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\fil.pak
Size 680KB
SHA256 be9a51a3e3bbb334ef1dcec3f85f5d884e04d5580b4e7a24e9d5bbf84fa56e1f
MD5 73ac58f1d32dd061f858757db19b8610
SHA1 4cf94db854bc2a92642210366a80f779d9c7e4d7
SHA512 eea35e40893d875fa6ba10a5150492026f8f654b44cf4fe8854f1b67db1f6f5e377349a954ed4f1a99c023e8ccbee04364d76adb4ad9639405ae7dc54511007b
SSDEEP 6144:ox+EKwo43MLOr3dWzA8y+DQXOp9lrlt0FhDAG3sYT2v//9/oVoA1CKO:ox+ER73MJRvt
TLSH
T1B7E4B616B7402748DBC352E52360A82F66E560BC3F81786E0FBF26977BA7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\fr.pak
Size 700KB
SHA256 2a7e6756253d85edb24a27e4e3f8e43ba1b124160cc1adae9792195abbbf7a5f
MD5 4e3c7a0617b4bc6a512e366034331b65
SHA1 cc5dc3559f8ff0b298d53757240dabdcc62202dc
SHA512 5e2155cec16d9e9ab6199407f6066924e24ab9594c3d12ab31b9db7a7545ab7d5df5b14c7dc4794b8069c1f4c3ba68e7253fe34cd6b85d8d0e40cf26a0a0230d
SSDEEP 12288:+B5l3eALWJ3TZLrCk27hbTZw66QuaHVsVyH8ATezI7oO9ZuYnY38jw2waxFVDX4c:+B5ZICvVIgEQ
TLSH
T1D4E4E66FBDC431CB19C612A7FB12D663DD348248F215E340D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\gu.pak
Size 1.3MB
SHA256 2623480ab810561ca86eacaa6b09ec67d4716e74484917a9931caafe57f183d7
MD5 f361cb58e8a89046611c0d805cd61eef
SHA1 e8b4462e33cdffc03c1dd7c054eac619444d0a31
SHA512 879f91e7743f7df6cbbd9259808acdda048eb7b36311f8f29c6e63f095cb97e3fb0b91b76dfb8316f2d22542e27beb8131ae4906412206b3847f3b819dc7c8de
SSDEEP 3072:XYy89LQtEnpDUB4TLS53LHZDmiUy8iPjAwREJKVMjNiT7llj63rAulfcSi5NnWsx:XY9QApxu3zZSiRVCdsqUWcCj1Istw
TLSH
T15D6508D0D7B9F07019DA9F7E819E512086699343D57E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\he.pak
Size 854KB
SHA256 c6712be63d5d0337c345cf03af8a492200e1cdbfa124801620b58f7212c20c90
MD5 63181ee578a7a64e73c2836435e08e88
SHA1 2e92d130aa799c5b37c7de5ca2d3172c4dee06dd
SHA512 66eb184a1433b4d92b3b4935e1f5728725de19e9239e5e1cbd97a38036002633c6e16365fd799eafffa1d28f60627a445b6f4de72a90776a0303c276c9c54c21
SSDEEP 12288:WZrefchOFlxc3Tm+F3r1f0fBAlzWq+/KU466MAeBXlieQCaj3dto6kvAXS5mJmm3:LT6n
TLSH
T161159AC4B2D492255131AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F1BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\hi.pak
Size 1.4MB
SHA256 04007246aa9acde32d4ab3e0edb6c898e995d6b716579911d76a8e169538074a
MD5 5ebfc6ca0ca5e4a5266bc8d7ff7d3d81
SHA1 b60cbe9aa2da097fa7f6ac20a5c4099e78a02573
SHA512 ce3ca3a661228c0ef69479eb785c69231f5455134be3ae78d7ccd0725f73c90d206e8fa808ea201de467f444cd2ddbc8bc2f12973dddf143f698fd06e9911a02
SSDEEP 3072:EXFa7fdZPwOWAyMLTd0pup1CKDOV/B90ZV1d3uGlqvN3dgYJEdtD9eLn1s4f4/BE:DTdj9SSCa2XpytdcUY
TLSH
T12765050CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\hr.pak
Size 657KB
SHA256 a6c1d62d5ebf72aba06b83da68c2a7e4ed77817cfa6e5f6f531df9ddd2d67f12
MD5 faf7e8f5c81ef13535f3e8504bf6c678
SHA1 b406c925e17ec1cdbd6783f8b4e59ed918eaaf47
SHA512 65b19405abeb9474ceadc0735ae13f652dfc230901915eb80cbc7aefa6255bbbf030659cc7dfe9eec3760b3ce2ea13e6a955a7f4b4a9d635ad62e4e86b0f085a
SSDEEP 6144:ofaujUoH+0wbiUvZ33KnYbQbcE7PBO2qNdvjJ:oCuj+HiW3QdlOlHJ
TLSH
T1CDE42B7DBEF3970A0897B246EFAA43547DBE08DCE52497B7684F522E0003F4D6AB4149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\hu.pak
Size 702KB
SHA256 bd054c1c8c9f4a53106accc3c61310322a160d9c66c6317a63c91d17eacee23a
MD5 a98eec67c28a433d2117cb4d30baa1a1
SHA1 1be598907e0a239e8656e1f6e3a70d21fcc4fc27
SHA512 fa79ba5a1e266878add04e84aedb8dc61a7a3bf64f43cca329bd24f5dd3b9be7e5033e36e2418d98ca1d8be3977cb9fd8cfd8a5884433ad852ee38cb5e181dc3
SSDEEP 6144:3WlDYKCjKdhTpepbHlhlLH2pfaHIA4jt+uLU5iTt8gZ49Jx/YhyoVm5Ws/kYsyeC:mlDBCjKaWAIU5iJ87+0BMo
TLSH
T193E45C7793B6945AB86C179778643F16492E481BAB3B32FB2883846D349178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\id.pak
Size 580KB
SHA256 81574aa518c3cf7dab5e08510db9180a7a4d1e115a97fee8ae471b423301e793
MD5 e5650846e5ed16b9b301cb11717f0a50
SHA1 4bf3f3063f2204de0fec56a3aa6a85acb24b1939
SHA512 0e62dc2a43302c8651efcfbe34c7f9cdeeed8852da5dd09efc8d178c33ae940795f228ccc2c51176ef0ef96d37e3d85fcadb525cf0bcf615a6cbeb6b383b1551
SSDEEP 6144:+Opx1YvrUTJmh/x9ijBz90bpbfjzTFjlFlXmBMMBp691j6nsWOBRLmIiTv8oyHS:vpDsuM+jB2dzTFjlFdmOMS6nH4S
TLSH
T1CCC4E7632ECD310C494842D5F2CEA91E7CCD233BAF05B76E8E348F7055A67686726B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\it.pak
Size 635KB
SHA256 516392ee5c30cce472c5e2f6ea72c9607fde7d543791840b2147ba126277fae8
MD5 4cf9f6a0bf3b717bbfd368c4364a3354
SHA1 d1f833655de6aa32f178d9edda19882cc42f4903
SHA512 17a98946370e8e455f8f9656e9145c4542cb3d3a64697380485fcff10eaadbe9f14f31ddb08dba5a979e5d58b0431e0cebda990ba2e84c5785ef8dc5dda50f4e
SSDEEP 6144:2yDn3efbJsn8fnd1ymik/y52N5azVd2sYSfqBCfYs61wtn/RT9TbhOKa1iTURWYS:pDn3a6n8112dZZ5c8tN89M/MPqlVVN
TLSH
T1B8D41C3AA9D6212519976359E611B085FB6EFCDCFA41721CC99B031C22CFE80F1ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\ja.pak
Size 774KB
SHA256 f83467016fe545c2d7ffb29818b63141936ddbeb347eecb94dbcc4dd7aebc160
MD5 14f61ba3138ed44004f7e33d3d327e05
SHA1 810e79439928e3bd95aaaa5d85c8317e5138c4ea
SHA512 9be122474b1d37b4808278080f24c2f5025e1d91ba61bb0c9c153f1759a559897be60150cfc201f2c1d126bd635ae319d4240d0394e8069b83faa70370609cf7
SSDEEP 6144:ONtXfJkvxEYOJB37QOCe77fJ9ZWQ2cX7fBubP/VQpMzVd:CXgxw33kho9ZWQ2cX7B8dQpU
TLSH
T1B1F43F7CE3C969369D6153A22C0E36E17506AC5BFCA23A3A443DC074BD70BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\kn.pak
Size 1.5MB
SHA256 6e4307cb71b0086f9173fe76675f12d017f2318f31930c9b7551552d10608876
MD5 d92e7040d9625aa1281f6212c9d5d50f
SHA1 239f29b087f32c6fdd32d471a97efcf406bf22db
SHA512 0a4bbd552e5ca72d0f3f4c10ca9ceef221f5f4e79db9e9f37527d55afa6d0e100a86a223177bb1b6df5c34a5548b441df534638b2d47944fd53e3dad34cddcdb
SSDEEP 12288:+cqT8qq7+xz7EjHSvboMU3lhYWx75NfMa4I8yopb:9E2ZjMX
TLSH
T19675CD18ADBA7D301BD5006B24EC643ECFF16BE29CA907D2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\ko.pak
Size 657KB
SHA256 ddee44a6cb30a5f19fb7e2f475ef38ca866ccd9454807f04b028f211d6e0638d
MD5 1cb9ece1511920b83016066b122f7833
SHA1 e375f2c866e65560fc8249819ee220d4e6716467
SHA512 fbbf24e29ca21c81161f16d1833be174867891b3f5b327650543eb44561f4076a3815961a56b40f1ce2bb0d150c82780860b688dbbe301325f8ffa1ccd8ad03d
SSDEEP 12288:Z+uTsUgukKirM1WNiPszcbifYj4ZGRyzD9Iu2eIzRfgCx9IJ/xOSJGRG1zLhwgtl:HslIKW03+muW
TLSH
T1F4E4B5F238DF63C91193CD82AEF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\lt.pak
Size 714KB
SHA256 38a85c44924159a7096ac757e11a6e3ec94058e40d661b45e796c29b1ffc2fe6
MD5 0ff3893259295282ad36388b038428ca
SHA1 fed6c79a284fff806b0ee825f3aba35796fdaeda
SHA512 7bd057bfb80b8c52aa9e7cde64c8be9f6062c92afca309f019d014016a710ea656483795d1740908cdde1c86ff13f1a028af8cb8c14e80a9ef7b592703c046dc
SSDEEP 12288:oUi/g4jMRmqR/R2OKF44CO7q2bAJy6SoA:/6MfTPd12cJu
TLSH
T1AAF42B0069E3AEFB9A4467C981A48E78DEFD50009767BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\lv.pak
Size 711KB
SHA256 b1789efbe97746e1ceb8eca5fec1bacf84e2f157cb24ba10487141f80a8d0fe6
MD5 1e32b817d3f9730c9a929fa86ecf3c2b
SHA1 94b5e88a96b8457b05f20d8d5abeb98c21f6aa52
SHA512 788b7c29db58e87f143a4abc5b1df5f9c52a4fe2e8b41261cc63101828809b935206f332fd718caff1c42cdb9467ef4d5758ce631519557e0d5c1699d611e23d
SSDEEP 6144:BVo5uG5JOaqP28DBqBtNDqNg+Y9NVtVFxgzEIwL/jWWq5VbpGnmNnaogA+cJTz/1:3oTRqnBqHNv7+zwrzOrGo+cJTzuuTx5H
TLSH
T12EF43A959EC68FA94D918DCA7336D123A8CCD740FE07E112DD7D8B3A510F52822B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\ml.pak
Size 1.6MB
SHA256 35e3ecbc30a2ba8eeeafa884b63b502876086e4f58694aface215280620b6ff4
MD5 d0c861f218d4521dbcafb3df92a8dcb4
SHA1 e593c75658aa61350cbe4764338794b24ccde272
SHA512 f55212944854eab006e9d59614af8fef78174ab2fad603bc2ce9d8864e8694a841080ac706a2e105d06cc79c32b2809e4ad522da3edc140084e1308cfb693a76
SSDEEP 24576:mbHkT3g/oZAuuxyYl+9y9XBkx/9tH32KfyBR+zX0v+v2hitT3/aJRAZ3R:zTN
TLSH
T1B2759D57A036CD3B0FD102267B4E2FABCD5B9FD140AF668B5869B2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\mr.pak
Size 1.3MB
SHA256 20121228e7790b61c69d3e8a825098002bae61884b2c6cd84189c31415a594f6
MD5 a582466027e5460b0a8f53ef533f9bd6
SHA1 223b8f70a5ff9bb9826407efb37ffbe2bcd4b76b
SHA512 e018a475e53d2fe74621464cdd570126d652666be9bfe32e025b265ddcd370adb027d08dd68a7527ec85aa56eb448ba2611bac463ba666689b711ece20636613
SSDEEP 6144:ejhnaK7mqDh3c/PciWUenZ0goG22sYmGcAb:0L7nDhd6VG22sYmGcAb
TLSH
T15855C14DF7BAF3685DACBC8E36540D3BD8FD31B1C3E9925648E1B3A74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\ms.pak
Size 610KB
SHA256 3d504ad265b71b6de6e1d65a5a92c0a5f3d9ac188cb073d6391a0884217d6580
MD5 6e7b1fcaaa449e7f9373f2b8fa1ecb18
SHA1 45382fecd95d835f8d1d0be218fb94f245e22442
SHA512 284a75e6b2ef82f838bb184e61b31b4ea43495f205e44df33b5c2dadabe755410dcb555a5b7346298ba9e1c8ed7a7c9c9930ef52718bbeec711e6d4da7a15545
SSDEEP 6144:3XbsRy3VRYXAWpvb2DgxcdyABinEC2HuqwhYn8lNswzJTauVle13VDZY:L3VaASv5xkyyJHuqwhcOZleC
TLSH
T177D4B6579EDE3118085843D9E2DEA91B3CDD3332B705AB2B4DB04FB0126E7A53316B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\nb.pak
Size 586KB
SHA256 bf454559af0c66c2beb108b45664bbce95c8fc6ca6e9e176d77161c2ac3c2c09
MD5 479f57b828bc42d3344c175ceca646e6
SHA1 30130b144b86600f7b042c7e585d26d26667caff
SHA512 a9e484103d1f1d5409218d289e30270dbefab2c289cd72a367f9935b470b0ec9fa84153396333ac7b7dc3310c3f171b43aba0eaf8e5e38d526143892ac10db0e
SSDEEP 12288:vjS2rwbS3XY5sQlx72jOp7fYaRMGvNGCatB3jH7Jhu:5rwbS3o/7y7GvNGntBzbK
TLSH
T119D4F883EE46B72EF2A443A4F51986579B7D942CCE98199B54CCD23E0CC7AF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\nl.pak
Size 610KB
SHA256 6562756131ac1966805981bddd08c4330ab4cbcfed836482203bd6a819e6d99d
MD5 bbd69342844647e830bbc127c8a4484a
SHA1 5d1e4de6c15f73b5459ddf4709c8b13954460914
SHA512 bc1168fed928cef6722e2712a1090b01bd260c3d13ac7320431181abf6278cb3ba5fdda01b4930f6ce3748e3e936127071427064e4164038eb342174a40fc314
SSDEEP 12288:QhQ4lbJWQusEUFXZgtfzNLt9ywGgqHgG8DTF:6lbJWQusEUKfzNLLywhqHgGcR
TLSH
T1FDD4F807AC8E253E59C1A349FA098FBBBF2ED22CC26CE67D94DDD5340443F6841AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\pl.pak
Size 682KB
SHA256 a7266a664cfb74895e2b9099f67f179043df848e8bdf97264756e8383367c66f
MD5 7788f12a722053cf77d7a5865103db01
SHA1 4401b4b3ff19d4fbbec101fd9fc268f4452c3727
SHA512 7174499accfd14fc4de0465a8eadc696b13312d3dccdd3452e604de3cd7d039e45491f8c9b4a052d85595025c61b961a7fef9123429b1c281ebed871383602c2
SSDEEP 12288:+7PiKphZwfQfuzSJabZ0bn6fPPCUdje3mcUQLMrmE1QhHbaIFolm8TT:+7PlhV6OLMj1Qhan
TLSH
T138E45B0E5AE59A4E4CA008E6F6E71B7CACDDC808F208D35FE42F4526715B19EC9BE5C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\pt-BR.pak
Size 638KB
SHA256 1ab6dee0fb09dfe1c53cf196efe404041835602bce797877f7fa89b2011becf6
MD5 46e54eb73ec95669ffc92af97c023410
SHA1 aeda3a1b295bd4f9510938a985e22d898d9b8305
SHA512 a7b60c536e5e4a79101ce7ccdbd09d07eff31485a157729e0f9393d94798d0385a35cc6589192c73d08839996044fedab30cacae23a45642086afad61ec7efa2
SSDEEP 6144:BZBt1mcqSYfMlQAkuNBXBL5ogLly8SEpvhfgusRUUgv3:BxoiYfgqEnvsRDg/
TLSH
T19DD41B2E6ECA136604229350B74EDB47E5890745FE0ACA87DCFF4B05A3DDE40D933AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\ro.pak
Size 666KB
SHA256 2feca2991c73a665d1503b9c1320b518658ea940a62f35b75f7780d4ef0b054a
MD5 1e405336ebb9d3214003205448f53946
SHA1 bcbfbc7da72466eaf7520628dcc6194061fa6eaf
SHA512 cdcad7f6b1bb7242cbed50409c2cb0ce9d1dc0a4fb35e8e9f21ae7651d483d7eebce21b44c2cc702b09fe766a20ef6aa95b3abaef1ec70d0394cf382044ee55a
SSDEEP 6144:nY2Xm8yL4tE57smbwV9RnnB4mEgCLPuWJ+t9GSlCEB53csW2b3da/1ref:ByUts71KRnnB5QzH0XCQ5Mk3I/Uf
TLSH
T1A0E42C23A1C81A97295152B2B73634D3E88E105DF641E28DA4EEC97D10CDDDBC52EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\ru.pak
Size 1.1MB
SHA256 8487e04fab7b7350e17f3441455c4995d12ac870ff8f2b97dd44aeed1a3f0169
MD5 ef8c384edb9f7ef0cbffda4797783381
SHA1 77dfe67238ad9e4818ed09517309a747edb767ba
SHA512 f39c8bab9470b11937a80e8ed8f9ad2d9113cbea95626252cab666dc44590059b171cbe68cf7d5e1009fe07dfb59e66f206ac302e154df545a275ee2dc974ca3
SSDEEP 12288:tps3/osHfQeRo4YeWspFzJ9sF+oa+O1zXx6HzW/oqSvgs2ACWEN2igA8NiadQYHS:gv9L2DoSi
TLSH
T101358860669E64EE1101F01BDD08BE0D3CEB45FE3FAAA35619642D7F34F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\sk.pak
Size 693KB
SHA256 abe4f0f69555a929f3f9e992208cf178b86c300803fb1e01c7c78e5fa96ce1a2
MD5 68f8a1e5c326c8f132ea90b3409dd26e
SHA1 15e2abc6cca94cfaa512af3769fe717c79cdcaaf
SHA512 0caee634c451485d532e527610859bed07af9f666b5b7d9b5c78eaab14f5ca18071343bb0b09394ff02b4c73aefe7bdc0324525cf54f3541836b197bb102e17c
SSDEEP 12288:FDfRbbCL37/L+ABiPiXeJn5BYn6U8pTjsxt9Wi:JR6P/L3iBYp/tAi
TLSH
T169E44D3FDFE7181E8E8D0148EFEA7110FD7E8650864EB4A6944E364714E27ED8AB4E44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\sl.pak
Size 664KB
SHA256 105f19bd95178afdd37507b09187b7e57f660fc8cbaf61840e770a0dbd624989
MD5 2673e04aac61d2b16cfaa79f8e623c5b
SHA1 ee5926ca90d894ae6b4e78af8a93c29b98a9ecc0
SHA512 669441539eb4dfa96ac34d89762ff7c761aed2d0833c3880ff4a82d7e66b5fc8225684d779769f0c82243089d1c10b93403142e1a9dd9ac9bd7c7da60fb975fc
SSDEEP 12288:ZXXvcB2vBZI5frHrIWOq9Qyi/fzW8oql/ad:ZXXBI5frHr7i/fzW8U
TLSH
T1ABE42C397EA79E0F0C9AA28FFEA606007FDC044CD252E6A1FC4F336A5415A3817BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\sr.pak
Size 1022KB
SHA256 c85a6a25a18cbf773861255bdf09dbbbf6e7da0b56196d02ed9ed48b7c1bfa7e
MD5 95a3731e07f124bea3e89980c42bf2f2
SHA1 ba37f6e78e32ff5cab09a158c503defeee90973d
SHA512 9d82d6a6b00c1e2b50a7e36b618570404045e5f0e17c461d627660164c587094d587d4810b4a2be615559ffd25552dff64db144f0110e55366401c7eceae90cf
SSDEEP 12288:MAlKhZ3X658IAo8S0dZ6C0YAi42CJKMZp3ehMCexKIE37FtuXU/k/m:b8hxux7Cll
TLSH
T1A62546B19B9E64DB0501F41BD808BE493DAF41FE3FAB975211601DBD34E10B847BA29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\sv.pak
Size 592KB
SHA256 50ee47f0ecab084a1e47fd1055f14204a904e02e76cc11f056880027bb30f0b4
MD5 d02cb5e8bd91f2b132352002f8950de1
SHA1 e8a53e906c1220a0b06db5240759dae44bffca0b
SHA512 879d7136a3c299f60787cd42c13e4341de5d18a3af4dd757e07b51a5cac14d6090b521e220223c06643870db39df08a56161c011dfa3b5e1df8d0ff628fdfd7e
SSDEEP 6144:90Ij9KxZZV9QZA37JCyOzxnqx0xflMT3LOVRFcz5RtGmgYSM4pmFM7OSO8XU/rih:WIjAV2GEnBCihG8l
TLSH
T156D41C438910F526FAB2530DB609015B0AEDE25CE7F2958EB8D9883DAD8BD5805FF347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\sw.pak
Size 626KB
SHA256 039c517ef328c62d1fed7e8b6d229f6d30f09df5aabd79503d6798e37ed89315
MD5 8c77972584b7d08a70555fab8820bccb
SHA1 73957dfced7cad846137fb4501934ea4bdec1b26
SHA512 12de731371851ebc59240bc17d9b573ffe3d89805585cec79ebd261cbc0913ef18b8ae0e760c9b2bbc2c6b59ec704f6813708b58b06e19f79b13883667614d83
SSDEEP 12288:a+pOm72YxGy2qWHZIcA5YmedqNGjRdpoPiM4+1GKL3fyi8SLR64GFp1dgNUiFaX3:3OKZGFFiizl
TLSH
T15FD4D5629C71D1191233918603DDEF732BDCEC5C6A2B2D935A46BF0F218F48C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\ta.pak
Size 1.6MB
SHA256 b629034f195f1b354f959186f9c9de6a8e5fcb8ed98f2b120cbe574681a96f6d
MD5 e37e931e75ef0fb38f2884247ed38274
SHA1 b37e746b6b539855574d18b56909bd89343e725a
SHA512 18774fc9b57a87aeb939fe012fb701bb59fe48ac0e8e956b53511a9dab5ea62951e65ffc08ab8a57d92dd89f465f268a5f715ae73b3c233c7041758cc7bc36cf
SSDEEP 6144:rW4LwarWhOkCKasGPssqVtR95tm1vYpiMyN:/FXsGBqJtm1vYpiMyN
TLSH
T111750CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\te.pak
Size 1.5MB
SHA256 b226521143030f9c0253e26e45603db8817a106253f085e731ded1269be74127
MD5 b75beb2304300d0c972bf77a4f9e8041
SHA1 0ee4561f7dff256f56e97b90048388819662adfe
SHA512 4ab491bbe18e74e12a8204f649723a644aa894a2093af7d50654891ebe8c837096a4e4dd3ed54e74bd6565d97593bcd9161b8dbb2b5f8fbc5d02be9c1de74ae4
SSDEEP 12288:vyvTjmvCA17McKNzywGnNqSF602ngIC8ymoRRT5JbIe52CMsWuB6mI3p1Fn1Ihba:6rjmCAWCtcue
TLSH
T1E86592023A6AD310DAE60273752CF66C49781B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\th.pak
Size 1.2MB
SHA256 adec2c1293d2bfc4c4e49d78b4d1a27f1d68b79398935aa45219736ab90903e7
MD5 eabc9d3e15a284ec169eb1b50dee913f
SHA1 188546cf445c922dc49b4a4ce7b3d91ec329c1c1
SHA512 1dee6fdcd40e28bfca4e3b77e38ae20b9f097bdc1c0a2536e3326924c8316118ec9dff7a62cb9e8be49ab2098e8faedee7f9001586f5797eb594c9d04dda2bcd
SSDEEP 12288:XCz0ynjBc9fN9LyZYAozYL+xWspoihwkJUseTPsO5eXffpbDFDS6Sud2OHXJjxcK:XCz0yjBc9gssk
TLSH
T1DC553BB37247DDD479441B5B262A7789672DAE693F73F8E00089215A73F071A8432EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\tr.pak
Size 638KB
SHA256 b38c37fbc4de0d502fa8fdb0e628d40e84dd4c3ae9a5d3191405635f8c815343
MD5 91bf08b5be7bc906cc191354e214e09e
SHA1 38d3a9fc4f437f6ef5110608af596d3178917e2a
SHA512 f17c587c2d32c88d095b98217e4d816ab598cda751d757752281ef95faa31f86302e5928b248a3a9e47d116863f348bba80daaeb4cc6b7b23c30b3ceffb432cf
SSDEEP 12288:0oIBxQq0XhH9fnHz6sgwhIfZF6c8BG9u+4C:NIBxxcxzG9z4C
TLSH
T168D4E98178EF282C8BB9278FD6E90666F89F0766B331F4469B168636774535703E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\uk.pak
Size 1.1MB
SHA256 3d19684ee617aa6465e25db6927e257f290ded63ead9402c440a34d5983b7585
MD5 ee2a5dda05b0e3cfc17f84fc460a6fd9
SHA1 561a0b34c4a4674e9a1b224a806b9c406a934a36
SHA512 608222b50b9fc12f0f2d8e5be35acf099562dd286b1ec46f75ab34d8f63821ea1eea69944735030dc992a08ff034e47c3e78f5318ea9a93b1925c9b98d56fef1
SSDEEP 12288:OByGuTS+QKjbwiIykki8URqvWvsSr+fXnwYV2onZSBdISWASNY+A6QFD8rJYurLg:KK8HP8m
TLSH
T1A235A9A19A9D54EF0105F05BE94C7A0D7DA701FE7FA7871625A43DBF28F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\ur.pak
Size 960KB
SHA256 4047d247f7827a03a5c64f252a9e5a5ac9fabc75bdd03b87a3d248eefca03648
MD5 45d05ed2dec83dae002a141cb9cee0ce
SHA1 996e0f92f89c8785c110a65107cb4cf1157ff114
SHA512 9d3a282c0795fa930047341392eb643f5f95bd63231f504ff748b80f6637608b238e34393c0da63ce22f9a830e85c9fef2936d0d28fa348bc9c8db83a155b8c4
SSDEEP 12288:wk+hB2ksdQZJpc4Uoew8PCK8qtdQKruKy3lVbnQiEh+GoOZxDiQYrwuYjwadcJKJ:0ZnKYGKo
TLSH
T1742500D2E6B896B35A21D92780D33C34CB735F13D34AF285E52246C54E9A0139F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\vi.pak
Size 757KB
SHA256 263dbe4ea8b3ab7f189b91d6707fdfba604d02894bc50483a8b562334d303a4c
MD5 a3a49fcfb58e509e30d5fb4370ca64d5
SHA1 a518822d0f73c2ae391ec0ec0708906bca46880f
SHA512 1544a9f034c81da802562800cb3dab4d410ca2980aee757486a3fd010c1dfdde0a8f23722774aa782fc83475510ebe85005d1f9e871a6f8de2f7ae4d7f6f23e8
SSDEEP 12288:h7VkS7I+cM5foEWoVuBOhbCT0+CKVN5+Fc1haRzeyV8iVyloINjZyjelyezicR2/:Jv8+cMjVm0rF8cx8JtQKlyYichfJq1lF
TLSH
T1FFF4951217E1302680AC553EC6CE540D6FCAE42FF7C18FE56FE429747A221A45F25BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\zh-CN.pak
Size 542KB
SHA256 cba14b4e279269daf8e7e7925039df8eb37a9b7459a27a41e57c933fccb745fc
MD5 b3928453ff2df74ae9a10367e52f334e
SHA1 c5b7cb8954a9efea37f733279f6a4b1afb7305b2
SHA512 6cbd1801519d4287ed202b9df33a472fd6994192ba0d2a07f00070d59e3e362719ba3ac6e3eec8bb02a4ef8ae226d3f36c368858590475f7dcb53be3fe2faf4a
SSDEEP 6144:2fc69+mPNLWktYLinT7hpU/kfehd42YYXv3cYPDMZ2ABN+WmYGlw:7IiQYen5pU/kfevlYgMYPDMLBNd
TLSH
T193C47DA820F9B9EC044650E03729613D7C40764BF66BEF366ED248DD1BA2FAD0757A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\locales\zh-TW.pak
Size 536KB
SHA256 c425d71d1d06ba214857efda2a33b098d8d8469705840e13aa6e663963871db3
MD5 e98148ef5f3f9afcca1fc584e5dab9cc
SHA1 7b529a2174a1d9dea1cff44463eabde9c470521a
SHA512 772db736f28a9c2094b26a76e60a3eb74941e99794fff181e4b73ffc839bf3b0f617979a16bba986c8b0f39934ba942373a60292ca96282878f164350a395fe5
SSDEEP 6144:Jfz4ABm587DouImLIICVzENJVJm7DCa2ju3fpQzFQfiHHDwS6CX2CXUmITZ:Jf0+DxBcoN07W0fpQzmfiH0vCq
TLSH
T1B7C47DB608FBCBEF0901F484B7CD522ABC9B386DDD777636FC891CD42E69A540962085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\resources.pak
Size 6.1MB
SHA256 5e2fd4d456e6a5b999c3c0a099340035b0fcbbe40a8f072d0464a400bd04800b
MD5 55797e87306c32272a4be4d2715a8775
SHA1 5295df24f07c21049b9fb98a2bfed64fed52c37a
SHA512 1afe3d0a98dbd99c5dee88043434d08b5c72f62fce1139a9216616c80475160a530e5d61ab71a109de520dd55db29c406b6ddea4a0f45ddc5fa40c2978c59045
SSDEEP 98304:aDjUl5dPJ13mRplWYNvogy4VAHlzJRPrwr15DWcp8AGN843RTwCp3iXLPC1G6B:EUtBR2lD3azHkrucw3wS3K2B
TLSH
T1F55633E972E074DFC6945B7F40AA8334296CB66A3495325D0D8C6230EDA592F9EC433B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\resources\app-update.yml
Size 133B
SHA256 dd6bf45cec09fe47b253170cec2a5a19256fe84520bfdb4b871e7889c0bc422e
MD5 e80cdf3ec687414878e22b8c3c7ec9f0
SHA1 80d7c2592689efd39df8b40d28c2efa476f1b95c
SHA512 94837f476d2f6261ab1c33fa310013ad4b80524da0f0e87f2ac3a15e72dba480979e1269e0711c31e184eda142b25c56e244a242313288d5c962df22cadd28e9
TLSH
T1C5C02B7085308453433224D03824583400FD3081D3006609D5F88068801F81404400EF
MD5 SHA1 SHA512 TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\resources\app.asar
Size 31.9MB
SHA256 58ac4c4c9ffbd5e70f7d3457ec690ac22ba4dc1400634792a5bff9ba7df08c27
MD5 2e73bcabeaeee8d7007dcfcf62c7b15c
SHA1 d2272e4c00af01ace7ec9d0bb33e76e11f2a5e1a
SHA512 fae60c3dfed29c30dec9cd8c972c1acc48c9c97e65ac5ee7fbec1756ddf151b06c6ea43f21d5a9c3983bfed72bdd0ea336437eba49ce2237ebda99ee4aa85e15
SSDEEP 786432:IlnhaU4IEoYERXF6uNx4rXigG3zp5JM/9Ci:IlnhaU4IEoPRXF6uNx4rXigG3zp5o
TLSH
T14477F8A9513BF936858713BBE9BA0948BD634C45B400D2347C6CB46EE39CF64F292F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\resources\app.asar.unpacked\node_modules\electron-color-picker\LICENSE
Size 1KB
SHA256 3599de386b6821ea75d225d54d1a340553615b37330d061076372b6d25f99530
MD5 56cb7a1538663df3606acc93c2eb8c8f
SHA1 0b7e4f3ab00bc057dd68658d817a5796c6912c29
SHA512 8c89d4ccb16f52fe6b5c15215e75370b8b58d6e963bf1be4ab46684719c7f6cd76fb9440e8cf8c920128141eed7bc597e7cb520acd3f42ef926436c783dcda30
TLSH
T1F211B52EB2500B76189B13605578ACD5F23BB25F7A6F2A84246DF345233A06CC5FF840
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\resources\app.asar.unpacked\node_modules\electron-color-picker\library\index.js
Size 928B
SHA256 4d796dff507a477ebfc56b6442f41a357690e1f4af5294d1c446a0e975a30370
MD5 b47b6275f2c2e92fdcd92da075ea95f7
SHA1 dfc5948e5313f5f57e39b9ca68153322d2a5e942
SHA512 ae8d144aeebc50f9d9215361f467b78f420ca6052728ea1726a065a3c6de5230704874b2c0be1121b7f9864e4607122115d8e0a0491354479466764fce602e7c
TLSH
T12D111485E3F7793113AB09AEA81440906C63C2563CAEAD76D91C430E51170DFCFA920D
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\resources\app.asar.unpacked\node_modules\electron-color-picker\library\win32\index.js
Size 230B
SHA256 c90001421bc0729844528153ebe53ac6d43796575beaa1af91f9b5740f3d7db4
MD5 fb017620338f5f13e16c2b6a53815ff4
SHA1 91e47d5a85f59348bb78197b7871f682394f196e
SHA512 fe4f7ed4cbcdd25b94ed3933c30131bfb73e3371fa18606bb3fde5f7b72bbb036aa2c55ade4f397828bf04cefd98c3811c6368ebd3e66a90d9b5c96a5c05d893
TLSH
T143D023B1B5C104AF7633911C351DC5112CD3D439124849B9F02BD74D174F18A035F937
MD5 SHA1 SHA512 TLSH

Submit Download

mockingbot-color-picker-ia32.exe

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\resources\app.asar.unpacked\node_modules\electron-color-picker\library\win32\mockingbot-color-picker-ia32.exe
Size 247KB
SHA256 a0fe0d97c656ca677f87efaa855e359c185959f1a45106c191e4e887d789fd24
MD5 77728ea4d9dcd84e42c428e60ad444ca
SHA1 a6876247305df27abc6f3b593b84ce37e5d602a0
SHA512 4eaf1ee37852699d62308368a28b194caee6797aeb8e5eb4dfad92d7d76b81c749e9b1ab2cfdcb99bf732a99a3805665b2c6d09ee7ee0ff0e38fd5b24431138d
SSDEEP 6144:jSfPjqZp57cENm2eK7mnoUSgpAY8ODcDcm7cIskt44F0T6mkk9ABAO2Vam7GeR7E:jSfPjqjrt44F+L9wze5E
TLSH
T1F5449E1235D2C872D1B3183509F4CBBA5A3DBD210B6596EF57D40F6E9F303C22A356AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\resources\app.asar.unpacked\node_modules\electron-color-picker\package.json
Size 349B
SHA256 8bf60d4bb3ecb06113ba608b827cfa3d39c670b92246a06bcb4205bfaa00abff
MD5 f1a11573afbae4100c8e6f125435b79a
SHA1 2c8044ee72b8d3b9746618e925298465f61a05f5
SHA512 4cc9c60fe5d4dbb16558e0fe28b98e53442069cf0e9c4b3f76233d5060210152ce94fed7ef3b5fadaceea5ee8bac4ce5a9f2a055e44216cb4cd3b1d3a2be76e0
TLSH
T1F4E08014E565223711DE465D9C57864F96720D07014CBE092BA3511C41ED5FB54FC67F
MD5 SHA1 SHA512 TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\resources\elevate.exe
Size 127KB
SHA256 bb7da1cf464b3d5460bb72fc63c8f2b4c13f434cedbf12cff400cb417f788e61
MD5 24c406a291707a4ebc6232760fac6de0
SHA1 92fc07eba4cfe53b87d7a1c362449791e250492c
SHA512 30ad0183965844fb401220dd0ef7ecd732f644f27f9f95c2f672660580f6e203922f0cf31caddcf00f0b7be31b2c653cf894e48215e94752c40350b1359bb207
SSDEEP 3072:YNbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlS7GU/7ht:4PrwRhte1XsE1lS7GK7ht
TLSH
T16FD38D1278C08471E9731E3564B4C9714E7DFD711E759EEB23A8027A8FA02D0AA29F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\snapshot_blob.bin
Size 331KB
SHA256 7465afd52c876d08d4f0b645cd4c49cd9122b59b122220706dc21949a01f00f0
MD5 7d4032fca4f3ce9cceaad7729e797792
SHA1 f478683ddc64c84c1a02eb09cb58a6175a435257
SHA512 8a70d610ab656bdcdcb3fc9c4aa72896a8221f7eb834ce1231334eb3770b36d37a6d4957173621eb2ceb6aa1d673f144458e43358f9486bb482c47ff84c7b306
SSDEEP 3072:6/nTOiXKMOt+xbRu2frRO+eioXw1Wu+P3YZo1A8GV61HfuOLQK+:KT5Xkt+H9F1Wu2QQxtHf/N+
TLSH
T19B74BB06F759CB26C9893A745DE983982E2072CD9D55B30B3109B37E78BA3740D3A72D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\v8_context_snapshot.bin
Size 696KB
SHA256 8b47181db61d20574cf3407ffbfea0f4584d4d74b5e5bcd873dbad5b19d4d0ed
MD5 4b017115a143ea77cfd341e120a77332
SHA1 f3cc60f86dc2b5ef5f7f0cd0933ae4ffe24c57cc
SHA512 93427b2bebae004ba80d852eb18da2ec881748ea0731b24b15f0aa50b74a20a5f4d03127eefd59af92e0d898c23558aa0cfa9f2ec466556354e39c178974e1a5
SSDEEP 6144:1af8tLrT5X3ukt+H92AqDRQQxm2NyhaigNw69I3ndbkboE/UZ703yCTzrWD:1af8tL35X3usDo2NyI4NbkboE1rTzm
TLSH
T10FE49761F71ACF26C6493A7D8DD657463930B2CE8E46E24B3406B33E78B96704D3662C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\vk_swiftshader.dll
Size 5.4MB
SHA256 fb1c846f1fe82a8a7cbb5f438075d212aebea91210a61774c50cf8471c47adf0
MD5 5479c0a7181220a3d7f46b6cd8524b25
SHA1 92141e92873c30c9a30fa0eba6a82264615fe87e
SHA512 3c3560eebb4a465b30fce65c578f30835a663fc305051ae606f05312690bf265e37909a042649985384aa2bbe5b6067de1d9aecdf9c6a2a44aa3cce4055887b1
SSDEEP 49152:/RAYccoQajkjwWrTd/hMFsfyTpkXNYSsnt4p+L4lvgPTvFaHmJrL+4jopldbIqd/:/FccS3OQvNToxq3cTHIXP
TLSH
T1AF463803F28681E9C06DE579875FA633B631F8850B2276DF56A00F192E66FE06B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\7z-out\vulkan-1.dll
Size 935KB
SHA256 f2420e9c0b4caadf05e622a159d5aba3b22f2fd3348f0ffd538b49d269a22767
MD5 7327811804c6e294b98a65a1253b62aa
SHA1 c2b2a441a31a9ce99064661fed6d4a5c48dada77
SHA512 881085c8a1530e60df8dd92ea805ef3336a6fbdf15a9fa08c4c1e039f3e662380d43c94cf0816c9a30a067d6b428c2cfd3fd2166a07ef5926f64f6f3acaaaaa2
SSDEEP 24576:0hlEEziaf58fg5rY4M2IP4rB66Z5WGcXDYsHQDJ6g3P0zAk79oOHTQ0:0HESiE5845U4be4rB66Z5WGcXDYsHQD9
TLSH
T14C156D23DA644669C976D034C9D28B0789B175822326B9CF02A817047F6FFF47B7D72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\modern-wizard.bmp
Size 150KB
SHA256 fca04cec99488a124d0b2f53f3101c6bf6ed69a8a3f5fb7c100396ab98635658
MD5 009fac2fe792ade4815716972b0a2c0a
SHA1 8894e25a4733d21137d4bb11fffbcce5a546bebe
SHA512 53dbe7b635cd97ce6efde4deefc7ac6c5b5bee6b75c33d77eb98e3774d27716906a105cbe17f8f3fe0db93fa439122bbc20c31770657f9d4210b22054993f888
SSDEEP 3072:ytZLw+9yhUy34GFsRM2oqzX55WXCaOgw1usy25ioqSY2CHbE:ynLw+ENFsVb5ISb1uzqiCHCHbE
TLSH
T19FE3F18637AC4500F0F54B3ECB682C16D71787D942525C98FB6199F8E527ADFBEA002B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7EF0.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Blockbench\IndexedDB\file__0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Blockbench\Preferences
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe594d6a.TMP

Path C:\Users\Admin\AppData\Roaming\Blockbench\Preferences~RFe594d6a.TMP
Size 158B
SHA256 c355152d58f77b3d2b34410e91543e9358463c1295d8782246fcd937beda62e4
MD5 4479e458562a08c3351111d8f997859b
SHA1 6fc1ae1cdec3f7c300b15158f3f17cbc017bc9f5
SHA512 1d2197ec44d46329c74b498f15c03d6b0391ab9bde70cd75ba6769bd24a29f5286ffc641b5e891bc66b83cb17b49a2cacb640c6370d3f566bcef975388570218
TLSH
T1ADC08C5B783064B34A9E5AA5111EFC2A6CBA00344E031A0205D8B38E486BA4D088B02A
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1432-375-0x0000000070120000-0x000000007016C000-memory.dmp

Download

memory/1432-383-0x0000000070280000-0x00000000705D4000-memory.dmp

Download

memory/2512-350-0x0000000005C30000-0x0000000005F84000-memory.dmp

Download

memory/2512-352-0x0000000070120000-0x000000007016C000-memory.dmp

Download

memory/2512-360-0x0000000007760000-0x00000000077F6000-memory.dmp

Download

memory/2512-361-0x00000000076D0000-0x00000000076E1000-memory.dmp

Download

memory/2980-307-0x00000000060D0000-0x0000000006136000-memory.dmp

Download

memory/2980-332-0x0000000007BB0000-0x0000000007BBA000-memory.dmp

Download

memory/2980-334-0x0000000007D60000-0x0000000007D84000-memory.dmp

Download

memory/2980-304-0x00000000031A0000-0x00000000031D6000-memory.dmp

Download

memory/2980-305-0x0000000005A30000-0x0000000006058000-memory.dmp

Download

memory/2980-306-0x00000000058D0000-0x00000000058F2000-memory.dmp

Download

memory/2980-320-0x0000000070120000-0x000000007016C000-memory.dmp

Download

memory/2980-308-0x0000000006140000-0x00000000061A6000-memory.dmp

Download

memory/2980-316-0x00000000061B0000-0x0000000006504000-memory.dmp

Download

memory/2980-317-0x0000000006800000-0x000000000681E000-memory.dmp

Download

memory/2980-318-0x0000000006830000-0x000000000687C000-memory.dmp

Download

memory/2980-319-0x0000000006DD0000-0x0000000006E02000-memory.dmp

Download

memory/2980-333-0x0000000007D30000-0x0000000007D5A000-memory.dmp

Download

memory/2980-335-0x0000000070820000-0x0000000070B74000-memory.dmp

Download

memory/2980-329-0x0000000007A10000-0x0000000007AB3000-memory.dmp

Download

memory/2980-330-0x0000000008190000-0x000000000880A000-memory.dmp

Download

memory/2980-331-0x0000000007B40000-0x0000000007B5A000-memory.dmp

Download

memory/2980-328-0x0000000006E10000-0x0000000006E2E000-memory.dmp

Download

memory/4792-1228-0x0000000070120000-0x000000007016C000-memory.dmp

Download

memory/4980-1217-0x00000000708D0000-0x0000000070C24000-memory.dmp

Download

memory/4980-1209-0x0000000070120000-0x000000007016C000-memory.dmp

Download

memory/4980-1206-0x0000000006250000-0x00000000065A4000-memory.dmp

Download

memory/5252-1285-0x000001E456020000-0x000001E45659A000-memory.dmp

Download

memory/5464-1248-0x0000000005F50000-0x00000000062A4000-memory.dmp

Download

memory/5464-1249-0x0000000070120000-0x000000007016C000-memory.dmp

Download

memory/5464-1257-0x00000000708A0000-0x0000000070BF4000-memory.dmp

Download