acdf4b27f24888e7fd62701221300a5e66719f693349db534faaf494bc618f85

Resubmissions

27/07/2026, 04:33

260727-e6ypzavygw8

27/07/2026, 04:24

260727-e1h3bsvhjd7

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
385s
max time network
393s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nightlight.Launcher.Setup.5.2.6.exe
Size 102.9MB
Sample260727-e6ypzavygw
SHA256 acdf4b27f24888e7fd62701221300a5e66719f693349db534faaf494bc618f85
MD5 6061abaef7963fd8face52c9c00bcadc
SHA1 35bf77cae951aff9fa5d8022a964e361df9ccb3f
SHA512 1f83c76176b41b18179b7881ab10cf1c5a2acd8b4a4f829b4398e548413d34f6cac51812e7c01c2ca41f952ff1b92b8b541cb56b9d51d2013d4ccb3bf9d53176
SSDEEP 1572864:wspBL4sOiw/AgjzfTey2OLly0aUsXK98a8bmADUclxqrDgWp8UrXiIAD1UAWeSUp:wsXLUiwoXy2OZIE18bmsUcl5IP41LxSu
TLSH
T14F38332AF6D61BE5EFCD7F7835C989BDA1959F87818448A600E4C8F27F041C6B6D4832
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
5044	Nightlight Launcher.exe
2956	Nightlight Launcher.exe
2788	Nightlight Launcher.exe
4768	Nightlight Launcher.exe
4228	Nightlight Launcher.exe

Loads dropped DLL 15 IoCs

pid	Process
4632	Nightlight.Launcher.Setup.5.2.6.exe
4632	Nightlight.Launcher.Setup.5.2.6.exe
4632	Nightlight.Launcher.Setup.5.2.6.exe
4632	Nightlight.Launcher.Setup.5.2.6.exe
4632	Nightlight.Launcher.Setup.5.2.6.exe
4632	Nightlight.Launcher.Setup.5.2.6.exe
4632	Nightlight.Launcher.Setup.5.2.6.exe
2956	Nightlight Launcher.exe
2956	Nightlight Launcher.exe
2956	Nightlight Launcher.exe
2956	Nightlight Launcher.exe
4768	Nightlight Launcher.exe
2956	Nightlight Launcher.exe
4228	Nightlight Launcher.exe
4228	Nightlight Launcher.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
23	raw.githubusercontent.com
80	raw.githubusercontent.com
81	raw.githubusercontent.com
82	raw.githubusercontent.com
21	raw.githubusercontent.com
22	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_880105613\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_91521200\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_880105613\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_91521200\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_392045092\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1528423679\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_880105613\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_392045092\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_392045092\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_880105613\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_392045092\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1374256104\_locales\bn\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4720	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nightlight.Launcher.Setup.5.2.6.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
616	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Nightlight Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Nightlight Launcher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296008341270540"	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{4046C995-D739-47D8-92CF-866866246068}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{FAF0A1CE-31BB-4C1A-8FE3-5FE447E2728C}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4632	Nightlight.Launcher.Setup.5.2.6.exe
4632	Nightlight.Launcher.Setup.5.2.6.exe
4228	Nightlight Launcher.exe
4228	Nightlight Launcher.exe
6456	msedge.exe
6456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4632	Nightlight.Launcher.Setup.5.2.6.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe
Token: SeCreatePagefilePrivilege	5044	Nightlight Launcher.exe
Token: SeShutdownPrivilege	5044	Nightlight Launcher.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5044	Nightlight Launcher.exe
5044	Nightlight Launcher.exe
3484	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5044	Nightlight Launcher.exe
5044	Nightlight Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 2956	5044	Nightlight Launcher.exe	91
PID 5044 wrote to memory of 4720	5044	Nightlight Launcher.exe	92
PID 5044 wrote to memory of 2788	5044	Nightlight Launcher.exe	93
PID 4720 wrote to memory of 3408	4720	cmd.exe	95
PID 5044 wrote to memory of 4768	5044	Nightlight Launcher.exe	96
PID 5044 wrote to memory of 3484	5044	Nightlight Launcher.exe	98
PID 3484 wrote to memory of 1428	3484	msedge.exe	99
PID 3484 wrote to memory of 4628	3484	msedge.exe	100
PID 3484 wrote to memory of 616	3484	msedge.exe	102
PID 3484 wrote to memory of 4628	3484	msedge.exe	100
PID 3484 wrote to memory of 4628	3484	msedge.exe	100
PID 3484 wrote to memory of 1784	3484	msedge.exe	103
PID 3484 wrote to memory of 1784	3484	msedge.exe	103
PID 3484 wrote to memory of 4360	3484	msedge.exe	104
PID 3484 wrote to memory of 2676	3484	msedge.exe	105
PID 3484 wrote to memory of 4360	3484	msedge.exe	104
PID 3484 wrote to memory of 4360	3484	msedge.exe	104
PID 3484 wrote to memory of 2676	3484	msedge.exe	105
PID 3484 wrote to memory of 2676	3484	msedge.exe	105
PID 3484 wrote to memory of 4216	3484	msedge.exe	107
PID 3484 wrote to memory of 4216	3484	msedge.exe	107
PID 3484 wrote to memory of 4216	3484	msedge.exe	107
PID 3484 wrote to memory of 5276	3484	msedge.exe	106
PID 3484 wrote to memory of 5276	3484	msedge.exe	106
PID 3484 wrote to memory of 5276	3484	msedge.exe	106
PID 3484 wrote to memory of 1956	3484	msedge.exe	108
PID 3484 wrote to memory of 1956	3484	msedge.exe	108
PID 3484 wrote to memory of 4528	3484	msedge.exe	110
PID 3484 wrote to memory of 4528	3484	msedge.exe	110
PID 3484 wrote to memory of 4528	3484	msedge.exe	110
PID 3484 wrote to memory of 3188	3484	msedge.exe	111
PID 3484 wrote to memory of 3188	3484	msedge.exe	111
PID 3484 wrote to memory of 2320	3484	msedge.exe	112
PID 3484 wrote to memory of 2320	3484	msedge.exe	112
PID 3484 wrote to memory of 1032	3484	msedge.exe	114
PID 3484 wrote to memory of 5052	3484	msedge.exe	117
PID 3484 wrote to memory of 5052	3484	msedge.exe	117
PID 3484 wrote to memory of 1064	3484	msedge.exe	118
PID 3484 wrote to memory of 1064	3484	msedge.exe	118
PID 3484 wrote to memory of 3084	3484	msedge.exe	119
PID 3484 wrote to memory of 2544	3484	msedge.exe	130
PID 3484 wrote to memory of 3084	3484	msedge.exe	119
PID 3484 wrote to memory of 2544	3484	msedge.exe	130
PID 3484 wrote to memory of 1108	3484	msedge.exe	122
PID 3484 wrote to memory of 1108	3484	msedge.exe	122
PID 3484 wrote to memory of 1108	3484	msedge.exe	122
PID 3484 wrote to memory of 4920	3484	msedge.exe	123
PID 3484 wrote to memory of 4920	3484	msedge.exe	123
PID 3484 wrote to memory of 4920	3484	msedge.exe	123
PID 3484 wrote to memory of 3848	3484	msedge.exe	124
PID 3484 wrote to memory of 5768	3484	msedge.exe	125
PID 3484 wrote to memory of 5768	3484	msedge.exe	125
PID 3484 wrote to memory of 2072	3484	msedge.exe	126
PID 3484 wrote to memory of 2072	3484	msedge.exe	126
PID 3484 wrote to memory of 2072	3484	msedge.exe	126
PID 5044 wrote to memory of 4228	5044	Nightlight Launcher.exe	127
PID 3484 wrote to memory of 5016	3484	msedge.exe	128
PID 3484 wrote to memory of 5016	3484	msedge.exe	128
PID 3484 wrote to memory of 5016	3484	msedge.exe	128
PID 3484 wrote to memory of 4912	3484	msedge.exe	129
PID 3484 wrote to memory of 2544	3484	msedge.exe	130
PID 3484 wrote to memory of 4912	3484	msedge.exe	129
PID 3484 wrote to memory of 4912	3484	msedge.exe	129
PID 3484 wrote to memory of 2544	3484	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\Nightlight.Launcher.Setup.5.2.6.exe
"C:\Users\Admin\AppData\Local\Temp\Nightlight.Launcher.Setup.5.2.6.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe
"C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\nightlight-launcher" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1708,i,16342732136638537331,5268629281553759600,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1712,i,4891858541863316581,16860740657797075120,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1704 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Valve\Steam" /v InstallPath"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Valve\Steam" /v InstallPath
    3⤵
    PID:3408
- C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\nightlight-launcher" --field-trial-handle=1708,i,16342732136638537331,5268629281553759600,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1712,i,4891858541863316581,16860740657797075120,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1892 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\nightlight-launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1708,i,16342732136638537331,5268629281553759600,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1712,i,4891858541863316581,16860740657797075120,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2576 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onajlikezz.github.io/tutorialforkey/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffe162dc188,0x7ffe162dc194,0x7ffe162dc1a0
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,7896664710948960329,2218708453465318546,262144 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,13183848183539369601,2458554613887064892,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
    3⤵
    - System Time Discovery
    PID:616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,11674730913250376281,5255533946943300005,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:13
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,9627451863145856309,7488321761099450269,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,10840123209600180018,3139178399991686703,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,9971746192077415782,827845593969509978,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,11243870064526154300,12236502451691430335,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:9
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,7665917764662620445,10478098427394749358,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5480,i,2775143101339609549,6037258281829189661,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,10484667597262665048,14791546975257376551,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,11725116353866935656,1980189155559272535,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,8372626981790700582,16432419068207308430,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,8372626981790700582,16432419068207308430,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,4743810585310017824,639302310282230913,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,5205017294891701113,17334514691690731208,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,6409933174587736836,13496879786231951857,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,3456311075949264178,4198652606758960336,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6680,i,16752273106619400195,15547272016190937122,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:1
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4072,i,18213953769458822194,3573495052219317595,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,1678985855373470166,6455506517997131388,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:14
    3⤵
    - Modifies registry class
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7536,i,17265325185100568905,17863209138254816906,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:12
    3⤵
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7116,i,9573717093744783925,2685704856833785002,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5396,i,18127492233174668044,5347278031675911209,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5372,i,9280502291447271007,12165180185179315195,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5360,i,3825459299880993514,14280515750761969472,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,14814331600936800375,16907073227289675674,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:14
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7740,i,6479234315884406710,16397173380763879878,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7764,i,3596630542916069341,9329008858573921810,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:14
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3220,i,10814299912904504838,311894335713590231,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:14
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3864,i,4104568229691047611,3745230112417935094,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:1
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8128,i,8837681176470760626,6184193087672338305,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:6548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,16703599746012153919,1014280952377774201,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:6860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8296,i,1428755028920434694,12546249846693609313,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:14
    3⤵
    PID:6220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2676,i,9610880345412551000,7793255331943951161,262144 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=8312 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,9209049478657520965,11606166735189364803,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
    3⤵
    PID:6636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,16394066968677179707,18229962097642025797,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:6864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,5791983038798543795,2185756081623422420,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:14
    3⤵
    PID:7084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8056,i,15968507430141608140,9795650046372860790,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7812,i,5850790736146336980,14121966256313989690,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8204,i,2535198894786137116,2497094528266872689,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:14
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8340,i,9578870101986551568,10349216364764260310,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:14
    3⤵
    PID:6408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8540,i,16609641370669506227,11626367580471155331,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=8548 /prefetch:14
    3⤵
    PID:6528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,13428045811324221370,16058015089130728149,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:14
    3⤵
    PID:704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=6904,i,12954222367140616174,6461798759534087692,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
    3⤵
    PID:6212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5356,i,13351097635749726700,8030324242313015793,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
    3⤵
    PID:6260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8600,i,805924275240499210,11011119246819500002,524288 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=8596 /prefetch:14
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8520,i,12165305715121688170,17188586985473921905,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=8616 /prefetch:1
    3⤵
    PID:6296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8568,i,11016778894785388299,6611120832058222558,2097152 --field-trial-handle=2196,i,2126279462783802169,5990906480118853143,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
    3⤵
    PID:6504
- C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nightlight-launcher\Nightlight Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Local\nightlight-launcher" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1708,i,16342732136638537331,5268629281553759600,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1712,i,4891858541863316581,16860740657797075120,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3764 /prefetch:10
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 1.7MB
SHA256 0874fe716c0bb7f9ffb28b6365ca23641397a11e0738d7520e91b5b225870b55
MD5 d8bb5ec8ab99d1dafc3a179eaabbb36e
SHA1 93222b91dacf8a57636142468839a348a102aa81
SHA512 f32a378281804eb8c656ef7c94e863ada86b431c5fdf3747436b9ba20568852ddcdb2ca2d41dbf767ac996f10083ad894c2fabcbf0aeab9071bfd6522d3a8666
SSDEEP 49152:01/QLcq32beRFU7dcwvjjc0yul5W+KjJNzhKT6gaBJB:0tQLX3ZFFE/wNz8ThaBJB
TLSH
T19D853335EAC37FF0C507C6B1A76CEB8C9BE2B6CA4700CB4466B884491C66B7645D2F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 469KB
SHA256 99347b4d20b9a54d0aa75c9c08b542c782046f535a99430e157560b89847b557
MD5 de0674b53941aa4f02b874c252e409b1
SHA1 eacee3015835b53a5da109715c4bdaac91df343f
SHA512 d9081a80215607d4a4879c20519e6b82a56cf180e2006f73539a7c88f6031439340cdf5b96159e463b398371bd4698ffc5437862ff2f432018fb1b4d9640cea3
SSDEEP 12288:kDlPcybnwRPM0jisSPb4bO/lOCdZfWD1jkBmz:sctKbKPqZYtQ6
TLSH
T134A4233318B0703709B4BFA871420ECD418FE406C6507BAEA7B6A0212EFBBF47952579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 291KB
SHA256 2f7ecda38db07a67e40756336919bb14dc05367a8a68d5c7f17450e5035e3b84
MD5 e0af8fbe098ff751fdca2f8d4aed0ad0
SHA1 8f55972d6a12e59188b58e47cc21f2e6357fd8fd
SHA512 11b71c44ec34c49e2ad3f869b553443ad5870ac91414e44d3244e9e8e8e49153005d4154a751edcce04247d9d640e7845e113f6bf3a37fd308daf8fa501a6f3f
SSDEEP 6144:Tx0chndmFX5i5wzSdfzotlmegYuD1av+6NoSXNTFW1kmMrAFJx:NsUy47SmegP1avhRXFFQ
TLSH
T10B5423BA7D34D5E1669FCE58A891B8FEFD5E663C88A11EDE02D2420DCB17873E104027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 22KB
SHA256 294dd517946e934a9053dc2ba283dc8768784fc1b003dfa32291ae5daefb598b
MD5 292a5084835009ba659121f9a7e33e9c
SHA1 ebb353f734ce1422935ae590f8f23e576b310116
SHA512 0b21ab68da2caaae6549b915e8e3a7782f6dc5eb805f446e5ef112c119ee7d85f8e18f5bd0adbe2a888b85a3306e3ed8faed56cd469fe11992c0edb554ca8eed
SSDEEP 384:MZLKq+nOtzaHeEC1KNXZ4yuDutU9eyWa3HZ7j5K8r8dUdRg7S8uH0x44GZkDyn:MZLcazgeEIKNXZVuDxWCHZ7j5HYdyguB
TLSH
T17EA2E04EDB6E607C7485F50FDE18A969F2AB99628F63324350E8304FCE239E98504F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 16KB
SHA256 19726de0e7ce69b90aaa3fbb2ee1ff963725234f2a0142135dfb6e1c3d5e9d77
MD5 89dc0b2068d20724694b40ec9111c0f5
SHA1 482f1cd2541a4e05149358ae977e22f528597614
SHA512 e43ff5d7adff86addf82e870c4deccf3d3b8e251a844127fe759fe002078172e4d1520cde4cd8d049de5887b8d8154a36836f15a9a785b315ee7103f265d19d7
SSDEEP 384:AdM+4EWBNMOX5s6koMzzTBht4egjerP2qoYgn6ZKNu0t3W:b+4xmm5sNoKNPging6ZWvW
TLSH
T14572CF8A1A1D39CF3FC85E9DB5D21E058627356DE99B4F7FF2863214025A9CB921007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 125KB
SHA256 8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1
MD5 53436aca8627a49f4deaaa44dc9e3c05
SHA1 0bc0c675480d94ec7e8609dda6227f88c5d08d2c
SHA512 6655e0426eb0c78a7cb4d4216a3af7a6edd50aba8c92316608b1f79b8fc15f895cba9314beb7a35400228786e2a78a33e8c03322da04e0da94c2f109241547e8
SSDEEP 3072:b4XkN5u3RbAR2r4lJ8FBnP7fNblbKBRvqy:fGdA8FBP7fNb5y
TLSH
T191C3231EFC32AF9A2E1724EC288521809C1E92FBE0B3512CF565F437E76517D999CA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 125KB
SHA256 d405a3ac5f1e3dd4faf77948595bd702471d074a5ba127669649020174495c7b
MD5 2ed6e23323eb9b51aaceb260b942d1a3
SHA1 0ad054fa3e936c588e7514b97136c9de12414897
SHA512 65b863b17aa8cf8634378b837b65287a66ef47c9527b4aeed282cd2c4d47d4729347fa0a98d41870b81075670f9d7f20abc56bf803b5c48ab6a6de56c8d8db03
SSDEEP 3072:UQSecpPkAGBQ+/b73fFKtXbDWseKXNaRQQUy6wE+JXpB+:5SxkA8RjDgXbT582cJXpY
TLSH
T13DC312B672FD9E4630F792BBC91DE0A4CB11E32C4A5C5F058C537082991E6F2A6E25DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 51KB
SHA256 1c6a8b8bf6f9290c3efe3a705cebc58214498fe9928f4cd5093c59b1254b0038
MD5 d69c4b2162a622809836cbbb8160aaac
SHA1 aad84facd65fa2079187d770927ac9dee1ace1ca
SHA512 560a4981b35f51121e696965533733e832de30b84724ef0c8dff284c0fb128403c9099ce048b09804e99d0efe29d1f00bcca548f58f1bb7d7cc5aa7ed56d3e89
SSDEEP 768:gG/g/89u1LzKYzBvP0xFHkrux3k+jn0AMp4U/TZmMp9UT+nYe2SPrHbyZPpp845J:gM19mURUy0H7ZPbUSnYe2SLeZr3A0g5w
TLSH
T15C33025EC7074EF98B16DB54A3C537418F0AA74D9783F9928ABEC42801E16E236D4DCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 400KB
SHA256 5ee3b1ade2ec3165f2b6b53ba21725651e6a352d1e8870cd941ef054b7ee3ccc
MD5 86cebbf534a513afb669d0635a0b797f
SHA1 edf792beae1b85253d1bd78a4b8a104504558075
SHA512 d3ad96e54ec6d7845a10515a93b70086051f34c548bab15f902c0a3044ea5d07b689fb2470d6a2a2b0c75ed5d6bba40cb85be0bfff7c91468b2958a45eb49042
SSDEEP 12288:Zm6Vqwww/LDfFkl9nTyVL3lE9RRVG/ev9gs5jpoC:RVzwQ3d6U5kRRR9r5jr
TLSH
T140942343D193DFBE63F906799931082840A972C7853B06554CD61C9FBAD6C3BC293EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 177KB
SHA256 ca5cddea5a3fd4c8fd5c94648f9948c6af6985f344083e3303c7a15e501c2231
MD5 d81353f3e854f053e2ce524c43ef420d
SHA1 de60954981f36ce54144d85d827b1c2e47024e41
SHA512 262a19a780036e3c6147f8a416c85dd80bf150d6aa7791367d62fe77faf7d320951ed765d34f66aaffb9bd1e87d811c58591c0733f7a87a4880e71a6ccb31bf8
SSDEEP 3072:papWo4gSvl8KsQW9B4j/s1zDlADt2nX3nQPvQc0UTqHIOnNMIJdAqO0oDeCw0u1U:pGSyKsn9yjcD2GX3QPZ0UzONM+d7OxDL
TLSH
T1C40413B800E19D2BC4DB15B5B6EEE6FC69260390A04440C74E7798623BD2BEC5DF49B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 115KB
SHA256 b91bbc351a42c6907d7e54b05fee763be9fe2fe5953f6f33a5da05f6756feb1a
MD5 23ac6fe478e463857556eb639de0bad3
SHA1 2af9360252cd0d576908f1a6556b32cc95ad3f96
SHA512 03cf93c719183f2895f7f090d9f4219f1085aa99fb6c253647c71bfd7391833191658a4fc130a4db61e554fd6d02ba89f356dad50a7a5147193e4c006880ef59
SSDEEP 3072:T1NZRGHILt9A2/gOQs24rqVCJTv5SeOP+2Z:TXTt9V7RqV8v5Seps
TLSH
T1E2C3126DB6FB52782D72F3394BDBE737228D09E596D930D42CC04E446E82DD9462E82C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 211KB
SHA256 b5ae7217a753a1c2bb02f0a56b5efc5a177dff58fed331cafde2dcdad24ba6d3
MD5 4788048f319dc48101678d9e69f5077e
SHA1 a353e61a922f0cbf41a57918ee98e5f003d2f9b8
SHA512 9c2c9f92b43172bfd417cd2b873153e7db59b0060b27eee6c2f985c0ce0abde44debbbf0c86db0c00a38ae33908e66f386b1899d02ec1ed8afed2a2b1cac282d
SSDEEP 6144:a+bVAE8+fN5YOoK+zXLAxnzNsXg0kxqsTzt989PBzzTlKrRj0EFX:a+5AIf8hK+z74KXg0kxqOQrz/krNLX
TLSH
T1A62422B70DD8C1E4BA7F740B52CE5AD3ADE38B0EC158E150F5FCA4093B92D0AD60599A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 22KB
SHA256 458158ecbe872bfed69802a393aa2d5c44a6fd3468fb838de2b1f73a3a3c3036
MD5 338a40d51fb4cf25c0eaf6322a675f34
SHA1 935da6c06d560e9e3fdba75b2506aa2c0f0a9305
SHA512 44686d89a2d20e0d018b04ddd489679c46312d014d10a39b4f259f33fd64e05e835a71b0d8812d1bcbb0ceae76492df5c453d028b6e108f621656235b15a3169
SSDEEP 384:gi55ApQG71cEFEhwI5SURYnaldid3h1ydL3T5LHBh9fW0C857tv7G0VLznE:/6EhZyq8RAdH5NL+0L7l8
TLSH
T17BA2E17D59FA035B2DCBEC3691A6BD2A9833151B40BDC437A2081F35B18529A76233DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 55KB
SHA256 ec0bbc22e33def366adc7d1acd3cecc1af1c514e8a19e41c30c00550a00219c4
MD5 c299e329d524735247956b5d22061e7c
SHA1 c775c51afacc9e22fdf8bc7e4ac5d8136d2cc322
SHA512 b914db2fdd8dff44f67e107925c615d590e88d38c139e4cc86cc5d8614b79eef7ff9f3a802100258d1d6a01015bc86223f8251eef85096d3ea54ae28ddf37181
SSDEEP 1536:BT8y7/aRqvW1JYIo/ulWwEjlq6gq+UtM6:FeqO35lWvq6sU+6
TLSH
T1194302292B4454C56EEACDF035787D342B801DE96BD299BED74C0A3A6C5216D234FC33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 85KB
SHA256 b1f7e7aacff10768c641c13538ae4a98fc750648f03066eed3fd75230f5d5ee0
MD5 cfcbcce6fc978668fba0ed8a353b6cd4
SHA1 cb96c8e0978e0c7cd24685ab91844e3b3e943679
SHA512 b4c79ab6026b94e039a7ceeee669cf88ab9618897f4d0971a3ca396ad905c2c87fb0b9ed37023f913789986a1faaa1eec0943fe95790b75af7897eccc4983cfe
SSDEEP 1536:O6tayTe7pkALaBMYLQvcCbQoM9OQ+J99AdCVyVYFIszQ3bbX0yzVOZjy0Gn:daEe1bYLQvcCbQN9rk96v67zahzVsjyZ
TLSH
T14A831284C3F2137D308FEBE7E905BB0248E5F253858B2277952D5944AEE88615F1D8EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 166KB
SHA256 6201eb96327ba0b412bf43a086cbd1dfe2b20f7b4b2dfaa4a94788fd6a8f05c8
MD5 3445555818b4ec4445efdf5726902e5f
SHA1 2f9a16df4605c08ec9c596bb5f45358aaedad37e
SHA512 00a7b4bc1c513c34bdd64ba2d3a6dbf6b81cbbce7188941b07df501b2fd285930a866fc225b450ed70440c4076bf6bcca486789abb54af8d7f278e8809f1a920
SSDEEP 3072:bZP4viM3p0YFwmAkpYLYbcW9cnsVYVV/pdiv32/eYSf6wJjs1lSjDYeRUEv8:FPjapwmbYWc4msG/py32m7CwJImPYeeH
TLSH
T1A4F3129003E1FD91FE089665A806BAC7047E8DE48C132972AD6B603DE17EF543D64AED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 43KB
SHA256 e2d2da6faba2b490cff327e2eac7b70170f165ec3bdc7ba64132d86449383716
MD5 953529a7c8219cc516aac3d6e66dc03e
SHA1 cf787ba5b3d1c16dee9cd0b2543c44a773770f06
SHA512 fcc6e623619764133bff0435f531362841d6ceb6ea25a6c8e120863dfbc3de6d87039411136243839cb45524dae52dd345396f96efe440d7a31b950d55749288
SSDEEP 768:fF1z5yAqI6/9JRsd/XeD3I2BR94NmDCXDv/4nxyG3voN5DkQ7tu7ItSIT6lH:fFuRsdq1BRiMDeaxb3vsyQZuMtq
TLSH
T1BA13F2C4A01EC5182DC6F58C8A8B34F0CE6FA28F5118D6D69FA7279906D6CD20DD939D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 178KB
SHA256 5bfeebcb0e8bf7dca3bf00b655a6fb84c80b3733051e15e5238070df45e1b120
MD5 e31cfeb96d93ab0722f6bd9f42b88bec
SHA1 1adb094a2ad7a9cf7b4300959e19258b94264d19
SHA512 4ca2b4ae719d08e2b5bdbc68d6398e2998ad34f7d6fe22461ade8201a0e40e19c7f308f0d663eac71d3d9f024707e56492e0f8470270801bbe73fb8bf570520d
SSDEEP 3072:nSTwpcibbCx4ZwtdCxhuIeQIqpQTisA4MvEPpMOQXfvghuPJXFcjzEpkG3:nSMLbot2huIeapQTisA32pMOQXfmCDl3
TLSH
T1CD04126B3CD3F52B5AD72C5AA01C4431A3163AD7D4A0D783C046B5B4353D8FAAAB724B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 24KB
SHA256 3096c47012a7255879304054c9d8d260fd67a0f4b3fdffae385fda6d519856e6
MD5 e8ff9d6fbd28ef9169d377c958235e8f
SHA1 40e43683f211f525348978e338f3d963649e6f55
SHA512 cdcba0c5532d7e53018569ad2c02326d92cb6ed58f38bd10cc94b8a848cbb6aa2e69a73862fb820ccfed233cf4144b4323c4cb2d352dd7249d66fa3cdc7b078e
SSDEEP 768:2YpFhYdDFIJXM6o7ybBcd99jYY/JRcwbU:phiDoXM97UoUaSwo
TLSH
T1EDB2E1A787D0E46D6E9F3BA3B1A4880CCA59760FD7E41C80503FC5167BE22D2058B76B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 21KB
SHA256 1096fde818e9e830d3f70770d28fa1d01e4ca2739016407150295d8f87423f8f
MD5 6ecbbd0c4919d0cd7a9601e194c439b4
SHA1 6fa07982772d576303667de56c30c9609519d1ba
SHA512 c1977033e233c3308e066d32eb8ba5b1078ea251189a46185110c052c8d8faf3eded92e8ff2a48bc36936ce762a2f94a975f08e33e0ef377acd7348fe2e1d84d
SSDEEP 384:/rpha37wZHNTd//FN0Igk/cB50gQ9B6kR++ZUOU+bGxgkhjpVObWj:TphFNNFN02/cBqP65+ZU/+bGtppVObM
TLSH
T134A2E0199EC2FF6D0CE09FBB894E935A9199FA9103CDDCCC559289FA334140A9537F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 a3e51fec592bf4e2f44b4d2d541657de74bc6cb8582c18a627660b3b894c11c6
MD5 6726597796d3415a6737b1e5fb445ecc
SHA1 6dc2e13bc602b612916ee4352a376bacd5870bb3
SHA512 b0074d8f0cc6cda09f1fbf3723cbe23898d306629eef8e3988f1c1b7d74ccb0045e165cbca419a9d890a67919909c9b8dfa307a48be778632a4a22bb63e26ef7
SSDEEP 96:eT5pRtqCC1Di9M+GeHM/mu3L2nOBq/oH5cNa5zr:25pHqCC1ePslWLjE3
TLSH
T1D5B1DA202F5D19EAEF688477F5E01A74B1F04CE48943CE524E5A2FB4443BF48B2DA897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 340b5e491502ad330e021f94238e8753bd3834dc4cf438a019e84dc407e1d2ae
MD5 229d1fc71ee344bb9fe7c5a3b9756735
SHA1 04e08edcde8650cf22d89d8376f97ab547a06f5e
SHA512 4b1aab259bf92dfd32463cade6d560d520f8463a1a4ab30190c163e9690845bfac624bb510bd31de4170d24a65fae1e9619fec8899ca5dd3d90dc11735f47263
SSDEEP 96:85pqrACQyRid1+jI2M/mufTZOBK1gQ5qN4:85pgAC/8ssVtNEy
TLSH
T18B9196102B5E19EADF288473F5E01BA8B5F04CA48943DE629D5A1EB4453FF9873CAC47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 cc2330779cae6dcf9b0514399905a7feacd9eab782ff4624fa8f932ac37068a7
MD5 3f9fdaf50fd0fedff3a3d2496a6be5ae
SHA1 742d205149445ecce723d5951938d04bd69dba5d
SHA512 a6a798c6722182776ba73966867ecbb1d8eedc8bfbdbeb2d91ed0004e2a9c8309e5ef6aab626bb8923eb05a4cf3b8f23e0189211840ed91d853c611bbe76e6d1
SSDEEP 96:uu5pqtqCC1Di9M+zkHM/mu3L2nOB60oH5tNd:uu5pWqCC1eeslWom/
TLSH
T1DFB1A9202F5D19EAEF288477F4E01A64B1F04CE48943DE525E5A1F74843BF58B3EA857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 22bbb8036114927f1a72f0b9ccccb398113fd63454f0edab665ce6656716cbd5
MD5 a90052ecf01cb2b273cd2d7c276bc765
SHA1 b2fe3ca8ac40c3b8baf817455eaf347c1f3c73f9
SHA512 17d2e284bd687ddd6f4d3c4fb3e729aaef6de7a328d0c3027f9121396607969496aa426aea3e6d59041df9c149f4a6c23a1d487390e28c13c4acc1d3e5fccf75
SSDEEP 96:r5Ug6K2kWV9hwdB16TMG527czh2epei7HE3M/IuIpl7NfM:r5d6K2Mw4SV2eAszIpRG
TLSH
T154E1FE202F5D0AEADF284472E2F04A6379F048B5BA43CFDA4B461E74443BF8872D9853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5b9e30.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b9e30.TMP
Size 3KB
SHA256 213730e2460a0a0eb58e98720fa741324e669176890940d5d51ae34eae577f0e
MD5 07a121a252dededf5eff4cffeb34d4ca
SHA1 5eaef911f3161590c4bbc07e574615f44e12bc17
SHA512 09d117cb6c8fd7beaabc0765c129d8fc8a2c8fa14af90e529abd73af5dfb90ee6d384ba50026be4b4d67e5cc4053f20787dfed37b177c6f1af412ce4f931b374
TLSH
T13D612C54032E4DEADF2585B3F5A047B4A6F08CB49D47EE40999A2E348812F1C72DAC67
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 2bb238ced1a16729997ec9368ce15d3aa47a688c7b0b5c41b2c082a09eaa2169
MD5 1978b7ebc4a31f176a036e1a250a0900
SHA1 dab379af2e32b17b129036715af270d393f0e395
SHA512 6331d5f44b61b17d44798a6ea1efa2635fc058b4e26c1c384a6bb7921383a0daacfe9c3b2efee54988061dbce4a038c9430b30837be1453cc224ab112be55af0
SSDEEP 384:DXoJrJlrel39LnbE/FDrLNUBzeeylnkeLDcoJMZaZVr2b7GhRl/Z4rkMRDNzr2L+:aOu+7AFE1QO
TLSH
T1B492BFFBC6F485BD981156F1AA28BF2FCE2E0555526C3C1BC8D59F4BA3E2031D24198E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 78b92c926de9680d39e65800882804a56ed19494f2048cac5450ff11cb0f8ea2
MD5 283b49f4c40521bf1d2961157cd755b2
SHA1 b022a8cab249101c8c0e7e6e708fa74c0a933690
SHA512 5d630bfc5a51699725a2423d20cd34bc16ba7ad98e6487ccdd496e39bccd610d36bfb3eee9292e9b1b3481cd00414022f65353e83c74bdda9c915f475eadfda3
TLSH
T166D022635200B0FAAD6DBE8194AAEC8FC33A00200C02EDE550E09C9C1A3586D8947149
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ea5b92b8ac45ad63ec2e2bba5a2ae7423c67eb28a8082aa68fb439ec5b950c29
MD5 85d1c5b8c3d3342214c2e34cca2527a1
SHA1 5e11263f30d80a253ca9ea387345edfc81f03f72
SHA512 c549328fb71160074e1d8d48c6439b70c1ed3f29ee956ae9564b08423c384202ee90b51d886de5d96f12fe0a50c576afd47ef9d4e6630df23b86332c6469d573
SSDEEP 384:sxR9BF/f7ss9ePtMO1/57cdV/rcVr/VqSM4:sxBF/fB9wtMU/57qpKD0SL
TLSH
T18C62D797A97849BB0CC6D129F595BB27D6F71023D1D01E95BBFC8A0C10EBADD720680B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d2e21e7b8b603f3cffa4f43978b8e262af51c438874981f3273136e513fb4ac5
MD5 730a821ecce4eb91fb999f02f30c0f18
SHA1 fc3e7f187975f3edaef4e53e8c36a1a7e606f04b
SHA512 50f1afd83046b52e1cbd277158d90f75cb2e82932de8e1b580d78a455872534670fd9d0043a03ccde0376716d1fa6b7527cb3fb5099b13208fcdf5e95cf56138
SSDEEP 192:sxRmRoCF/f7sghbAZPtMnzoA8pnhlJ/g6+WNmqSV/yHIv/tG4rIEVI8+ZvBD9+6x:sxRmBF/f7sGbePtMO1/5aV/wyr/V6SMt
TLSH
T19352C5576938597B4CCBD129FA56BB13D6FA102391D05E54BAFC8A0C10EBADD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c4f0f6617d95a6e23066a520c91d1d04b4b2c90132c638143a4844617a8ef082
MD5 9df8cda96a993a015d2900b975b378d2
SHA1 5805ff5e87c51955a64c44a472fc72273432d617
SHA512 efebe604a011126a51e65de86ccc64c20f2f0aed62e27e10fc2ad7016f79bf92c9f19e35f3d38646fd5eee378884c29180f7bfa407182fa6660736fcd2158e48
SSDEEP 384:sxR90F/f7ss9ePtkO0/5atSBXoj8r/VZSM4:sx0F/fB9wtkx/5a8ddDrSL
TLSH
T19662C65BB938497B0CCAD129F591BB2BD6F61023D5D05F85A7FCCA0C10EBADD620680B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 39ef6d7de8ae1fc6411631d0ae4fd7947ccdd67eb09f76c80663667ef805086d
MD5 c671843c394471754a9d9fd96bfe6660
SHA1 80c4383107419292d865fec58be5e1f9ffbf58a5
SHA512 ec47f673325a5596aaccb93df51abe866951399de17e4d09b6d68c1af259bb4652f29c9bf9ab3fbdcdb6a4b5f2e9724a631655239f4cbb4f1cacd06205024a92
SSDEEP 384:sxR9BF/f7ssbePtMO1/57cdV//lr/VkSMe:sxBF/fBbwtMU/57qpNDCSd
TLSH
T17152D757A938497B4CC6D129F696BB67D6FA1023D1D01E44BAFC860C10EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 6e49303a32033936603efeec4f5ac76544983f1633f0de73a8a877125282f862
MD5 d56873a6e6c01d34ebdd44074c3bfbb2
SHA1 c7e3a58019d6d8bf74e045c4512aaba0815cd94c
SHA512 3d0af3e805ca24922014f742b4f60d83a1b208ebb650cd942d66fb88cdc23959203fd5eee6b89e10912b5e64330335e2594643f2e60160f880a593de2f9b98d3
SSDEEP 384:sxR99m4F/f7ss9ePtUOvR2/5HLqB+5/om4iDr/VrFIpSM1nfw:sx9m4F/fB9wtUX/5H2o9/D4Sgfw
TLSH
T12B82C697A534897B4CCAD129F961BF2BD7F61023DAD05E88A7FCC60C10DB6ED6202847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 b705c419ce252b1d98b63b018457c0b983af84be152aee7bdf6c54293cef6465
MD5 1726858ccb2cae941f2ae277496f18ef
SHA1 bf3e6cb67d8bffb021a3ebb38a263045d55f718a
SHA512 66056872e6d53a312e8a061fab2fb0d2380ce8274f1784c25822cf107b05221d069c0513d42cb3839d110e32f46997f8c5546d1971aefb2c39e774058cb9ca89
SSDEEP 768:azfWML7pLuL7J0Wg/Xf7f8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2NYc16AropLioF:azfWMdE7J0Wg/Xf7fu1jahNYy6LpLP
TLSH
T193D2EA7B640CCE7F4F800A9DAD197E9F6D6802CB9698CD5047FE941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\0d2582b4-8b39-40b3-88c4-0b029e854170\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\0d2582b4-8b39-40b3-88c4-0b029e854170\index-dir\the-real-index
Size 72B
SHA256 6bfb16a06a3c48ce245bb781ee9d87f294b9c1a8b2faebbf38c9f9ebe766bb0a
MD5 a519fcfbfd06f0bdc208b39b7f19257b
SHA1 7244263bc0328379c6a5835f3e05d1a493430530
SHA512 83592ed4a2bdebce807e7a85a8014b086a75c44f485c35eab12df3ecee83d90b3a2c6caf4c7b1777b3cd0289bb2e4fe9d36f5cd6498217793ab1f516868ef0ed
TLSH
T17AA0026C05610201C50003B12857016132719950EA05035289F025E4C8A31A5624713D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b563b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\0d2582b4-8b39-40b3-88c4-0b029e854170\index-dir\the-real-index~RFe5b563b.TMP
Size 48B
SHA256 0834d787152df2c5fdcc93eb486ffef420b1ea23ee9d9dd916f5c818373f4248
MD5 5da037e07a031ae4ed952ca24ed2df15
SHA1 3ab89d216b87ed5d00ffa04c095cfcc934ae848f
SHA512 03112b1eee2fc75fdac770ac5c97d1b7d4740d1a78683b4e47df97b54ace85711d21f5d90c548567e9e4afbd9c6cd3c8cb17474f793daacab451a7c62c217538
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 86B
SHA256 36ad4fad38f660131aa88470ad9fc22c9cb887f2380a2f8977aca1ca996e2f70
MD5 8bfe19910fb1fea1aa051adddeae4363
SHA1 2524d7f356e9acaddfd7b815bfe422aa56f546a7
SHA512 7e5f4e874ee7113bd6eb0be483cbc3e288fef5a0138e29c7c435ee14c4fafdf346ec72d4036577f26214f2abe0f4a8c3b1faa0c986685da85285cfbe06b5fadb
TLSH
T163A001FB182580DA0F20ACED6525B65DE25B8A8C8CE0CDF4855E80826628A224092860
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 167B
SHA256 874d7c39cc8c5c0a01bdf84f6c10fd36df3484572550e63a670dd2d5b37f02e1
MD5 38335453495a2262526cca09389648ec
SHA1 efe2d77b141a1b343561ab4657296630bb6cd862
SHA512 8cba597dd443530845159ac70bc8917f8bf3009966270eb6f7274db49ffa87dc9247032f643d99521ecf5e57325a92a8efffecb225a86a64dbc7f60ce37336ff
TLSH
T140C08CF3286089C20F309CEC2020B74DE62B8C1C8CE1CCEC914E74816638F138182534
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 161B
SHA256 088313e82fd9b13e50ff902b1fe8557fc5b27afe280914c487b62450460c13a7
MD5 ca579103d3ac78b0ef4cf4ac7077b3d7
SHA1 021f11911a477f7c5b3dcd25415bb7656e0fb4df
SHA512 610f7cd8eaaa9d4fab805b0dc7983a90b7451adddf7d37053e151feb4aee3c31cedc818c1594f686a1c39ad66dacc68df8e1ef6636edaa699ef55c3c60329f4a
TLSH
T1B7C08CF32C608AC60F309DEC2014B75DE22B850CCCE2CCEC914C44815A38F134883634
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5b053c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5b053c.TMP
Size 170B
SHA256 9279ae79e6805be2cf88465c0c0e1ebd64f7766b9c86c2385b1d4234ba1f9790
MD5 2fd34b559a95aadefd0d98a3acd4fe63
SHA1 0c12094f1acadb36fefc405f258ca0e18f2f7d55
SHA512 4184060a1c01d3f54099afc319340c598167656f54f0b1b5b9e3cee534f268d21579dd1eb31a937cb89b769ca364d5ea65d441c0b75a3d8a6fdcc79cd27a3d73
TLSH
T177C08CFB483690C23F20A8DC7920B15CD66B8C4DCEE9C8E99809B0823278A128046920
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

c75e569d-e83a-4c8e-bda1-d1006cbfca62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c75e569d-e83a-4c8e-bda1-d1006cbfca62.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 12a842073cc9f31d20fd566310d70bad64b06d793cf22d9bb344a660c012f44e
MD5 c87c67a69ea1b0d1e72e52b6c4a60189
SHA1 6e842170a91a91f204aa8a02b5953f3ebeef0bb5
SHA512 b189bb6e155c7d9e1dea030f52da5c9bc510780e1d5998f455f9a2c15fbde081e94626aa37db94541bc2515bc780e079383fa3a8b91e57e862b896ea78b063b6
SSDEEP 768:OFfrC3GwgAF8v+VE0sntarEnjN3Gac1Fvb9MyT:wrC398PMQnjMaob+yT
TLSH
T15A2328F598E78972D8AE9783677E2D029DFCC263B5884994B7C55D0CCC825BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9ce3851780905b27b1423e9011789fbb65a4871c309eb1e49f25aaa6ebd1d509
MD5 1b8288cd6522e047b36dcab292413342
SHA1 6b1ca188745a3e11de409fc9c2bde5d0f5bae7c8
SHA512 a7da61b93267263102a6f0b50b25b5fe579e6a0ae977aafcc960555c0b30832853fc8715ce55a908005400ea7882010e049aa3a3c22b54c984ac1b10a13c59fe
SSDEEP 384:nfZcIt38NHSUMuURi2La72WZlf8hyEGbXt9LFHy2rEoajo4cdR8eHhVODjYPNDUu:3t3x08M7Hi0ntVrEnjN3Gac1Fvb9MyT
TLSH
T1C6F2BF756C748DB38CEBE35675833B53BEE15363C5D40A94E6DAA70C0583AAC170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 1410c3c696169aea86918676f3127ddbde9588eac0cb04a6a98451f7ab4ee19f
MD5 e5f451e3203933ff94e10f9f4d3d646c
SHA1 7e60a91a225d15ed4c7ff48f16f99862d4776227
SHA512 fd7741d75df5a5f2d30796fad3c65d2333840f2ff0e3910d28e34cdc3760a2a2577a57c6335f5e71d2ed076ce9d30df99025abb9e345b401d777de5592b231be
SSDEEP 768:OFQ93uwgc08v+VSEsntUrEnjN3Gac1Fvb9MyT:l93M8xSQnjMaob+yT
TLSH
T1F21339F598E38972D8AE9743677E2E029DFCC263B5984994B7C55D0CCC825BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a5e12b21039b755a339a0a0434375e7e4dee23258cc8fe42e98a8bc33aca8190
MD5 ca9625217e4e8045469c98f691d8e8d7
SHA1 84aa77cdd65e7c8c3b13a0d2ad2d19e564dab5ed
SHA512 f11931da4e4e748ce7cf2a23b9f8874edb2e810a3bcc59251e2471d7512f0751644c94ceee368ebbd612051e619a301745e6a272ff8431fbe452865eabae87f4
SSDEEP 384:n8ZcIt38NH5UMuURi2La72WZlf8hyEGbXt9LFHy2rEoajo4cdR8eHhVODjYPNDUu:qt3I08M7Hi0ntVrEnjN3Gac1Fvb9MyT
TLSH
T187F2BF756C748DB38CEBE35675833B53AEE15263C5D40A94E6DAA70C0583AAC170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 577eb2db54b5ea665d7120ba777db5c838513f86a54e855783dc84bbed57ec5d
MD5 09ea0046ddd600fb7c4ba58765daa101
SHA1 7668f61aee29625983098566c032b4f893ce49f1
SHA512 84d81c74b61aa643b2a32dd9af170bdb6637be7e27881cd00f3f9e0f489bcfcbbef55466fb4c344c77794ef2868bbdb75bf396a86e2d79151dabe2478299a359
SSDEEP 768:OFHrC3GwgAF8Z+VCTsntPrEnjN3Gac1Fvb9MyT:CrC398CBQnjMaob+yT
TLSH
T1752328F598E78972D89E9783677E2D029DFCC263B5884994B7C55D0CCC825BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4e05397202561e312ae08b0638e13ec1da7ba9343351832bfe6bbf3228abc419
MD5 a4148a84ff99975038b6fbbbed9e25dc
SHA1 91b32484c8715502c28817ce32b5648a377e82da
SHA512 29e976b72d2776de851d783d2d659076dfc3da95599a373962e80fa4874eba31c857819e9fe9ee9d3991d1167f87ccb28e1bb87321a4b6a4ad8b320b2c92a831
SSDEEP 768:Wrv+4UNbdS3I08RTi0ntqrEnjN3Gac1Fvm:Wbsbg3r8z0QnjMaom
TLSH
T1BF03BF3579788DB38CEBE285B1837A537EF4126385C50BA4DAC96B0C05876EC270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e5fba137e15e180d2a4f7cdba4d1c128c395e7ba8419bb00810aafd5e04448c7
MD5 ecf85f8772af0d712511954559bd23de
SHA1 e154bbe73ea52c48830be68268fd27f4d2f93fbd
SHA512 c62139b0d19d03cc7dbbb2cacc6740efa5159b97b028d9cbf515498aa2e643b16fc8f3e5fda01fd00e6b74a1fc47c1cfa900f4186c185cb9bc7ca1c16b06a066
SSDEEP 768:rrv+4UNbdS3Gmi0ntdrEnjN3Gac1ZKeVH1SCz:rbsbg3FPQnjMaxEH1V
TLSH
T19903CF3669A88A738CE7E38575837A037EF4525386C40BA4C6DD6B0D06DB9EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6ac7a4f4b46c329c5e01b746f8b841746bc48746276b80d48133c44f8cf36373
MD5 5143427876d66e8409497e8a22a03080
SHA1 0ce1848d7dabf9b496a32e4cde5a5e7e4ae9b7bb
SHA512 b8e6ddb878d1ffa5d67170d666e5ff2f7c0c786d1cba1b0cdf9e48c4bffa28427d22a78eb5ccd85467c7017d61459d15fbbf964034b7277758b808452752f903
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6c28c6e9d380f54a06a07fe3e0a8db6d3f8c6f662e65137508833d03a43ebb3b
MD5 09a3189f816def711df7344b7c7ec91b
SHA1 0807c215182e26bb29094a0dc41c743f4598cdfb
SHA512 2f4a984c684f8dd2740e9309d0f4cec8085e1f1c54c3cfec38db30f817114a3d67500598957d239b8a9203db11a01f03f9d8ba35347b886cae3037e4dcfcd1e5
TLSH
T19AE00201E341406BD024173004C31F316FE2C0100373074B473001782C723013E20A81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4459217f5292ee08150cb5381f07efac2870c18c65b81f37e5cda545de3b9be0
MD5 2598e51a66b01b0e7a7f97d40bc54637
SHA1 d9de65fbe2f1ceca5ec0a4c2fdc4afc868c82cf9
SHA512 28186044eabf9692b45e5442c46599e01e3840a6c49c4b8732160fbd96242b830b0b2afd8aaa3aaa8e1b4240ea63edef4e2045d785daf57a18e8a7eeb4a0bd2c
TLSH
T1C6E00102A34150BBD02C173004C31B216BA2C06002F2074B472001782C723013E31E81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5c0651.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5c0651.TMP
Size 392B
SHA256 a5f38c908fb038964148c10baffce7d162215fde3dbfc8dfd92dce10627ee359
MD5 6c4928abf266e83b1f393c3bd63e7d37
SHA1 16f8d17aaa7476a54e11ff10371872ea702ff9b4
SHA512 e9fb4607f7340d4d78de5e9c242c4f86903abc22d7ed473341b1f6af4782668e8a39d1f1aac888a355e122899b7bf347c281d2e30a25de2515befc4d2060dca4
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

ded9d2da-f8e1-4963-ae2c-a2802b94ff34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ded9d2da-f8e1-4963-ae2c-a2802b94ff34.tmp
Size 392B
SHA256 f0a34639e9f640179862e9d1d040a4ca22f2023dffc03e4a6d0248b12ac3290a
MD5 4f15e61684aa05c9e54cedd88a28a233
SHA1 d85123789dca3a1aaf92f96de9413fef8ccee717
SHA512 f1462be5feedc574f27a31d8253817de5dfc1f47a41b32f2f1c08359a3a336393f0afa821d3360143515f7058ac7ac1706586e79188ee6922f7077fab006f569
TLSH
T1E5E00102A34160BBD02C173044C31B216BA3C06003F3074B4B2001782C723013E32E81
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

db053251-3df9-45d6-a1aa-f7358660e732.tmp

Path C:\Users\Admin\AppData\Local\Temp\db053251-3df9-45d6-a1aa-f7358660e732.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\LICENSES.chromium.html
Size 19.4MB
SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
MD5 f18ed9a25df7c7951cb7f936ca9feeea
SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
TLSH
T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\chrome_100_percent.pak
Size 117KB
SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
MD5 750913d55e87def9108e55728ba67d00
SHA1 a5944bc170d1f6c3223195c043134566471dae1d
SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
TLSH
T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\chrome_200_percent.pak
Size 192KB
SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
MD5 d476c19d21b3c2861f08c1c82fffddcb
SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\dxcompiler.dll
Size 24.4MB
SHA256 f0eecdc9bd3bd048b888b19c1be803867dc5592e9b0745914ef48781a3956d32
MD5 216959e543bffdc463bdf22504e2558c
SHA1 4cd5407f4f09be3b01def31ce829e165bf7b463b
SHA512 d733b224a3c79090e50b093162756d768c8c9de798fdd22e7e9a78ba69f97aedda9f048ea45d79a5bf58fb9169f4a486a4e0596a15993fb42fde5a4a1f91cc39
SSDEEP 196608:zKkG+l2tvb3nmgD131GYN7aPtAH+R4gQiUiV1gFould/5YmO0r:z5G+lkvb3nV1GYIP+H1gQoV1Ioul3Yl
TLSH
T1B7473A122646D49CC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 80d1ff5d7689071edae78164eacf92e4924689936d8cd818340377318b0a5da6
MD5 aaf703b6b18fb9aaedc7f9096728a241
SHA1 84e6437212b30f4be80d48a7e8576527306a5459
SHA512 ee4701f80b8d3a125f894effc92832d5dcd2cc56cf015afd60606a5ba28d3a7b9817f907b8c9c4c40cf81740c79cb65adb8e1d58b76e88febe4931eddd043c78
SSDEEP 49152:Rkg42lel5GuCT7w5LHBXz81IQbx6i1N2SByUSo8hqaLujbLDQdQcLNZ:RWlEuSwRHB/aaLujPm
TLSH
T1D3E59E02F6D251EDD029C03497ABE213F271780A4F205AEF17A05A253F66FD86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\libEGL.dll
Size 467KB
SHA256 380900fd2c24f14d602e5bf6d43c86f9c69362ac911d44f9609971a62735dbd7
MD5 28bf6bd56c12532526fbb1c914c0e1b5
SHA1 38f2c595d271a1d6281c5f49ff6aa7c3ec5f58bd
SHA512 a9518d1207b03b416428705034d88e8e831b2aab1405dfe128ae49e86d32cb8f7d34c896909f9d24b3073eb9d5c64f10c76d595dfb69f860dde953784a331ca4
SSDEEP 12288:w6/vCrog5QZ9yJNe8DcQir3YB9ANZMBg:w6/vCrovjLA94Mm
TLSH
T1A6A48D15B3E948A9E07BC1388A538643EB75B4520B61F6DF02A0D2793F77BE45A7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\libGLESv2.dll
Size 7.6MB
SHA256 d6a0d6700956b66e4b0d75f6cc102a9e0dfd7d923c5fba1ab227aa3cb0ba3b0b
MD5 e62d384a041358e5c15183e1663f2c65
SHA1 6395e53b2d148c902c4efc757b365cbbfdadab64
SHA512 b51f18eaeee4ba49fe27dab5f075e946839974351fb5caea237f4f7a28e7bb7f95c826fcd87decf315171473d19d49530ebdc5166d64b9e078e31261c84561bd
SSDEEP 49152:WZLjoLYM0JCVIM5OImUoJbmQO+76qJ6AJKibKnTaUueVYAO6a/wBWUx0IXvJ/k8m:gsLYR7J19mO6c8LSPkOSR6hLpsH8s
TLSH
T1C8867B03F69681D9C05DD2B88B57A223FA74B8450724B6CF2BA447152F6ABF0EB3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\af.pak
Size 605KB
SHA256 d990f4ced39e31a1149d2a1842ce2504706885e6ab05957ee2f338c77d94c16b
MD5 38fc876717fd2811593b8e1f5932685d
SHA1 3dcb3222e420713d6d731ff6bab7783dcd75c16d
SHA512 b98358fbb30f988b67edca4e7d608665ba10ba2b9c3230bee6adc9c040f974464b9e26eb72bf9a45b58d677419d8a2ed7f99d84cc1c22eefe496ec634bfa1c74
SSDEEP 12288:l+Ifrr9xi2tfxgtRGt+TkTnPxxNtEKY+53GmNAn4H2JyneNASgnALzcGfozvhpIX:ZvZtfutRGt+Tk7PxxNtEKY+53pAn4H2b
TLSH
T1EED41B0AEB91173D05B07696FB0945B7FB9CA26CC770B2BADDA982310566DFC10BD0D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\am.pak
Size 983KB
SHA256 8d3d5dfc64acfbb0c35036d74561d09ddf3b22058eeed0f8d26a2e9c0703248e
MD5 ca12f04a04bc27a3a5fe78789091ce51
SHA1 eefa0606bcf3aa65edc124978f731336c60811f9
SHA512 07fca45e2c99ab93eda0346550f083c0e0fc7abc50d9610869ed9f558cec399a0b88434b4d8cb5a838acdec7e8b3e7a2a6c9b1171050293647977b15fdbdf109
SSDEEP 24576:Ueb6TG1orqThTCKHyK6ax0hHfjnNWNT5zaAfX8j5xi8bVdwZtPBE:lI
TLSH
T18425AA547DF9F7570F8E8A1994320E4EA594AE4692803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\ar.pak
Size 1.1MB
SHA256 01f11a2c50a25b12aa99e36d6f38b334179d6efbf073ac47dec7819f88dce668
MD5 c6b9a7a859a6dc06f741fa83eda18adb
SHA1 1ca13eadae5d2c1a380954f03c1a6230709bde1c
SHA512 55a93541276b5f5fedf2e36feeca463dd1333e8011bacaeb7bf5d46e99e0c431c43e7e5b778a63820f5e70603b9e9344d946f4a8ff10c0cba91d2d3b5212bf6d
SSDEEP 12288:XbXxwb2BGop7mFo2GE5Hwjdfg7P3v4Uzbgkb2QSVMNj1Eio7DAi:7K1Ev
TLSH
T1CA357BE21B2984720B56DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\bg.pak
Size 1.1MB
SHA256 2789212aac5f2133ed23c1f84623bc64eb4cfbd93aef7af751d1221e27a21daa
MD5 ea6519b0214acdfe80b9ceb590ea4dce
SHA1 49d14345b6baa6939055d7f50bf0984791481706
SHA512 28a1ddd55b55e792db5a114fd305ec3631579a3e8e5507a629144769bd25c4e2de6ef9e969ddb037f7945330be02e4951a5ba8a27881fc5e413c2a33c436b84f
SSDEEP 24576:0KWulJLYAgCzQkEC2U5Vb6IqSsl373ZWmKf3p2KuUfVDrzQE74uOVnQxRfkn4wxI:0KWulJLYAmFU5Vb6IqSsl373ZWmS3p0g
TLSH
T1863535A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\bn.pak
Size 1.4MB
SHA256 e72b72977b40fb10472fe1a3fcffcda8b434bf52e2bb2da2935faa80da224812
MD5 ae6da45169b7a3fd99da8218c92a1e2b
SHA1 2552cffa1f63012b2fa7ef6209869f3eeae207c7
SHA512 8328e598f9c30636d60547a1d31e909b46ab6f92b3c210274c95886294af7ef20552718a536ee55c0a58d7947d2932061fea8e3113b8b331b4ca084501f51c4b
SSDEEP 3072:Y2M24emMNfpp1pomjwuquXCg/V7hq2XOUU9qygEfK8tRs3F+IBEBbaUqQsjkwgw0:Y2q+Nfcm00yg/V7hJF+IBEBbjwg/H
TLSH
T10165EF209C6E81B6A8C5CDC9434C6370C523AE9B9B65F74DDC17A24538ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\ca.pak
Size 683KB
SHA256 4289d89e86d0394bc545d63b375fa050f3823ef99ebc6831e8b1a28d3a17fda0
MD5 177812190302c5b4154c2f385455ba55
SHA1 ef43fae863ce81b5458d560804e092b133646b44
SHA512 64b23af24d642a7f73009e4920bd203f5d949e46819e043249fb50ad76076874fc02b1f2f34e0726ece12e83801825d53d4a4d8064f02f57bc673113d7efcfc0
SSDEEP 12288:9m3D1+7hjzlCiG78lpGa8D5PsF4N3Mw2juwwPR9zejm0t3l7C7ThALDq9wTLX/f9:gcQf0LApMZIM0wbJhXsQ
TLSH
T112E4F8239FC93B7704D2330EFB46C253A48CA9847A16D254F4AE1B1622CCADCD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\cs.pak
Size 709KB
SHA256 8386f70e830a565d0674014ae4ad385a61eb43d7e7b99d4d373d14388dfd32ce
MD5 fd8b34402d5e02dd82babb5a3ec5eb46
SHA1 c191efa261b84f6514227b6c41edceea7930b189
SHA512 2edfb6eb3d647a7f62d2a09cba95d6762691de9c4c73c1ad0817f9b262cee9bc20180745e64a3043a4d399cfa95fd212f2e0dd996ef3f5c212e7296989d0e26c
SSDEEP 6144:mzj1kQPV+WB/p5jDk8EmuVSG15ADF4+AP/uzBYcZ8OlJSBs98Qv:m2QNV/p5jADVz15AD+kzBYcZ8OlJS+
TLSH
T1C6F4391EEEA36425584002487FBE4128BD5EC3140B6EE5AB7CCF9D912579B7E8EF0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\da.pak
Size 637KB
SHA256 ff687bb6dc79bb638bca4f6a9226544a783209645922d323cf777b169690b25a
MD5 3402cf97870da2b1aec77fa74062f874
SHA1 758610d4624471ac55e9f4ac59abb07ad60fb309
SHA512 dc2bc7b982cde34e0678021a00ee92d4c21b7c91c64a33c0118f74d40eecaaf7ce5418c6986c78b4af88138cdd2949c006acf20ce7b2530a7d3747bb782d98bb
SSDEEP 6144:GXjE15yr09M10AETh/OQzVY2/QD5Qn+XgRVBaFLxE/ene2wlzqJwZBIEbPKaSpuG:GXI+rAMG+FXeRIAAmjfsPP
TLSH
T153D44A4BDC9CB32F89A94725F311CDA7DB6D443CC684264F65D8953A09CFCA092BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\de.pak
Size 684KB
SHA256 941c4d0ac3de30cdb5922e4bf1423354eca1148aacd3dd71499af3bba1fcea8f
MD5 00f74a2f094628b8e03f262adc399f67
SHA1 beaa32e764ccf537a2975e07d870451c470640ca
SHA512 e93e20ea6e5d9d4e4213e6f40831ffe19b2c4920efe65c6ab1fd9a83e2f52d36d55f5546fcd4f8327ae5580d06e68bc65b0bca3d4aaf95e8fd6b2fbc0d769159
SSDEEP 12288:qfvoo3vT3K7UpVdg1aG3g9LKVLePU6ApCgW:qfvoo3vT3K7UpVdg1ayg9ehCgW
TLSH
T111E4F803ADDB625EC786B3617705CDB77B19E36FC346322A84DDD02B654B5B283AC422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\el.pak
Size 1.2MB
SHA256 3ee2e46a5a569e411ccf9d77ee4f356e1833bfccbaefcc5e71b7c1517206ab5f
MD5 b5b01fbf52e566a2042c2bf019a6fa1c
SHA1 d6764bc102d1819f48724be1d14e1f6d547d2724
SHA512 35c4d5668f9f5a1ccb25df0f36cefa9c3f3b134a0af4b9b460af5b073eb1257b131a272505b0f2823d9b0a4c21cd8ce76128fa6ec088de539980499d941c9f95
SSDEEP 24576:NRzn7HWFbrlE5Yp9Ck2twZuwxJXDsSSEumUaR67ex2MSPgL00O5B/FCyjlHvAdQ/:bfHWFbrlE5Yp9Ck2twZuwxJXDsSSEumu
TLSH
T12245CFEFB4582DED8046950785D8B07C2BC66D6CE749CBD86229CB60BDFC0719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\en-GB.pak
Size 552KB
SHA256 aac3b4904d021d58d053bdea2d8056a219ecda1e341d87cb70070aea2cee418f
MD5 121461689d08e6e0d1e0ad4e6c695f7e
SHA1 113ec35be3b54ebf9e2b064181475bb82dda2670
SHA512 69b0d1d401aafd2fac6ed86f3c51de4889ebda123c6cfbe6267e83cd9271dccf7db2627cfaf31bf5713efad48845662763106ef26da09803a1580fa04c7416c5
SSDEEP 6144:D1Zf+l9GJBIvNBlxIxhb5E43FzcieMaMP9zQ49lfaYHEJjXCYDcBcnR7K:D1ZfqsJavNBPIxhbQvMNQ49UhDc
TLSH
T13AC43D1FF784126A05A311A2BB0AA5A2FF23D07CB35112667CBD811C33B676583777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\en-US.pak
Size 558KB
SHA256 bce3ec06227dba2273c4ff12482cba37b709cc8bf5fd29c4380f9a07b92bf821
MD5 6249e6f03590c631a2a873b3e79058d4
SHA1 b82396e2d4ddcb822254dc999c378642614e7f13
SHA512 3352f438f691067fcdd1cc331cac28130e464d0d9411971ecf7bf8c2d30d32e67cd9a65a71a48dc72f60eaee295dacc9055166dff0bef1f79e0ad4bbb2d0f3e2
SSDEEP 6144:JI1Ecs6drHfBLOFcGfIKUMP99Q8HUfaYQypqs5GjWngK8/uYwj:J2G6drHfBVZMTQ8HSkjZwj
TLSH
T157C44D1FF744112A06A352A2BF0995A2FF32D06DA35112563CBD812C3376B6683B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\es-419.pak
Size 674KB
SHA256 3beaef48bc776d3ebcfb867786fc47f78af2dfd6503f460094db5183666ce34e
MD5 2de214419bd7d75a54d7c4d53b2b5816
SHA1 24be574b50ff8c5fa55019f9ff3a2b9cd48b12af
SHA512 d51419c4deaafd9a948c4a8a0be82e154ef5da2e12bf19da9442a99ec825ed3b6a59ba93605cef6fd0fb3de8f5f9626d771328683cff61cc83e4f89144bc7878
SSDEEP 6144:by/lPx7jO15hgStbdXisoO5yMYMgsoZNcNTkJkH5A4UnNyz7:bOl69tBXXwBmkJMApU7
TLSH
T197E40826BAC81F6310E3A348B743D753E4D89545B408D29BE8EB876522CCF8CC967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\es.pak
Size 670KB
SHA256 669099cdff7ace75d40fa7b2fcb731b9fa3946d7939cae5dc6d751cdc88519e4
MD5 db71b60a3daebcda75035e4158618253
SHA1 146c97db3081e41cf8930c622aba97862ea5b090
SHA512 5719b9419018f93a6b783493c6e9d1e0eb2fe8cb7b9ab573796ddfc1582a4103a546f74aeed04332d41d3a3e865d64d87ec849fc081b6339bb9c80a5bc6cc161
SSDEEP 6144:Cy7XAQQj1VPRuogNBM+7p4naYwFd8jw9MOJRev+JETiZ6PZC+t:CAQXRu9HGaYEd8jqxJkveyitg
TLSH
T1ADE4E726AACC0F6350E39349F743D753E8D49549B408D29BE8EB866621CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\et.pak
Size 612KB
SHA256 ecc838878412cc9f28dda9efed2fc60b67315f5fdf64e912db33cee7571a5939
MD5 0485794b4810c277d1215c5fc9a69e3d
SHA1 c0e9b7feb062df79ec3a1c94115efa36bc14c72f
SHA512 c694c4d2badb1c22638e7ca652ba4d801b1cf1b9f63c3f492b651c2a41c03e5c6a2e41310d129f70dbf7278fc4b6b68227e5882b86ad9fab8c8cc31f5e21dd0f
SSDEEP 6144:STM5NSzkgUaqY93DL+cfFnyN0GnFajtRvfZdkUmPOTQyXgXmjVOlvuCCn1qyzXiu:STMOzVUN8jfF8nFajtXOl2CC1qwP
TLSH
T170D44C42A27D771B182412F9E737E923DC9ED3D8B4000D9668974A1971EEFCC38B6B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\fa.pak
Size 1013KB
SHA256 c4db250c0d32645a93536b188378da51f1af9b06988aee9e930ae5ccd9c09790
MD5 f92c086417dc31636a9280e01ebe9af0
SHA1 88f818f0e539e4cf603bc8b0865082b4538f752f
SHA512 aec9e6fd2996142dd7cf087fc4db32c79a9d8f81adb9e08b27e59b31255ccba8b846a1a40230e20eaad5fc287cbb8bfac87c139fd68d6b37f79b7f5f3ae88718
SSDEEP 24576:gT0L8u313uyqoz+sn2isRmXnloTUoXtCfGk62Yhk826JfikW0MX4dOqlUrHkI026:e
TLSH
T13325B1957AAC9AB15747CA0341E33834C773EF12D349FE40ACA1076609A5B139B5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\fi.pak
Size 623KB
SHA256 18d904efd7d15a49ef3638c45a40b3aa604e5ec4b68e017ab3f568e6a8202fd4
MD5 3d5e89e58a263b94ac4f49e4e8c76adf
SHA1 1d4d5c23c74c7e98ad49aea4ff1e67424afe6245
SHA512 10a1b6134dcf59d01781e59f7733aa45d3c24e76182f1da6d25921a98600571be1a3b904430dc64707b6bcfd43238929be8df37576c86df10bbcb35dac5672f7
SSDEEP 6144:8c+vwr1RbX48u19cj80ar6NmSFrGkAgoFRjPVOEmHbeaq5pLx7wvpVv7IJprWaTK:AvObX4x19C1a8GtaRvpVDIJprWa/gL/
TLSH
T138D45D915215C32237C4D29E7DB0903AF5E5E3DC8C284D9AE843C7D849EE9887DB276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\fil.pak
Size 706KB
SHA256 4034bd7ef11f48d7d646aacb7006562f0f9caec888785a13c36e31b9724dd798
MD5 ffef924fde59f90f783517b96f700a48
SHA1 51be8b9ee59c13bd091105bc075c141a11e45a16
SHA512 fa32dd493d819bce89e1a02dca48f202e0e4b1bcc3470ea8071d1c242983bf6b8805a64acf588723f0e49fbdaf38cde322e6003e190fe2bd80bbe91ae168bf57
SSDEEP 6144:kBp5PvYzZfRuh6uNW9cqiKb8yzDQjGXa+Ea3o/VzV8H68v6/C2oVHA11EW:GpJvYzZUfNW9BnvG
TLSH
T103F4C616B7401748DBC352E56260682F6AE560B83F81786E0FFF268B7BE7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\fr.pak
Size 728KB
SHA256 ef6d63007598261e38b0aa356f54b517e4fba5d38ad606165785afac5a7d577d
MD5 841e40697a9e19dba9ad5e1c3afd3fca
SHA1 19015f78c3a8c9b4086e037139ab6bdc7d3f2980
SHA512 e0f78d888375e1b667e0bacd7cefc1dea74340d80993502289177a48c31beb5e65de60ed44abdd9361ed617b945be11dcae6a6664ab89703da7e84b418cfb45e
SSDEEP 12288:EFiMeZMNZLkW94S+bvZZiut6QuargVCcm8N+bezEh0y4VoZuYnYw8jw2wW3S1X4I:sJ0vcVeAmh
TLSH
T16BF4F75FBEC431CB19C60267FB12D6A3DD348248F215E344D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\gu.pak
Size 1.4MB
SHA256 b207f2046791aa8150015ca78f9f76f2f6509953a00c5e89b155bb40e3a26474
MD5 7daaf6a5370eb04dd0e1d1df08d35f15
SHA1 d861655e79aa6165e9101d7de18f940b5f9ae976
SHA512 051dfe0a1ca3c09dce67456d75bf595dc36d1ebcba5f5003a1effdfb679531cd29593ebe524612c54104bba0e8f442e3588da966f74ac1655cb3fbeae501c18f
SSDEEP 3072:KD8i2t5BaX1eq0o5KPjAwREJKVMjNiT7llj63rAulfcSi5NnWsWi+/GQoynAzl/q:M8DmFT15STsPffC+1KsP9
TLSH
T1BB6508D0D7B9F07019DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\he.pak
Size 887KB
SHA256 33c380725d0ab1a858c594fff41a2363cb2a0ad3bc0ed7209aacdfd7a60c7c60
MD5 5ef51e044f26108fc57f9a98c54aef8e
SHA1 1ef88df97d3c89035d7503355aec229248ebae5a
SHA512 1a270d5e545e5e85db116bbbae240c000970b1e684eefed061d7c51ec5cf8d2b8f6c2e349486a453113a937da2c69ba920b982c987dfa2025da81b08c795f013
SSDEEP 12288:lo+tHxhMPBBAoyTmXdUulrYyIQDAlCWq+/8mrguckANXkxeQCaj6Tyi6jcAf5OOa:lo+t864
TLSH
T19C1599C4B2E492255131AAC39FA4FA285FF3CAB53CA27512CB14526CAD774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\hi.pak
Size 1.5MB
SHA256 6e58e12bfc69547d03d61f23445bc996e1b09ed5e8599b00f553bf8d022a08b5
MD5 a92068a3af1464a4b02fd50f8a8e949e
SHA1 908e45081c10142a0486be6e5adc6991a2d4eace
SHA512 bf6413010c40ba838e494bfb86a4c23ffc6b9bb9e8a0b04bb00ef7d82a8262cb98cca3874e9012905243f3d1cae37232bf8705550d873b50f88997624d66a617
SSDEEP 3072:uAFAoSJLHQ8ZyjAHl556oN8cH1JEtPV/B90ZV1dWuGlqv3oJEdtDVejnPs4f4/B9:jF1SBHQ8wjAHlr88J+ja4RldbPk
TLSH
T1CF75F40CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\hr.pak
Size 682KB
SHA256 6990ba056fcd1cac97ed5b48024be4ab366846a9c517d43a181cbb0eefa095d1
MD5 18123099716cba1fffbacee72dfc1315
SHA1 67fae0cd4739e964b59460aa1c4d8b2e6cd9d707
SHA512 ee2f3f6d54def03a8562f4b944b341d2b7e5d98a6598e05aa6009c810003f92fb1d0d9539a6f078d70a0a985e3d41958824a3d8e27ebb2b67491f0b8c36ee355
SSDEEP 6144:7hS9VbVbml6edNJgUVaT5ja46TzKzbayoE6pOWOYwhdbYu:FS9Vb4IevPVoadJJnOpku
TLSH
T12DE43B7DBEF3570A0897B24AEFAA43447DBE08DCE56597B7684F522E0003F4C6AB4149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\hu.pak
Size 729KB
SHA256 b83fc60c6d3ce3a04338ea16ba4627d6dfdf81f4373fe4921ac01c7c9558bcb6
MD5 9b7c0f6446817764f33fee01e82db019
SHA1 40061f4276cdde875303b709fe783c2d52e2a60f
SHA512 ea1ca65c71b5a216865cebb7cfd82774f0f8184a09dc0943321c9d5d44d94ca8858e99c11ff66c58cf35f943ac75ce82b917594ab21f53e1049b26a047bf42db
SSDEEP 6144:dzgVHf66Wfsxn/3BLk5dnTpJ7yHlEx+XlH2sSaa0zA4ttAuSU5TT78bZ49JxTYhW:dcHjKsx/3ykJA9U5T38e7rROyr
TLSH
T144F44BB793B6944ABC6C178778643F55592E481BAB2B31FB2883846D34A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\id.pak
Size 603KB
SHA256 a6ccb8c77ecd0db5c9d8d3b809937e627fffb136737ffeba65a9c09e6469a243
MD5 dcbf88b94b3a13d9c6ff165f55d61a61
SHA1 16e08e3e951321229a492ce6665ebbd10d2eb9f7
SHA512 9c538a1246c0b57d6df4668f36d068c696d81123069ce9adf9c1167a35a53d9df332a77721143e745f1639f65c3ef691e9b1942e9b94886862db03b009934662
SSDEEP 6144:4wzPkpLIRUmd2k5b5OZhCNBL71y7W30ffpTFjlFKzmBHCY26kkC68jWOBZFm2iTP:UpLYb5FBLEiQTFjlFCmpCP685vC
TLSH
T1D1D4E7632ECD310C094842D5F2DEA91E7CCE233BAF05B76E8E348F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\it.pak
Size 660KB
SHA256 666f811313f9bfd0f582816ff5c9fd693da6a3b4ec0e1d6af7cbbc100d8d7bd6
MD5 09c2ecaff02b0191ec309149dcda0e57
SHA1 56d84e8c422cb2d27ce603e3ac5833f0c812c230
SHA512 62d6459806c4a45fb5d9865432393cc14b769601dd7bdd71b14b4d7344bc80e11a3271ff0c4417da2a3f0a28de5fcaf2f17f65e285b5d1df09aa26f1915a7465
SSDEEP 6144:qPiRYInKkErphf3ikJd52N5zVX2qlSfqBCfEs61ltM/whOea1xIkYMcrFqpzSj9c:qKRnIpSGu8d0gzP1nJGlNpc
TLSH
T1D3E41C3AA9D6252559876359E611F085FB6EFCCCFA41721CC99B031C22CFE80E1ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\ja.pak
Size 804KB
SHA256 de290ab75b4cf9f59e6c106b12fba39666d19a98d1fbe1cd8dc18628187b50b5
MD5 e48dd7f01b99f4d505bb753569af9fe6
SHA1 049745165fb62171218c1068f4f3249b52d21109
SHA512 72a16e8175331dd1d5d3ff5842d2e540d65d05c637e6c07a9dccad71e7f797ce3ed8e451c15f746ccfb9bc51dad24dc9774043cba47a1548343a21e8560862e2
SSDEEP 6144:Dqs4bG0qJBSe90Y+84EQH1oZJMxkZrQ2TMaDeabRAuGVHhsV9:mjGpJB7zstH1tkZrQ2TMqea3GVHQ
TLSH
T12D05307CE3C569369D6153A22C4E36E17506AC9BFCA23A3A443DC074BD70BCEE415AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\kn.pak
Size 1.6MB
SHA256 d154c50013245a268ba9b4b49639516ab0593922d893bdd551e4aa30ee6a3e2f
MD5 05078d08dbd65e9bc4e27a903ddd6462
SHA1 3ba2c33a01ed59102ca3cfc7d5655ea693d48bb3
SHA512 158017227b71a8701de418a0e02896a339b61c4a9416248c6684549068df241c0487ffbae170c3d5181b38b0a074c1e0eb2bbb2e4a784f53ea242d617c44b3be
SSDEEP 12288:12bz3zDwQNSWJjQgY2BQvwT7N7zSyMW4QHyGEV:udMl
TLSH
T15075CD18ADBA7D301BD5106B24EC643ECFF16BE29CA907C2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\ko.pak
Size 684KB
SHA256 37f167bdf1c7f0095e256dfdf1d5f40a92e29a350bc78a8fe048f364d5fdbd76
MD5 7f37bbd7cfe4f3f2b5ae99becb008a9f
SHA1 868deaa4c0acee03c81104322b42ed7bdcd1cbde
SHA512 ee91ee9e6bf638572fc06a23d6083259b8b3d1d6901bb7c652a2a4f77c52e0cdeb6d5f82b5187369a5fbf48075fa3171aabea7734a8e3e3fde61699612d79d62
SSDEEP 12288:U+FjguTbckmM1WNiPszcbifYj4ZGRyzDRIE1zHFQgC0lIJ/xESJGRG1KLhw1LqcG:U+FNWIQ983yyOt
TLSH
T1D0E4B5F23CDF63C91193CD82AAF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\lt.pak
Size 742KB
SHA256 0c755ce72d1b71e77d58ab014228458d8ce2b0c51a9b00769635c6609255c9f2
MD5 1cf07cb33fe89bc96f45994a0ad98a62
SHA1 b8a9c25eb8fcf9f606f851b61a3e97cb2bc0524d
SHA512 2d9382136b3444b8130317ac658c04ab275a20d0e684420709840029c3c50ef69ffe19e51f6ada312439d7d2fb4a8c8d127e0202987d55612e7923ab323dcdcc
SSDEEP 12288:GXBwFUg40MQ/u3qhD78baD0dRyN7UJiuoE6SSH:GXWrMkbKQ6J3oV
TLSH
T1ECF42C0069E3AEFB9A4467C981A4CA78DEFD50009727BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\lv.pak
Size 739KB
SHA256 911f922f6ab11d04c4913b04088619276994104979b2c5f132182953fabc24a9
MD5 797904d9b8cc446bfdc8823f8efd249d
SHA1 178b5ae7a875e50646cee8a9c34be60bf68f3ade
SHA512 854a126b5a7dc48513729d476c540608d557de3049868b2329e507451beb9a73d38a68a2517a41d9a85f2b1970087630b334323bb307af1a58d49052972f920d
SSDEEP 12288:HjFJa4VAWdx/N5g/1qrcxm29c4TloHD+oB:DFJa4VAWdx/N5g/1ucxm29clHCoB
TLSH
T132F43A959EC68FAA4D914DCA733AD133A8CCD700FE07E112DD798B3A550F52822B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\ml.pak
Size 1.6MB
SHA256 8beb5df27b5a1b88d0f441518a807b2c6acd99a81820cd0249710ea12bc179d0
MD5 1ee0b429a68d70f8e14d90fd5fb740f1
SHA1 704642c287bd4cbcaf472923062fe06c26a8b489
SHA512 c3961d0b06e8ac84b9d4c1a943b03049ae59f58028e0dfd99ac9e7b7b7735673c5ad936759f14dd218ba924f27170bae2093c602082ebd0f2eaf1e45a4293ce1
SSDEEP 24576:kQm/CzR/oZAuuxyYl+9y9XBkx/9tYFrKfijHeBRJzXtK+v2/idf3AaIH3F3u:PMp
TLSH
T102859D5BA036CD3B0FD102167B4E2FABCD5B9FD140AF668B5869B2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\mr.pak
Size 1.4MB
SHA256 1971da05e4868841c9d9f78be5e17ab09178af99b86a6c07df385015a0c9d9ef
MD5 626fbf6ed8eca2fa44e52ae9cfc8b856
SHA1 c4b8fb73e8dd22f1adc75a609fa15b917e98a049
SHA512 83534bcd0014c7431599e49da7f1c18fbdf4176085bc170c78acf31965fe375dcd1a0d2814d4374cd7509a4bd5c07859e811262bd637ef341ba822aa8a3887f6
SSDEEP 6144:VIU8ZtwrTSAld7dSCyiWUIsN00UH5rCS0mOygEb:ewrWS5TGXH5rCS0m/gEb
TLSH
T1C565D24DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\ms.pak
Size 636KB
SHA256 b60c552a9ced5d0e1f4ed408f65a04068acad7d80db7cf88528fbebbcd337e23
MD5 a31481e751f6bb180968b2381d793d05
SHA1 a8b197bfe937469497c53e7df3796d11111b6024
SHA512 5793f68de93a896b689fb52ea82e2102c7d89550236dd108758745d22e68db055c577634dc41f1e2cf80bf4954d4167a84607dd282daf98210882a996685044f
SSDEEP 6144:njqCnjw23rq9CrUOP1dXvkSLxEHuqwa528WN3wcDiGPUlw+CV9hD:njq6jwQUGX4HuqwaSZKlwp
TLSH
T113D4B5579EDE3118085843D9D2DEA91B3CDD3332B705AF2B4DA08FB0166E7A53316B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\nb.pak
Size 608KB
SHA256 cb50908b03c77263297e63ff75d4d3c58fb0cb491c69a8964239e787c762f52d
MD5 d1ee1aee9d6944eb8ed7a658333cc91e
SHA1 1faad08736d478e7d25a144dc906147781e6de5e
SHA512 66d6741740d59d442fadd734ec4285cdb15c6559b448bad513bd9aa08062487acaa36cc0c88c289d37e64c89ffa05cedaa70f4473046b20bd6d3f850e5fc0c09
SSDEEP 12288:4FzGCp19tcd2Ql+hB/Op7fmPYiGkJcKb8B0Uim2r33:4FhX9tcWhn3GkJcq8B/gr
TLSH
T1C4D40883EE46B72EF6A44394F519865B9B7D942CCE98199B54C8C23E0CC7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\nl.pak
Size 634KB
SHA256 b6a6cecceeb0097d5fd9628c684d53339f7871948655740e0f625bfedbf526ae
MD5 712c3de8c9c0f50e580ac82074d7ee76
SHA1 9c69e08019dc195037c0d83fa0b21c8e6227a5df
SHA512 011b60ec55581ee7cf7f20715d31c46e923462fa6604e9c13c6b0920e986a54b6b262fc7c09b454791dcb96ad9c0cd27a12103659465c8ce040af17724c1c5cb
SSDEEP 12288:EUodlCCMZnLplbJWQuseUBW/gISKdaFFygn9qHgG48J:8QtlbJWQuseU+SKdavyg9qHgG4U
TLSH
T1B9D4F917AC8E253E59C0A349FA098FBBBF2E832CC26CE67D94DDD5340443F6851AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\pl.pak
Size 708KB
SHA256 dee5b710ca72425cd4d1236ce260f8d68b41bfdfceaeb2f98c8e89217b24208f
MD5 7a5ab308647d031a3cfa1311dfaa3ad3
SHA1 b7893bcb9951b554234f9b3fb60441617aae3661
SHA512 a5a25d3971f16ac49a20d8506a0a05de7253308cd5befdddfa232d9bbae9b5356e5c5ee02b69ce740440ab332c55f1b99c33bf327882e6b84377f294dfc7d673
SSDEEP 12288:cOQ2r1eDw9OjK4mZefQfuzSJabZ2bn6jP6CUdwe3m+UwDMSmG1Qh8PNRNGoliJSd:XJ5hwmX62DM81Qhnm
TLSH
T189F45B0E56E98A4E8CA008E6F6E70B7CBCDDC818F108D35FE45F4526719B19EC9BD584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\pt-BR.pak
Size 664KB
SHA256 8773b618385adfb3c03bac5109ea381ae2042b18a03d6929b1f9406f13dc627f
MD5 a491c62b1da15dc5d7fca9b61484bf88
SHA1 0d8b0965c97de26dabf8a37bfe0306d954fe3e93
SHA512 99c6544b70d12ccdc09a855381404c0bc8289fc4996e00051053db810f46b533e4e4f57f05651603d5fb63f9c7b4d545e03c7144ec12d1de93a9bb9c2e0086b4
SSDEEP 6144:1Mz1t1wlEJOsWYuhvNBXBLPwVoNvyFE5EVL0oNtsRGU1pV:WRwlFsWAozEvDsR11n
TLSH
T1CEE41B2E6ECA136605226350B74EEB43E5890645FE06CA87DCEF4F05A3DDE40D933BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\pt-PT.pak
Size 668KB
SHA256 266e49a497c6bf9e48502c7eb01aea1fa90260b6fb1609165ff50307a3d81b59
MD5 70557f8ad0981e4545ada8988c6053af
SHA1 43569e4fff4f1ec4f23e3592ab299c474ef40289
SHA512 e8df0f34431dc4fc4c0610208e93ab63c13d70e9bdd7c9153a63268a68b0d3c1d1043c7951ab6c4b007901022b695d8ea48321d5c0dd0e66a63e6b718400c24d
SSDEEP 6144:bqTin/hF2VNusBieJVJJxhTIjPNsWfwgYnbioBcSRhI:byi/72unYnbDcSRq
TLSH
T1B1E4192D6EDA132605135341770ADB03EAC85695F80ACB87C9EF0B4272CDF94D6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\ro.pak
Size 693KB
SHA256 16b11fb73ea0c5d0336de453d3e2abd2de69b3e6c66dcd72bae318666525bb18
MD5 9b2ffd81518422f5377295885d980161
SHA1 23e2177172bb965b5faf4e4667ef000d5a60051f
SHA512 2426e87b53dd8c4d26d34aa4ff685449edbb2547c1f1ccb17e4ebb53e4372896748ec05bb89ccd7880cece4e176467b3e2c18c53694e93ee2e99e96a7ebd9525
SSDEEP 6144:1e0qK3JQ0EghDYnnfwT9o0PBciVgzD+NrF1tcAGLtOVmdO547HW2wsQo/Mr/j:1erKOVDnngo0PBhgD+VB3mw5OWsd/uj
TLSH
T1BFE42C23A1C41A972E5152B2F73924D3E88E105DF641E2CDA4EEC97910CDDDB852EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\ru.pak
Size 1.1MB
SHA256 cf7ec388e57755475515f2a4a6b312459ae2efa693c80bedc28458df9616e638
MD5 11f75d057ddfbc2c0b7e87759f04bffa
SHA1 edd171350a17aa81e672996f4fe5ea42fd70f579
SHA512 00e56bd4d4d5c7502e6ea766f70a24d6060b76097db233ca45f303171b35df4cc4758b2756af45b06de63d40f3ad788d509d689a464eb4aef19b91cfc9d3e4e2
SSDEEP 12288:xYap51G5mfQeRo4Yegsp2zJ9sF+oa+UlZHO6HzW/ZqSv4sqCz6kE0LR3Q8Nirh2b:xY27G5z/oBB
TLSH
T14F458760669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35219A42D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\sk.pak
Size 720KB
SHA256 8c14d528efad4c75e09ce70719b0b3d1162954b4de4013112e014e2ac6a84d3d
MD5 729a2d39f83ad855dc5c57c00bd9b72a
SHA1 091f1e778ad60f70d3ef91b572feb36c561d1571
SHA512 032a14be8980feda7b7957f7a6167af6126c7a2b28b233eb2862ff38867df3a9f342721867d589cf7f9f525c8b7d4c45dfbd51d424284a6431fe7e00bde9b23f
SSDEEP 12288:HqSr8kmKWjowk74V2AI9+bi3NWTnjzYIng9pTjsxt9we:tdLN4VG+fYzktae
TLSH
T1FAF44D3FDFE7181E8E8D0148EFE57110FDBE8650864EB0A6944E374724E26ED8AB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\sl.pak
Size 690KB
SHA256 1550f8df161a3484a6c7af9bc5321fae524e10d6853467afcb8749054a73e601
MD5 f9983e0770e42bd3c3efd4731795efa1
SHA1 62423b22e235b64f4c0a543aa89e122437249605
SHA512 269d4877cf58ae67e713acb40acd58e98349832e8f036e2d4cce42598b52cff013eef0019fa19e65ce4e23e7478ccca77944410cc71764b3fc80518211d0b1e9
SSDEEP 12288:slQdT2FT8cB2BynElanWHDoiNi/fzoDKql/af:9duTNElaWHDhi/fzoDq
TLSH
T10DE42B397EA74E0F0C9AA2CFFEA606007FDC044CD256E6A1EC4F336A5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\sr.pak
Size 1.0MB
SHA256 a76930f2c72e49dc3a2c9be7e7bce0f9da0c93de03b6e275521fa86da0d2d39c
MD5 a44e04518c70dff31799dd47379bba04
SHA1 8c4830e17cf5d7d33d5296e030c2ca4eedf274ed
SHA512 09b0193ab1c803bf2e66a998079728bb17d4daa1cd7b0a8197dff35cf59bb4d415c697dd836347c9a32ca3b16d2f37b66770c4474ae84d9a5167f9f58c74ac14
SSDEEP 12288:vwnK1PVzj34noZMFI83SS0dR3Ckdi4B/J1rpb6hKPCHxYX037XKue9/k/z:3pZjY7aC+a
TLSH
T1933556A19B9E64DB0501F41BD808BE493DAF41FE3FAB975211601DBD34E10B847BA39E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\sv.pak
Size 615KB
SHA256 118cbf34d040c8946669f889393364070e88d3f0263f1b66ab4638b1f8f3c291
MD5 3cde379026d02f6b6f4a676366fe32c1
SHA1 0c797a8b977027782aabb886e72570b7f4989146
SHA512 9a9714acd3681f4e0afc5446ce6bca69fb0231101ef2c99a50bff1ed0292ccad3bb0ec73d7c8d950756382c225940457ec3b9bc51b688e1d7e443a37a528a664
SSDEEP 6144:x8AxMqKuOIi48viS/ZQ8lUJIcpjwdux+xzL8lGswiLOVRFcz5RtGmqeqMWkSMXty:CAKqWIizD/q6cxyHipg9
TLSH
T1C7D41B038A20F526FB72530DB609115B0AEDE25CE7F2954EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\sw.pak
Size 651KB
SHA256 f4e0e2f5b49d9d767884074cc3ee8d0dd83a986f7c1d2de236885998d7a53460
MD5 c45ae1d02bba66df5e1720faa9b062e6
SHA1 0281a51663763ca1a5622a4d0e15dc361b04c80b
SHA512 abfb709e1229208f68e723448b9766bbb2aca6f0d21df9effa6cb6198a00f546475fb59d760e1a634543a085c1e3e02b8b26c3162dbedf1e87fe83b9daab57fb
SSDEEP 12288:/+4khPft7byxGH2qDOKd9zGI/d5NmedqNGjRdpiayX1jt3hFinSLThYFaKI3z9iJ:/WPfNBFYi281
TLSH
T111E4D6628C71D1195232618603DDFF332BDCED5C693B29935A46BF0F218F88C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\ta.pak
Size 1.6MB
SHA256 2c5f8aaf21c9a035f71d763cfa9a20886892fcde7cf71878168a9df0faa6d417
MD5 db51dae96bd76c432ed4c0328bae8378
SHA1 93ca9f691f6949015c3cf8983d5df0c93dd173a6
SHA512 359e9c9da19a15320c37523aa6c4b5f1ffb03f62ac56e1f9bfb5c26dc0b7cc2bed32f55bbdb0c776281bb77cd07bbe1c500be0cac08c69d9344ce536747ef936
SSDEEP 6144:i0JoYKj15Y0ykwuiGP2wqdtRAwtm1vYpiMyx:ZmY01aaiGXqPtm1vYpiMyx
TLSH
T11C850CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\te.pak
Size 1.5MB
SHA256 e9e85c763b92b5a98e74290c3ff07e7953269ab6228a4cc343745229819d7f8f
MD5 827e945321a758570fc55c9ef1576db8
SHA1 86e3214190e55c2902c77a7fd49d903154ca1dc5
SHA512 ee2c24d1dba914261dcece37cbfe03897d2ab44511f081ceb850197c985d0df7a0cfe1f0630dd5d345c72f4abeccd1bc96ff4bb7adbe4060c5de914fdd70763a
SSDEEP 12288:7z7MZKN/ywG6USF602/LDgIC8ymoQRT5qbDM52CMYRWOB6ym3p1FW1OhEaC/ly29:7tXscRq
TLSH
T1407592023A6AD310DBE60273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\th.pak
Size 1.3MB
SHA256 fa33c671ef03a11f1069cfb389df5c8f311daf145f7359ee78758c3a0709b209
MD5 e6f0bedeb524f56b79799df543693246
SHA1 c262dac2bbed4c6ebae79a71096fe4f725502f1b
SHA512 bec94d24ed790db2b7ade098604762d82cd711a8b6da3ba66af54880d45ecd1e05c533c060c9bf4e1e207fec72b5ff3340db8d20aa9c6eca9f7a169795b4585e
SSDEEP 12288:OTlu6kvYN9LyZYAhzYL6Lys6o6hCQskJUseOPsO5eXwpbDFDS6Sud2mKHlojghvS:O3CsR
TLSH
T10A554CB37247DDD479441B5B262A7789672DAE693F73F8E000C9215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\tr.pak
Size 663KB
SHA256 7a42e54611e2633c9c999f121abf2ffbda37746237e01ce29dc650510af08b0c
MD5 db63f89cb8ea6ab2cf7fbe93c3cc0411
SHA1 4a9947135f5bb705bff772b9772fb018b68e5811
SHA512 69657a495dfcc49a357378bea838cf3d09e5944a38d91d07e1cc85452cd19732aedb2f09a185826fc50370e6e0d0c4522508c5c5459e5558ff500ad788fe70d3
SSDEEP 12288:/YN49o1gVCk6Hz6sgwhqfZF4MwkN9epd4+R:/0x9gN9q4+R
TLSH
T1D1E4EA817CEF282C8BB9278BD6E94666F89F0766B331F4469B168636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\uk.pak
Size 1.1MB
SHA256 39e272f1acb9c0b0bc791efa0347b92cb29e20cfbb5ae14f539628f10f45b0f1
MD5 6b422573ebc1769223710a6bd8fedf39
SHA1 0a14ebb6d3091cb3b0e9adc336e088eef87a81af
SHA512 fd7a6c02c62ba7b303f5509e947b761ed3a65af986ab8fe9b6dd5e18cb99074b96cd7bdcb81d486b4dfa909dd790f04c2da3a84880a6682813c584aa867e8eea
SSDEEP 12288:lc7n9OSlH+QKjbCI5wkO16UgBRrsSr+UznS7BNb7eBPSlFXKNnEUA6QzAz8Pi6N2:y79Sv8PG
TLSH
T19E45A9A1AAAD54DF0105F05BE94C7A0D7DA740FE7FA7471625A43DBF28F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\ur.pak
Size 997KB
SHA256 0c1cfa61d9a9be6338b0a160b43ff362a982003053ae5be3b3ec867e78374d7b
MD5 6cf3c36a589dd5dbfc00b19cd96ddae4
SHA1 2f35469dfa15eefcce47f35231b4c19b0ca5beec
SHA512 8eab2e970a05171d3acf514566bd5183155dd6bf59dd26d4a909deec18bd67d4bf9e375c85608233879ca8bcfeca93b5cf7daa8447dd53b151c465b5162b8f3f
SSDEEP 12288:KYuEnE4YoPL8P5yzqtdQeMnyyK32By98qsE8dGZOv5dQYr4KYjwadcJKwUlubcoF:duEnBLGcb
TLSH
T1F82500D2E6B896B35A21D92780D33C34CB735F13D34AF281E96246C54E9A0135F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\vi.pak
Size 789KB
SHA256 3594ddfb89758a3d87d51bf90e676a5dd6107a6becd96c8840df6739cf268af1
MD5 278b92d960d7b13690df141c5f39a3c3
SHA1 6f3200f7260ed32219b07d41cdf98450f9111d9a
SHA512 5aa31895c350d3e1ba85655b4c4223955d4dbddcd957a0aa855caf45e734ff13134372fa0299d852e50ce102e54e424259b8a141b0651e90946fb6b7f09d9c29
SSDEEP 24576:T1P/7+ce5VM0LMuoVbE7KHJlFtiZGfoq1ljP:SotiiT1ljP
TLSH
T1A705855216E1302680AC553EC6CD540D6FCAE42FF7C1CFE56FE429787A221A45F21BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\zh-CN.pak
Size 564KB
SHA256 c2c40bd2834ca62f99312d93eb47e04d22b4c8eb86197f98cc7865b52fc11baf
MD5 1740ff5fc59dc2b362897b96a92f484a
SHA1 26a4ecf2a5e27d6d7d711b697d5716818c23bee3
SHA512 640982cb276a48cd95b9f1f427491605605443d1585ece41ff1cf583b6342704905845ce0ec3708a58066baf64a6d4407c737e4816ab40a10a9302b276fe64ac
SSDEEP 6144:+CXLDDKc3wn97cDc+qvYnE7MpUcZXojddwTQZyRU4YoDMe2ZHtNKEglu:+r8mp+qQnBpUcZXo52Um1YoDMtHPH
TLSH
T197C47CA820F9BDEC004650E03729613D7C40764BF667AF35AED248ED1AA6FAD0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\locales\zh-TW.pak
Size 556KB
SHA256 8e831ed21bd21ce3610dc4b658aa337229c83dd6d7cef336923d69779d0365b1
MD5 6b9341f76a06591356648427e4df6f4e
SHA1 964cdc835647034e404c503a2d4b5d833a92fa33
SHA512 cf82a06b17c366f20ae80d828f2477974352a1baafef85014771791723cda71c75432b4c514df7715539ebabd288049bb2576ed97f212c9a5e4627ca7c96c556
SSDEEP 6144:o9uZDCn3n/DAYuVJoOk6a2iuooryf8w7HLD5O9B9aUmzTq:GuwEYlOPaoryEw7HGPH
TLSH
T1A1C46CB618FBDBEF0901F484B7CD512ABC8B382DDE773636FC851C982E7AA5409A1145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\resources.pak
Size 6.6MB
SHA256 21641d8da2c30451d782c217bd156cbed278ba78df350a2d19578804b5b156b4
MD5 b5327ffd50e004a90dec55867d33b6d4
SHA1 2a1c2828ea38f7e8aa2b21f7d0728ae27db33ced
SHA512 9f8c771ce7030c704be901e1fd80c21882d7772546ddc1a6aaa22b112a410a6c0a794b4da695a93af37ad881791410219e1e8cde96b9e942731f69627af1f14b
SSDEEP 196608:RUBR5sfMVDTz9u4bkriACmZnC3gEL34tVrW:WT6Y/zlkrDntEoVrW
TLSH
T1236633D277E2A80FCD90677945488F35599C6F2532E0B1A3889C6129ED9CB6C0AC4F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\resources\app.asar
Size 19.9MB
SHA256 747d6ffa14b7ef72511bdfbd9ef8a2dd965287fcaea2af76bd26b8122cd72af4
MD5 52cc2d018e0626eac8ab87dc463a9ac5
SHA1 f9d9702c8b0b891918f6b50e19855f31b32bf046
SHA512 9e90d5c4fb0c1da689e952d27589b8a49980bdff9f99f12913a36c22afa30c77f333e9591829d52e82d73335ba751305dc5fd2af05b773f75c487920bf693bda
SSDEEP 49152:pH1/QLcq32beRFU7dcwvjjc0yul5W+KjJNzhKT6gaBJBbblNhttfIeLLs+V5hNlT:FtQLX3ZFFE/wNz8ThaBJTXBQHmyVHcnh
TLSH
T100270A14D8A5DC23169F20755DFD4202F934520789246CA47E8D82EC5F8EE1E92FEBEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\snapshot_blob.bin
Size 338KB
SHA256 3641cb8756cfee0bf77a226d176793ab6f5de2c3dc61544fbbdf50acf94ecb6a
MD5 4bd6fa24553ddebce3a8aff53a7484a3
SHA1 279c3f2f52bc88ce9112d55191de1c759d735f1a
SHA512 ed658274e4c1694ffef403783da4668f042e0de044dc00b69e6c85f7f3d9f5f7cb57ab0e9c23ac486aed62207be52b24fbf2bf118d1ed3936c10bfd6dde0f124
SSDEEP 3072:1uOiXK9Ot+xbRt2FJRDLdd6peM8yN/SyNsCvuVq/khbvXU/P0cA/9:1u5Xzt+HwtH64e/BNso/kpMP0Pl
TLSH
T1BD74EF12F749CA26C8B635745EF98B942E24B2CD9D89AF573020437DB4796640E2F38F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\v8_context_snapshot.bin
Size 704KB
SHA256 290fd744c3499e6d9306f26d194e51b648a93ef3a25c4e25387413781ac4991b
MD5 d19d7f35be9df7deb08e4daf4a75e133
SHA1 a44edb27eb10281838156a9297181acfe064598e
SHA512 80937594bbfe26b808bdb6d24f333875a9b08737e96052412e81cb2dae7133205c50687fd9e90f101ba05ae59a8f3bfa448973f5076327a810a983e3d40b81d4
SSDEEP 12288:K15XrgAJ8ph2NdOeP8POqYUdEMH+jURWYS:K1pqP4H8POqYkEMH+AtS
TLSH
T180E49676FB0ACA26C8657A7D8DE74B063A34B2DD8EC6EB077011937CB4B86544D1E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 ae7e65a4462a2f8fdfcfa7444259a8d2625ebd3bd75c170128025fa70e1ca037
MD5 8834d95b94614dcbe837163a447b08c0
SHA1 44e34ac3c70f66f922aa80feb64f166742930688
SHA512 43db036181849cbbd58a1a1e5b2afa22281ced906cfd1c9794fe83eab0b1ec260c5bdb907412e4a232c4cb7b9b1779ae6e38076b4d089a61acc0e20b2544a490
SSDEEP 49152:pvMQibTIlI/EyGhcIDlpcSJ13DFDUgcD2Qn9agdGgkkDCqBK2WgPM+2HryKAoxw:pvMQCkgUrr+2yso8FX1+
TLSH
T11D464903F68681D9C06DD6798B5FA623F672F8800B2276DF56A00F192E65FE06B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\7z-out\vulkan-1.dll
Size 904KB
SHA256 ef8b7e499fc34f5057c498702694de37fa87289ea3d866717fd1c001d955883f
MD5 1e5544ce431425eca51f0bb4e940da57
SHA1 0fafac1cb6a72bc021fc7d8fb877fde8407efadc
SHA512 2270a3400a9eddc07eead69e6e6a056fc2190e162d0e26fccf97a616fb5e116db7c88f5c9be3c6819519d223233944f2589948300a58313f621dd3c71146ecd9
SSDEEP 24576:SGq7F7pknIiAXUMKzUjvg6Z5WzcxDYsHkDE6g3P0zAk76oOH0Y8:5GF9kIiZAjvg6Z5WzcxDYsHkDE6g3P0r
TLSH
T136157D23DA548B69D67AC074D8D18A0789F074851322BACF07B817147F6AFF42B7DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpiderBanner.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\SpiderBanner.dll
Size 9KB
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
TLSH
T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1DEF.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3484_832880248\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d9f9070-8aaa-4c2a-81c8-8f128b715e6f.tmp

Path C:\Users\Admin\AppData\Local\nightlight-launcher\Network\4d9f9070-8aaa-4c2a-81c8-8f128b715e6f.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\nightlight-launcher\Network\Network Persistent State
Size 1KB
SHA256 45ff0fe7ebeeacef7efe402181436b5496e85b3da6a3f1198bf44a983276c0cf
MD5 409d9bcee6674a5dcb06b0caa2ee4ff0
SHA1 0ea5a0d403f1806ac2a58a281d96b79fb50b2b86
SHA512 c9c896363047ee9db8fe3af60e6ef3a4a994b405fd6300ac64bf0ab0711a99b47159af61b3cf718f0c0db9165a2de7d9974c0a2f95982709d845b574ca58edeb
TLSH
T1752149E7C7E845BE4A5297F05B253E37C5FE05285368BC0288D8DF4E97F1832924168E
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Nightlight Launcher.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nightlight Launcher.lnk
Size 2KB
SHA256 135e767f01f461211aa15da0d07b83e9eedb1da4e3ae2bc5dbef54d1ae20111c
MD5 40c02194197dbda8051e5cab6852f101
SHA1 a36021f962720706ea7cf0b8764a0421711eb95f
SHA512 b2ade2e33e21f6a4d6c69c8516e5043317a2833c1c2838129a15c7d0ae9a16753d121dfbc12b09e34de2e72a462538cdd4bf9cd1693401a34a14fcc093b5ebab
TLSH
T1FB5188009EE9225CF2FF473219766524AA72FE25EA27DB0D0004C28E6D3D9009F54F3A
MD5 SHA1 SHA512 TLSH

Submit Download

Nightlight Launcher.lnk

Path C:\Users\Admin\Desktop\Nightlight Launcher.lnk
Size 2KB
SHA256 b0cb371368dbf6c53e095d7843d89987192b38841bf2a66705e09929b2f89ad0
MD5 5e872b09142284ef22617954ef5dacd8
SHA1 acbfe2ab9bacf0db37c23da8507395743f0dbca6
SHA512 952a7d5d4d57ec86e23b6d52f8b5753488efa24b4d4948fe70e84b3043e01f321a996d45be0cdc3c0a9677c0dbbb2abee283b602bbb07beed701c4d183b6146a
TLSH
T11151CB009EE9215CF2FF47322EB66424AE72FA25A627DB0D0004C24E2D3DD409F64B3E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4228-1220-0x000001BC4B6C0000-0x000001BC4B6C1000-memory.dmp

Download

memory/4228-1221-0x000001BC4B6C0000-0x000001BC4B6C1000-memory.dmp

Download

memory/4228-1222-0x000001BC4B6C0000-0x000001BC4B6C1000-memory.dmp

Download

memory/4228-1223-0x000001BC4B6C0000-0x000001BC4B6C1000-memory.dmp

Download

memory/4228-1224-0x000001BC4B6C0000-0x000001BC4B6C1000-memory.dmp

Download

memory/4228-1216-0x000001BC4B6C0000-0x000001BC4B6C1000-memory.dmp

Download

memory/4228-1214-0x000001BC4B6C0000-0x000001BC4B6C1000-memory.dmp

Download

memory/4228-1225-0x000001BC4B6C0000-0x000001BC4B6C1000-memory.dmp

Download