4f0f2e7e4d7f48b0baa5c4d03e216f970cfd1ebf9b3c7f6d180cf2a8b0a49b6c

Resubmissions

03/08/2026, 23:49

260803-3vae1astay8

03/08/2026, 23:46

260803-3samzshf243

Analysis

user interaction
yes
max time kernel
998s
max time network
999s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bettersurvival.zip
Size 530KB
Sample260803-3vae1astay
SHA256 4f0f2e7e4d7f48b0baa5c4d03e216f970cfd1ebf9b3c7f6d180cf2a8b0a49b6c
MD5 908656ac4be203219ba84e2350981262
SHA1 3b0bcd24768447859857c1a36b9a3e72761027d8
SHA512 b555658c01d712b4e428cc999d6ef34733f7d840990a034aa75ee6e54de1ac3ea6cb42cee49ddc4d38fc76dcbccb4d9b663edbca4585efb35cc9d74999d57610
SSDEEP 12288:7fb/fPhj2w8YiVJ3zFih6SjdfXkrPeb+5VJXPJUIkFw:7fb3Phj2w8nVFk6u9I2CHNvqw
TLSH
T1B8B423058B15DFC9DC21F2FAC81A7935610BBF5FD7562A31B8E0A2F1850EC2E4754B91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 29 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
7552	powershell.exe
7600	powershell.exe
7584	powershell.exe
7568	powershell.exe
10108	powershell.exe
21064	powershell.exe
7560	powershell.exe
7520	powershell.exe
7512	powershell.exe
7496	powershell.exe
7472	powershell.exe
7612	powershell.exe
10100	powershell.exe
4560	powershell.exe
7576	powershell.exe
7460	powershell.exe
10128	powershell.exe
5160	powershell.exe
7544	powershell.exe
7536	powershell.exe
7528	powershell.exe
7488	powershell.exe
7640	powershell.exe
7624	powershell.exe
11012	powershell.exe
7592	powershell.exe
7504	powershell.exe
7480	powershell.exe
5216	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
314	1288	OWinstaller.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	CurseForge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	CurseForge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	CurseForge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	OWinstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	CurseForge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	CurseForge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	CurseForge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	CurseForge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	CurseForge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	CurseForge.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 17 IoCs

pid	Process
5116	CurseForge Windows - Installer.exe
1288	OWinstaller.exe
4644	ow-electron-setup.exe
5856	CurseForge.exe
1752	CurseForge.exe
5780	CurseForge.exe
4376	CurseForge.exe
4484	CurseForge.exe
1008	CurseForge.exe
5272	CurseForge.exe
11628	Curse.Agent.Host.exe
6164	CurseForge.exe
11584	CurseForge.exe
6792	CurseForge.exe
10724	CurseForge.exe
9724	CurseForge.exe
22908	CurseForge.exe

Loads dropped DLL 40 IoCs

pid	Process
5116	CurseForge Windows - Installer.exe
5116	CurseForge Windows - Installer.exe
5116	CurseForge Windows - Installer.exe
5116	CurseForge Windows - Installer.exe
5116	CurseForge Windows - Installer.exe
1288	OWinstaller.exe
1288	OWinstaller.exe
1288	OWinstaller.exe
1288	OWinstaller.exe
1288	OWinstaller.exe
4644	ow-electron-setup.exe
4644	ow-electron-setup.exe
4644	ow-electron-setup.exe
4644	ow-electron-setup.exe
4644	ow-electron-setup.exe
4644	ow-electron-setup.exe
4644	ow-electron-setup.exe
4644	ow-electron-setup.exe
1752	CurseForge.exe
1752	CurseForge.exe
1752	CurseForge.exe
1752	CurseForge.exe
4376	CurseForge.exe
1752	CurseForge.exe
1752	CurseForge.exe
1752	CurseForge.exe
4484	CurseForge.exe
1008	CurseForge.exe
5272	CurseForge.exe
5272	CurseForge.exe
6164	CurseForge.exe
6164	CurseForge.exe
6164	CurseForge.exe
6164	CurseForge.exe
11628	Curse.Agent.Host.exe
11584	CurseForge.exe
6792	CurseForge.exe
10724	CurseForge.exe
9724	CurseForge.exe
22908	CurseForge.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\com.overwolf.curseforge = "C:\\Users\\Admin\\AppData\\Local\\Programs\\CurseForge Windows\\CurseForge.exe --minimized"	CurseForge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OWinstaller.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 32 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_adeb6424513f60a2\input.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_adeb6424513f60a2\input.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	dxdiag.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5552	powershell.exe
7552	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6192	cmd.exe
7040	cmd.exe
7128	cmd.exe
7404	cmd.exe
6480	cmd.exe
9580	cmd.exe
6768	cmd.exe
7032	cmd.exe
7024	cmd.exe
7632	cmd.exe
11164	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CurseForge Windows - Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ow-electron-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1892	chrome.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DxDiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DxDiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DxDiag.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	CurseForge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	CurseForge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	CurseForge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	CurseForge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	CurseForge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	CurseForge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CurseForge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	CurseForge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	CurseForge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CurseForge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	CurseForge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302746318977681"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{13F7A4EA-6E05-4C0F-8F3D-D4AE2DC15B27}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	DxDiag.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\curseforge\shell\open	CurseForge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{A182F319-9D73-4053-B538-98CCE6F01A45}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID	DxDiag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\curseforge\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\CurseForge Windows\\CurseForge.exe\" \"%1\""	CurseForge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	DxDiag.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\curseforge	CurseForge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\curseforge\shell	CurseForge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	DxDiag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\curseforge\URL Protocol	CurseForge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\curseforge\shell\open\command	CurseForge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	dxdiag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\System32\\dxdiagn.dll"	DxDiag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}	DxDiag.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	javaw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	DxDiag.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
7404	NOTEPAD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	326	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	327	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1288	OWinstaller.exe
1288	OWinstaller.exe
4328	DxDiag.exe
4328	DxDiag.exe
5552	powershell.exe
5552	powershell.exe
5552	powershell.exe
1076	chrome.exe
1076	chrome.exe
4560	powershell.exe
4560	powershell.exe
4560	powershell.exe
4644	ow-electron-setup.exe
4644	ow-electron-setup.exe
5216	powershell.exe
5216	powershell.exe
5216	powershell.exe
5160	powershell.exe
5160	powershell.exe
5160	powershell.exe
6164	CurseForge.exe
6164	CurseForge.exe
5272	CurseForge.exe
5272	CurseForge.exe
7192	powershell.exe
7192	powershell.exe
7232	powershell.exe
7232	powershell.exe
7192	powershell.exe
7232	powershell.exe
7600	powershell.exe
7600	powershell.exe
7584	powershell.exe
7584	powershell.exe
7576	powershell.exe
7576	powershell.exe
7612	powershell.exe
7612	powershell.exe
7488	powershell.exe
7488	powershell.exe
7460	powershell.exe
7460	powershell.exe
7472	powershell.exe
7472	powershell.exe
7640	powershell.exe
7640	powershell.exe
7504	powershell.exe
7504	powershell.exe
7520	powershell.exe
7520	powershell.exe
7536	powershell.exe
7560	powershell.exe
7560	powershell.exe
7512	powershell.exe
7512	powershell.exe
7544	powershell.exe
7544	powershell.exe
7536	powershell.exe
7528	powershell.exe
7528	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
9080	7zFM.exe
7672	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
2512	msedgewebview2.exe
2512	msedgewebview2.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
9080	7zFM.exe
9080	7zFM.exe
9080	7zFM.exe
9080	7zFM.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe

Suspicious use of SendNotifyMessage 63 IoCs

pid	Process
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe
5856	CurseForge.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
1288	OWinstaller.exe
4328	DxDiag.exe
7648	dxdiag.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
7672	OpenWith.exe
21996	javaw.exe
21996	javaw.exe
21996	javaw.exe
21996	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2020	1664	chrome.exe	99
PID 1664 wrote to memory of 4104	1664	chrome.exe	100
PID 1664 wrote to memory of 1892	1664	chrome.exe	101
PID 1664 wrote to memory of 4104	1664	chrome.exe	100
PID 1664 wrote to memory of 2984	1664	chrome.exe	102
PID 1664 wrote to memory of 2984	1664	chrome.exe	102
PID 1664 wrote to memory of 2520	1664	chrome.exe	103
PID 1664 wrote to memory of 3324	1664	chrome.exe	104
PID 1664 wrote to memory of 2520	1664	chrome.exe	103
PID 1664 wrote to memory of 3324	1664	chrome.exe	104
PID 1664 wrote to memory of 1284	1664	chrome.exe	106
PID 1664 wrote to memory of 1284	1664	chrome.exe	106
PID 1664 wrote to memory of 4360	1664	chrome.exe	107
PID 1664 wrote to memory of 4360	1664	chrome.exe	107
PID 1664 wrote to memory of 3148	1664	chrome.exe	108
PID 1664 wrote to memory of 2700	1664	chrome.exe	110
PID 1664 wrote to memory of 3744	1664	chrome.exe	111
PID 1664 wrote to memory of 1096	1664	chrome.exe	112
PID 1664 wrote to memory of 4212	1664	chrome.exe	113
PID 1664 wrote to memory of 4212	1664	chrome.exe	113
PID 1664 wrote to memory of 2908	1664	chrome.exe	114
PID 1664 wrote to memory of 2908	1664	chrome.exe	114
PID 1664 wrote to memory of 5036	1664	chrome.exe	117
PID 1664 wrote to memory of 5036	1664	chrome.exe	117
PID 1664 wrote to memory of 1740	1664	chrome.exe	119
PID 1664 wrote to memory of 5116	1664	chrome.exe	123
PID 5116 wrote to memory of 1288	5116	CurseForge Windows - Installer.exe	124
PID 1288 wrote to memory of 4328	1288	OWinstaller.exe	125
PID 1288 wrote to memory of 2512	1288	OWinstaller.exe	126
PID 2512 wrote to memory of 4208	2512	msedgewebview2.exe	127
PID 2512 wrote to memory of 3316	2512	msedgewebview2.exe	128
PID 2512 wrote to memory of 3316	2512	msedgewebview2.exe	128
PID 2512 wrote to memory of 3316	2512	msedgewebview2.exe	128
PID 2512 wrote to memory of 2804	2512	msedgewebview2.exe	129
PID 2512 wrote to memory of 3108	2512	msedgewebview2.exe	130
PID 2512 wrote to memory of 3108	2512	msedgewebview2.exe	130
PID 2512 wrote to memory of 5556	2512	msedgewebview2.exe	131
PID 2512 wrote to memory of 5556	2512	msedgewebview2.exe	131
PID 2512 wrote to memory of 5556	2512	msedgewebview2.exe	131
PID 2512 wrote to memory of 6044	2512	msedgewebview2.exe	132
PID 2512 wrote to memory of 6044	2512	msedgewebview2.exe	132
PID 2512 wrote to memory of 6044	2512	msedgewebview2.exe	132
PID 1288 wrote to memory of 4644	1288	OWinstaller.exe	136
PID 4644 wrote to memory of 5552	4644	ow-electron-setup.exe	137
PID 1664 wrote to memory of 1076	1664	chrome.exe	139
PID 4644 wrote to memory of 4560	4644	ow-electron-setup.exe	140
PID 4644 wrote to memory of 5216	4644	ow-electron-setup.exe	142
PID 5856 wrote to memory of 1752	5856	CurseForge.exe	146
PID 5856 wrote to memory of 1752	5856	CurseForge.exe	146
PID 5856 wrote to memory of 5780	5856	CurseForge.exe	147
PID 5856 wrote to memory of 5160	5856	CurseForge.exe	148
PID 5856 wrote to memory of 4376	5856	CurseForge.exe	149
PID 5856 wrote to memory of 4484	5856	CurseForge.exe	151
PID 5856 wrote to memory of 4484	5856	CurseForge.exe	151
PID 5856 wrote to memory of 1008	5856	CurseForge.exe	152
PID 5856 wrote to memory of 1008	5856	CurseForge.exe	152
PID 5856 wrote to memory of 5272	5856	CurseForge.exe	153
PID 5856 wrote to memory of 11628	5856	CurseForge.exe	154
PID 5856 wrote to memory of 6768	5856	CurseForge.exe	156
PID 6768 wrote to memory of 5164	6768	cmd.exe	158
PID 5856 wrote to memory of 6164	5856	CurseForge.exe	159
PID 5272 wrote to memory of 6192	5272	CurseForge.exe	160
PID 6192 wrote to memory of 6992	6192	cmd.exe	162
PID 5856 wrote to memory of 7024	5856	CurseForge.exe	163

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\bettersurvival.zip
1⤵
PID:2940

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xb8,0x124,0x7ff9bb9cc728,0x7ff9bb9cc734,0x7ff9bb9cc740
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,12590084300311298482,10825230542156484600,262144 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2080,i,3526629671732778667,1508899692133958084,524288 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,669330468199892175,6691778620974119146,524288 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,1793491240257859616,6397847307383389830,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,601677984402966320,8725470765578566148,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4556,i,6415530764704226954,1986755188423366674,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4804,i,9715012943230584746,7761347730278062241,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,95852458107154713,15621454967628248285,524288 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,1472576347772753173,16889558082068266035,524288 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,17778925538705245354,4119672068660408156,524288 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,16618965834414808874,3473250343889594362,524288 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5656,i,16656133120626924075,4868925134632953806,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3536,i,9923978066349365578,953339845745139302,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=868,i,6787787910916330775,11104429731017238352,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,2586433330940229194,6409650298426141242,524288 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:1740
- C:\Users\Admin\Downloads\CurseForge Windows - Installer.exe
  "C:\Users\Admin\Downloads\CurseForge Windows - Installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe" Sel=0&Extension=cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm&Name=CurseForge%20Windows&UtmTerm=eyJkb21haW4iOiJjZi13ZWIifQ%3D%3D&Referer=www.curseforge.com&Browser=chrome -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://download.overwolf.com/setup/electron/cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm -AllowWindowsInsider --disable-change-location --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --silent-setup --app-name="Curseforge" --auto-close -exepath C:\Users\Admin\Downloads\CurseForge Windows - Installer.exe
    3⤵
    - Downloads MZ/PE file
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\System32\DxDiag.exe
      "C:\Windows\System32\DxDiag.exe" /xC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.xml
      4⤵
      Drops file in System32 directory
      Checks SCSI registry key(s)
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4328
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --high-dpi-support=1 --mojo-named-platform-channel-pipe=1288.4060.2108109872917063903
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ff9ad67b078,0x7ff9ad67b084,0x7ff9ad67b090
        5⤵
        
        PID:4208
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1748,i,8449842142766673891,5936309613121013877,262144 --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
        5⤵
        
        PID:3316
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2064,i,8449842142766673891,5936309613121013877,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
        5⤵
        
        PID:2804
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2348,i,8449842142766673891,5936309613121013877,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:8
        5⤵
        
        PID:3108
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3684,i,8449842142766673891,5936309613121013877,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
        5⤵
        
        PID:5556
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4172,i,8449842142766673891,5936309613121013877,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\ow-electron-setup-cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\ow-electron-setup.exe
      "C:\Users\Admin\AppData\Local\Temp\ow-electron-setup-cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\ow-electron-setup.exe" /S --force-run /d="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4644
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5552
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4560
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\CurseForge Windows', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5648,i,8304866925090271747,8355928096293369107,262144 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,1806973413052357636,4440209442633107302,524288 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:16164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4444,i,4185195973325370764,13948706776650030810,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:6808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6156,i,3126467473923966160,17457230857780625247,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:6180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6304,i,12307953961629740404,4272123943136021086,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4812,i,5952269013084719415,16752755582559790396,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1152 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6464,i,8166665714385571854,17598225682430981748,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:21200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6328,i,12704835157022734927,18364750549762701809,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:11736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6412,i,17192328470438682120,14152845193508000091,524288 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:10920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,4973047757814539885,11899511295957444795,524288 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  - Modifies registry class
  PID:10924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6448,i,6585063490063838152,3904075393007616608,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:11912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6160,i,15513796739081950472,6852546726660995318,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:21528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6528,i,4544241698752082879,18245539456922946222,2097152 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:21692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6332,i,10385052467129106538,16858347868509789863,524288 --field-trial-handle=1908,i,11281661356119496034,9715509126499811644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6916 /prefetch:8
  2⤵
  PID:21880
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\jd-gui-1.6.6.jar"
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:21996

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4388

C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
"C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1772,i,14652119598467694833,6495022485435749364,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1752
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --field-trial-handle=1772,i,14652119598467694833,6495022485435749364,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2084 /prefetch:3
  2⤵
  - Executes dropped EXE
  PID:5780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-WmiObject Win32_VideoController | ForEach-Object { $_.Name }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5160
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=cs --cs-app=CurseForge --uid=cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm --phase=48 --muid=d623af71-d77a-4f96-9422-153bd3aab0b9 --muidv2=e2389559-f4ed-4b3c-8baa-18c92a166783 --version=39.6.1 --first-run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4376
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --app-user-model-id=com.overwolf.curseforge --app-path="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1772,i,14652119598467694833,6495022485435749364,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4484
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --app-user-model-id=com.overwolf.curseforge --app-path="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1772,i,14652119598467694833,6495022485435749364,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3868 disableSentry=false /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1008
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --app-user-model-id=com.overwolf.curseforge --app-path="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1772,i,14652119598467694833,6495022485435749364,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4164 --uid=cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar" --muid=d623af71-d77a-4f96-9422-153bd3aab0b9 --phase=48 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\OverwolfElectron""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6192
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\Software\OverwolfElectron"
      4⤵
      PID:6992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\OverwolfElectron""
    3⤵
    - Executes a command shell one-liner
    PID:7128
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\Software\OverwolfElectron"
      4⤵
      PID:5588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\OverwolfElectron\cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm" /v enableNotifications /t REG_SZ /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    PID:9580
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKCU\Software\OverwolfElectron\cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm" /v enableNotifications /t REG_SZ /d 1 /f
      4⤵
      PID:10724
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar.unpacked\plugins\curse\win\Curse.Agent.Host.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar.unpacked\plugins\curse\win\Curse.Agent.Host.exe" --port=54809 --to-port=54829 --pid=5856 --appDataPath=C:\Users\Admin\AppData\Roaming\CurseForge --api-key=8140fd0b-279c-4029-a1e1-706e98f5ebff --clientId=Overwolf
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:11628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6768
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:5164
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1772,i,14652119598467694833,6495022485435749364,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:6164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAGwAcwA9ACcASwBlAHkAYgBvAGEAcgBkACcAOwAKACAAIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAbgBQAEUAbgB0AGkAdAB5ACAALQBGAGkAbAB0AGUAcgAgACIAUABOAFAAQwBsAGEAcwBzAD0AJwAkAGMAbABzACcAIgAgAHwACgAgACAAIAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBOAGEAbQBlACkACQAkACgAJABfAC4ARABlAHYAaQBjAGUASQBEACkAIgAgAH0A"
  2⤵
  - Executes a command shell one-liner
  PID:7024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAGwAcwA9ACcASwBlAHkAYgBvAGEAcgBkACcAOwAKACAAIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAbgBQAEUAbgB0AGkAdAB5ACAALQBGAGkAbAB0AGUAcgAgACIAUABOAFAAQwBsAGEAcwBzAD0AJwAkAGMAbABzACcAIgAgAHwACgAgACAAIAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBOAGEAbQBlACkACQAkACgAJABfAC4ARABlAHYAaQBjAGUASQBEACkAIgAgAH0A
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAGwAcwA9ACcATQBvAHUAcwBlACcAOwAKACAAIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAbgBQAEUAbgB0AGkAdAB5ACAALQBGAGkAbAB0AGUAcgAgACIAUABOAFAAQwBsAGEAcwBzAD0AJwAkAGMAbABzACcAIgAgAHwACgAgACAAIAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBOAGEAbQBlACkACQAkACgAJABfAC4ARABlAHYAaQBjAGUASQBEACkAIgAgAH0A"
  2⤵
  - Executes a command shell one-liner
  PID:7032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAGwAcwA9ACcATQBvAHUAcwBlACcAOwAKACAAIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAbgBQAEUAbgB0AGkAdAB5ACAALQBGAGkAbAB0AGUAcgAgACIAUABOAFAAQwBsAGEAcwBzAD0AJwAkAGMAbABzACcAIgAgAHwACgAgACAAIAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBOAGEAbQBlACkACQAkACgAJABfAC4ARABlAHYAaQBjAGUASQBEACkAIgAgAH0A
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "WHERE smartctl 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:7040
- - C:\Windows\system32\where.exe
    WHERE smartctl
    3⤵
    PID:7296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  - Executes a command shell one-liner
  PID:7404
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_DiskDrive | select Caption,Size,Status,PNPDeviceId,DeviceId,BytesPerSector,TotalCylinders,TotalHeads,TotalSectors,TotalTracks,TracksPerCylinder,SectorsPerTrack,FirmwareRevision,SerialNumber,InterfaceType | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7460
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-PhysicalDisk | select BusType,MediaType,FriendlyName,Model,SerialNumber,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7472
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7480
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_SoundDevice | select DeviceID,StatusInfo,Name,Manufacturer | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7488
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7496
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7504
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7512
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_baseboard | select Model,Manufacturer,Product,Version,SerialNumber,PartNumber,SKU | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7520
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_physicalmemoryarray | select MaxCapacityEx, MemoryDevices | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7528
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_ComputerSystemProduct | select Name,Vendor,Version,IdentifyingNumber,UUID | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7536
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7544
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:7552
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7560
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7568
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7576
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7584
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7592
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_SystemEnclosure | select Model,Manufacturer,ChassisTypes,Version,SerialNumber,PartNumber,SKU,SMBIOSAssetTag | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7600
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Battery | select BatteryStatus, DesignCapacity, DesignVoltage, EstimatedChargeRemaining, DeviceID | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7612
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-WmiObject -Class BatteryStaticData -Namespace ROOT/WMI).DesignedCapacity"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7624
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance -Class BatteryFullChargedCapacity -Namespace ROOT/WMI).FullChargedCapacity"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  - Executes a command shell one-liner
  PID:7632
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    - Checks processor information in registry
    PID:8568
- C:\Windows\System32\dxdiag.exe
  C:\Windows\System32\dxdiag.exe /x C:\Users\Admin\AppData\Local\Temp\dxdiag-YGG2g1\dxdiag.xml
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:7648
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10100
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10108
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10128
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance MS_Systeminformation -Namespace \"root/wmi\" | select systemsku | fl "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:11012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  - Executes a command shell one-liner
  PID:11164
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:6380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAHYAIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuACcACgAiACQAKAAkAGMAdgAuAFAAcgBvAGQAdQBjAHQATgBhAG0AZQApAHwAJAAoACQAYwB2AC4ARABpAHMAcABsAGEAeQBWAGUAcgBzAGkAbwBuACkAfAAkACgAJABjAHYALgBDAHUAcgByAGUAbgB0AEIAdQBpAGwAZAApAHwAJAAoACQAYwB2AC4AVQBCAFIAKQAiAA=="
  2⤵
  - Executes a command shell one-liner
  PID:6480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAHYAIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuACcACgAiACQAKAAkAGMAdgAuAFAAcgBvAGQAdQBjAHQATgBhAG0AZQApAHwAJAAoACQAYwB2AC4ARABpAHMAcABsAGEAeQBWAGUAcgBzAGkAbwBuACkAfAAkACgAJABjAHYALgBDAHUAcgByAGUAbgB0AEIAdQBpAGwAZAApAHwAJAAoACQAYwB2AC4AVQBCAFIAKQAiAA==
    3⤵
    PID:6624
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_bios | select Version, SerialNumber, SMBIOSBIOSVersion"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:21064
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --app-user-model-id=com.overwolf.curseforge --app-path="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --disable-crash-reporting --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1772,i,14652119598467694833,6495022485435749364,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:11584
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --app-user-model-id=com.overwolf.curseforge --app-path="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --disable-crash-reporting --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1772,i,14652119598467694833,6495022485435749364,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6792
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --app-user-model-id=com.overwolf.curseforge --app-path="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar" --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1772,i,14652119598467694833,6495022485435749364,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:10724
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --app-user-model-id=com.overwolf.curseforge --app-path="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar" --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1772,i,14652119598467694833,6495022485435749364,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:9724
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --app-user-model-id=com.overwolf.curseforge --app-path="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar" --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1772,i,14652119598467694833,6495022485435749364,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:22908

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:9452

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\bettersurvival.jar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:9080

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:7672
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO8733A62E\mc.class
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

21495965-ec69-4059-b556-64b4f32343e2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\21495965-ec69-4059-b556-64b4f32343e2.tmp
Size 236KB
SHA256 0d69b1b029d20d8f7b2a26275c6e62b8fcc3d33e164945ac1b7c4ef5f6c56992
MD5 a387772840199632fddcb037cb1c9224
SHA1 cac4afc557f1b9f1e63813eba09517ec872d1e45
SHA512 4d02e5c5c30cfb6761a50577a48624f5b76b237e66208974234a0f7b34ab2ed7f63d44214cdaf0b9eef2dde35ad84fbdfae811dc06d0fc2200b4a2e41521e420
SSDEEP 6144:Q1UnKCZgoCcq8Unqlm7Rkm1tYpBeh2BAoR:4ijxpnQqM9oBGcAoR
TLSH
T19134233ADCB7EC77A816A70E504D2A1D6FF16DE7C824AD65C8C8BB0466DD2DD0E06870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

142c406a-21cf-4c53-a878-b0e04293d081.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\142c406a-21cf-4c53-a878-b0e04293d081.tmp
Size 13KB
SHA256 2e17e415649230895f7ef92cc3653e9d4ff439f32cd71789576377c9a5a0616a
MD5 988837c9aa26bc1d6009bff0dbbdd127
SHA1 1ed4133ea2684f75f2f708e982d68f98b4493913
SHA512 484f1122f909a2928e6c2216dfa8f17c34ebdb1e941a9ccc469df40fb5426cc5726dc03fc0963e027870feb0cb7e06a3b0b0362ae42e4e2628f321cec0e66209
SSDEEP 192:9R2cBzIx6xPv78pTPRp/9hGSylP9DHsb+WN7NLS2fh7L+aOErkgsoRVyIsnAUgrK:9R2mzIYxH4pXm5wBvlSE4gsKe
TLSH
T12552D72BA9102A3B5CEBD226FC617B67D3F6103264E42E94E6FC892C15E79CC7127507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7dc5eab3-f196-4cb9-ac0f-9389b1bcae7a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7dc5eab3-f196-4cb9-ac0f-9389b1bcae7a.tmp
Size 12KB
SHA256 f201f3606c27f67003f693234f30df3bb7e94e4f32cdbef8c3f6ba6ef722e0b0
MD5 55427f884bd115b0d93a73556b5bdcc3
SHA1 59d36f970815b79e5baf6d6280c98af0f8a6aa44
SHA512 947e492801e013ece495703e652fc47dff55cf403d6f911f98d71667f9af1f585f5d432675b6ac217c2565534712ea50b0480eaf4402d19d8a5b24ef9f97b29b
SSDEEP 192:9RfcBz8x6xPv78pAPRp2ZPP9DHsb+WNnS27aOEjkgsoNVyIsnAUgraJ:9Rfmz8YxH4UX45wDrEggsQe
TLSH
T10242C72AB9106A3B5CEBD226FD617763D3F6103264E42E94E6FC892C15E75CC722710B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 12357ff4eae10834b43a8a95b3b9bdee913315ee0cd0c68f30878c1ee5ef065a
MD5 bf0540567a980e60e318f54dfb7c3e4d
SHA1 6c760fbf294ac959bf833d8565083ca170bbf28a
SHA512 8428664ff024c520bce9ee7c3438571b38b3d6fd490d83231ab1aa93edda5c276f63427a37ad46a82a722a1864ae4735f5a7c6c2fccf01f704c10b50b774b419
TLSH
T1A5E0E5AAD921AC2718F9472850404B46E750136B2A40C95F363CC109CFB563A056591C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000053
Size 21KB
SHA256 2a0b7c30f0977fb1625451633b6b398f1f2c69d01c655bba3918c961b66a0583
MD5 8a2c36b90c9c621271b5b157ed86e56b
SHA1 f542f96bdc7ea0f2acfd8cd9353ad01d722256a2
SHA512 10ab9e8180698c4f5570b516c20c7282c50755a33c9215c9bb97d58990004f614a95c06fcf5dd2fbb844e24a5d81332ebdffa5c89cd4b22ee46828d5deab1bd4
SSDEEP 384:3YCbDPjmywD3fwAJ2ZmSMqcHbjgog9rfaPkiTOi/dkewSpcE5uW:3sv0YUmSMnHgogxfadFkewc75uW
TLSH
T164A2E17711DD711BF84E9DE82DCE8ED5C8A9A0DE6C618C4047E014A8D0DEA760FFB4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 0a6ce5da16dbfde3a0db14c2f972c65134f43a6fd13d92e1d5c939bd98bfa676
MD5 82048f5b553696ee8d2f4cbdd906c6da
SHA1 6c3287bfbed053666d45f4439708e7945537320b
SHA512 e86f5034d7afebe46c177a90d4b6cff8f476b35c5e1405d9c78a0ffe3a6079f040a83687bbf0c3a41fb517418ffd79a428e9c62c94258eea93aef3422de8b9ca
TLSH
T1E9C0923B518013A9E35C8AB31DE24931B1633E2A4987A5D692A1109AC8AFA600513405
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 6ed20eae962574b86c335bef6ad94df19ff282db72ce8ca32f7ea9f9528b0401
MD5 db62e8cd812b565f2be365cdfeaa5f95
SHA1 6b88a531c57ce0d43e52c4ba1408d0b289e3ff5f
SHA512 00d641acdaf80ea9ba73c2360196d51ca81a771234e0fd26eaa69157b3a1f508148201ddc9364a02de8e8cf246a694520b5838436455528e69521e4aff845b51
TLSH
T1C831763DD19CE37BEF28D6311CC9085DB924A5B189133BC750541CA8ED6FAA91D036D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c23933285fbf7ff005c330a26be65394dd61b29aeb509dc3a48a4d050d180cb8
MD5 46a02385347318dc1500cfc0ebabfc4e
SHA1 0d71a2c46105f928532c06e2dff40c75e04172e6
SHA512 bd234c4965f2ebfa0ebf70c9f420a2596bf2400684ae7347c75e3f740e37c58eed91468c07ef4ce99911e58d24e46792ed5f1a180c1af8475b390243970eb15e
TLSH
T10E41A73C92CDE7EBEFD495305CD90C4DFA14A6958A0726CB10502CACEC6F6AA4DC3998
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 b24e44f9b1211adc353d8c775f3918421acfa4c028b7d1a00c18436c03f08abf
MD5 80e15c1e8c952748857e0cf34e76972a
SHA1 309e1baf49de78d2e40c50c5e9bddbb65fd9e542
SHA512 afb34e7f910656d00bb7351cfcf786f5c01ea7a799153c4637561b9ad97fd6c6fc505e595801326432663199ecb1e42bb9e85b2c7a9fba20babc87ae0bc08848
SSDEEP 192:DubmkgACmZtaIMZ5rgoCXYBwUNPwaPNNxsGuqYbMgkgILKVthcOKtI8Ae9c6H+:DubmkgACm7aIMZ5rgoCXYBwUN4aFNxsR
TLSH
T1A5227CF7C7E4C63DD91156F4AB152F1BCE2D0924522C3C6AC8E8EE5B93E24B2E14065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 185b3291a2f3f33d1d2ef0536c05d9ef3ed3c1de10b03e37151fa19915b6d258
MD5 8db66432993df768662cb1395db856cd
SHA1 ed8cf4e28b939d1bf70dc827daace070ac8131c3
SHA512 f76af140bf0809d00240a6e985ce711af8cf108785f19b0d0fb33f32bae579ebf620a9ea46cf6400e73bea22d842b0669a1dabe764555c3e8afda27de39e2ad1
SSDEEP 384:D0uwWdMRufehdeEfx2jGh2HqJCJnCJN0zdaIOzUxsGpAMgkgWLKVR45KcqI86RTk:kcAr44PuRFgFnx
TLSH
T185829CF783E4C62DD91152F4AB156E1FCE2D0928432C3C6AC8E8AE57D3E24B2E15175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 10aa7d3d5a1449f14c2f9fcc3f1490554da76a22c55f00bd3d01e7837d863c61
MD5 05bedb43ae4529a065ec45266b305f67
SHA1 412d8428c6e6bcda236b39c066706234950bf3b8
SHA512 d6f32751a622e19617a173129feded46371e42f7a54c8188318de7b003297f5fca68ecf715ee996afc7154edb4f26b14f2721dd2a80a29fc8dfbe8d4eddda177
SSDEEP 384:DubmkgACmHxMXTSmlLeZvhaIMZ5rmCXYBwUN4aFNxsGpAMgkgILKVth5KCqIc6H4:0X8qUw
TLSH
T1B8527BF7C7D4C63DC91156F4AB152E1BCE2D092452683C6BC8D8EE9BA3E24B2E14075E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 d586f9d1f206d09482f5403f5cbcc34c2e5a39fa4b155c8d458030698a71cacb
MD5 f2a58188463c1e452fd7b0716d62d35f
SHA1 c10ed5265af533be51035496dec01e16ba086893
SHA512 284bb2d134be035bb45624bac53ceca04bb1aad036a6d0ce76524d4bf91ea6ad9fa112b7e0d0ed0947eb0d4a1fb76bf5a3a9cbdc42d028c4cb557520062c4b38
SSDEEP 384:DubmkgACmHxMXTSmlLeZTaIMZ5rmCXYBwUN4aFNxsGpAMgkgILKVth5KCqIc6H/g:wX8qXvN
TLSH
T131526CF7C7D4C63DC91156F4AB152E1BCE2D092452683C6BC8D8EE9BA3E24B2E14075E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 bb79a17fbe561824fcce5a1c60b57b3c8f7af7621056b1147dd877867c75f9b7
MD5 9686a2bd119b6f19a043f5124cbcbbca
SHA1 8109527596d83b95fd9f3710df04dd772c7e0ddb
SHA512 ee7f2045f76c5fcdea5aeaa8513b946bc51e8bb9d8f813562de9392114700c0a4528608187ed9eb07da6d043f5c86aa77cf0d30f11ce9b0de42378d5b0114fa5
SSDEEP 384:D0LuuwACmHxMXTSmlLeZvZpaIMEdrmCSYBwUN4aqNxsGpAMgkgILKVth5KCqIc6J:iX5qUx
TLSH
T12C525BF7C7E4C63DC91156F4AB146E1BCE29092452683C6BC8D8EE5BA3E24B2E14075E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 989e43c4d92edf756cfb8e5874fed52346c7edbbd2cf71c8207e64cd8188b63e
MD5 c71ee2f30d2728db6dd9632f2243d643
SHA1 4ac526553e2bd2450d9ce8e4d387dd66bdca79c5
SHA512 6e81c3be90e6b8c8034525ea7ceb9fc045fc2bb0692ea8628a092169b815e7d2ff837c6c5f9b216c1ae21272b8235198a1cbc3d52f3a458f4a3559143543e602
SSDEEP 384:D0uwWtdMRufehdeEfxRjGh2HqJCRaIOzUxsGpAMgkgWLKVR45KcqI86RTnxPEU0s:jckr4kV7P3vU
TLSH
T1D7627CF783E4C63DD91152F4EB146E1FCE290924426C3C6AC9D8EE67A3E24B2E15075E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 ae23a4beae37c572c6c8caa7eddd513b6663fe77795056fb8e7651c10a4c99c4
MD5 4aa6f6683c9309bcfedc4cf370d784be
SHA1 46d57240c3a0f5694fe2f50b7dd2aa97831e6712
SHA512 89eca3b44096102bc8e8bab4a1a8365178e57316b215d6a826751e5a1340c874fb927ce3e04c2fb7f8b28b1e9b1de599efad74391c0e5d6e33bd422edfcd6f1f
SSDEEP 384:D0uWdMRufehdeEf22GN2HJJyJm+JkdxdNVaIOzUxsGpAMgkgWLKVR45KcqI86RTp:3Abr4ZPui9gjHc
TLSH
T153729BF783E4C62DD91152F4EB156E1FCE290928032C3C6AC8D8AE57E3E24B2E15575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 26d0a6bc81cd31abfafebcc3676c5090da14780855e8c057aabdf4b6b86580b2
MD5 5f77fb90b7e664e07875c80df8a6f684
SHA1 b5d70e20a9ccccfca5e304beaf213613481f2af4
SHA512 382fcb5c99250b3465e1fdc666cdd90352f3dc611de913efc0c3f4b6e351321c26ad0fc08fa8e984e46243d84e154af8beaaef6df22f505a1d7fa31baf97e8c7
SSDEEP 384:D0uwWdMRufehdeEfxRjGh2HqJCJnCJN0zdaIOzUxsGpAMgkgWLKVR45KcqI86RTj:lcAr4XPuRFgFnR
TLSH
T171829CF783E4C62DD91152F4AB156E1FCE2D0928432C3C6AC8E8AE57D3E24B2E14575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 355eddd5ca5cc7fefe5186cd485809db543f07418533cd8f0c2fc97e30df9718
MD5 7ef71c5561136733723243b7a68bdc42
SHA1 34dda23061278c66816546e75ea86871f57682c4
SHA512 a5e01a23b631c434a8b298667d59453d14153c51e3e80bae98506580b5553cc32c57beac091cdb34d4de9fa6f7596ba42147269f44cd18db0fcc7a8e8882f8d0
SSDEEP 384:D0uwWdMRufehdeEf2jGh2HqJCJnCJN0zFVaIOzUxsGpAMgkgWLKVR45KcqI86RTQ:4c6r44PuRFgFnV
TLSH
T133829CF783E4C62DD91152F4AB156E1FCE2D0928432C3C6AC8E8AE57D3E24B2E14575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 6770001dbfdbe85eb139212bf7755c758beea4913b61bb5a8f83d9e8c741f347
MD5 792727de98c33794531681f5626bde2c
SHA1 77396ce8fa0021c8263b5f3a14c8f9847cd3c9b6
SHA512 4bc35b8ed3ecf990aaecabf77f73977964644685591a38e5ec7ea42cb713dd90cfbd1e907526bdfe5c3ddb695660e3e459905673b7c63ae9c8d8a950cac7f66c
TLSH
T1CA51B167C6BFB857107A4CBB0E49BD0A1CB9F8324291A8F5EB6A816DB0855F70F03153
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ae24e77c1d1aab4628b6cd46e6a85257c02dcb6c6a856c671800564857c274b2
MD5 09aab4cd6b6d2a429f603479b1c87421
SHA1 5bd1e8463d53ec310781d70083d23561a478192e
SHA512 172e0edcef22f56dde6937b41b2d1b5f4408ff3de3b50d6c358ea2511cbcd1c1be60d19fdb0d043e9136ec8f9b0067412db926a12e92e6949538fceccd7dcf0d
SSDEEP 192:9RfcBzIx6xPv78pTPRp/9hGSylP9DHsb+WN7NLS27aOEakgsoRVyIsnAUgraJ:9RfmzIYxH4pXm5wBvrEzgsKe
TLSH
T11252D72BA9102A3B5CEBD226FC617B67D3F6103260E42E94E6FC892C15E75CC712750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ebb28ea1eaed5bff86744037159b298df7aeb2612307a45f4926ab3608e2c267
MD5 41d63c9b4b21f101c9173d84128360a5
SHA1 df1e4794e0c5f10cbcf7cb4add2160f6559b2231
SHA512 cabee9f4da0ca63dfa86052571739d7d50a771c503d045c8507a0a57b4d4eedb157825dc57290baf0b7165ec04c14589f6a31ed25723e54649b380f8b8d94e95
SSDEEP 192:9Rj8x6xPv78pAPRp2Ztf9DHsb+WNnS27zX2gkgso/VyIsnAUge:9Rj8YxH4UX+5wDn25gsqe
TLSH
T10F42D62AB9106A3B5CEBD22AFD657763D3F6103224E42E94E6FC892C15E75CC312710B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 17e2b7df913a0d66f949e268a0f6754e75c70eaf3516304db014844393de4f82
MD5 9b834a4e46d9e4141a9589cc346209f0
SHA1 233864d4c82e4b0817131fa85d77a1f3c8349540
SHA512 c0f3c61a6aa1be4f250053c1b32f49c5851dd666b1ebf641ca1f42d7582164b4fd8292290701756b9fb5fafb39d4c42ea6123f3e8e01afdf611feb194bd49869
SSDEEP 192:wRfcBzII6y6v78pTPRp/9hG1+ylU9DHsb+WN7NLi5Yh7L+SR+SkgsoRVyIsnAUge:wRfmzIvyW4pXf5wBkcN+bgsKe
TLSH
T19152E82BA9106A3B5CEBD225FD617B67E3F2103220E42E94E6FC892C15E79CC7127507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 705936b7c3f474e1e266b337a56ca257e7360281b0fbebe6253a4fea78098ac9
MD5 08024292d8d535f39c8701062518ef6d
SHA1 397c1f941d3d26d5f2942e6dabcb2950d41c0ed3
SHA512 f184c6faa8915529b1ddcb5955182efe03815c075bdaa188c181437b38b298d411e0da7473cb195cd2af92e40371d826fc07f377cfcb9970f535f8f0ce073ae9
SSDEEP 192:wRfcBhII6u0pv7qpTPRp/9hG8yltlH9DHsb+WNNqi5Yh7L+I/IIkgsoRVyIsnAUp:wRfmhIvuMmpXW5wLcRIxgsKe
TLSH
T10052E72BA9102A3B5CEBD22AFC65BB67D3F2103661942E94E6FC892C05D79CC7127507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cfb5f898e9360088855fc314de7ce03acacb536ca80941f3010635f95cb13b60
MD5 ec6581a8bcb3c6b6ccea42e261fbe6ed
SHA1 9a7def483a53574df210be00778ec253fce229b5
SHA512 7cc64bc3410ced809140f51909d6510191837ab8b2459ef110af35e4b00d2cd4030bf0ea96e2918d110d006d84d0baf45fae25bcff174da62bf86cfbb5ce88c0
SSDEEP 192:wRfcBhtI6u0pv7qpTPRp/9hG8yltlH9DHsb+WNNqi5Yh7L+I/IIkgsoRVyIsnAUp:wRfmhtvuMmpXW5wLcRIxgsKe
TLSH
T17452E72BA9102A3B5CEBD22AFC65BB67D3F2103661942E94E6FC892C05D79CC7127507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0db0fa2980aacc953bb5b679c1da3b317e146e3e39e67e7f45f48bd879bfe6fd
MD5 b79bf5e67ad298d1a555a358fc29d036
SHA1 702796809fa735203215c9344448bdcc85f54660
SHA512 3fb87ef95fc1abbfdb043066024a55f69643d4e3b591ec4888fb9dd623df4e3ebf240ad1a650bb7fd029ced2e655797d3380955cd225da9518336d07a16c7ddd
SSDEEP 192:9R2cBzII6xPv78pTPRp/9hGSylP9DHsb+WN7NLS2fh7L+aOErkgsoRVyIsnAUgrK:9R2mzIvxH4pXm5wBvlSE4gsKe
TLSH
T17C52D72BA9102A3B5CEBD226FC617B67D3F6103264E42E94E6FC892C15E79CC7127507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 89091dee710dab0cc4633331a284ffd35eaed62bfc2dc54d40ee0289481aa129
MD5 97e969bccc95d17d28c42d8e24f0110e
SHA1 d15ce296852d6faa5b368faaa3c403ede6770b85
SHA512 5859a7076aaeb06e62b286fb65af2a0dd9eeef4cf0ccecd90ac8322470a65845e821e6e93ee6f515f8e2687b855a5387a235dc6179fe432eb286649d74caa77d
SSDEEP 192:wRfcBzII6yNv78pTPRp/9hG8ylX9DHsb+WN7NLi5Yh7L+I/IIkgsoRVyIsnAUgrK:wRfmzIvyt4pXQ5wBkcRIxgsKe
TLSH
T1B352E82BA9102A3B5CEBD229FC617B67D3F2103661A41E94E6FC892C15E79CC7127507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 27e45d1e1596563c25600bd78d75c97812d06a14c7f849b90812f89144c9d03f
MD5 0c8505830c18ddb6db58b671d52c2572
SHA1 55daa0704272cd950ddbb30743c9b9c518ebfa9a
SHA512 16c838d2821b21ede6fef810c29da3b91e22e02ccb63cc5469492d440173df32e08fcff6e8e0cb0342c8dcd166f5074e975829ce67949689348d54169ae46734
SSDEEP 192:wRfcBzII6yPv78pTPRp/9hGSylP9DHsb+WN7NLi5Yh7L+aOE+kgsoRVyIsnAUgrK:wRfmzIvyH4pXm5wBkcSEXgsKe
TLSH
T11352E82BA9106A3B5CEBD226FC617B67D3F6103660E02E94E6FC892C15E79CC7127507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d383a030e1d8a960a1f8a97c72611ff01cabaf9bbcfb9342ef419a68e8018579
MD5 613dba6edd91d70d1b3339d71a0f364e
SHA1 61af25122df77b31f112f295469cf6e2ac150ab2
SHA512 a99f26ae5c41b2bac17a78866c03051c2cb3a0aa5cd8edabe7f13ced4214182ed778c7be22d5fe5839fff9381d4ebc455fb24ebb9058e661cba0373e357ba169
SSDEEP 192:wR2cBhtI6umpv7qpTPRp/9hG8yltlH9DHsb+WNNqi5Yh7L+I/IIkgsoRVyIsnAUp:wR2mhtvuumpXW5wLcRIxgsKe
TLSH
T1F652E72BB8102A3B5CEBD22AFC61BB67D3F2103661942E94E6FC892C05D79CC7127507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 bfed956a777fef7f5a7b82a9c6c815fe6b640274be2e0840f3c14215895cc5cb
MD5 25fcb7413921b310012915e5e51c47ad
SHA1 277f44b131c9ea3b7abe80be94379873914cfa7b
SHA512 091b744cbdbef5dc03d2c66b2a09033ff95d12ea51a039b240f5044bf779d23b6d2e027f2b3a8c2f7380f2577e4b132a885e34e07408c8ecda88da2bbbd6a646
TLSH
T1E1A0022619910432E54D577574911159BEB05825118706434CA04544CAD0AC5A166D14
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 921b44ae08784c15cc11fe1e39cb907c17142e9e6c7eb7e970e2e2cff96be415
MD5 ee2b0dd54ca9cbcae2072753ebd96eaf
SHA1 ff0d704884eab8ca61cf71254773112306e97961
SHA512 e92520a6e1c7c4fd25d7f16a91c9348cb035dea326b8629df43b683446f1d784786b9ec6f2dc0a4076fb37112ee6aa4d2c24d4835eb0119de64b572b00298e7a
TLSH
T191B0045533D11C37C7CD03F075C75554753D7C501147555350F4405455511D44155555
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 150B
SHA256 1849ce0d615c0e6b26f7b5682116615e7dc93b8a27c5c4647e48c1a02b6c4cf6
MD5 43a238f568b8930a97ac47b98067a106
SHA1 90bda42dc7db9e2cd885f534240f386575126066
SHA512 d236ef5f4c7e53cdded7fb6462d3afebb0f726369d0e246f0baf4bddb9b3530657bd1139dcfc1ce43b1e57fe6915a57c3676786029c9b5bd39f1a5048c0a7af3
TLSH
T16BC04CF36510869B4B75EAE82059722DD95B95488CC9CCE8944C551A217CA334802AAD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe604dc6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe604dc6.TMP
Size 157B
SHA256 6d45541904818c934fd48300e5f31fa768bf0f6a41bea39876ca5b25bf92df57
MD5 2c500e391f6af45ccf210f4aa281fd6a
SHA1 17afae2c0ce23827ca645cb214d11ceb3dd46626
SHA512 a53ca61b91341fd6e121b6f0e3eeb20ef05631bed3e052f2bf269d1196fe0e25ae19194a5db84d9e7910c7de9bf6d95507fb0a3b048f26a97d6b5d2294bf4040
TLSH
T1A6C08CF36420828B0B32A5D42028711CC85B8C088CC9CCEC904D710A207CA334801ABC
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 f0ce5f4bc8599befff4dadb64d66f1f940a36c8a3daefcb5cbde6cebb70d5a98
MD5 ab308156298c609c431b4365031e6483
SHA1 21bd1060b7c608e4b3ac420c772b24dc4cbdbd97
SHA512 1ec8fcfa3a2d41130cc91e847a06b0a22ad4ddadcd8fcfac35dd6b7716d4cdc797e73e4ca29d1a754bb27bf7419ed13ce67c0d802c1d080c14a9cd144d81bed2
SSDEEP 6144:GcnKCZgoCcq8Unqlm7Rkm1tYpBeh2BAoR:G6jxpnQqM9oBGcAoR
TLSH
T16334233ADCBBED776415A30EA04E1A1D6FF22CE7C865AD76C9C8AB0426D43CD0B05970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 664d1e56aadd42da671c0fc0cea4b00ac3459633d206fed2d97499e2f77a6dd9
MD5 dc7e54538f9540d00a2803d46ac10c11
SHA1 2b3c0872ec06e22c925798c8865676b5f84b8f14
SHA512 7ef216333edfe247f654e644c43218dc64d76919b9571d8661be61e5dd638e78a2bea6ebf12912a324403f660d5061280a4be75f687159b0b0ad165a2abfa479
SSDEEP 6144:lcnKCZgoCcq8Unqlm7Rkm1tYpBeh2BAoR:l6jxpnQqM9oBGcAoR
TLSH
T1AE34233ADCBBED776415A30E604E1A1D6FF22CE7C865AD76C9C8AB0426D43CD0B05970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ea97d803934c719cd14f5f0d00db0ab8be362573ff72e63cf13a7cc600157f17
MD5 2284d0aa3c0259787edae1e531a1e591
SHA1 56001787746faf066290388bb7567c9d6d347100
SHA512 cfda4dbdb12746aa1ad4ac48e88008b01da106b60fee195a0282034efe27ecec8600658bc94ebec0ae59daca443e88d635eefc4fce6881b5321b75be24743c79
SSDEEP 3072:jGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:am7Rkm1tYpBeh2BAoO
TLSH
T148C3123B5D65E9375D78A71EB48E0B1E1EF249A6C930DE4288D86A0433FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 c1b882094e38ba155a983b2d33a29149e5d923583bf4c3dd0741bf14918f47a1
MD5 0b76833fe445bb4ab2694f886388f28f
SHA1 0f2aae4d69561b58896c0d6c52d7f0efdbe8e7bd
SHA512 385ff074c837c01068678860b2e3b96177ed1ab345c5988dca55a9ab49222f092d424bbe65d26deff1c4a0bed6bb550a3ec664f807b204736cbc504be0632d5d
SSDEEP 6144:U1UnKCZgoCcq8Unqlm7Rkm1tYpBeh2BAoR:MijxpnQqM9oBGcAoR
TLSH
T11034233ADCB7EC77A816A70E504D2A1D6FF16DE7CC24AD65C8C87B0466D92DD0E06870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 19162509c0b36cc6118417169a32a4b6e33d702220f3fe52ae07931e59dfda2e
MD5 326dbd4b38e1d1e122feedeeb686b31b
SHA1 30ad2e73ff32678974020f11bb4fd98db4cc9a2d
SHA512 35fa2b4bc4eebd7d290c99fb1da420771112705ed456efed646a0b414eb93404f5e11077773fa2d5c43bfae7d4cf1e8954d73c4a1f5d3161f283fbfab5076355
SSDEEP 6144:V1UnKCZgoCcq8Unqlm7Rkm1tYpBeh2BAoR:fijxpnQqM9oBGcAoR
TLSH
T17134233ADCB7EC77A816A70E504D2A1D6FF16DE7CC24AD65C8C87B0466D92DD0E06870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SettingsPageBasic.xml

Path C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml
Size 752B
SHA256 fd20d230bc62647d238c37ba9c5f712cc8fe0befbd681a3cfe4e8b22fcf8c715
MD5 12a8d11da872e82d32880238687c39ac
SHA1 f10ba5bd82b30b61fc20f302a0ac53b497f2b189
SHA512 85e8703d805f847ad866f23f21b9f18b27677a67b2715f73293e600ac0d56d7dabd0cfc2d9989469ba67231dde10388a7f08dc618f901f7a8774e07a8c32679f
TLSH
T17501AD1D3ED2FC2909B20956B53ABD54EE70E61230354EE4F3E4232B2A53236194B72A
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\chrome_100_percent.pak
Size 112KB
SHA256 45d14a4278b1e152b363197401a5604aa5a3cee6512a6b52df978038fa521a0f
MD5 e7bbddff3081eeecf7f56e76ce1d48e4
SHA1 eb83b418ad0e8f502f12a339cabc2fef8ec06cb4
SHA512 2caaa851d095d1a641b959cf092a2ce02328298aafdfadafc773eb0a0054054ae54c41574328694f6a37928203509a0c7e38f3beff1f4fd2ded00b5ed5531d85
SSDEEP 3072:z84PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:zRYWFUbGz8LI1TnjQBQCrC
TLSH
T13AB3D0D7B7B0AD7DDA474BB783560170FCB30B2D0682120A5A99E479653AF88C8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mc.class

Path C:\Users\Admin\AppData\Local\Temp\7zE873AD79F\mc.class
Size 10KB
SHA256 339f8b7d044a557c065d4189eb3d6f1790cb27e291d6157229e43f9fda282e77
MD5 c311473d66312838a9f6b64da5c883cc
SHA1 280a489d098f14e1b78e2c5ef96c0243a918fa5c
SHA512 00ab3ab9f7216cc9b9dfb5ffc1ad150a9439736f1bb109375f01c94af3a4ffc064532786aed3bf2c3058df95a3a0b919f4244cb44ea5b8577595bf9672ea1a1b
SSDEEP 192:AOJga4GfzDSJTlMEPandhD3yC0dwbPHDL/C0dwbPHD4GrWvi5l4D0hfqTqZkuIKa:ZfzDSj1aLDXPS8GrWvi0DCamix
TLSH
T10322C83FF822DA0FE064EDBDDA9086E11160F47140FEB8826E5E2D5990C927728D65DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_rhksxmrw.fo3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rhksxmrw.fo3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\LICENSES.chromium.html
Size 14.4MB
SHA256 2a58d970dc22c4dee982055a3cec18d296aa776ea636eeddae3a90ba9d4e1505
MD5 38245a9da751c9c0846b1d9cef27933c
SHA1 914b900008f0b30e63b24e0b31e6ec68061ff210
SHA512 dbd996c3eb7bafae97b02027f3a030f8c7c168732338a6b79e03bc71ece201aefc4467c882b86926f5d6bfa4db41719e7071a09afc95ba9b7628c3d13baaf2bd
SSDEEP 24576:vCNmjZ6doAjZ6/u3jK6UwR0ouDJjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jK65x:vXJeXqn8m1
TLSH
T1F5E6A42F7B48037306C642A2AB8B65CBF31E903F3B561654345CD1681F6BA2583FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\chrome_200_percent.pak
Size 182KB
SHA256 aafc61b89748d17fcbc9fecd9844a77be2c584529a81714c98e0c4d453ea9496
MD5 1e1744b9410d29e7d1ed28c4f67d6317
SHA1 4f3fcf3db1f8a1eeefd5a4c2f3f2d2b34c094a82
SHA512 10fbcc89ae3251f4c163beea1dd3a53bca239486e1ed7a997e9b04d3a6193266cd96db4a1f8b753942429305ae9ee28b1e9d3fee7e2ddfee847a4db40c8cea93
SSDEEP 3072:dl4J8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:tGQ+N6uSZQDQYakvyAkcjQBQNd4
TLSH
T13804F1D373B8AD3DDA570B73926610E0FD7A20291EB3110A5A9F98397925E8CD9CD343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\dxcompiler.dll
Size 24.9MB
SHA256 34432ac04bc513fb28608334cfaf30c80ce3be193f0ea92f636dd6da226402f0
MD5 1a8480e94af62e39e2ab11579b9d8d69
SHA1 32ef27aaa0d0d6e09870d35663fa058e93e65663
SHA512 b7bef526a7e7ae8832dfbea0979f93731d708b1fa6379c01fad3371bbe83b8a660fe424d108d43bf5359d1dbf24e4f250bbb9f90a6be03bf55d48ba7c14bd2a6
SSDEEP 196608:5yEM0iNA8dEVPgDaIq/DYfM0gAgzgiyM+lXx6Ji:5yEM0i6MEE8sZiyfUc
TLSH
T1BE4729122246949DF059C879C3678626CA2C34E73FA778EFC0F461252B7BEB85B39135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 b2994c4b8ebc9f23cda10f410db4c833181464cf870f66949ad8b91ee3a83da5
MD5 0b6a0488edb326aedb5620bf8efb87d1
SHA1 ffd653df06ce236f1660e0f26d24334f417f5e7b
SHA512 5e63a056ab09a507a9dbd4e85c624eab5bf47903927b548587b0a610258e307baf70f80463a25870c1647cf71018316eb1739d393a62ff1dcc2c5bcf383b192d
SSDEEP 49152:lESTAZFzTxMIP2uEeLfptJrj0vVJA8ANdZGNxcO6IhgiS9Nol7WtaRRqSorwIaG9:lDaTFEYht8OnZGNxcO6IhgiS9Nol7WtL
TLSH
T118E5AE03F6D650D9D029C57197AB9313F631380A4F2056EF2A804A253FA7FD86E7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\libEGL.dll
Size 502KB
SHA256 8d135a01cb626390dd2eed1032c26ee77f331eba30de642013167dda68a239fd
MD5 37336fe387ce19ce3b031d2a1fab6cb5
SHA1 c6a4a2fa380d19e1432ccfe85a1c0701e70bb93c
SHA512 db8fa1d9a4f62bd0caa1162b3bd2c8174ac9ce769ebb53ea51a511b7fcdc94ad271bbb229fc7bc72a0f848ce7285c1441abbfd77f1ec641771a3f0c9e9f2075f
SSDEEP 6144:TtqwvC8uRreZw/wqbZyu5sIAeoZPw1ODZ6R3/8cWqR/H2plHoSZd3h:pqwvC8SrZ9NEIsPwa6R3/8cWqtIHoS/h
TLSH
T166B49E15F3E945A8E06AD4348B534603DA7278560B65FAEF03E092793F37BE45B3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\libGLESv2.dll
Size 8.0MB
SHA256 01d754d9d126676d234d738c91e7e68337653f5168901c48854f57950d31918a
MD5 489342139cd043b3bf0b62d6013d9fa2
SHA1 c667cd6c4d2f77cb50fbb68772aeae42c62dbbd6
SHA512 a58549022b9897d285ee546a0169d17454aaeb1e77a8e81c1cd88aaefcfd7844bf998ed696be7a2a36e1a1b1dc08d3b878b9b97bbd1d45ac6ac89edfa7ef28de
SSDEEP 49152:KACj6o+K5Wq6YogXd5ybJ2DYVCaVVnHVNukqUx0qSqfyOus4UUN4uVlMdgieDFdk:0VKgkTBSxRs5UhZHlr+hvhW8I/69DEQ
TLSH
T12A867C03F68541D8C05DE2B8975BA327FA35B8490734B6CF2A9413152F6BBE0AB7E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\af.pak
Size 568KB
SHA256 ca253121434ef430661c30672e1097e6d238e42821585b700776b56977c05d97
MD5 fc774f629eef0d028ef6c0d759b86176
SHA1 8a57809eb22b2d77a2b18ad1c12a17698c512e69
SHA512 ea2c29892c7313063512d4223884e5301ddd265c7299a93384ad1a7d98c950db52665063671242ddb6f2785dbb48d26439b423b12d41055484791414fea07b64
SSDEEP 12288:18abGwqRXxgtRGt+vW5RwONM8KuY3GB1sz4H2Jyn9N+saAQGmQo0v4JIAga26F+C:KaPqRXutRGt+vWDwONM8KuY32sz4H2J5
TLSH
T1F2C41B0BE781173D09B07696FA0845B7FB9CA26CC770B2BADDA982310966DFC11BD1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\am.pak
Size 921KB
SHA256 1f126a64a58ece296209d24c36ae416e3187996765027b1198ee01dead17394c
MD5 e523ed0f5b61632b6bcecdba23754417
SHA1 e146bf586f4b0d05732ada8ef1db69d750ef5d24
SHA512 444e540b31e713e0c3c354cb8b6d7e1b6a2953fe7290210ba26f05241c31b6d0f49ed818ddc438754403e7ce0fb06af4e9be6c46e101da6cf96bef6082d58d4a
SSDEEP 24576:tC4KpTe1jEQhTCMpyGvxVdDSjyc8TzeIXGf5530iABV6zZUPhW:NS5l
TLSH
T1F215AB547EF9F7570F8E8A19A4320E4E9594AE4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\ar.pak
Size 1016KB
SHA256 cf46d1687d01d8ba58512ea7082aedbaa14ff0e748eae295fbcdae464b271b77
MD5 9236822ebebe58d5931cb3abfa59d05e
SHA1 a28c445ee0f9ba804f448d37ca7da3720d664f28
SHA512 368fca3153f7130b3fa76e373a1574a0db440a027697651c8ae075804c78d9d50a6d98c0b7d4edd13094d1da6c332a00ab943893b3006b507e491a489b457e65
SSDEEP 12288:8yq5GPb4BBjLVHTLG2awjy8u+7v4UDodMqkMZS158qNjpPEKLLlYy:8yvm5zE6
TLSH
T107258BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\bg.pak
Size 1.0MB
SHA256 f2a46c4ee04330ef49f6acc62c26ed7ec57dfe124aa386e08c5b582832c4000e
MD5 934193d485de19986de7e0277c139cd3
SHA1 387b3699cfbfa62fbdeeb4f6d9b127df0eb7e719
SHA512 d3516bb252832db4573d38ae9d6ab63db4a5988f49f92fbcdf191a12d9be078600dda750330fe66286a89dcf614864191f60a97999e66e317eedb0fea75bb8e9
SSDEEP 24576:qDcOWNy/LYJzQkECtUrVb6tbGdx373ZTm1z3GjK4UfVDsMX74u2VZsxI5e468KtL:XOWNy/LYO6UrVb6tbGdx373ZTmZ3G7Ul
TLSH
T1283524A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\bn.pak
Size 1.3MB
SHA256 b4ada9665be5c9d9fe4254bff291978dfb50c2b22a7149faf9b9c3f470f0d32f
MD5 22f36ee63dd0e66da673a95e85352e1c
SHA1 65ea5cfaadabe5ed611a20f77d816b1f51aeea1d
SHA512 98b7661cf382ab9feedd09c074b8fa458e061633b250e0dff3ae5417fa7ee43f950f3952aecad8dc6d4dc8ece3d7f4428f4440acf03b525850476517ddd53efb
SSDEEP 3072:xlE7CdT2+xplSGuIpdJ5259J9gJfifHRbkWvLypUBbqVQL55BkwuHX:xeCdT2+xpsLIp3UkWvLypUBbb5UwM
TLSH
T1E755EF209C6E81B6A8C5CDC9434C6370C523AE9B9B61F74DDC17A14938ADC7C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\ca.pak
Size 640KB
SHA256 252c097b90fc3ba9096c519a6ab2e91b441f11cce65c7c47777542959dbf6c34
MD5 10db08caf10e1b1bf0570cf1b765278c
SHA1 914c5c8e9eb7cc7e718c16036025199c6dafd0bb
SHA512 e62302f4240f5eb5c56ec3f6ffa7846a562c02628812e70880f86818a061ab5b29197fa677c72f78bad9e0118f8de1e3ff13c223ccc6e54a2356dddb50caf343
SSDEEP 12288:YTW25sL27hjGlCiGh3UQU8K5PsFYN3Mw2juwHzejm0t3l7b7T5+vHcwTLT/fnWyN:YT5sio4L622l8MN2M0K5MYwUy
TLSH
T163D408239FC93B7704D2330EFB46C217A48CA9847B16D254F4AE1B1622CCADCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\cs.pak
Size 663KB
SHA256 5e9385505f9507d4a57f7a5960ceb35b5fba92c662b53bda4e4dc0d63245059a
MD5 b5daa2520a4bf24cb6b5298aa518f444
SHA1 6255446419fc78dc365267f254e7cbb5f5033b40
SHA512 000a7b9512ac05d027c43c80d397efc0b082305fcb52c499b587bd0584c54ae3794a4c74fefef9c7280f1cfaec4d21696178a5ba52815f992c9b5fe3df5e6899
SSDEEP 6144:CWEvFuhf4xp+EHbF2Pw00z35AtYJlA7Af5Bzp/GZ8OwwJSBW48Qz:9iohwrbF2HO35AtWD5Bzp/GZ8OLJSV
TLSH
T1BCE4391EEEA36435584002487FBE4128BD6E83140B6EB9AB7C8F9D91257577E8FF0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\da.pak
Size 598KB
SHA256 054849037db8f9672ab80606dd7163f25b18710ee7f777e7eeaa68d24447aee6
MD5 f5e55fe7f2cde2968c0d2d0cac10dc36
SHA1 4c93a1eeced587dc5b01d7d8e3a063a5a2a7b4db
SHA512 3042ee29efef6d8c580758c623173c6fca5bb6a65779f928d6c1e635bccdd0f0c0528d1a2cda4409a1be1c25d6f0006cef3bd6982fafa0400c784890681494e0
SSDEEP 6144:sATJBS1qVIQRMNiVzVIv5MwHJBE/evTawlAnsJwOgobiq2SaE5dtfwcYsghHLd4E:sAIiAHVTe9q5dt4nsR8
TLSH
T1E8D45A4BDC9C732FC9A90725F3118DA7EB6D543CC684264F65D8943A09CBCA097BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\de.pak
Size 640KB
SHA256 404975e6b3af1f4e40be3905da1850c3e87e29bd03d0866185ff85c06861ba68
MD5 a63e224a1e24b61f3acf3bbdd212f563
SHA1 17e6e42e88509e1aca6ec87a0d5e936633bbb5be
SHA512 7db291bb6df49ad037916d31244636ce588f851b7e2d6e9b5c05bbf9199377a45f852ec979fcbe40b5810c0d8f2b1fcde924d7f8d1ff4bd33a3778dbbdf07a53
SSDEEP 12288:ZyDS5JG/3K7Up+guafzEmLO35aSUMUdChT:Z0S5c/3K7Up+gua7R650ChT
TLSH
T1AAD41803ADDF625ED68673617305CDB77B19E36BC342322788EDD12B614B5B283AD422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\el.pak
Size 1.1MB
SHA256 dc27d24e9afd24124abca6dca1a362462851267902fe6493ff3165a1c5aab69f
MD5 bd76528a8fc532885ecb7530f543e975
SHA1 a95e9ed8e3b7fd6a768f37465cd66b09404aa156
SHA512 b9d4a98768a56509ebb4a55f1c2a05300e32be939647a0b3acbb45083930d91967c68c5a0276d5f57400a6b8a410c8d0289ee403d127e7985db502675729a398
SSDEEP 24576:rqss46HWFbrlK5Yp9Ck2txZu8OJXDsSHCmu2Od7IO2USUBx3PyjkHvFz4VoyNJmJ:rqP/HWFbrlK5Yp9Ck2txZu8OJXDsSHCT
TLSH
T12845CFEFB4582DED8046950785D8F07C2BC66D6CE749CBD86229CB60BDF80719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\en-GB.pak
Size 518KB
SHA256 ee6fc979d1fff0c1a4d6bca929691733665c5df7e7a43cc54f1165ea14cffa67
MD5 c66a0ee9892bdb1f511a614d432b5b68
SHA1 0bade47c568201dfca6982d46d44a64e44de288e
SHA512 c83f45164b07932bfb17204ba3016ef4bc2c68817f7456d9a25f807d0ffeb4c1eeb1d3114bac5dd3907332765b20ae0790fe90d54399b6e0e4733adc40e708c7
SSDEEP 6144:mCJMs1KdSc4rcuF4yVEMP9pQRIBfaYHHDjko5b0DG1BcERQu:1J1IR4/EMLQRI7F5wDw
TLSH
T199B43C1FF785126A059352A2BB0AA562FF22D07CB35112663CBD801C33B6766C3777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\en-US.pak
Size 524KB
SHA256 bfa782c9efae2c9cd2c0214dae1bbb3c259d4d4c38d920b06677b9c4cf4f813d
MD5 bfbb69222dcc50ca860b6a80a3da4f4c
SHA1 51200c9bd18b0999ba38033662c5e319485e7420
SHA512 940a2855b5de5f1545abbfed5dad0cfe81e74e847a60f65b4a8df54860649502062ff8941c0fbb248c203fbe6b883ecae8b21e91215b07c1231129a914008a28
SSDEEP 6144:njtGVh0jMRG0PTMP9QQo94faYQ6TFB+5P2jdnngP8/s1wf:jEVhmOTMCQo9+C5Ojawf
TLSH
T160B44C1FF744122A05A352627F0995A2FF32D06CA35112663CBD812C3376B6AD3B77E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\es-419.pak
Size 631KB
SHA256 2b728123b590c5570a46ec2da7d4e620cb81559629f933ee5d71386fa142e02b
MD5 b0a63cb56453f3ec942195e1065e129a
SHA1 5016eab186612f33a7241f842cbcbe80ca709cce
SHA512 ea61a557d626f91c12e22dde790804dcdf6d407ea623369fcb4bd376d72152b71648263f02d2600fd77b2655d34382be95f32ede24057bafdb891ccec45a537c
SSDEEP 6144:rsK6lxhznjoJYLFLnQ2FYjnmo5vV305ieSr5AAoRGCl:m1BmpVu5ieUAfl
TLSH
T1F1D4F822BAC81F5310E3A388B743D757E4989545B408C29BE8EB876522CCF8CD977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\es.pak
Size 628KB
SHA256 4801312dd5d7e3d62db05b8fe326d982f3887c65ac9faa7621009853c0d3b0b1
MD5 60abb63b7d0a231c361bb03111499b89
SHA1 e6ec3f843f199b706fbe7c1d3a342c667bfc6e7f
SHA512 b61b34f108e264bb24fdaa5c638cfb5afc428a1f28edde8a1839b6af84c2d6889b460a0e73a9ec3d3dd0d3c4e1041aab8fac7413e64863a0bddb6339542207b6
SSDEEP 6144:b1YkJ88v4zeV/1uGbU5gtEa+5QhGcm3X8ji5JOvAJLlvJ58J36PZOW/:Ze8v6GbUy9hGjX8ji5AoJJvf8ho
TLSH
T14AD40822AACC1F6310E39349B743D753E8D89545B508D29BE8EB876621CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\et.pak
Size 573KB
SHA256 488a91b53d17ca8b52e25f143197875aef7dd50e1bd51bad749f559c17f52aec
MD5 afe1f76bc67ea3886fd0d6ada960dc06
SHA1 363cb7d2713e4f286c3655df753108b8bc1dc5d0
SHA512 b5d178f2e27e751a173b2556199eaf7a3855dc537ddb76dc105e697faaec69cedac955202838b4288f562f154e55abf12a181a1bc1dc7a61a4d5d74d1200e97f
SSDEEP 6144:yc6YcUBG7nXh+f9jaH+KPe6yH07nFdGpNQvmdxIPOTQysogWUiofoflLXhS51Tqi:ybYGDR+MvPe0nFdGpUoPfljhS5Zqcr
TLSH
T1DCC44C42A27D771B182412F9E737E927DC9FE7D8B4000D9668974A1970EEF8C38B2B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\fa.pak
Size 946KB
SHA256 cfd05fb194e5c43c2c65e7803eca72fde4f5629e849cf2dbb8f6f62156485aba
MD5 71ac9af8d1deebd0f4ac15a2f2b81e12
SHA1 8c61c12860d220b0fdf2d0162ff95c53afac73a6
SHA512 cb9f4071da718edc0ae735ac087ae2329384ad34f11dcabe2af40ca19f8a7b83cc95160e3aa3ae88bd9a4f0dffe19eceb46e2a68903381d350a761ffafd02beb
SSDEEP 24576:BOoBOF5I8u313uyqoz+sb2vRmXnloTUoXtCfGk62Yh78ai/78MX4UOVU8Rkc02un:MdS5im
TLSH
T19625C1957AAC9AB15747CA0341E33834C773EF12D349FE40ACA1076609A5B139B5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\fi.pak
Size 584KB
SHA256 c04f5e2b7f30e8e350feefd6cc45f266dbeacf11837cc774c977bf76e9b403a7
MD5 4c9edf90a899707ff2ac97c81b5e61b1
SHA1 967ed2339e4a14147ed60d0875f16ea3d3cd480d
SHA512 fe80a1f6df3458e43bebe1f62203bf3f738055f4a13412c6ab0bc16da83b876b05c8aa89baa365a1ca7155296cfb3dbed4f143b89e4dacb98aaf50edbea1ab2b
SSDEEP 12288:ulx/dp19Tca5WaW5wJw+UURI8pvWamvaG:8x/25wJzId
TLSH
T1EBD45C915219C22237C4D29E7DB0903EF5E5E3DCCC284D9AE843C7D849EA9887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\fil.pak
Size 662KB
SHA256 48884f90e800b0b0803ddaa0bbebbea1292bf8e1bb5ee8f035a79371bef7ac2b
MD5 4fcaec162908f63d6da009e18ad83539
SHA1 953d1748d721717dd7ad7f535764a73bc6a4d616
SHA512 0ca395473ef66ad1142c5f6088ce90a534f7eb45fc9e9e5acc32eab5f371571679b2bd6538f09c5223a82558371cd247182f4b64624cc507b09f2815daae1c19
SSDEEP 6144:4IC7/okacr/Er9FFfNy4DQ+ZyIWltRFhsAcJ56SGvla9boV8A1cOO:Hi/aO/ELn5yvO
TLSH
T10BE4C61577402748DBC352E55360A82F6AE560B83F827C6E0FBF269B7BA7CD5D270182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\fr.pak
Size 682KB
SHA256 e311ebdf49828d313760453a01ad1335bac955b4b8b291accf038714c91ebc03
MD5 73896c5acfb23715348065cfeaaa95ca
SHA1 a5faac8ea692e1dbe6dc667fea32a1a6ad8f845e
SHA512 4de8e3bd5bc4fadf655536b5285e4f5f570236d3c60d1e52259bd1d7568415f9c57816a97633d439eb36e22ffcdfd46913465dc827ea74ea3ae1e2b3b0ec7855
SSDEEP 12288:Abw5DvTZLAqb5dZb2Z7R6QuaSVYLyH81ezQI9kiZuYnY88jw2wTxJDzLmdxSm40m:3o6VmZf55M
TLSH
T1D2E4E66FBAC431CB19C60277FB16D663DD348248F215E340D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\gu.pak
Size 1.3MB
SHA256 11e4ab3cfa421ea0d4d0971b038a6e7a254094fa6dfe9b8f65fd1572f36bcabb
MD5 d76f8c03323625db4edfee35784da1be
SHA1 af7cdb843bd30ca234d81cd9c593c87709aec30c
SHA512 3af2d086b5abb988b2c67037870c1d2a9cf68ace232d99cda47b93d2639adafed3bc39300ac5635d7028004c2d3a327179be90568e27a1a1a6c7869f5d76359d
SSDEEP 3072:/sKn1zW++jFtt1Ib9tPjAwREJKVMjNiT7llj63rAulfcSi5NnWsWi+/GQoy7vBzu:/sCNWxCbjs7z5qCVCi1ssLw
TLSH
T1BD5518D0D7B9F07019DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\he.pak
Size 829KB
SHA256 30409b7264418b9b9852b2419669bb8da6f489b58d4eeb1007b39d5cc978621d
MD5 2fe5716790acc2234910947f2501f387
SHA1 062c54e342088acd61a8cdafc6a2264235c54c94
SHA512 57ffdc66c062819d8a5e2edc82d04e626b1ca00e5528f796e46e170c29f69ec89a771d157799ed732fce31f97bc2f6001b559471cfa84f8ad0d1f932fa4bbe6a
SSDEEP 12288:wGrhOF2GrTmoBrAfDuBAlGWq+/1J3GIGAACXlXeQCaj35RXbN60jsXk5mOmmrrB9:l5j62
TLSH
T1BB0599C4B2E452255131AAC39FA5FA286FF3CAB53CA27512CB14526CAC774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\hi.pak
Size 1.4MB
SHA256 59ae1278d1b58da7c0a11e5a23bf69ea31c674aebbc24fcd537a84769efe9d69
MD5 116a4f944f08e6005b792d89d3f0bf96
SHA1 b507dc68a7f86abe2db57dedf3b04a8ca7534acb
SHA512 f3547fbc2e28a34f7ed849f05280fc1ad13c0e81cae85e06a89068bf8b1c1b10901fc067b3c066d89640f40e82236878e365d039d531d5ab4cad3b8535626d41
SSDEEP 3072:eUe+UDOnh+DI6ESjQrcewaV/B90ZV1d3uGlqvN3dgNJEdtDVeDn1s4f4/BtROy4N:8+jh+QSjQt/+U5pAndKtu
TLSH
T11165050CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\hr.pak
Size 639KB
SHA256 36d9939cd9d89baae124fc930cc050e386df2b8fd0eda0fb48882a2929b94a76
MD5 8ca2b00eb3f0a1aba023d6bd80b0df03
SHA1 925a49d5c63dfe2a5a4f235bb31007f060751ab3
SHA512 df5406e2cbbed3f612554c2a13c71211c0d8883f69b96f0116b5044ec8d8ea8b39bce572f158d2eed52fefee9ea8dda684987019f78830d2b2deaafcb379cdd1
SSDEEP 6144:krVaCiySH1RnvXOKDOYE/5wQCOR7PrzpJ:kxZu1RnvXfM5+O9pJ
TLSH
T119D42A7DBEF3570A0897B34AEFAA434479BD08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\hu.pak
Size 684KB
SHA256 501569c5e74285231b41d067e0ea28972ef0ab7b269886485cf1b42cd78cbd1d
MD5 b898f99d79360f2bf2ce506c324c25a1
SHA1 8805034141ac3b138688d00bb8ffaec7a5033f68
SHA512 bf55f3b15964e346e9b6be757de03fa0c610d568428d443a55135c8a823e71ae3c7bb99ef40e429950e601ce96ad8fa2b68d7fb482c785a10c5dd8e52b76ae23
SSDEEP 6144:MddbPxudyTpVHiLlw5kgWA4ZtOu8U5UTt8gZ494rYhCi/UtmuFNer2EnjD+54RIf:MdVPELAjU5UJ8LRa5Tys
TLSH
T18FE44BB79376905ABC6C179778643F15592E481BAF2B32FB2883846D24A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\id.pak
Size 565KB
SHA256 09d4dd7cbe4eb1b7730a80a3a3cd0606139f4b9647b0a04b49314638680b0a31
MD5 7bbdc528c668aa0994417aac9301a718
SHA1 71a6c00c115c5c6ea01d8f6258f141e5a35c70c9
SHA512 52e742e249f12fa3185c961e91c39a290b8ffcfd4260d9b502b90608ebdbbfeb834a43b150a415af76e84a0527c7473da122c6e857ab12b4e0c87319f64d9c6d
SSDEEP 6144:4pNXRs8aNQQ83ZA9tK4AfjzTFjlFtXmBmiFp/Q25R61lKOBCTmWiTv8oyHu:w/vaNI3ZWj8TFjlFlmAi75R61T4u
TLSH
T1F4C4E8632ECD310C094842D5F2DDAA1E7CCE233BAF05B76E8E348F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\it.pak
Size 619KB
SHA256 901a28a4cd0b1d545f0c2e4aa54914029adc03801859761db30c81947de63f92
MD5 5643e0b3864700801fc4a1c59a1244d5
SHA1 2c7529e034bf04589ed52a4bafc5123d7f424910
SHA512 bc60b4df1f943df74a93046eae531ad8a2eb7c0186a8df9c5e9b4a09b3a3466f8b3e8f0246fcf53bf819e3744599519182bd9a3e52d87e683fa260b007002766
SSDEEP 6144:ct7Hl4tBXWx8miX97+2N9rYS/qBRRs61wtl/RT9TbOKkg3gCYrqdqpzSj9f3wBYE:0sGMXZZ/K8YM1CWkb5PkSlxVr
TLSH
T1F6D41B3AA5D6212519976359E611B085FB6EFCDCFA41721CC99B031C22CFE80F2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\ja.pak
Size 754KB
SHA256 8250b4783dcc389fa96fdf79e8188e439ffe5fc01325f32ab8c322c4d27f20a4
MD5 830a7cba279a3deb42af3e23775cbc4b
SHA1 7102caba0d73d48af569d6c9877fa3955fb778b6
SHA512 e0277e4dc6a1f603a0ffb40e7e01dace0f49604eef6aa6d4fe554592f7366af490b84c6d7b823ab61fea55d335437f69ba04502537a3d90fc704a741b6633b2d
SSDEEP 6144:mnhlmdGBTZTDm1CQRdMfdV+Z8Q2E0uRUNbN5ziIy5GzV3:qraGBBDTyO+Z8Q2E0sUj5zVy5U
TLSH
T18EF44F7CE3C969369D6152A22C0E36E17506AC5FFCA23A3A443DC074BD70BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\kn.pak
Size 1.5MB
SHA256 847c5e6abcddf120b4dbc34e28dcd1c2e93f94ab1d6f016d0c1504a58cfd5b93
MD5 4183e32193ba8bd36bc421490dfd0959
SHA1 c3c1ea138dbe32969f10f3d25556f381ec1e3688
SHA512 06b0fb8ac6c844b3efa6a26c0af5e295d0074ec78902bb7c1767191440176a60367e4deb7ff527284c12b5de22fe84e943967e37a6baafdee798d7dc2b642017
SSDEEP 12288:BiHflzAE1TS7ZhbUqZMS1M7P5JVHM+4EryjEi:BsKQ5nMl
TLSH
T19A75CD18ADBA7D301BD5106B24EC643ECFF16BE29CA907C2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\ko.pak
Size 640KB
SHA256 b8ecd18ce8601686ef64129c77f5307d0c60656d27eede7a23b4f3947647b302
MD5 577ffa9acdca15ad31b1bcb16814d4cc
SHA1 799416720afe209f47355542cbd6ca607a965df8
SHA512 01837e4a84bb4eef059bda5ffab9bc4bb7d3b349bdb3a11d7d01471f1d9afec817a26925255078c62dbe05b51a8aff4a652a93740a1ea8833d3471b7f3f535e3
SSDEEP 12288:47/T8gEgukiPM1WNiPszcbifYj4ZGRy0IeYs1ubLwLCMrI01xWSJGRG1zLhwEtFr:6/g6Im3R5o3uHuI
TLSH
T129D4C5F23CDB63C91193CD82AEF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\lt.pak
Size 694KB
SHA256 6d648211ff3a6801e049c9a3931afaf3007857b2872e55ae11e19849180d19da
MD5 bf8e3fb7d28a72a7064e593c065e2535
SHA1 127eaad62f1298643dc2b2558f24d18a24eb7355
SHA512 930027bacb01d41124167b326df40d61e7119d81046eb289ae5577cf5bc492762bcb80932dcb56e4a8103d63fbde11873b1477af627f159e709c9fcfa84771ba
SSDEEP 12288:zzffIIZg4oMwQSY0PrVKrY4bi5P7MIAAJP6StA:zzffIBM0Bbqi5oItJ4
TLSH
T182E42B0069E3AEFB9A4467C981A4CA78DEFD50009767BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\lv.pak
Size 692KB
SHA256 0c0663909339a1f4edf09355a67eea0fcfe821c78d4891604eee31695ce20b37
MD5 247ff0976e6756e17f3260b19ec59ff8
SHA1 a42f0145d6c7422bab290a7552155aa8b420e515
SHA512 3ec584b9b637a5554a5ee1e182851dd254f28d1767b582b1bcf81b0c4096a0ff74487f3153bebce2126e1de05c813cb0d1b2dac251d6fbf3a71abc486a6fcf8b
SSDEEP 6144:5mjmTu+M7F28kCybaFGkrNStVFxH9KGz8mQWQd5VbONT5rmNnaERchTyGisHcAz2:1R4CCywMd9zpQHINT5UchTyscSx5S
TLSH
T16DE42B959EC68FA94D904DCA733AD132A8CCD740FE07E112DD7D8B3A650F52822B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\ml.pak
Size 1.5MB
SHA256 2bc35d18af85b3c7004a6e1e02591f5db4430a2f334f5c4be3c0a0e04837d9ae
MD5 d2faced6115180461f01ec5b37780721
SHA1 04af518a359396406efe27062de502d72a0efee2
SHA512 cdfe605367e5a2ef4026d1a1805f932397b161c28e37673be06431494bcecf4757aa4677d9ea38659e40a0a4dabf482ac4598eaa430ce8ec59cf26e6525567a4
SSDEEP 24576:7zVM/oZAuuxyYl+9y9XBkx/em7KfyBR+zXcj+v2uiLl3751aaiAD3e:7zJ5g
TLSH
T1F5759D5BA036CD3B0FD102167B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\mr.pak
Size 1.3MB
SHA256 5dee369e9366bfcc4fc95aec6c58b915933efd72c718d56802e35e8af5a880a0
MD5 83769844b688def4c5a1f4ad810cdf03
SHA1 8280d04751f52d62397fa9eb0fd73811cb331344
SHA512 15b1bce67685c1a3e250f89c70a6e47c16cf1d78cc089c86bbc342aa047ec248db71a0ca0cdf00d1147341289b778ae280d0d29932f673bbc65d79736f28079a
SSDEEP 3072:zDvYSVM2ENIGC6dN5t1iIh8roTsElUrX3iWUVse0NF05HwF/yGRR3R5EodxEdY+7:zTfM36iWUPuH0P2Qt4P45tmbAy2
TLSH
T1A855C24DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\ms.pak
Size 595KB
SHA256 5af99080b311e15a19f9988779a1cdd939a7fb9b98bf093fca324eeb58b39602
MD5 ec5e67d9e72519f3a1c7611ef1919a9a
SHA1 eadf0806da3c5020ded53cd0a0a2a16551aa0de5
SHA512 3c5101b115e548134ae8c1b915305b0cbf81b955a63859def2271796353d7a6f3441c01956fa3f6eca855c40febba666b6c11322a9dd6399918bede5fdafcf3f
SSDEEP 6144:l5PzpO9dhf94qE1XJHxze6L/rg42Huqwo9O78AVzZY5b4tVlqL3VDhh:ncjqz1Rx66Q/HuqwoWfY5GlqF
TLSH
T130D4B6469EDE3118085843D9D2DEA91B7CDD3332B705AF2B4DB08FB0126E7A53316B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\nb.pak
Size 572KB
SHA256 11e798ef612a1d22b90450c547998bf0b23ccc4ca5265f27f1924c8b09f22937
MD5 08d67d2d33fbac45ccd9d09f86f16d9a
SHA1 1537998d712de4d4936a00df571d979f56523ff7
SHA512 df267cbcaeba56aefd906005c11fe62ef1d697c2e0213bdce1fc24805cd20e384ea213da0c1255e156fdcab3ea59f4d2b200868a6d02e8ddf9f4c1ed878b95bf
SSDEEP 12288:Qzjx5QXbO2jOp7fI4R36v3qG5wmNBdls7FDu:uxmOes6v3qG5XNB7uA
TLSH
T121C40883EE46B72EF2A443A4F519855B9B7D942CCE98199B54CCC63E0CC7AF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\nl.pak
Size 594KB
SHA256 bf2a7d52d8c061b5f5543e7c4e20b4eac96e65e02a967752af873c3ec30034b2
MD5 628efc38e167f553e6ea4e46fe77c112
SHA1 44734e1804e10bf0a18675432904ce2689293064
SHA512 200ea89e0c466216af6be2d029c057c15b3afd5e48287fc978d551b14116f41712289fff86234e5dc5f7e33260723a5b4ed0a9d48672d0d496bb5f8d8935cd9d
SSDEEP 12288:KqKspUlbJWQusNUSX/gmfex95bt8ysigqHgGfDTF:KqGlbJWQusNUsfex95biysVqHgG7R
TLSH
T155D4F907AC4E653E59C0A349FA098FBBBF2ED22CC26CE67D94DDD5340443F6842AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\pl.pak
Size 663KB
SHA256 7a464e196878d304c7358e7ea457e5d2a17e3065ab02f29b8402803c401d747f
MD5 879a5773cc682f1d557eef24cf02c8d4
SHA1 eda4190bd8831926b8736d5f7d86d1c84228e52a
SHA512 1a2c9d120136eda736fcbc30a03aeee3ff5f23c794bbff63b384299deccb65a378cc6d2f126c625ae29fe968db842a2b39692f112f472baedbac7ba83e11c939
SSDEEP 12288:FvPTW96Z+wKppFwfQfuzSJabZLbEYPPcCUdTe3m4U0hMrma1Qh8j5Ra7FolEqtT:F3Ti6ZopPYfhM91Qhk5bB
TLSH
T192E45C0E5AE58A4E8CB008E6F2E70B7CACDDC808F109D35FE45F4526615B19ECABE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\pt-BR.pak
Size 621KB
SHA256 6cb59658b372d605c4dac61711b56abf5555ed69e7b9ab0916f9185af48e66ec
MD5 51094db887fd87bbc9162d5521e22973
SHA1 36e3c2e2516493c35dbe11ba18548eeb7e2dec99
SHA512 c5c15fdf857144105f2d544f70a454aa9322e4e451c377e184b543d99f20ff5daeadde54694ab1e77385893f9f728cec0402891bd98da86571d73893fa24e98e
SSDEEP 6144:0D/LLEOBh0NBXBLJZPlQcy2Q58ENAhzgesRUJmMs:0DjLEOBmY58EAXsRemv
TLSH
T194D42C2A6ECA136604225350774EDB47E5881745FE0ACA87DCFF4F06A3DDE40DA33AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\pt-PT.pak
Size 625KB
SHA256 b727b377a6ccf25952189c59ef175c213dd1e29e896b6b5fdfacd024c711ac93
MD5 ccd1baf51f76cf4041c5946a3280c5d4
SHA1 98d8c6adab3d8bff3a4339898a8bbf68047d8c8d
SHA512 b6233a3eb262cb16b4cd61302dda8a74b129af80596528289f47e3efabce50fd4e06b8ee6e39dfb3426851f191ee62d79bef2ed97757fb2da02f0284b079e7f9
SSDEEP 6144:kKrHqVBc1X+oYpStieJVJJxhbGDLfbDGfDUh5snsusGMSRTd:klDe+oYbxh5sns6MSRJ
TLSH
T1D1D429286EDA136605135341770ADB03FAC86655F80ACB87C9EF0B4272CDF94D6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\ro.pak
Size 648KB
SHA256 205ea8cc0b368426f06c533b636a2845e66e3f7932aa6a680645e79de15edff3
MD5 06edd53ab148c98097b5970386e2f9ef
SHA1 c1cc65de8cc69e82666f7fecbe510de7a9f8cda6
SHA512 9bc9a8b34bd6be4bbbe959757c23708aa109ca476727686c5cf4de295c596bd96ea4f226b2b93d04fe0f67b9011f14ecbd3648e967fa003b9b1b26e548575aa5
SSDEEP 12288:sVjgzMdy7hjolyvnBf4d2/j5sAZ5Bc2/ff:KgOs5X5y4
TLSH
T1B7E44D23A1C82A972D5152B2B73624D3E88D105DF641E28DA4DEC97D10CDDDBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\ru.pak
Size 1.0MB
SHA256 54f1bc4ffc72547a655d4737d2c7260a71794dda56fbffd13e6e8cc313c5520c
MD5 b000132c3da11a23d9502e879e35244c
SHA1 19d441ddab87bd2ae421b31196ecd2c9c1c158ab
SHA512 b3d43c43701c569060d3f5a942102d07fe7f2c76e7856eb4769f5fccd56aae9907c69e1cedb391cd66fe437ac92105a4e5f3d4d949982a5adb6c8bf72708f57d
SSDEEP 12288:V5ThpwfQeRo4YwispqzJ9sF+oa+UWXv6HzW/oqSv9s2WTBENtgA8Nb6dwYHyO3j7:ffcBW5eohP
TLSH
T1B5358760669E64EE1101F01BDD08BE0D3CEB45FE3FAAA31619642D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\sk.pak
Size 675KB
SHA256 eb91fe27fd087433da4d21dc1c387a816bed0de3e6a140b4597caa90f4921fda
MD5 b4438d51809fe2f1ce9b6dae65644de8
SHA1 43c5adb90d117414c9b21fb122e268c67513ac4e
SHA512 b0c49d7cb43680358ce5692079d27bac6b3e6a21ccd23182252a17775652e9c9b4fee9e2833b28798749f4e9e97b8130e5791f737fdd66cd909b9712adecc462
SSDEEP 12288:oGoBq77+NUAyi5i2Tj5Bnyf9YQ6+8pTjsxt9ia:oY+NKix5cYM/twa
TLSH
T1FEE44D3FDFE7181E8E8D0148EFEA7110FD7E8650864EB4A6944E324714E26EDCAB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\sl.pak
Size 646KB
SHA256 52426fb8fc82d1ed28797ccb62b7fe14f123cddf011f5d5875b076cdb0c33695
MD5 ac0a75c5b39b5d01894e81fd0705b1b5
SHA1 0bb293f904c9450e26f88b47462fabdf75f03d3d
SHA512 4c002d8206040e0d76f4b7c26cdfc75e7a86cae6187d4361f8b20cf071994415bc1e8f613794b3233d631faf9cc9705549b846322430ac3e0be02380eacf404d
SSDEEP 12288:voOLftUNcWtpeWpcB2BLBPHL5lbH80WOq9Myi/fzeDJql/ad:wkftUNleWHPHL5lbH8ji/fzeDj
TLSH
T1E3E41B357AA75E0F0C9AB28FFEB606007FDC044CD252A6A2FC4F336A5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\sr.pak
Size 993KB
SHA256 92dc15bac0e96ede33a7055994f3558605b3147b890ee0414314274216dbaf80
MD5 b1c9028a635ac87124f958cdf762f9e5
SHA1 342a883649a11645c90ba87713619de0ece94002
SHA512 0d5f64e224bd84873bf6d1fe004ec1c79680bb29e6eefcde0aee7460e2417a8555b9b3816ca190039165ee6cf98b1171983ae99ffb08203f95b5fe956c483cc6
SSDEEP 12288:aBNEoTHMyfD0+z3nIAhuSOd8CC0ili4MCkHvj5YEZ/XCnxKnZ37GbuEU/k/D:y+oTs5ucb5JC4o
TLSH
T1CA2556B19B9E64DB0901F41BD808BE493DAF41FE3FAB975211601DBD34E10B847B929E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\sv.pak
Size 577KB
SHA256 51f5cfc915aef54ffa11077d00021c99aac1c86f04076ba70f43608b11486199
MD5 fbc8be5878cf2eb9caa03249a2703960
SHA1 397a3975e8bfe33d4a569d1ec193ca1788f49b83
SHA512 80884b7f345add46c2d3949700cee62be1beb70e19c37cc6e1f37dff16b899dc483205ca487677f3cb7766eb736ecb1fc3d21480f2e66900e8df11268c03d3cf
SSDEEP 6144:iRdRvgh0hKL6Av+iIkQywo+nmHg2NxbINlujnLAVRFcz5RtGm0+SM49mFMuISOG9:UdRvgAO6W+DTj2E/5Mi/38N
TLSH
T123C42D438A10F526FBB2530DB609015F0AEDE15CE7E2958EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\sw.pak
Size 610KB
SHA256 e3bf553f18a0008dc5ac86e001a0ffb190f885260a7bf06feaf34822f0dde36a
MD5 5d8f54655b52c495469c81505bc70cf7
SHA1 1137cfcc672d04e4d042af5e9035807ad1ee4de1
SHA512 77b01a29418ba010d1da495692ca4a388e6ef3da808c337c4696deb49af364ece62b97cfc9ca89cc5375951611f6f0e19375cb9858f15eb152da639afc07b6a7
SSDEEP 12288:x1XijzUy72yxGC2qMrZ5CmedqNGjRdpvC574FqHKLC6y5IZSLQB4GFpP2NUiQlZi:xdinNUGFDi4p5WcQ
TLSH
T165D4D6629871E0191233518603DDFF732BDCED5C292B2D935A46BF0F218F98C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\ta.pak
Size 1.5MB
SHA256 d3849b163ddca28155194a3b68583e115943d087a4d0bdb90ea815eff618cb73
MD5 f940b7b57fa0f5bc1c10c646318970bd
SHA1 d2c84040cbe3b317a2f237d05db14a31fd1be347
SHA512 fd1f8762582e0dd34b0791b38f5220eee384a8c11acd97b37194563ba8e1dd96e844d13c2e963fafb7f999f3ab6698303baead64e789780097a88856987c38eb
SSDEEP 6144:XUBBTJI5LocB5aAkuWdGP5f55q3tR9Ptm1vYpiMyO:wTq5Ll4FdGR55qBtm1vYpiMyO
TLSH
T1CD750CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\te.pak
Size 1.4MB
SHA256 4038e8dda796e26e5101da4af24a2a9c212637fec1e7633458b821d38023751b
MD5 09af4a60f243cb0211a69c142ef858a6
SHA1 3a6e821cb8ce2362a093d983ff51b41f01cbec81
SHA512 408bcd2cf86965f1fe6d71d2bcfc2231fff02259b5ff755903232503600466e32f04370d43dce55cea6c2b732ff92f9a5b9089099322f67efa475dc81c82a3cf
SSDEEP 12288:EGJlztoiUy7McKNxywG6USF602ygIC8ymoRRT5bbiu52C6WuB6SI3p1FG1Y5/C/K:EG7aRt/5SRcO9
TLSH
T1E66592023A6AD310DAE70273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\th.pak
Size 1.2MB
SHA256 e4e627969668d8672cc5212b9b3a1f3c42fe0c5d90d15ee893ff0bce8cf7c2c3
MD5 2f2e7773c921c55378207f4262daf575
SHA1 e919488f38f46afeba97d0759c00c66bacc728a1
SHA512 347bf1308e9ec5fe18f9e0e1f30c0c56f1b629db99be3ec4ddd8d03c4b9f6e09b6938cb93ad385fe194441e4540c190e367eaa7785917a068e9bf4fb7524b176
SSDEEP 12288:SY6dz/wyzx9N9LyZYAozYLz8AsShukJUseTPsO5eXffpbDFDS6Sd2N+Qj4o1qsl7:54Iyzxg15Csj
TLSH
T190453BB37247DDD479441B5B262A7789672DAE693F73F8E00089215A73F071A8432EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\tr.pak
Size 621KB
SHA256 eafa2065b5dc4a3c95e5f0207fc31dc54f63aee65a8fe79925ac62a15161ee68
MD5 c7c5739fde8a8e6a74fc67fe10cc92cf
SHA1 9be5a3f6aead9c0a7d5fe6d688eece2d1db53a1b
SHA512 2bb59e05dc1499e326533b3521c5345b50c404efa512043ce4f908909242ccb8cdfaa5e12218ef9769bb3199b7a01ea7d4b364cb6608072f74415b5d82bfff88
SSDEEP 12288:yR597aXhXBQTw5Hz6sgwpIfZFR9G4pKkf5Mo4c:yJ7xcgKkf5F4c
TLSH
T167D4EA8178EF682C8BB9278FD6E90666F89F0766B331F4469B168636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\uk.pak
Size 1.1MB
SHA256 4b65c4e32609f29eebe8fefa25b0fa861c05cfb51131d5ba64e1878666a0bd24
MD5 1b697e603f9828c5ad13e36afa829341
SHA1 f4653e5619ac52b79da8b6576ed4febff8f92ef5
SHA512 434e17983b7502743c2210bddf1679541c8bba9c0f5b715d8b77cc919cc8d46395449054a0b407e024e30fb661acc00d1f8aa6f90bd141e1c87328204d8ccaed
SSDEEP 12288:phbqFH3ijmrV7GjIwkkzVWxjvC6sSr+fQn1u6ChdiBEIKT3/5iNvcA6Qwe860Yuo:p4ZSyrkim5K8E
TLSH
T1DF35A9A19A9D54EF0105F05BE94C7A0D7DA701FE7FA7871625A43DBF28F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\ur.pak
Size 933KB
SHA256 c0d81e0446bae6d62b496f5268222ad53fe5e6f7325c19bdb7685974967beb3b
MD5 38e2b44e1d59e3275cafac4225896dab
SHA1 18c75e680d79c648434ddd19dd22a55fd49530ad
SHA512 a5a4dcf0c24538bfec537cdccb993032bb5947e3c7c37793f7a6204df77513bb8ec6bade6e832a6248c1e670c513a8dbed2a9e2f30fcc7d60f034500dfd94dd2
SSDEEP 12288:9uidSKoWw8Pl1eqtdQarI7yRbTpt5gnpEhjGMOd+DyQYrsKYjwadcJKwUduqco/r:9QI/5xGtu
TLSH
T1BA15F0D2E6B896B34A21D92780D33C34CB735F13D34AF285E56246C54E9A0139F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\vi.pak
Size 737KB
SHA256 3db088338da5890b390d6bdc047bd038ef2b2f3d982c74f546784895dd0d9b18
MD5 7772d478e416ee84286e591f5ff60c18
SHA1 1294bda5e37a7e02ee16a0ebe5937af99a5ecb50
SHA512 be88f4200d81916d18880160087a0c360c213fd4cd1356a691d00a525399422782e14fa39207d9c3ad75ed3e6979c6cea87342483b7ae329ca675a860b3a06ac
SSDEEP 12288:TQq+cyZ8oE1sVpBhbgN0+QYVN5OFWdjaMg3p5a8iVy7oIN1ZIj6l2eziuR2mfzqK:TQq+cyZVU0DFG2r5a8JFC+l2YiuhfzqK
TLSH
T111F4851216E1302680AC553EC6CE540D6FCAE42FF7C18FE56FF4297476221A46F25BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\zh-CN.pak
Size 529KB
SHA256 e0eb2457c1edb82ab19f484e45d3e029ad0c5b5cc07d68a82faf6bab55f52e52
MD5 0049a699318d1fcba473a12387e12154
SHA1 8f6395bd3c089aef2f69827e66eef04a37f241c1
SHA512 8af8059f8ade9df619068945ac9836a58b700fbbad2cece134cea82a5a250f93c2abd1ebe54390dc01bb1f0de93266661a86da984c325259b766e20f52966dd2
SSDEEP 6144:FJzyWdo7DRSkO1zik9nV7u8UkEZWbn5tXNIXp3IYj2EBxnWuY7lA:FZyWdoX4ziinc8UkEZWL5RNsYYhBUu
TLSH
T1F0B47DE910F9BDEC004650E03729613DBC41760BF66BAF366ED248DD1AA2FAD0757A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\locales\zh-TW.pak
Size 523KB
SHA256 a5847062b32872a9a9b77361aa1a1e7f8734f6547adaa62f312a78baf20ef5c4
MD5 41adb340e5e3f4ce714359af89247e64
SHA1 65279e638f06fb1f8270955ca2d38d1065cf6100
SHA512 ceb4473347ce8e9c0bdf78c450e93f70c89e36abfdc9b4d613e1c1e73ade52d65c2ec226350e49a32fc1d4752752fd09e54fd0a1fd2294fe1a76b074ab0512fc
SSDEEP 6144:6HMV/vahIDnbeaVJVhKM92GuEL7t405YYUoH8DnXmYX2LX5mdT4:9VXaweCh9jL7t405XUoH3BLh
TLSH
T15AB46CB618FBDBEF0901E884B7CD523BBC9B342CDD777632FC4518D42E6AA641A61085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

owutility.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\owutility.dll
Size 2.8MB
SHA256 a97cb2591d9b313e80a6b84dd3be6a530991b31412b9b6848e7be51fb3641479
MD5 a67245f39714984e0dff26b8c81483fa
SHA1 2d1501581e3afe3f6621dad9f9da3437e017607e
SHA512 e6f8d2fed47701af99ba2c6b35e9312444985330f10f0fbb95d6494de222e29ec6d09455cf3b980cc6650b7a9fc54c9c48b8e4274596e55e361c28dde3d31e58
SSDEEP 49152:M3xsLRsfYDodxgEX2sP5z1zbIi1r8jj9IbamVA9/5OMbyB7ugVphXAQkhsGd:MBNYDo/pPB1zbH82baV9hLK7uqkyU
TLSH
T18FD59D5763A551E8C12BC17DC586A94BF7F3BC290B35A3DB41A1932E1F73AE12A39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\resources.pak
Size 6.0MB
SHA256 07b8972c1f02d363a24dd5f10d93dce22d1ac1d557bd02c1e576adab75677cec
MD5 d8cca4ea684bc0fabbf137a778a25c65
SHA1 a703c31ac25acb19e5962edc688276225e0c5cbe
SHA512 54b001d7805d229339c39b7b3b7143c8db8cc127b36d8beda62cdde15ad318e5ef35ea2087653e56ae7e345218c9f2587fa743a29d2edd98449cc571620d3ea5
SSDEEP 196608:eLBR5ltjL+WkrYtJ/eGDi/F7MeZFFfD5CcowhJT:cT5n1krI/7i/BZfD5N1b
TLSH
T1665633E3F760383FC088477A42D087716B3C99492A41A1174AECB165DE6A24F6B85B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\resources\app-update.yml
Size 57B
SHA256 904f76c019d483dcd722543a0eb42cea8247fd648fc1ab3af73e9a634cecfc8d
MD5 72b4fe773901f33bd9bf09de35432280
SHA1 6d3fc89dc1b5c9e84e8cbba6e9b8dc3553baacf3
SHA512 7fe27ecf130020d13300c7dca92d8afa852a05110625bd8e2aec54ccd949846304b37baeed20a7afabbde0fba5b9c2ac97add2d6954dad22f28d62c54d7abaa3
TLSH
T1779002544614D16044760A7934442E395098709191860625D5DA141981178414D5909C
MD5 SHA1 SHA512 TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\resources\app.asar
Size 15.7MB
SHA256 96387113b91b5be5b258133618294a9438a36a0937a5cfc86318760d6582ff66
MD5 fb7e57394163c465c5c574a392d22fb6
SHA1 f277e7334b62a7228fc2ae09f30404ee1dcd6379
SHA512 e6f893596c9d9efd5a226869cefc5a33b401d1d36f78434c4534c02080648170784a68ac3367b7d9ec0e67d81dd6c732167e595cc76fb88984305ad15ec8c61c
SSDEEP 196608:Oq7vhPNo6X0ytF79JfnFPacOVr3drCYZ7+7+7REg:OivhPNE4F79FFPROV7Th+7+7REg
TLSH
T1D3F6BFA5F2746CB3979B1176946B1006B239415B99081C68B36CE88C1FCD8CEA1F7F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

minecraft-custom-profile.webp

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\resources\app.asar.unpacked\assets\images\placeholders\minecraft-custom-profile.webp
Size 17KB
SHA256 c037bf7dcadb47e4259cd5fe4fc05736478e68cbcfb238c8b3628e4914f8d95c
MD5 8e0575582d207373b190744fe6e87345
SHA1 ef98d19c13364b79e50938e00d44c1e9d7e31b22
SHA512 d0d85f11ec94b56a4a7216f9f98faee5d54ca37933d7272dfe6ab6ff51fc71088f18865b6618b7add41e1418b37850d894e1fa57b7101e1b60f1932b47f4a1bc
SSDEEP 384:VadH90N0euX4ZN+UAZb8+Um1S+I3RPV8f7fhG1GWwsGHN:4bnXKNahLUmY+IVA7UwWAN
TLSH
T19182E19DB06DD3C11611B1A930F31036F7E583501C2F369A3DF7BA64CA906789112EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vanilla-modpack.webp

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\resources\app.asar.unpacked\assets\images\placeholders\vanilla-modpack.webp
Size 22KB
SHA256 0d947990927b78487b4af0ed9d6742264cd1af640761cbaf45d85278f720876c
MD5 c81db4c5b4bbafef440a8e40a611c856
SHA1 b15dfafd2a9796371c048da02b130fc11939db50
SHA512 fd22430febcf32ccc920e9a2998df3ac438f325a232f2c7c52d1522187a812b90fa12f78e5e42f3940e6d0c2d8d01840d9366c309b6d6b419e8cb42fc05f0a23
SSDEEP 384:6FUkwMZ/E7mOtR91cmP/q+3Lp7Yew3mXZ/uyHdRxDd31WofMN/8mb3wP9/:6z1E7m0T1c2Nbp7Ye7Jf9dlWofq8k3wp
TLSH
T1EBB2D1EFC87AD9405DBAA6E49134033A00FBA20BF5057E30FB9CA9DCD65FF140896499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Curse.Agent.Host.exe

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\resources\app.asar.unpacked\plugins\curse\win\Curse.Agent.Host.exe
Size 29.3MB
SHA256 69f29ab6880aeb8546e5b5f8ef511f669c28de684eeb44aacf0a9db1e082e1bf
MD5 4ed5c4141f3554487b11855729828322
SHA1 a9c44e9cc2279dd4631440c702df1cdd04833f18
SHA512 76afc1ca4de286907d642f20ce306c776723eda1eca61e1dfe3a75c4a8934e31d7e9e4bdf05da5b4d99fabe9bb8cc67f3ffe249aca0f66af56d180c91fe9299c
SSDEEP 196608:rALyoxy9t59CMfkn6urTxyGvyFHJYMWBpBBhzm8utkSSVyeoHK3/+u6eohxizai4:MLP+fuJrTB8HJYMWTra8t6eo64
TLSH
T103679D11B3EC466AE5AF8334D4724516C7B2F8066762E7CF2558A5E92F23BC08E35363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e_sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\resources\app.asar.unpacked\plugins\curse\win\e_sqlite3.dll
Size 1.7MB
SHA256 3f42322d1af298504dfc0b7cbdadac3562b13ebfb471ab6752a0bfce805ce4c5
MD5 e8640c3fce819c14f191a534f82847fd
SHA1 6036f5dc77483d9846d2b8fac5e061b3c385f2be
SHA512 970e8ee4586f39705a4ef04412ff444ac4ddcbc22d4af866a03ccc90f7220a35455d78e68b132dbb1185b1e6c6196024ac5d4c7cd737ea2fa39f29df4cd6308a
SSDEEP 24576:TOduSG8dN8tpBWQCCA5hF2pQwtqjnU43qCtWuj60dshJEZwLB8vOCmFZ3JO:TOpG8dN8BCTcpQiOUn0WCshTLyo+
TLSH
T105857D4BA2B900ACD86782B8C917570BE7F1B4052764ABDB1590C6652F23FF61F7A334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libsharpyuv.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\resources\app.asar.unpacked\plugins\curse\win\libsharpyuv.dll
Size 38KB
SHA256 3ceeaeefc6848f16e975592db9429f889bb58b5d6f0119ece75f497eb55bf227
MD5 ad62d9903e22298d33f0dbe22e0a1728
SHA1 22856228c55eb13c3f20eb560cefa6a23f1a4e8a
SHA512 9c5030b8fe2004bc95d22b4aa84abf425cdf92577e3a1d9ae9acf243bcec0e1df03fce0bd1e6d7d1cd72f448d9e3aa94b9b13dc26bfbb6f79669be9d1a565188
SSDEEP 384:1iTRU14NPHTWzGAaYwxCrRDdXvyrmJw/ZEPLxtOyUldxoCaWWVXBBGNyEIYi2mLG:1iTmKgGATTROQ4ILxd8dO3LYiDLk5zV
TLSH
T1E8038E83E7C94984E0A3853090B5262BF5707D190B11E3EB93D0D3292FB67D5BA77396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwebp.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\resources\app.asar.unpacked\plugins\curse\win\libwebp.dll
Size 493KB
SHA256 b94ea36a2b4a9278817a990791604ee99378dfd967d43de5a20674b44d24c7c8
MD5 58f46405c893f5eab1ff559963cd9fe2
SHA1 2ae26d7cde09a9f7f3128498c39a2e08733734dc
SHA512 704dfc5d66efcf6061416d2e38ae1023246e7517345a6782768a140aac86f53880c719ad9a07e47de9b748910d3227a45525ee58cfbffea1cef166b7b4b7502e
SSDEEP 6144:yEDId+sCUu+yFjQm2c/ngKwfWRmbnfHLM4icSBGLrLrLrLiiEMjjL+V0Jdp/Gfr8:yEDs+QunpwrfrFicrLrLrLrLiyjQgF
TLSH
T164B44B4ED85636D8E56B90B8DABD960BF6643C5C438095EB03D4F9392A33BC4573BB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwebpdecoder.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\resources\app.asar.unpacked\plugins\curse\win\libwebpdecoder.dll
Size 258KB
SHA256 7d07803553ec64ae95266e1fb44228ac1a574a26ae72ef5b4657107083e5cb15
MD5 ea17d7c28c02144c36709c1216916b15
SHA1 6b37ef8a9dca56cb9ec8adb6bf218893c671ce16
SHA512 ae20e5f08c43a073b0cccae75a55f4087a454b540dce0a4c982ec728a62983cd868fa5395a19b4a3266cc9365694c23808961643f825fb9a67061e0cfb9a0475
SSDEEP 3072:i/oEVKgo3TTz1n6qOAfaBJlf+tJcepnHEpIV8JDX2DXuN1TvrPL/NNu/376x+L:30o3TTzl6HJlfyKJN1Tjj/ru/376E
TLSH
T197443C4D98563D88E85B94B8DDBC930AB2643C1C8785D1EB13D5FD3A6A33EC45636F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwebpdemux.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\resources\app.asar.unpacked\plugins\curse\win\libwebpdemux.dll
Size 30KB
SHA256 a7b9b3c2084b91bcce51532a4b96c8dfc015e91517f4c001bdfe99219a9f9314
MD5 ec48f9bd6659a1646e295a6e4460e5fe
SHA1 ae28ceff91debdf75d2f0543215e7b8e164c4ac4
SHA512 f6b13914705aa9dcabc1a7238a48b1b5e19b6e21a58b4d83a59ae27eb437a44dfec38df1dc9dcc88e8768551ac6b7f3bf1ef8cd8aaf0445444e3c268d7c8618b
SSDEEP 384:kFJN+8dDoqWnr6+naFfdbPO2Wvc/D4NUnBhEnW9cb04QNyEIYi2mL4/y8RiBgLdQ:KlDir6+a5dlWvGENUnBoWGdFYiDLk5eV
TLSH
T147D28DE3DF942804E527A474E492DA1BE6B5B5006B6143DF3740CA2D1F637C22A3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

owver64.exe

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\resources\app.asar.unpacked\plugins\curse\win\owver64.exe
Size 610KB
SHA256 119e74898cc6ebf361ee300b76d668e7f8c6100f24c3a84f3b8d92a7835804d0
MD5 d5cb92f80e88a189ea7de6f2863e7825
SHA1 7e4fc6ed664b4c386d213e5e00149b2a6e91550c
SHA512 3943641b1c900aaf0826af9009ef96e856f451d6af2018b698e302ac460f453e23447c62e6e0f2163186c55f88f3762c97eee6437d2ebb6203ab7671244cc849
SSDEEP 12288:qmKt6DsU6ngc3kY+KC5gzwGKZ4cuQW8XQAL019bqoFARwpg:qR8Y+sxYWkX019bqgWwpg
TLSH
T1EED46C17E35511FDD06AD17D8B469922F6B178060B35AAEF039053272F2BAE45F3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\resources\elevate.exe
Size 115KB
SHA256 312fb92b27cd4e039767dbe2715e987cfab94ab06b56850149c3eb0bb0fe357c
MD5 152aec222ca41733e3ced8c297482c0b
SHA1 1a047dc5d92bc923ca1a3971872b484f6ab29a25
SHA512 7955c6cf9a7e963cb398c86bf94b587abb7f45928374b6ef2c98426d3e3120dbc0336a3f9f17c3c15c474943e4641763e3969d845f2fa3de34986c5c0dc8026a
SSDEEP 3072:LqbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlVz:GPrwRhte1XsE1l9
TLSH
T109B37C1274C08471E9732A3559B4D9718E6DFD710E759FEB2398027A4F602C09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\snapshot_blob.bin
Size 394KB
SHA256 eb484904e06c217beaafd2cd6847eb909225a5f0a4bf814cb1ec22653e6bd2e3
MD5 2475efe9ad373a9ffd0da6ff9853a9c9
SHA1 c63fdceef60f3409013df2af2802e681c71d982e
SHA512 9a5fc21e93df7df65ed051eed9c522b42dc5e11b58f5b370b7d699d4be1de8709e8a066e5ec6bfcafa2ebe069981bc5c3a1fb41b5874cce6c80c216600de98df
SSDEEP 3072:XU6QtROt+xeRvISYOoxs+Yi9qSkvpqE+IE3qfJjtN:X7t+OcTCvpDjz
TLSH
T13584A909B349CF36CE083A756CE887896526B18D6D96F31B7519772F38B35740E32A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\v8_context_snapshot.bin
Size 758KB
SHA256 1fa1cdd08423809344fe15fac2d9d1ec604cc3ea5af4b944d89a51b1e98c8665
MD5 00f69a4fa2169454a5601261a9c7245f
SHA1 b6d3d33b615fe050b7b2d009695a2a6e4e7c12a6
SHA512 abe8e379e1842d00c71a7c9cae3bd4d3a1d6ab4679f8c6d850dfee3f91affa23cbb4e0b35c035bf2832adb5f0cf5a8fe4fb21a7a377babf190fd6f11ce67e4c8
SSDEEP 6144:tU0ckYOkGt+OcqCvpWoNyuZaVaBgJjdOSkvh8mQu/INZV/peyWBOI:y1RNvMoNyerT8mQuANZhcOI
TLSH
T10EF48565F74ECF2ACA4537B86DE547463835B04A6F8BD21BB518233E38B65B00E3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\vk_swiftshader.dll
Size 5.4MB
SHA256 a0b76d530203f153e28c25966662c4c668d03fcbb79e73c9854cdb85f93d8b5d
MD5 c6a5e1bc8c599290587afc7709f1169f
SHA1 5cd85310e6eed5f8c25b1bf77a1c5311ca239925
SHA512 4a7874fabb01a9f89893913ef9bbbff209be3e12cb83b75108aef20cd5dbbf175ed2fa4e6ff301176d8d6d56a4f5b4ab50265dff1a8d88e9199a4d86cc6b3dfe
SSDEEP 49152:Cf8J6ogB5C2csJiy2fY+sY2IKZ/s+OUvKW8yhj5PGhekCciy43Jvlj38HxiL2cWB:u8U5C2csJijqwuHEr17D8cR08R
TLSH
T14C462703F28681D9F06DE679875BA623F631F8844B2276DF16A01F192E67FE06739710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\7z-out\vulkan-1.dll
Size 932KB
SHA256 49b12904e0583e5f396d84f9dc217ca9551a86dbe91859eb278ebce5460fa1f1
MD5 ae7e3331dd55790f934b7fef97a020f0
SHA1 f7f8dbfb47006939b7cece405fa67ede2171b61c
SHA512 de0a111f3b8b788c20fac0da849f42afaa22371f0fb8bd22be2b3ac591c35a6eecc25e2f4b7a4e0ff1da0f06c4bdd1da4214fa8fbb0a4e533f06c8b0ec5473a4
SSDEEP 24576:tGVzDeAVM7N/L0H6tDVj3sF6Z5WGc4DYsHQDy6g3P0zAk79oOHAFO:tGlDeAq7N/L0H6FVLsF6Z5WGc4DYsHQX
TLSH
T114156D23969485A9D47AD034D9D28707C9B174822316B9CF02A81708BF6FFF47B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiD2E3.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommandLine.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\CommandLine.dll
Size 60KB
SHA256 569307401b949368527b128155b4e16b349803ec7d65c1052cc23c7b7a1336d8
MD5 210472e9e333d3329072c9ea3ef06326
SHA1 298c5473a79ab2c34d1ef05a75cbdd04905c822a
SHA512 c0f41486e8e7a8178322bd1fcd37fe645e4a23041e0aa84d3571b8031e2d1881029aeac1b4a554aa2f6a4f1b57d23a063872fcc72a04984fbaec2bfd12fd4b01
SSDEEP 1536:/Zj9JT17qpL/6ePMqBNzrstoJSkrjbgbwziM3hwW:/x9JT17WPMqBNWAkbwzibW
TLSH
T1C953292193EC472BD6FF0BB9B47462610BB5FF86B523E36E8D49A09A1853F4144613B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\Microsoft.Web.WebView2.Core.dll
Size 557KB
SHA256 11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
MD5 b037ca44fd19b8eedb6d5b9de3e48469
SHA1 1f328389c62cf673b3de97e1869c139d2543494e
SHA512 fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b
SSDEEP 12288:6CxswUBor35JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIE:6Cbmv
TLSH
T15BC4402123FD8A1AE6F63BB5A57407709BFAFC967979D39D0598251C0D72B408AE0333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.WinForms.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\Microsoft.Web.WebView2.WinForms.dll
Size 37KB
SHA256 e4f695b72f99024e3ee5d5f26a367e664f4e120bd5d90aa87a8bc0509c365ec8
MD5 c7000faa6c6040188c8cd8ef28b6deda
SHA1 07a23c50092e5c1fd9c9df87e26b65df25d37b24
SHA512 eaee01031477454823974546055965df8d75c5115b25ab07b15ca608a20e8c21154ebb8c707a74213ebad04c2bf34a5f5563306e6da502235372c60672144022
SSDEEP 768:sijOv/1uokD/iyUdcIJtYZDgcEST3p4Jjrjh2jJFSUyauTv1JKia5/Zi/WGQK4uC:jOvZyUjJtYZDgcEST3p4JjrjaJFSUyaf
TLSH
T170036C0083AC8527E6EFAF78B5B481610A7A7E837A61D75D1C85F0EA0DB37E05914377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\Newtonsoft.Json.dll
Size 692KB
SHA256 7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13
MD5 98cbb64f074dc600b23a2ee1a0f46448
SHA1 c5e5ec666eeb51ec15d69d27685fe50148893e34
SHA512 eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147
SSDEEP 12288:p9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3SH:p8m657w6ZBLmkitKqBCjC0PDgM5CH
TLSH
T1CEE44A0623F88F66D1AF2735B8305A1997F6F407A2B6EBCF6904D5B81D677608E00367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OWinstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe
Size 336KB
SHA256 c2e8e0a138ea4a2208c68a7ef5f2a6ddfe64a382df3a1b35adf821ddef733e90
MD5 c454ce8c2af5133007f63a5aa415ef17
SHA1 dff6fffa4004fe7ac1d7eaa70ffb00e43c7b7eae
SHA512 2a4afdccc0b6b3921aad5063cb9e7fb71f67ae7cb70c3fa38b654e5a1995b71ff3432cfe1edc91886a9a6b95ce97b66aa5eee753c4253464d3b05911a9bd4f74
SSDEEP 6144:LiXZ70YOCPQGLgNesAkAZNNldoMuK4oTzk9boAeoSYm9qXb5PBEcTX0dbq2CZUpe:LKZ7zTLgNehNmMuK4ovMeoS6Xb5PBEcg
TLSH
T1DA746A4527FA4628F5BF0B79BA7649218BB6BE836877E78D4D8068CD1933710C890773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 56cd8e7fdc57b4f9c388892625eab3642ba9d40844fac2c2adb7326441cf915c
MD5 b7b41b78cfe9f0289558b64bffbab9e2
SHA1 0d9151f1f2fdf7297d0d3c2f68786e575d34dec8
SHA512 1461cafd4b45f3ab8a9ebde0f9dfea7a1965105a7c6bcfc52172b5552a756b68e6f555401efbf64af48640d7167edbbd8785995fc7bc2cc4021fe76e224fea23
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0792f81cc7d48d524d50b8c975cc6ac6f41c84b5c016f8967539127a388e2a0e
MD5 bd8bf33a4470f93d35b4c30b7549d837
SHA1 ff21166c4dcc80d83b1c8b352e842365468315c1
SHA512 7f0da721b6a373cc5fdc96901e38eb0f7c4f340642132fb34b4eb62f38ceaf0c6d99d875b33cf71716f22f5c4e8d96b734f83183a0c6f254a8e3918649227af1
TLSH
T1C8D0243373014734D010303304037F4D0400C11FC1454440F47CD57D5F071701D03441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 0141db97a80c0e7f7d36f29458d4f677c8c26dbaf1b29918484af442c5aff181
MD5 ad62eca78162c5c44d86b7d951876c6e
SHA1 8c9b9f1f11c93d4d6488203abe8c70719e0cf185
SHA512 7f312060b65886704d7a0cdcbdea94a77ca9b30099169791f6e54b8db2b6db6e5a6c1af3777539af1bdbed6a8d931aca19f0cae9ca44362f60d8f82a900ce29f
TLSH
T1F7B0123000950306C6405738189985467B13CB00050203C3E09021258D119C11553214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ae8db.TMP

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5ae8db.TMP
Size 48B
SHA256 761e41d4e8dac4896bfadebda930b7d32d8e81a9a7d6e7ebeb0d051533ce37e1
MD5 a01454e80ab1e276d44d372ae2e69093
SHA1 45ca9f3254a4ca6864a03347fe0c0e71e514c1c6
SHA512 5026017cdfa7906839eee6f2f305c4c47bcbd3e79138a135bb0b902d3c96e3845dfce98cea1bf630b7acf154747f676fe5ab6b65c5a525f7e397b15eacb88ed3
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 995B
SHA256 00913c6a8c79d1302a2cfa4951c4876c493a938bc3c72982ad6ecc0e1c79f388
MD5 e20d5cd19786dcbc0c378b7f11622656
SHA1 52ff16ab7bec2a93238ba777a19923918f278ed6
SHA512 77c0a714fb3c29947b15c59974b62c34026cdc0a1f0493ccef43597e90efcc277db9d1d5c10fadc30ac92b4407f491ab39120fe8eec0161d36985611f0bfa8c9
TLSH
T13C119BBA83E447BE894502F51A366927CD1D4417532C3CA69DF4AF9F63F15B0E20128F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b55ec.TMP

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5b55ec.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 ae83f00d4bffd2a7e0feda80cc2c9e8a100701510fbdd795d76b2c95e85e855c
MD5 4f27cf35e4c764e1041a994572de61d1
SHA1 a463640aec906ea147309d0c66ff1bedd65174e4
SHA512 909f47509be6fd9b710b787e010e70f320d1c9ebda20c06f4e86c67ae8818518bdfe90a5fdd764b35920fb66f5cb0bf90c18a69ff51969e5692746bd901df92e
SSDEEP 96:st1Nq05BYWFIsb9R4njffLEZ8i0vhEAEkm1+m/7qx+WVHMSm+uecaY1YQjuK+gbb:st+0nKfIZ8patB/S+Wi8YOWj1MC
TLSH
T199D1A7025F6879774CCBF619BA35BB12E2FA102265D50E98EBFC861C09E76CD530790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 b4ef0e39e55fb0f6ebf99bea7e0b90be85baa2baca2653c3a6b5a5e28ccbe383
MD5 82e6f61a47e11de4cd7e20f4aba4576d
SHA1 b7a8fa498152d5682430d1928358f046524ffdf6
SHA512 9443859e12b7bfb6287e8a0eaa9927ae686606e6489b6b78509e99d87fdfa2dcbafcd2e7a1adc5cc56c1d17b3da0da3a34dea1fffe7c20e7a6fab8ba1ff0e56f
SSDEEP 96:st1Nq05BYWFIsb9R4njffqREZ8i0vhEAEkm1+m/7qx+WVHMSm+uecaY1YQjuK+gj:st+0nKf1Z8patB/S+Wi8YOWFNKC
TLSH
T180E1BA029E6869774CCBF6197A35BB12E2FA102265D40E98EBFC861C09E76CD530790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5b0b86.TMP

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Preferences~RFe5b0b86.TMP
Size 6KB
SHA256 34ee99ce1a9d12940d4ae5e084e11bf8d635eba101b19c88b2a9eae7b7231d39
MD5 b66045d733fa93ef05666872ddb1aee8
SHA1 c92ff0bea5c3feedde84aa89d89dabe483c69b9b
SHA512 63176b0240e3f73263262d0d101583b08c225e98b7ca26a2780e07aaa8663d789e855155bba5685370c231ee1331f32d0323b896a4b9b53c0183b7162740f9b9
SSDEEP 96:st1Nq05BYWFIsb94jffLEZ8i0vhEAEkm1+m/7qx+WVHMSm+uecaY1YQjuK+gQ5fT:st+0nYfIZ8patB/S+Wi8YOWc1M8
TLSH
T16FD198025F6879774CCBE61ABA35BB12D2FA202265D50D98EBFC851C09E76DC5307A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 5109f1f6ab06f1269c1fa971b40ab4bc6d42b3873d9727c46d9f7abab1380d72
MD5 acdea103ac24edc753ee25e3f482b204
SHA1 15aafebf7ec833b5a522bfd791532b9abc0fe056
SHA512 a5955bb26ef1287dddf7e76cef656ee9850b2255fd4a4e6af22f18f10b673e773ae0ccdbae5b0b007ba757c6880ffaae3c378198007ec80f934b8d15e5410e95
TLSH
T1EC3185B3E4D47F326ECA6A81B106AF473D61019A81518F5864DE8F2C12E72DCD227D32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 2f494c80ca3a8895a07df5cd39e49288dcc7f6b544ae08653864ad6480df4386
MD5 07aeb021d3a81f4d698b02ef82918cd5
SHA1 088bf75be76fcc3f0e9e9d02d15a2a54d1240600
SHA512 279cf88df401611dc276d36138e8e368162e085c87d01cd0a512968b9c809787125e3edb776729bdfb2b39026b92042e703ed33440b5c34cc3d7fca7d7d13f97
TLSH
T18451D773F844BE375EE75A40B90A7F17B97101A995511FA499DD0F1C01E729C6303C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 16df2b210eab1dab4d499b227a51cec1821927f007d29ef860bf371a6618db55
MD5 bac66f20fca504479d33baad1efbef45
SHA1 e8da230744f9e06e5629987eb421e82133271092
SHA512 65674b5c128f20b68a3252a578a87a330e7d61c1bd6daf029f204e37a62a63e70d3ffdf0ad3a859b439c853de6208dcf24c864edd742adce99486641f2158b55
TLSH
T10671B673A8A4F9375EE79A40B8862F06B6A11167D5D13FA8D9ED0F1C02D73D81342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 03da7c320bfa40b778879f7196daa949366d949db2c6bdc5c7795d278ad8f45f
MD5 ac5ed917ee57e3c5db30d60162c696d1
SHA1 16785b57be45372b4c7c6374507b1f8862a58689
SHA512 93456340eafba7e2b1afec3a335de464018e0a8e52657acef24e41fa634264f0908d08be5d981dc6368141e14e50a84860e2a4f2c5ed15d118391ee8335eb24f
SSDEEP 384:zh+aQikB+z/xvxjg/qhEwNbxzsKHi2U8P9zD:A/UxvxjgC+pGi2UkFD
TLSH
T1DF729E2BA5A97E2369F7F9057A4D0B4FDAB548A290C16FB84DED6F0D06D73D80302D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 0648cb3c931ebf53f3d5f86d610b0be1ec9f0183518876d8e79a7cf71a745567
MD5 307acb9eaead5b7c577009f9da6ba0e2
SHA1 c8972299c942a7db1aaf85308939af1a9b56a7ab
SHA512 e6f278be7b93e52028919e7e162b99ecdc562023b66c84e95f46ec050c1bbd533a1ae7459c1891527f0cd2338de8b8dc3275340c5e7c98ddf722d2f08e2c6193
SSDEEP 384:zd+aQikB+z/xvxjg/qhEu3NbYi4KHl2U8P9zD:E/UxvxjgC+uUGl2UkFD
TLSH
T1B8729D2BA5A97E2359F7E90579190B4FDAB548A280C12FB84EFD6F0D06D73D80306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a6c96.TMP

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.WebView2\EBWebView\Local State~RFe5a6c96.TMP
Size 1KB
SHA256 0a9d22f671141bd42aae4ea71c46e9be4c5af36a68639d3bb1784e7083d80f0f
MD5 00fe7d68d9d0037221d4b24bf25a7624
SHA1 9f5fa8ea0a72bc71c409480250b268bc0121f6e8
SHA512 20de8b23a0c8d57e26427d58e5fc13c642e0669f6621c7b14911f7f797d59c0025a8ee13203b69a095e033b1e9390f0a6da0d38605a17bb71b83059125e7ef0e
TLSH
T161218773D4D9BE727EC95941F102BF4B3D91019A81104F1CA4DE4A2C12E71DCC227C72
MD5 SHA1 SHA512 TLSH

Submit Download

OWinstaller.exe.config

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OWinstaller.exe.config
Size 632B
SHA256 272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827
MD5 82d22e4e19e27e306317513b9bfa70ff
SHA1 ff3c7dd06b7fff9c12b1beaf0ca32517710ac161
SHA512 b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9
TLSH
T1F9F0E11048C4FF268F3185A33B774814EF3883B7108C091C705E39AB0B271964317233
MD5 SHA1 SHA512 TLSH

Submit Download

OverWolf.Client.CommonUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\OverWolf.Client.CommonUtils.dll
Size 674KB
SHA256 43a581a5c77695a08682fadfef7e8c2e835948a528b98ca832ef25e8ae329c6d
MD5 1e5240a947fe7bdd6b80f6e61743f5ef
SHA1 fbc9443f12f76a88c6283fffc3614188729f3f50
SHA512 c26cc32d0cb9b5f81196ede4e152720f22cdd9a8548dc4c4bfd69e14a6b5143a8861884f0c5a4b021c0a16faf29c0c5595b55055997dfe368d99e76799646ccf
SSDEEP 6144:tIs/33W831W3kq80Fh0Q+9J3WKuA+KMO/K5eFbPfnoueh/78fbpDdhg10YJs:tIy3U3kqa9yO3louGUbLj
TLSH
T14FE45A1233F8866AE0FF5B35A8B0121147B1F547A662EB4F399C904D1FA27498D61BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpRaven.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\SharpRaven.dll
Size 82KB
SHA256 776c6b0642f7a3f3f3ad3cc6bb5f1d528e90c6029b671d8f82b0320b185b92a7
MD5 271251960bf1d6a491803e15bd562e45
SHA1 1a305315dec8b44b4d80ef8c23452880b7e90380
SHA512 d5fe5c76f2074a05d32785945ee9f088fb4293786968a1c84389233d83e9bf0480d04d5fa9676c70fd0fed47213f434ec0e0cb2e38379f720919d680336aed4c
SSDEEP 1536:aa9qjviI1YjOrfRK9bvyyfpHbnzDwky7PndZ:aEuqI1lRKbvyyB7nly/
TLSH
T13C832B3123988728CF9D6734B078225A63B8625E3B31E6D6DB1C615E6F973C347212B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\System.dll
Size 21KB
SHA256 4dbc79d2b1c7987cc64bb5d014db81bb5108bdd6d8bf3a5f820fac1ded62be33
MD5 51bd16a2ea23ae1e7a92cedc6785c82e
SHA1 a9fbaeb9a695b9f2ba8a3ed8f0d95d2bf6a3d36c
SHA512 66ffc18b2daf6c4cba01aef0e4af2f006a51aa218eab0f21dc66e47eea0389d2b1748ef0e30d2ec9f0123fd7f38ed3aee964dd6bde5779aaee19ebf55369af79
SSDEEP 384:ASUmlw9T7DmnI5+N273FPlIYiPWfPJsaAM+o/8E9VF0NySk/bF:ASYTrINE3cYiPmvAMxkEt/Z
TLSH
T197A28DA246509CB1EC468D7074C8AB3B5B3866476AD0CAD3A3A7C0419F543C77FBC2B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\UserInfo.dll
Size 14KB
SHA256 a27dc3069793535cb64123c27dca8748983d133c8fa5aaddee8cdbc83f16986d
MD5 1dd4ca0f4a94155f8d46ec95a20ada4a
SHA1 5869f0d89e5422c5c4ad411e0a6a8d5b2321ff81
SHA512 f4914edc0357af44ed2855d5807c99c8168b305e6b7904dc865771ad0ee90756038612fe69c67b459c468396d1d39875395b1c8ec69e6da559fb92859204763e
SSDEEP 192:9xvcecVMIYiYF8tO7zhjjWvp9A5K+o/y2sE9jBF0Ny+aiQE7:kruIYiPWhjjWvHAM+o/8E9VF0Nyp6
TLSH
T1C2624BB386A45C15DC0B8E7135C8997B9EB0FB922AD081D7621BC1814B84787BFED2B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\WebView2Loader.dll
Size 161KB
SHA256 465a7ddfb3a0da4c3965daf2ad6ac7548513f42329b58aebc337311c10ea0a6f
MD5 c5f0c46e91f354c58ecec864614157d7
SHA1 cb6f85c0b716b4fc3810deb3eb9053beb07e803c
SHA512 287756078aa08130907bd8601b957e9e006cef9f5c6765df25cfaa64ddd0fff7d92ffa11f10a00a4028687f3220efda8c64008dbcf205bedae5da296e3896e91
SSDEEP 3072:7evoTTlTRTyiuPThTNTKm81SbbMYSPLNsknZiZ2HZ5AaliiT88FEtJ57dXSvlCW:HTlTRTyiuPThTNTKmFQdhsknZiMHfEti
TLSH
T120F36C5B72E4407BE16B8274C9A34A11E77778110B60ABEF03A447791F237D4AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\images\icon.ico
Size 34KB
SHA256 2b0767136e971cbc99daf157675af67cc997852d996ea01d0dc2aa482959aa00
MD5 2d76837971d64e5ad529ddf8b03820b0
SHA1 1ac4cf8f20905f6bb109c4c7e8cdf3b7cafcbb3c
SHA512 50fd1c547da87d26b54432ee8e773d33e7297e6af3e0d02f62b97d0aebaee2d603ea9c69c03d76339649dc61a87ff78ebb0ce5ca8570282a0015a7dd1a40d236
SSDEEP 96:kdR+F577lVzB67GhriqPaV2JgLtwaJbfB8R1b9RpsLZuSgV6slvHq1N:kdRO5xVNxpiKRJgLtw0aeKvHq
TLSH
T10CF2414AEB63A53CCE64417291E2AA25B7B0739B2837DE0E743B2430DC133073EE8595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\index.html
Size 27KB
SHA256 452154a082fd36b9ec8b5230bf4b6708c4715153e78fad120eb25828fa89381b
MD5 14c405b7892f466f89d16bb5b3ec68ca
SHA1 d7ba5ce2b5efd4bedc78c3c78eec5274df5b6898
SHA512 6795fe8c7072adf44ef990a12f9a840421622b2c0836a3590a7905e135d42be922f9db1070e09c1fd2f82f1c5d2ee09b4526e27e2454b04923e84d52afa49b68
SSDEEP 384:23JlhPshoRJ/seq06ItLglbyPasN1vnYogfZZ51Px+mppiq:2OhoX/seq06ItLglbyPa65nxq5xtoq
TLSH
T1D9C2D811DA36102CB237462AB5E2BA4E7024C117E6538A7FFA5C5635CBDB08B1E13BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

block_inputs.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\block_inputs.js
Size 789B
SHA256 f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
MD5 b5b52c92b90f4283a761cb8a40860c75
SHA1 7212e7e566795017e179e7b9c9bf223b0cdb9ec2
SHA512 16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353
TLSH
T14301D2D864D3A87A597DA328536BE748F7391964905A1054F0DC8C64BAF003BC16EDFD
MD5 SHA1 SHA512 TLSH

Submit Download

cmp.bundle.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\libs\cmp.bundle.js
Size 391KB
SHA256 039d5d4e442cc360b6f54923c53cba5432d80727b8d614a3ee99f7c70307bcae
MD5 48ccfc31db67a9e9d6decd5b18df96f3
SHA1 2086877b894bd0ddec2ae80dd853e47fcbdc638d
SHA512 e369682bbba708ea66797024bc2885e85a4e2b4ac6a4005cc648a7a81d8a4b1c3691c5484408bbd847c40ee80d12e72c5d9722950da020b284843c10d05d0963
SSDEEP 3072:iyUYM9z8F+GxPMqbOISP88WEAtvgnnhLCVJkNO7Z6BEFltnxKg8rq0gU:LrF+GxPQWEDLmkNO7Z6BAly
TLSH
T13D842B8D7991B0E617D722F1802F900BF33A6458784CC490B660D8F1ADF96AD927BF6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notifications.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\models\notifications.js
Size 5KB
SHA256 c32495d55eed52f47dc7268eeccb90fb6bdc5686135ed089416c6bb8f703a578
MD5 911451f65b2503d23bc27c6a6aa6af72
SHA1 01d3654b23ef7f5adeb4097bd851e8c100a7b2ab
SHA512 06edaebb0bb2980a7b6d6baa31a9c0894a9bb5f14a91468ffb8f182d98f04bb811df2a4c37f0b56d612603528aa21f390eaa7cf885874ae770a24dce2f9b249c
SSDEEP 96:sOr8u1s9FHYYdfHsW/GZwzpJGf8mui+U8QrGjqTxoOxoYsdfHsW/GZwvpZGNjINU:sGu9GYl3rNQ8K+JQC+N5Rsl3rxeEYIo
TLSH
T1F5C1AB5F90BA00A7057293A819370342FA5753AF49408CAF737C5EB40F311A6B4E5EDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

analytics.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\utils\analytics.js
Size 5KB
SHA256 0a3b80a0263691f71e85ec681be87229e6325a7d173ff430bbf4eb7fa355476c
MD5 52b20797b4568fd9eaa065d676b7a344
SHA1 a14cb0b575f2a7d274a78093d74906351b603dfa
SHA512 f99786edcfc0220f1563617f40441f9b0ff02083be2c1847677b6533f7d1de16911227e349fe41e328800230bc2994b70db3ab79e4acef5fe07631e87aad0c5f
SSDEEP 96:LlYkmHqqVHlnZrJGvt+QP2EZc8kukLQsO2LT+gObNSPgPgzauV:AHqSGV+kC9zNObNSPvzaA
TLSH
T1A9C199292469719068B373B68F5B1518EBB116233144E9223BBE87415FF6D02C693FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

commands.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\utils\commands.js
Size 15KB
SHA256 160ca35f80aeae58f6723c37cdd3e52cbb4ef56e659fbe105a8edab1f0f35ace
MD5 ccfc18e42871f7eb701c54bc1833dcfc
SHA1 7da62247f4383148109c198aee1e26c21484104c
SHA512 f6a08520790106482faf6345ab534210f14e8b5629880f875af8f4210a3d1b7efb24e05dbeed895e2044034a6d535a4b4cc2dae34f5b15e7c4960806c2d0340a
SSDEEP 384:2Ur5Hs8cD+1uUPULQq06WCHp7GvvoWqEWOnvsUmd:2MwGUd
TLSH
T1C872EBAA68A721651933B73DDB9B0215FB33083B11465C147EED46917FF6402C2A6FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\utils\cookies.js
Size 1KB
SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
MD5 6c60e675f8c8c68c0174b644d3a63a2a
SHA1 3635a3fe07ccc4a6f33a986ddb690522d0611abb
SHA512 1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452
TLSH
T17721E0087580D81EC5725739AE286778FD30992611C6D54DB88CA4F02F30C169DBE9FF
MD5 SHA1 SHA512 TLSH

Submit Download

modal-events-delegate.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\utils\modal-events-delegate.js
Size 1KB
SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
MD5 117e4fdbdb0ecf211c8bd909efd337d1
SHA1 9f8684d856b7c95bdffb139217dfd89f41373187
SHA512 f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1
TLSH
T13C31D54D36FD173AE5B7172B5B2F5F8CAB72120B09054A26B2E69A804F354241196CFF
MD5 SHA1 SHA512 TLSH

Submit Download

strings-loader.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\utils\strings-loader.js
Size 5KB
SHA256 9b833f9e058ddb31ada44764449fe030f05e241dcefdef46886a74e30cd04ba5
MD5 8ac781fa72423fc5c4c21a8c4138b709
SHA1 50ad1d7f383d6801c57f916e46c1c17f79222725
SHA512 f78558488968b1151b189545294a0bb97131c0a4d5dc0fa61ef168d999151e0f12af271389aae985d129adacfc6bf610b0191fb912ffdf8e97283829e2802604
SSDEEP 96:FXS/WSBWlbBtDhWFTnTeWsNkEj1I/6Wfwk0lx416moPdXDKP8j8yZrME6:FXSuQwBBh0nTevNkEj1O6WGe0muXDK0W
TLSH
T132B1ED58289354118C32B764CD935264ED6A4917023996F3FDEEC2686FB149E82F8FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utils.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\utils\utils.js
Size 118B
SHA256 b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
MD5 a0952ebeab701c05c75710c33d725e7e
SHA1 1da8a2e889f1213d481ae3cd5571670c01e64adc
SHA512 5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389
TLSH
T1ADB01274B7AC73A2D315377AACBF6C1DF0375C368414B099B19034E19572D04519DCD4
MD5 SHA1 SHA512 TLSH

Submit Download

cri-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\windows\cri\cri-controller.js
Size 5KB
SHA256 8c8c3097f0b587d715e051f55894d73a0fb7b441024f47512fa340eb3f692152
MD5 344b079e423000460dbcc623d3dea42f
SHA1 6f7a6db5cdf0e4c511ae1ec8aa1f08dd9e79190c
SHA512 15358d30f96ba6ec330417896ccd5c837e71b1712357185d7d84e60e8e6c21af52eadc1fcf61f6ce9a79165fab94813370a5ef0b632742043355ae3eb7eb6856
SSDEEP 96:u6CeVFfOhETv5T6ToY/aq4bCWCtoQNxcGyUkeErscwn:u6jVtOyl2EY/aLmWCyQNxaUkrscwn
TLSH
T1BAC1DC9C7CF9866058B7277BCF160518E732420722426A2B7AFE83404FF5E404A16FAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\windows\cri\template.js
Size 1KB
SHA256 016ef6ba4ccb64f2cbdf63357d180f0d3a5f74857633556b311eff57be8d023b
MD5 2f82acef2d339db31fab5c73edf8af19
SHA1 d9138de6fe1320cd232fd6e1971fbbfdb9225bd6
SHA512 90311035970edf2c1d0175c9b718c731fad4f58ad5a0b43a2588e2e6132cc09deff1d49328174408c51fe3082d62612f7a2a6c25179ac474101468ab68c2abcd
TLSH
T188212E24441C90331B7B979BDA13276CE9519301D80B7D3871AE43A82BF3B828E62359
MD5 SHA1 SHA512 TLSH

Submit Download

cris-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\windows\cris\cris-controller.js
Size 9KB
SHA256 13f1bb9718444c1e15dc13cd99862c8ad4cd9f1a607680906309f1ed9a058231
MD5 056d641203097bf638dc846e01712869
SHA1 64f77761e9eab875f8dfa67f3dc5d488aeb9d4f3
SHA512 88e1e2e7d26fee9a37ae9b0c9fea3e61066a9c71f15b8a6e328bec6880f6b9795ec8e85af6055350d2a10d5bb814cdb6cd5c0fc09f29553dfa4b2c6d8f64a3c8
SSDEEP 192:nCoyl2vxrZn2C7s+vK/H0mIvo99hnap0kelwPcGMJ7i9W:9yl2JV2C8/HyqkelGh2Z
TLSH
T116120E1998BE26299A777375CF6A0508FB3042172944EA1A7CEDD3940FB950182B7FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\windows\cris\template.js
Size 480B
SHA256 c6c0799e027b5554e44e1c31262ef62b2879bdf1b862fae56615426f07f471d9
MD5 408961db547931d2427d96035dc7245c
SHA1 8a0330bf52f53cb1e82e36cd67723ebb29d7a6bf
SHA512 08d79c8f54cc9898956df5b4de8360a38d482ad19ce155e84a33843221a0242240c59c49ce0ef980e150fddce716557bee7071a6525ef438fdcde9bdacee95aa
TLSH
T1B5F02E114135CE20373F17BE93631B28F631D0024A82E634D5DB5790333B4E78A96769
MD5 SHA1 SHA512 TLSH

Submit Download

modal-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\windows\modal\modal-controller.js
Size 2KB
SHA256 e3556a5482b5a8c9f9581902d9c91b9293fb664f6da938c700bc78c21fd1506b
MD5 aa727a41b4fbe5c3ceb80c32a5b9c7ef
SHA1 de32c713099c441a9bf60a1fb06d76775b2078e6
SHA512 dacc2df7748a5f859c7debb34503d031d0689fa445898f1f2cf26f909332c5ca1e7bdd5dfc28e110d2f09283ec975960be84cfc4b34630b0fbac1046de6864c6
TLSH
T19451268A241E116585B7677FCF87029AFF73509B4A41421A3FCD8B411FB0850A3DFEA9
MD5 SHA1 SHA512 TLSH

Submit Download

settings-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\windows\settings\settings-controller.js
Size 9KB
SHA256 846b7dfdfac4c748589b33df2ae9a392b49b8010637b49cb880b9e000f0253a6
MD5 701c1f21f9969c50bcdd3211176a174f
SHA1 b213e1179a2a83d911a14677f10a0629170c35dc
SHA512 27d9dd9647fc1d692e8c935fc67f0ec1a6c34578c0b7848345bdb97b3e6458b96b7c72d894e3e3c7e753dfa8be48c7d2355225a0c2bee9b71f567a6e25ba621d
SSDEEP 192:5RFBjugWX8x2zLjiaPX/iXv1ijiJRWzHSQ9whrMk4Vo0MEKAmNN:5RFB6gWX8AiQPiOiJvsmD
TLSH
T1D3121C4EA96440364977577FCB678789FB72049B2402C92A7DECC9882FF08940396EE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\windows\settings\template.js
Size 4KB
SHA256 8014a7c919da249ba2f2196d9c9b62639d20851be426f3ffaef161cbe477c45f
MD5 28513de0830383a516028e4a6e7585a0
SHA1 d31fc3a6f4a3ce6c4afb82ff2342a1ed718809e5
SHA512 0f7321c2ae13145bb694368dae1b74e6fe20e6b09712da2178bc46e6aa65223ab84c38abbf0ed074c85b42dba1a238a5f3f8d1ae060a0af6df748c5befe11b61
SSDEEP 48:Zx8LQmDdbaoFRpm4+0A2AEeQmDdbaoFCpm4+0A2AW:wpm4+5nHym4+5nW
TLSH
T18891086384219412477680DA5B369F1EFB65CF0241E65E34B2FF6BCC978BC8156ABB0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\windows\welcome\template.js
Size 1KB
SHA256 42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb
MD5 17f54fca6723b983875d940d931e0afb
SHA1 01774cd5cea36bd74c80a708d6f77567e8091024
SHA512 401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038
TLSH
T12D31FF0AC55D81361533C3FAE28B5A5C7860AE40C9BDBC3439AF075967ABC00B933B70
MD5 SHA1 SHA512 TLSH

Submit Download

welcome-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\js\windows\welcome\welcome-controller.js
Size 2KB
SHA256 50a9faf985750a344344657dffb6880dbad95d2f0a060d911224f2addc6995a9
MD5 163f58f27116d6fa6f82aa9512259fa5
SHA1 8ae067638d5c3889d12ff18d3725982bbb76dd91
SHA512 a8d14643dce70da2fa5b9d519bdb012a2d1567f857d24c4cdad0bd4b42eec65b04e76a2e876cba0e7a6c433ef316428b2dfea42edcbaae15d874ad38d7eaf6ad
TLSH
T14F41DD9DA9B583742A357B3EDF2A0748FB32922F0A19866D79CC52410F71014425AFF4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\app\manifest.json
Size 691B
SHA256 6fb3383f94e63810149126e2a504a3b35fc9a7fda46f405cb610aa61f8198134
MD5 4cdc836d09caedc9a5740ea954e20db4
SHA1 e715a84365aa15ab6ee3fcf4c764da054e06533f
SHA512 801d6ab2bb2582084f6f19caff75035a87f55a3ca9375a28bac1b2fecc63bf5c19f0eb624ff70ebba8f300fa4c91c885c598efe304c6b3c4eb5029a0771f0968
TLSH
T18D01A419E8946DAB157A761668E50701FB85433F02024E4B37BC504C5FB21592457E74
MD5 SHA1 SHA512 TLSH

Submit Download

log4net.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\log4net.dll
Size 270KB
SHA256 ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309
MD5 f15c8a9e2876568b3910189b2d493706
SHA1 32634db97e7c1705286cb1ac5ce20bc4e0ec17af
SHA512 805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e
SSDEEP 3072:F+8gmdoxSO7ZbQFroo7RVir/dtnK0sgdnogtHcU5qFG1RSGCkE9kKn7GCcaLoWnS:I1N8LLI/PK0scnodG1RS1T93caLQD
TLSH
T15044065477F84A19F2FF6BB8A475411587B6F946B87ED39E0A80A4FC2C33B1089117A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uac.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\uac.dll
Size 24KB
SHA256 10a0e8cf46038ab3b2c3cf5dce407b9a043a631cbde9a5c8bcf0a54b2566c010
MD5 861f7e800bb28f68927e65719869409c
SHA1 a12bfcd2b9950e758ead281a9afbf1895bf10539
SHA512 f2bf24a0da69bbe4b4a0f0b1bfc5af175a66b8bcc4f5cc379ed0b89166fa9ffe1e16206b41fca7260ac7f8b86f8695b76f016bb371d7642aa71e61e29a3976eb
SSDEEP 384:5GVY6ClGoWxXH75T1WVl83lLsFIYiPWc+6AM+o/8E9VF0NyOk:tBWxXH9TYqlAyYiPjAMxkEH
TLSH
T14BB27DE682980E6AEA235D3175D563335FF8B6502DE0C1DF161786448B607D3BB3C27A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5A76.tmp\utils.dll
Size 58KB
SHA256 251ab3e2690562dcfcd510642607f206e6dcf626d06d94b74e1fa8297b1050a0
MD5 c6b46a5fcdccbf3aeff930b1e5b383d4
SHA1 6d5a8e08de862b283610bad2f6ce44936f439821
SHA512 97616475ef425421959489b650810b185488fcb02a1e90406b3014e948e66e5101df583815fd2be26d9c4d293a46b02ba4025426f743e682ed15d228f027f55c
SSDEEP 768:cmLFb5dc9LS+8dayUhaPxYkkLE53UEDNnxqWLb1pA26MbwYiPbAMxkEu:cmLFtd9+O0fkV7xpD6ww7Pbxy
TLSH
T1AD434B1172A0C433D5665A3069E8D6629E7E7C422BF480CB7FA9027E5FB13C16B78367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallerTrace_2026-08-04_00-51_1288.log

Path C:\Users\Admin\AppData\Local\Temp\ow-electron\InstallerTrace_2026-08-04_00-51_1288.log
Size 1KB
SHA256 9816662239a2df86edb73592f2f5791d9424cedefec05a40b9388d3c427a6871
MD5 a866a8e9895f83e37be99ac192fea158
SHA1 8ce713e2fb1eabfcdaa81498652252c526d9a91e
SHA512 e9a114f1fe899c5f6f02f381b21c8137718b16e8edcc44e3ebda7102605f489709e8e56467eece09ff8b81bb4133184f74a25799b26f0315524d660096e6d1d1
TLSH
T19E2103600678F4F1454B054EB3BABD2DD173E483A7297261DAED34D5BF67110C4ACE8A
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerTrace_2026-08-04_00-51_1288.log

Path C:\Users\Admin\AppData\Local\Temp\ow-electron\InstallerTrace_2026-08-04_00-51_1288.log
Size 4KB
SHA256 982a0408ab70d71a42d620283fa386dd64bea853eaaacdce8e901edf9a6457fc
MD5 67f931b0d523cfcdd16d84d4d003d184
SHA1 f5f09a2572aeb534a0153c9cd963b82894249646
SHA512 fe7ae02361625b3e398e1a117c90652767d5f8fa8df3b4d743b55a459842a2184d9acbd04da6741d689d0580a4e4768fb824ac1b6d19fcdf793238b8783b13ba
SSDEEP 96:LDj1j5w0SujB6fiMQ9iHIH0L5wj+Wj+3j+H/Xhj+DszzGj+Dsaj+Dsbj+DoxcGAc:fjB5w0RjBuX5wVME56AlxAc
TLSH
T175811011077874E24D1B420EA1E67A3AC173B487AB58B171EAE9354A3E7B040D4ECF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Roaming\CurseForge\Cache\Cache_Data\f_000002
Size 34KB
SHA256 d44058ed9105e015a3265f7e6cbc4e51eed9fca79aa21970a632e4b70da994af
MD5 44075c6de7b78ea0c5b6b4592ff85dba
SHA1 2a54ed397f6302451521adc492241c9e43b05730
SHA512 aabac140caabc4bc597e2ac9afc81c4f6f48c3ae396a33b2c3e70578165507dcee6cf0a36910588a7e1dffe7dc8b6c1599b9525b2f318107deaa78169d36ef83
SSDEEP 768:rMFBXbQIEHmcc3TgwViHWs+0YejPDQJzozGE9/Hf:mBXbQIYyvZBerDQJMn/
TLSH
T120F2E1A50AEC4BD0196ABE54D0E17AD121B3012E3A213D9F29A7E8F71D72ECBC147974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Roaming\CurseForge\Cache\Cache_Data\f_000008
Size 24KB
SHA256 66ae800a4365d0a553aed555ba7d740667f597f66ab0a65651eb4b15353a6f4c
MD5 7f68813ea43849b1c31854657c943db4
SHA1 aac08ecd453300cca91ae3d384c353e26a2fcb01
SHA512 d000cb7c21edbd425344fd36700ed0c7a2f5775d4e06b3892145900da3b0d45238bb54bba4c6af5bf25203cc084aca4f80d57eed7dd60462fd98968c247f4e5e
SSDEEP 768:LxLxnOR2HsfB4rhC8IN//Rgh0jAR0TxhHeh2CAP:FLxnOTBqhC8KRgh0jARcxh+h2Cg
TLSH
T19CB2E0072DA3798473A84480E05BD2D59DE02CA18901B935B8FAD6874DDB9770D2F9FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Roaming\CurseForge\Cache\Cache_Data\f_00000b
Size 56KB
SHA256 5fa30ab76602e54295862c06f22eecf4bed610025d9f23e5071d0d9e46c25c56
MD5 f1888288affe9a76dd7345efd0291241
SHA1 4117777366ccb91c64a5da244ab383ce10d5d3ee
SHA512 6b1f4734651bcd22807a0a749aff366ced6f2b2e5ba7d4217a0a73768dfbc9303ea39f25d4b15cc95b9ac62531fe5a28b1822275b9dfadedcccda31b4f982558
SSDEEP 1536:YQw5nZ0JyOxugA9Gqk1u2iRC5UkAOBXOwhGI:vw5nuyOxoBkc2iRkA+Owh7
TLSH
T1914302493949F9127E4F9825FF9DA3B27D38B2E0953DD925FC8D60AEB0720410AF41E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Roaming\CurseForge\Cache\Cache_Data\f_000012
Size 103KB
SHA256 6b6acc50f2b48cea67029b2810c255c7be01104e2a9df9cd117190b0bd4de0ee
MD5 baf3d8b26f86033373bf00b3182721b7
SHA1 8506c8490ce1b548b0a9d4d37fc7c689e51024c8
SHA512 86d2d77370e8abba835e3f8e5b69583dae359e07fc1285de508eb2f1319b1e8670594130e25105bb99cfbd667615802f2ec021f10a687c399d014c2c3bf3e886
SSDEEP 1536:yc2JsJH0vr1FmoXbRiVLyc+5qE/weYaj+NEhlKE+FZMmZxnVGwjDAabUAqIIZA:BJHm1Fmoit+NVYw+NEOEWPxnH3FbUzA
TLSH
T1D5A312238651AB868DBFFA58B8F04E7D0456790EC6B4D85F4892577C3D706368388F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Roaming\CurseForge\Cache\Cache_Data\f_000013
Size 23KB
SHA256 8af9915f48211dab44ffc7ff31de198caed78603b3c7fb1db3cd5c45c40ae9e8
MD5 1cb903ed6f535d4cd1b66c098f4a2311
SHA1 89bb18d7ae9e43490d4fee41bcbd99ea572ed651
SHA512 c9620dfcc30a7bac559e81a6c9cab6b29438bb9e7d514a86b93a845e249e99369160692424aa1bbd047eb9f125a4f5936589d31c9ecd39a339a8e9930ebf22f4
SSDEEP 384:6p/djkkaKu1IBC+YLNlpk2VicdhCm3mbgxiKl8g4eyqDGlYo8vOh4nib/eVMnb:0Ii/YxT9VJdhCHgQKl8g4eyqDEf8Znil
TLSH
T15FB2E0FFC3A092B317A3C42EE527354448132AE18761390EC692C6F6B0639246CB2B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Roaming\CurseForge\Cache\Cache_Data\f_000019
Size 36KB
SHA256 b1a71cd4567701b1f531a7abd1c4f7f6449e53cc67e8a8a40453721b5b385a1b
MD5 a521e9d0d96bb5cf4ed22c89db042022
SHA1 432b3abe2ad14881f38a2817e0bcc065e3fe4dd7
SHA512 24dcf1c7b2b19ed084d8c350ab06213c09439d8329c10fee033030abe331977cc96e0dc081131aebed1609a5e60b5be852af343102fa4e68361fc51cbb638470
SSDEEP 768:2G/dyY8vBXYPLXW6yl+JYM3vXOKZnR/QD7LRDWj7AYbMZiThIesA:2yyY8pIDXtfXnRYPLQgYgZiC1A
TLSH
T17CF2F12EF10117698B53A7E24B114E7491B2F60AED784B22DFC578EF38124A1D9CB17B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Roaming\CurseForge\Cache\Cache_Data\f_00001a
Size 150KB
SHA256 661da318691caad72be26ee91cd1e71321cf512e9676ffa8f8f5f3618af8d938
MD5 f54d756435282f34fa94346873601fc6
SHA1 ade35bcbe94d1b4deefcf09b8390b6c1b6d78352
SHA512 b71b88199cd438afd20512f3dd3c14256f0c6b52955eb46897d30cdc6fed07f90c3a7105749df348ae7c7bf8271a0d19946aa8e6e94c4220f142db9a7003f891
SSDEEP 3072:ByItlCRUllgIInSe1zEVFEEP/bNMx0P0pAJ3fxJ/6HnBRx/:BJtluUll0Se6F3e0P0OtAHx/
TLSH
T121E312D49923892897673F7CEC1BCF46D5BA07AE36B843003B70B45535E2E2A04B6676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Roaming\CurseForge\Cache\Cache_Data\f_00001c
Size 276KB
SHA256 b562a865d65d5e062b8579e8d2299b550638aaafc0e1c288dfa256f3fce71c34
MD5 35a87cd9500c4fa050e15f11c47c738f
SHA1 083ae35fa087bfc961253f40684651ee818cea86
SHA512 ce21dc14bd4819bd351190cba848e521639633136d346aabae97685fa753db132a46ccc68f413dce0e5e3ce40f2c8877252f4bf71d4117707a9f14b9d8fc23b3
SSDEEP 6144:KP0AakBvw1WVvxTfcZlQS4b5ts6iLGe9/+4Asg4Ej/o:KP0AZhw1QvNfcZQfw2Al
TLSH
T162542310795F9D81269F1C0624FBA502AFB88613FE26BDB45D793ACC84173202767B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000021

Path C:\Users\Admin\AppData\Roaming\CurseForge\Cache\Cache_Data\f_000021
Size 47KB
SHA256 21a9f97f207361ebd0b10d50ac0ea0de4ed8be8c255919e9e933f61afc8fe709
MD5 8c410b8c9e1bd4c266e004cb4aed37cf
SHA1 36128c0e72ea9b512acfefda71c2bb89fb81d77d
SHA512 bb2b2b75f94aeb646ed222bfc36b64e58126bdbaebc41e5e4062d9a9f2116f3bfa3f7574892c5144b1b55a07a8c7b5241bf82a69c33b3d75df65ba4a5ac79c18
SSDEEP 768:EuxHFyt5rlDgu853rZlBt50KsTafVvrUHq/+WrqdShVRcSb8DEv4cNUzQn1kBnvQ:E7tDd8539tGKG0V4K2AquVRcm4cKBngT
TLSH
T10923F1625AFB2FE4A118423F2A574D7F669CC40873880840EA1F0D59F796EA7EC12869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Roaming\CurseForge\Cache\Cache_Data\f_00002d
Size 83KB
SHA256 2add930849642ecd3440a587d15893f8642c265ef3e2fe88d6e3d3a1ee861052
MD5 ac17e1f0120463a643db7a0577de5c21
SHA1 c81fba0f08b1141dfd556050cbb4ff4d7cf3820e
SHA512 64588a236f77058078aef7592982228c949bf396abe15250836896858fc283f01c8d9046c80ddb19dfade9fdecb1643b9c27f21b35642f5b8b9127b9d3164924
SSDEEP 1536:eLuqE0J3pPsWy7mdaV+25TUubCC7IDecBFT3qKjNSvMO/jf:eLZ36WAuB25qC7qD3q4SvMOrf
TLSH
T17983125C0595F560AC14A444986F54BF01C03399DCDC38B0FBB6BE5DA1EEE8AE6F8368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000033

Path C:\Users\Admin\AppData\Roaming\CurseForge\Cache\Cache_Data\f_000033
Size 192KB
SHA256 53b659f444338500b7c3376aef7d7e667bbeed4bd114de632912b686b230882e
MD5 1af66414e0f958ad4c07a9624ccdbd08
SHA1 95ec626eb35cc2121f1e739723da6eee0ccb7151
SHA512 80ed21e72d6c4e8e3433212b1f1430915b8bb5179c2f5f3cdc446b8642cc9209f6ef8b7a02cacf76692e22024ceba83861c242d35f4d829a107fb5f33a84ae9a
SSDEEP 6144:AntfwbhYnGKuui+iUcNAyfCgowSHg6BDiLv:AtLGKuui+iUcNxfijA6Mv
TLSH
T1B3142304A91339A2F62690095AFA7AF851E4F0F4DCFA4FC4D55EAF476E301EAB53B101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\CurseForge\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 98a49adb34816fff6558255f5f886337d69489594cb50c65ad02f50c4f40f60d
MD5 cad5277015581f03e77144c7396f716e
SHA1 8e3c99dcba08269f3d537c4bbaee730b149b1711
SHA512 611acaea8cf23e3dbf75f4f80dc9ad4919cea3ef72999300dd67e22a4193855ea32937b4fc292e09d9cb36a3b79a94432b0b90c9d1e78e480c51ff3ba4e75228
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\CurseForge\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 9ab3df9acf52c3bb6b15316ded6c4b74cf860188d09b13fe9fa7d396fcb8b7b4
MD5 1c19e7e69d3f6e065aa028656bd7c690
SHA1 c680bf8770da95eeb0ede4d3172680b6f88c4564
SHA512 43a75dd69d0e9fd739039789485c7fb4a0c99733fb74afed5fdb40af97e6e328988f9f2dbeccb4991e8576718cd45404e4865ea53cdf90ca50f769e44eeb02c5
TLSH
T104A0023087F416D6C90163BC154707506316882247514BB740F4909AC8D62D48746020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\CurseForge\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 5e729b38e0fdee0b4a1028521c605c963d87c2b0a447d595378a01a15d853f0b
MD5 8e276e62d4fa6a804f57f8225e0c2df0
SHA1 4026d65094df8902fc1c1a4cadafdb23ef462aed
SHA512 7f90c684f15693d660262a4aaea48d1466e01de547fbe836b1994bcd56feab05aa9e7c9e70f0ac1423e71271837fbdaefc5f0f6c6596142426254e8e539f5400
TLSH
T100B0923008A29703DA021374CE479400B3314C09422156E790901462952F3D0C706000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\CurseForge\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 fffc097df8e7fef4514f17b158411ac233661d125f5e9de571aa58b5ca875149
MD5 5dc8ea56820ab0bf2239b0bd9da6b1fa
SHA1 c2258d38df1975313764db420dca00b22042a502
SHA512 b5c592dd968e1c55e7e06a5fa6a554d05bee3ab8d0a2e37650bec2ca6abefdbf4940ebe05136e5fc822e6e1bc0e5bddcbaacb77b41d53b3d5a17c1596e175562
TLSH
T1A3B0923008E1E712DF022B748E865404B331480A421006A761921462D5AB3D4C71A120
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\CurseForge\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\CurseForge\Network\Network Persistent State
Size 12KB
SHA256 753ec6fc1bcb6fbc4e2433c98e73e8a26a941104d9a926a632ef068ed0f2e5d9
MD5 3f10ae32e2423e8d8b7bcd4b886ff31e
SHA1 be0189980951e0e63a27e4229213f50bd141590f
SHA512 d079cd2a7c6c766e965098c35562867cdc65f53ebbf6975740accbf26ec7e23741a002a8d95c243637f52718ec7b86d4b3732f711502fc0e0938fbc371ce1271
SSDEEP 384:DHTHzHjHsHHeH1HYJHUBeHvJHjH9VHMHMHGHYHzHSHIeHvHEFH42HRHjnHoHTHnn:iuwXLR+1kl3tk/
TLSH
T17E426BEBC7E8163E8922A7F55F253E27C5FE152C635C3C4388C89F4E53A1872964168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\CurseForge\Network\Network Persistent State
Size 23KB
SHA256 006e79a3e538821266605a8a655d8b05ddab56dbd416b6803ab7ff24c5a1ca4f
MD5 50fb270fec4502a4623e2e5553367882
SHA1 d9ab41d1e0fccdf8f7eb2ba32fd5d75cf723f588
SHA512 774678b440b2f9b411a3caf359438f7fb919148829b32da7c8ec437db3c4ccbb77e1c1e3a8ce9f5dfaada2c8a713977d8c8a6669dea00585578928316af8b9dc
SSDEEP 384:DHOHoHPHVVHfHpHLHdHcHCeHCFHoH6HqHyHLHPH+HhHqHZHYHrHFHuHiH5HbHEH5:V7ys0byc889N7RILZ9
TLSH
T1B7B237EB87F40A3E9622A7F55F157E23C5FE152C139C7C4288C49F4E53B2872964268E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\CurseForge\Network\Network Persistent State
Size 27KB
SHA256 55aaf2d83b698ef6a3b3aed12885b6c1a8ff256073850c9b2a569be00fb8faa9
MD5 0def96a122a5a462412382a8e5add649
SHA1 17be0bbcc516ad7af2e35febfb693786f6467d01
SHA512 808f139ee377489a051a521d36c19b41d2895316cf27569fa2267a57944d802f36e600a5c6073fb1e431e6be9301b8f63e61bd3d75582e955af90922bc6d99f2
SSDEEP 384:DHOHoH3JHPHVVHfHpHLHdHcHCeHCFHoHEHhH3H/H7HzHKHdHEHHHWH+HFHlHIHlL:P77QnLyc88fy3Rh0gA
TLSH
T1D2C227EBC7F80A3E8622A6F55F257E23C5FE152C135C7C4288C89F4E57B2472964168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\CurseForge\Network\Network Persistent State
Size 24KB
SHA256 d20ec703059fe6c454fac42e5c69f71fcc1c44cea6e90b156e2ac42e70c74a6e
MD5 65d7c54598618f2bb75745bcff63ce95
SHA1 8fdb167c2229ee94f2c9e1ddc017ece0f9770646
SHA512 85e4a21c9da40f0ba65bdad954e6eda24c192b11046757492db86b7ad88e5549646fd3efe8d52679c1f993adcd59633bbe12860e794a4e80d3d121121f97833a
SSDEEP 384:DHTHzHjHsHHeH1HYJHUBeHvJHjH9VHMHMHGHYHzHSHIeHvHEFH4eHDHEHhH3H/Hd:iuwXLob1UEbBzODzHq
TLSH
T17AB237EBC7F80A3E8622A6F55F253E27C5FE152C535C7C4288C89F4E53B1872964168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\CurseForge\Partitions\__owepm__\Network\Network Persistent State
Size 364B
SHA256 90df597b5068b2db7a9baec81d8c91246ac17aa8456bc0550137f69b52cfc2f3
MD5 145c4a428f2ace4c4870e1457734ca8a
SHA1 90a4beff37ad16aaa693dde47c8bf6044c993d53
SHA512 4ac8e2ebcc443d949ba12c16a35a3498d6385f6d47446657a47566e9949f6d7fcae70fab50cf659e7f4d8bc26df2c77209ac9186fe7fed40babf1f0889efccbd
TLSH
T1E7E0D8E7437429BE0B15D3F11E176D27CEFD1525134C9CA291846A1C87737755408C8F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\CurseForge\Preferences
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\CurseForge\Preferences
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

20260804005255-2D6C.json

Path C:\Users\Admin\AppData\Roaming\CurseForge\agent\logs\CurseClient\20260804005255-2D6C.json
Size 13KB
SHA256 ec3a2ee6dce7072cd66d4062238884bc180093693e74859709baf923a37c4db5
MD5 9c6709d638bb6f5717bde6cddd9438d2
SHA1 f0f5028852dbdefc3c1245f63b4797301ef29cfe
SHA512 916bb745c4a007557e1e8604cd17304967dc8aabc7802b36a93ba22c0fd781784ce8488a431c4052eb75f30f248686a64c03d9bc1f58aef14695c6e30ee5f58f
SSDEEP 192:Z6ApNlRPjCIHamcpy8KWK6iFL3VDI+75UnMGdWIhQhpJelG8DnTG9hxjXVoMCQsI:cmfMNS7gvQsMZEyN
TLSH
T1985229114866E4372A3F49E575283D4163D1EF1E4F386C8BBBF75A0C0D81A5368DAF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

electron-log-preload.js

Path C:\Users\Admin\AppData\Roaming\CurseForge\electron-log-preload.js
Size 951B
SHA256 1662939424294fd4222c80541c7b936a1814255ff6cb8035ffdfd2fd45b52f90
MD5 045b35037bccafd977ee7a6d777dd8c6
SHA1 c6b23e9ae61bdf2d090c8608d98fce3e1114ebee
SHA512 662510f67565cd7f10fcc55a4758856aaa623fab1cbef0d07b89478d51012e19c8541d9605c4782fbe17f75a067f112c8884e82dc1b16137777aa64180252288
TLSH
T1A41110B928EB5C7B0102503A6DDE3A051FF687A5243CE1493B4D01AF3FA4C61690675C
MD5 SHA1 SHA512 TLSH

Submit Download

elerium-api-query-cache.json

Path C:\Users\Admin\AppData\Roaming\CurseForge\elerium-api-query-cache.json
Size 530B
SHA256 a69868f4a38354838f343af793a6c43e65988959b1eb49048a543b3f84a62e89
MD5 0d7759203a5cc0e4c6958edc32645a34
SHA1 cfcd906149e5662095ebe2cb614cd9c95acba5bf
SHA512 aec5e4b52f192b878d35f6c73e9f3e9d943d4e7523de56ade425c430d807b1e89e1a50a8fb829fe08ee21021a02c77bad90318c7e086a78fd07fe8f960aee02e
TLSH
T130F02B79FA42CACBADF56585A5BD2E7064841426AC73681D11D9A639811C8705B1E022
MD5 SHA1 SHA512 TLSH

Submit Download

elerium-api-query-cache.json.tmp-5801199720bf63b9

Path C:\Users\Admin\AppData\Roaming\CurseForge\elerium-api-query-cache.json.tmp-5801199720bf63b9
Size 54KB
SHA256 5bd88395702ef56ff056704a5df0c2be5bf5d802df5321d3c072aa9a5b6d917f
MD5 ebe2722c89938102b0296e19eabbe25c
SHA1 6b136552bd7c98af4dc0d31ab68ea6e1f57f66d7
SHA512 0fedbce21111c48702d0b156ea54df316b91c4346e869d3b7d04e77856e92f8583cbbd1e4af543001675e85640ae8c2bd7ba8a56df6bc95ad55d868057d0a094
SSDEEP 384:E3hyvsyuij5XDChSAh/8H/XUyu/NxqcaNTu5EtleIcvMGwqILhWq97ugy1ZasSFB:C4PI7k2QsMhvSNWhE8wlI25CTBYcL
TLSH
T11643C2BEBC1DDA64A546ADCF40BCBF6EBA32909A4D060FE2ED94EB05C1D20F13356415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

full-2026-08-04_00-52-49.log

Path C:\Users\Admin\AppData\Roaming\CurseForge\logs\2026-08-04_00-52-49\full-2026-08-04_00-52-49.log
Size 659B
SHA256 8ae803dd8febe9a6e3ef65c0b7a7f62f6b6ab53ef3d270447c5be8f25b607b8a
MD5 599ecad002c299dab5812799d63f4c0a
SHA1 a4708722d9e285f7dcdca89806857936f3baf1cd
SHA512 93d0e6d56786456ab2528b6f24f05e770d25b5862e4fae978c6078a29b4d4d681b2fcca923ba6aabdd164b96fdf5d5049027c5b32dfde5d7d449ecccd7b7ce01
TLSH
T1E401D64148F828B727620F1DFBA13F9C34167D7A1E84AB0393B8741928C5C9C9AD367C
MD5 SHA1 SHA512 TLSH

Submit Download

full-2026-08-04_00-52-49.log

Path C:\Users\Admin\AppData\Roaming\CurseForge\logs\2026-08-04_00-52-49\full-2026-08-04_00-52-49.log
Size 2KB
SHA256 a82c7fbc74cbbc9a0b0fc08ac2ddf2bc5cf0fcf9a2dd21dae553ad986014c0d1
MD5 ba38182c39746ff47f4ccff806a6d94b
SHA1 bdee41266f39ff55b89f99d7e953965a56e73452
SHA512 db82965996effef30f03927a8bb8d0dc395d67601d7c8ad695cdcb10645decfcd623dace70f682ba10c2721719c3df6f25e71c020f0c4bb96ede6aa269aad03b
TLSH
T13A41FE8514F860FB55620B4CFA923E9CA913B9B35F80A713A2BE540935D2C049DDF62C
MD5 SHA1 SHA512 TLSH

Submit Download

full-2026-08-04_00-52-49.log

Path C:\Users\Admin\AppData\Roaming\CurseForge\logs\2026-08-04_00-52-49\full-2026-08-04_00-52-49.log
Size 2KB
SHA256 abd7a430c0dc5b0ee189df0dd5689b673688a9de89c4c8d5ceed7902f0caa510
MD5 4ebf9f790baa633370f1de8fb0769970
SHA1 e4d8f6815c5b3fabb4d254315cb5c582471c7c29
SHA512 82ceb820f97dea851cb4b1867bf6b05a839ada71977ca20171af5e628b3dbf4b5ca13ecdb78d7bf6dc6830456db6f968ed66e86ccd91a74d9cedab92be3c106e
TLSH
T1EC519F4414F864FB59620B4CFE933E9CA617B9B31F81A61292BB440D3DD2C059DDFA2C
MD5 SHA1 SHA512 TLSH

Submit Download

full-2026-08-04_00-52-49.log

Path C:\Users\Admin\AppData\Roaming\CurseForge\logs\2026-08-04_00-52-49\full-2026-08-04_00-52-49.log
Size 4KB
SHA256 11d8aae9c4cd7805bc158742f6307159a22fcc9678fbaa0f26228a7df980015e
MD5 a177f80af31865fa837c78abf7e2a9af
SHA1 ce946fd3de39ea88f1474d11a781bf2c63c456f2
SHA512 698dcbc6292a344bf644b704b12ceb121f43ab38644f8a2fe46a305479a368982fdf9be2b425e3cfed954da263576684b59fd15fbece1949cc3a55965cfe8c0e
SSDEEP 96:oHUpyfmpBS9ITkTvE3QDKAI70FDjASencTjEn4X:dn8IYjhGMjHenc3d
TLSH
T147A1AB4414FC64FB55621B4CFD923E9C6612B6B35F819A12A2BA040D3DD2D058EEFA2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main-2026-08-04_00-52-49.log

Path C:\Users\Admin\AppData\Roaming\CurseForge\logs\2026-08-04_00-52-49\main-2026-08-04_00-52-49.log
Size 1KB
SHA256 267c44ad4363d0211b3628c00f27fdd6202302f5d924320e956a274bbed5ffa3
MD5 4c2e487aad7d65673ac91f0be941e0d5
SHA1 2877877c8c33fb486f64d864c11ef10afa99d015
SHA512 53d8e1d284963685b8e6b62d89c179e42264f2348cfdb730c87842f741528b48a262662d9b19c24d026d2f1088eb0c158341e8ff0b652aa2aff2824ad27ce8ad
TLSH
T10341704014F824FB59620F4CFE933E8C6912BAB72F81A65292F6540D3DD2C555DDBA3C
MD5 SHA1 SHA512 TLSH

Submit Download

main-2026-08-04_00-52-49.log

Path C:\Users\Admin\AppData\Roaming\CurseForge\logs\2026-08-04_00-52-49\main-2026-08-04_00-52-49.log
Size 4KB
SHA256 58882ff53f31de8584d4a97ec99b072ab8fa6854b1cda5d8ae7b8da5ce4b757e
MD5 4a29fec23a04cb0b3b85f7ee485be55c
SHA1 eae2b8410a0ff74ed0fe3ea024fca3535d562fa2
SHA512 50745c063b858d8ff658420f0bf1b8bac66c559fd52048cab43261af4bd2859346333be0e46fe7d56cae5db7523e1b5532d62026a56186fb00e66510484b415d
SSDEEP 96:oHUpyfmpBSylAI7PIOjASSeE88CR5Z9GjYvF:dn7/jHrEA
TLSH
T18CA1CD0014FC60FB1AB21B4CFA973ECC6A16B6775F45AE12A2B6444C3DD2D059DDBA2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.json

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

storage.json

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json
Size 27B
SHA256 b2df86a34937b13937e24e504558bb1c6bbe98f813eda7521a87282b7a6b00ce
MD5 b30e12f754f4013e42955567cea27266
SHA1 6d8590a7f0f5a1299f279f808977fa6bc9c130c1
SHA512 9ba1771b934359c742b13c8e229aee5c21de235f9e4d0a4d6cfb0629b9f2f313f44644f2b42556b01b0375e03cec74243d1658f22a0cb1cdc7a77d2a5f885029
MD5 SHA1 SHA512

Submit Download

storage.json

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json
Size 2KB
SHA256 48fe1beed340c6c0cdb58d2270f777417aa0beabd7fcd160291e9949793ac679
MD5 869338e2102b181ac40bf1d318e50b60
SHA1 ed6a8f21a2ffcb5d1a175cfe9ae8dba753b1d1a0
SHA512 40bff5166b30f3e19808e7d4d8ef83ebe1d7123af4373ca8c999847e3ce0249d778200a169f65d5b77f3488f9482803510c894dc53859c5e3e28be101dbc809f
TLSH
T12841660D980DF497E646D70EBFBE3BE2553D3803042319B4027C026C9165276375BA0F
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json.tmp-5801172540c0ab62

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-5801172540c0ab62
Size 785B
SHA256 0427b11ca318c86fa8af29c45cac8c039831d60efc76da0462bbe7fd95bcc3ab
MD5 a06e82cda5755450b8a4d6961a5ed945
SHA1 c855c741f5ffeaee53f996f363d8a1688bb0a75f
SHA512 d417ee6f73c62f4266f0c416c0303d6a9c740f198622eea8b5361d52a9e3765fdb480b9351bf0a47d518dc802ec1d4cb988a77b56b3fbad2809afaca940d3a17
TLSH
T18101470A6D0CF192E166E20673BE77D10E143C42042B207006BD043D62622E4372AF9F
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json.tmp-5801173151878aeb

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-5801173151878aeb
Size 922B
SHA256 dae80611262737174292fff763873d15ae2847b0ab306960fcee6d180ad5d5b2
MD5 34c06b0a0141c1af794d784f6772f2be
SHA1 43cfec21826ec59566e1d0d50443b9b3f5962663
SHA512 0f71bb7158c03368c24749dcccb1be1db6f5cd538c0e80d9a896d4188cbaa91c4082a089513e295c9718dcd91cf287177826eb17d368384a83dc9475fb90b0bf
TLSH
T14711480A5D1CF1E3E125E21677BE76D109293C46052721B006BD407D61616A5372BF9F
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json.tmp-5801173467df3a0a

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-5801173467df3a0a
Size 989B
SHA256 fa361eb8bb4874c106669c46ec3d32122cd1c97c1dc3b93a101452ab65a098c8
MD5 0dfd4631ffb595ab07898578ccf6b46c
SHA1 383b1e758222ab349543514dac5fdc6bfd03bbaf
SHA512 125135830c2da9eeea5aee6f6a0d5870153235aad86c27d3ac4814727c201daa7e3726b5f3b374a35a4bffd5520c39a2cb6cdd8a185d96fe7023f0fec889eb7a
TLSH
T11511760A5D1CF0A7E12AE30B77BE76D00A283C46042720B00ABD043CA1612B1372BF5F
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json.tmp-58011742912ca725

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-58011742912ca725
Size 1KB
SHA256 452bfa2f144a6aefcf11077965830e044b9afb9ba6e5144464314770518b3b08
MD5 7a0df5866390797042607e9a04437925
SHA1 2111b75b7f0548554f97b53a560d7bd42fbdddc1
SHA512 19a52388e6045d849a6a0e9ed28958efc6d4aa23806ff08b59ef6c9507e7c2710e3a358b8055fcc1cc4f3ff5e0f500ecee77f8c17a689e73064619fed436f2ee
TLSH
T19111A80A9C1CF1A7E125F30BB7BE76E00A293C46042710B01ABD003CA1612B13B6BF5F
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json.tmp-5801183189b8d281

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-5801183189b8d281
Size 1KB
SHA256 41eeefe5ef394f98464a745574b8c950755e6017745d72dcefa7ddff5eacf9f9
MD5 48be2fdc1803202d7e8e87c96bfe03f0
SHA1 1e64ea796c7b6a9432557f00d4d2e247ae5375b9
SHA512 899e8f55789ba0bf6289d5e15920dc5489427377a12c504708bb8156966268d0b98086d1d0b038fd4f9d4e505a513e400af9b54dafe2832a222efaace82e7a7a
TLSH
T15B21660A9D1CF1A7E129F31AB7BE76E50A293C46042711B01ABD007CA1612B13B6BE5F
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json.tmp-580118334237da4c

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-580118334237da4c
Size 1KB
SHA256 385b40752f6388a4d3cad470609940bcab067db6edf54a9caf5aeeca99acee5c
MD5 4aadee8aa8a90c939796e2538cc413bd
SHA1 d1f9a506b28e127b18dbe86feb36647b14101391
SHA512 fb89829c573fd73be53cb5119d66c1705d78daa3e7db140a7a9d17fc6b04798d95a363b421136bf13d5a8450db67c354f070d5293584eb3bfd63b76979a32cf6
TLSH
T1312176199D0CF1A7E129F31AB7BE7AE40A293C46042715B016AD053CA1602B13B6BF5F
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json.tmp-5801183701d41e0b

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-5801183701d41e0b
Size 1KB
SHA256 b082a8974f77513ebfbf52383a6999c4b403b19f1fec20a409ab394aaa6ccac4
MD5 132e4c32114ff01e879574412fab326e
SHA1 a287583046031d61a4e55da5b6d9106fa9f9ed43
SHA512 0b04197c8be9b32aa628a4731c5c28bd6830892ba0a13b95f14e3bfe20c8fdeedfc61013cb17f36d08bae5d77d1834a92c1a4f00972d3805be2c44b9889ccf05
TLSH
T17621A91D9C0CF1A7E129F31ABBBE7AE54A283C46042715B006BD013CA1602B1376BF5F
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json.tmp-58011960426bba5b

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-58011960426bba5b
Size 1KB
SHA256 08796e55eb0a1b5988e7a80d19eb1910e973235fc698821b2dd4a15f57222a93
MD5 e380ac9d09f7904f352b616e9bcf08c7
SHA1 97c31daede7cb8aa9a1c04b9525bacb0fcf593e9
SHA512 642ceb318ca193ad06824157e36242d6b5dc36a11342e6629881f4bc3b8e6c6fb56900e6b5ed3a419c6dd0d24c1e02cb7d6e4283c514f0b020d299465f4e51d0
TLSH
T10621B80D9D0DF5A3E629F30AB7BE79E50A293846442724B006AD013CA1A12B5376BF5F
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json.tmp-58011990012e4923

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-58011990012e4923
Size 1KB
SHA256 e38a3814b1d65a9eeee77e92debc7cb8fc639490b1fa66e57c2d5fc20f60ccfd
MD5 e0bd8428367ddcf7a85ebed23d75851b
SHA1 c09ebabec6c80db1ee9b16e4ac2ba3623e82b854
SHA512 c05e52fb03c91c5314bebbb30a6169b6e02126586ce9e56a65cbe4de3c82d44224266671d43db467ea31980df87f2402229be1bc1b46c51d68fe09b29f3f4049
TLSH
T10D21DB0D9D0DF5A3E629F30AB7BE79E54A293C46442720B006BD013CA2612B5376BF5F
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json.tmp-5801208646875dda

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-5801208646875dda
Size 2KB
SHA256 f420df0c698cc576f98393a97f8bfe33512f88b7fec0d169091fe1b149ba2a27
MD5 9f17c60dba98ea22879de170537758d5
SHA1 31eefa28726082aeb48edb104ff9006d4b7761ab
SHA512 06e8aa4669c6d3cb849cd077492ae133e601a68419be0aa93e24b71a51522cd66fe2cc50a60177416904ea44a1bab27e09cf84742f6250c7a8463275ec788a23
TLSH
T18641640D590DF497E646E74EBFBE3BE2263D3842092319B4027C026C9165276375BB0F
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json.tmp-58012088211c8649

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-58012088211c8649
Size 2KB
SHA256 0e9f9f50e448b6dcee1bd94b18cbb1ce9847ae9925e0e0958eb38378d79b589b
MD5 0196f1e6bf027a2d30880d183ab6404e
SHA1 ad6182f578c2615eb7b0e34d39fefcc16fbb01a4
SHA512 da34af1954157c5148257af43f300752d40484c3118156e536f94ad244dadce5bf3a0453a15c56278bdd88ac339a4fe21754a5e253f2ec3295e9cb8770218d76
TLSH
T1DB41750D580DF497E646D70EBFBE3BE2663D3842052319B4027C026C9165676375BB0F
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json.tmp-58012098592ec793

Path C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-58012098592ec793
Size 2KB
SHA256 19eaa2f9a7e61040d99cc99fb6399bb4e826c5c906695f4215b098493069b592
MD5 0aa4024dc684c8ce558157686f62e565
SHA1 f80deb1427af6ab62c95ab7e1bbddc7569e9a94b
SHA512 a121b607941cd68e7873392b32d516f4cec7635d10c8b4137b12ead34da54aa6d394d214e6eff4239e1ab6214a5285f5e03d2ad3a74fffa548247ec928e3ac96
TLSH
T10F41860D580DF497E646D74EBBBE3BE3263D3842053319B0027C026C91A5175375BA0F
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

owpm.log

Path C:\Users\Admin\AppData\Roaming\ow-electron\cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\logs\owpm.log
Size 4KB
SHA256 a84ce3cf5d51465d1cc4161e799cb780709919b66c95c3e5c4e4971f3e4d4fb6
MD5 f116c02cb6f4f38c306ce398eda072f8
SHA1 07568ecb6b08b60a48c7eb64a61d1602348bfede
SHA512 383d802a17f0df964d9fc1d48abb201e0ccc3c76fcd2fc0c181e7fa97a04f2d50879d9de9c55beec5ae220a07328ea064b5042b72bc1437aa95af9fcd6ff3950
SSDEEP 96:KCrMxjj98/lAMvIhjGshjGshjT0hjTBTCjGjFxAEhjFshjFshjLphjLcEHIg53s:/rMjjkkjGYjGYjMjNTCjGj4wjFYjFYjM
TLSH
T139914D627FB99239990B8C4AB164A91F806BF4307B483A57BB30158C9C159C5CF7FC9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utility.log

Path C:\Users\Admin\AppData\Roaming\ow-electron\cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\logs\utility\utility.log
Size 6KB
SHA256 265e793dadf78fc96ffbb70ca75c46711ce1f3a608d54c687f6f689e407551df
MD5 3440a827913f7f124ba3b2598d9b3f2b
SHA1 c9d9eafed6649efaa99e0aecc97931c13e187dfd
SHA512 e48d6aee1f7a814cb02db3cdf0023f88804820b3c48c2dd6eac4a12a3a70317a412d933bdc8a3fd8253fc8e141e85ccafe251ae2796a9fc8abee70dc51fb8960
SSDEEP 192:xj+UzqjkTzLPV2QGStGu2/DbVIJ5mBPhB:xjyj696Si
TLSH
T138D185177DF8403B9F5BC5E9B4917CABC5BB70316A8C2902FBB01B880D89695DE1DC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utility.log

Path C:\Users\Admin\AppData\Roaming\ow-electron\cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\logs\utility\utility.log
Size 411B
SHA256 c79c137fe48021f70a95061af59c5bf9277678de295cfbc85aed0ce3fed339cf
MD5 6204ea5d7796051f990102ecd56c9775
SHA1 dbc4017059255b9329f87aa001a914f8bc871a10
SHA512 94572a3ed538a318036becabf08bb64b41887119be8fe568f612457a526b3315c2e7aaa44c85fd32e355398bef74e7660ad4bf233b2c3554d987d72756844911
TLSH
T122E0D8533CBC403A9A26CD0AB064A80FC46AB031AFD826677BB105980C555868F1DD66
MD5 SHA1 SHA512 TLSH

Submit Download

utility.log

Path C:\Users\Admin\AppData\Roaming\ow-electron\cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\logs\utility\utility.log
Size 3KB
SHA256 3f4cbc20cc696b0854036e17e4e99854d1e7a65a64cfb9c47dd4ca17f8ba3962
MD5 6f48a728584dadd4636374908e0028aa
SHA1 93ae4a0e41c3922c737ff4a6c760bf91792def09
SHA512 c83a9cd6e006d75b85cfa7991c83e8f3ba4752e13216f79afe74a140c133f6ed75bcb146f570fd8719f2796ab7072066cf421ec8d6d16ca1b674215a23a8c6b1
TLSH
T1887153137EF8503B9E96C6E568C0BCBBC57AB4356D882643FB35179C0D84684DB1DC29
MD5 SHA1 SHA512 TLSH

Submit Download

fbakpbpolagjcgkhmnjmaeieneioknidnfjiejnf.owepk

Path C:\Users\Admin\AppData\Roaming\ow-electron\cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\packages\fbakpbpolagjcgkhmnjmaeieneioknidnfjiejnf.owepk
Size 114KB
SHA256 fce368156df13175c4c134004d6e774f82cfeae09a0defae8086c3f09b3d6909
MD5 d74adc9283db91fbcca880336376e540
SHA1 32c7359f3a9b51863e1c4c28efc43c7b4310ea08
SHA512 f3cbd28e5c5b069114beb136d0975534474a5c17ebe874b1027a69cd1b831bcd393a13d9f4b2f04842c1ca7d0a5f02fe617101d31f67899a722871e8421838c6
SSDEEP 3072:SOZEdK8ZxRruVNxsmVmX0bOQK3Ldm+nDUGXekfTwNR+:SvdKcKPxsmVmkaQuDUEw+
TLSH
T14CB3133610A1F4C0CEEDEDFA989DBF84E34EEC6678D913127CD54CC19A910AC162E097
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jopghajpapbfooofklncedoalpgiaglgjaokpkon.owepk

Path C:\Users\Admin\AppData\Roaming\ow-electron\cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\packages\jopghajpapbfooofklncedoalpgiaglgjaokpkon.owepk
Size 1.9MB
SHA256 308aa1bb2d872db5b4fdb4cfb40769b51317e7354aa6b525730fafdf1e97887c
MD5 547d21a4fe16be9910124d2c00cbc63f
SHA1 e25623bbaa57e1edf75c3c1199128177b2e70ce2
SHA512 22c2d3a2e9fcbd76a044756e2aac9705ca7155529d26cda1d2111153da3aea8352e67eaeb009dab40b9489f706e89666c66c389305431b578944416b6a93c964
SSDEEP 49152:O3sJ2QnqIIxXUwZuLDZjzUcBu7Bl0p+Rwc0CuBBc0WetL0Z:O3sIuquLDZnvIwc0RBBc0Wk2
TLSH
T1469533C439B045365B17A5D879FE498381EEF8BEFAD2C33B0D87260AFC1E7960525A05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ow-electron-utility-plugin.node

Path C:\Users\Admin\AppData\Roaming\ow-electron\cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\packages\jopghajpapbfooofklncedoalpgiaglgjaokpkon\2.9.1\ow-electron-utility-plugin.node
Size 714KB
SHA256 c2df504a42c2a775876b93a73d43a34e874041d6aa80d4399406a11a976bfbb2
MD5 11a59b1518920bf2e6d409e803f043c4
SHA1 7d9d0bc4a7132c861eb2ac04abea42b0ced2b2d6
SHA512 aef776160e49c20841ddb88402acbd478509a789e899b9fd769bce1d241b31df55d3130ad115c144d07eca0605d50e9c294d69a156a182f298fefb98a50af3cc
SSDEEP 12288:qjVWom4AdHVVMRe1UWzqJph0lhSMXl+Zf:qjwodA1Vh15q7h0lhSMXlef
TLSH
T17BF4AE16B7A401BCE0ABC139C9974A12F772785207A1BBCF03944AA65F2B7E45E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurseForge Windows - Installer.exe

Path C:\Users\Admin\Downloads\CurseForge Windows - Installer.exe
Size 2.9MB
SHA256 70d07538a8c725e7abce2bc1012f2b0aac328cdbaec14b270cad152ccaee4969
MD5 7e113af8b0f3e119cc75d4ded0b84348
SHA1 19e9a1390af172091d0b4bccead4b0d5e61fe20b
SHA512 5d4384baeac18b02ee8e9792f3b3db5df344b12c87ecc3df0611711b2e89c39ec289a0a980474e4c39bc80d19738bba4ee6f67f98cd44f836931ef23e9666ca0
SSDEEP 49152:WLNFeI8xE87vxpsrFpIvQ4kvoHch90ksssY1XbGIw3UhsooAFhR8MEYHzcYq6y:WxUBPN+TIvrWccYXQ9bGrkhsbc8MEYT6
TLSH
T13BD53322C27F816EDB12C57179B441AE9166CF16213B0FADF7C4E8A46466B83734C87E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 297452.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 297452.crdownload
Size 3.1MB
SHA256 2c9d3efa8b06438a7284139f68f6efcbfb2a11e0b9d20a3370d50189685afc0b
MD5 5b1e5dfb3f38d089a092e2079289155f
SHA1 bd4fc400c2e41e31a8b516f4d15be726eb44b386
SHA512 ac05eade3bc70ac72fe92d52f178a4a8a028f00430fa709bcbd4e43564589339e731eb2111c9ef64c0bed26f2edbb510afafc73a4891d0bd018e813539ac1227
SSDEEP 98304:1YlBqmrhnVP8jGMTgFtti6zrG241v2Bxp:qBBr9YwoQxp
TLSH
T1F5E5F12DE1C51033F5AB4132A6A75D233E3F15D9E08B205339F413D2E9BAD492A57F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1288-562-0x0000028E48030000-0x0000028E48076000-memory.dmp

Download

memory/1288-601-0x0000028E60DC0000-0x0000028E60DE2000-memory.dmp

Download

memory/1288-590-0x0000028E60E50000-0x0000028E60EE0000-memory.dmp

Download

memory/1288-580-0x0000028E61410000-0x0000028E614C0000-memory.dmp

Download

memory/1288-557-0x0000028E60900000-0x0000028E609AA000-memory.dmp

Download

memory/1288-553-0x0000028E46390000-0x0000028E463E4000-memory.dmp

Download

memory/1288-604-0x0000028E48110000-0x0000028E4811E000-memory.dmp

Download

memory/1288-566-0x0000028E48080000-0x0000028E48098000-memory.dmp

Download

memory/1288-559-0x0000028E467B0000-0x0000028E467C4000-memory.dmp

Download

memory/1288-560-0x0000028E60EE0000-0x0000028E61408000-memory.dmp

Download

memory/1752-5530-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5542-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5532-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5526-0x000001B9A0600000-0x000001B9A0601000-memory.dmp

Download

memory/1752-5525-0x000001B9A0600000-0x000001B9A0601000-memory.dmp

Download

memory/1752-5527-0x000001B9A0600000-0x000001B9A0601000-memory.dmp

Download

memory/1752-5546-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5533-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5534-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5535-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5536-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5537-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5538-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5539-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5540-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5545-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5544-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5543-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5531-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/1752-5541-0x000001B9A0E80000-0x000001B9A0E82000-memory.dmp

Download

memory/3108-713-0x00007FF9D69F0000-0x00007FF9D69F1000-memory.dmp

Download

memory/3108-712-0x00007FF9D6730000-0x00007FF9D6731000-memory.dmp

Download

memory/3316-892-0x000001E445460000-0x000001E44558A000-memory.dmp

Download

memory/3316-632-0x00007FF9D77D0000-0x00007FF9D77D1000-memory.dmp

Download

memory/4328-818-0x00000298DC470000-0x00000298DC471000-memory.dmp

Download

memory/4328-819-0x00000298DC470000-0x00000298DC471000-memory.dmp

Download

memory/4328-817-0x00000298DC470000-0x00000298DC471000-memory.dmp

Download

memory/4328-823-0x00000298DC470000-0x00000298DC471000-memory.dmp

Download

memory/4328-812-0x00000298DC470000-0x00000298DC471000-memory.dmp

Download

memory/4328-822-0x00000298DC470000-0x00000298DC471000-memory.dmp

Download

memory/4328-821-0x00000298DC470000-0x00000298DC471000-memory.dmp

Download

memory/4328-820-0x00000298DC470000-0x00000298DC471000-memory.dmp

Download

memory/4328-813-0x00000298DC470000-0x00000298DC471000-memory.dmp

Download

memory/4328-811-0x00000298DC470000-0x00000298DC471000-memory.dmp

Download

memory/4484-1955-0x00007FF9D6730000-0x00007FF9D6731000-memory.dmp

Download

memory/4484-1957-0x00007FF9D69F0000-0x00007FF9D69F1000-memory.dmp

Download

memory/4560-1017-0x0000000007D00000-0x0000000007D96000-memory.dmp

Download

memory/4560-1009-0x00000000702D0000-0x000000007031C000-memory.dmp

Download

memory/4560-1005-0x0000000006060000-0x00000000063B4000-memory.dmp

Download

memory/4560-1018-0x0000000007C70000-0x0000000007C81000-memory.dmp

Download

memory/5216-1046-0x0000000070A50000-0x0000000070DA4000-memory.dmp

Download

memory/5216-1038-0x00000000702D0000-0x000000007031C000-memory.dmp

Download

memory/5552-960-0x0000000005230000-0x0000000005266000-memory.dmp

Download

memory/5552-962-0x0000000005960000-0x0000000005982000-memory.dmp

Download

memory/5552-961-0x0000000005A00000-0x0000000006028000-memory.dmp

Download

memory/5552-991-0x0000000070440000-0x0000000070794000-memory.dmp

Download

memory/5552-990-0x0000000007D50000-0x0000000007D74000-memory.dmp

Download

memory/5552-989-0x0000000007D20000-0x0000000007D4A000-memory.dmp

Download

memory/5552-988-0x0000000007BA0000-0x0000000007BAA000-memory.dmp

Download

memory/5552-986-0x0000000008180000-0x00000000087FA000-memory.dmp

Download

memory/5552-987-0x0000000007B30000-0x0000000007B4A000-memory.dmp

Download

memory/5552-985-0x00000000079E0000-0x0000000007A83000-memory.dmp

Download

memory/5552-984-0x00000000079B0000-0x00000000079CE000-memory.dmp

Download

memory/5552-976-0x00000000702D0000-0x000000007031C000-memory.dmp

Download

memory/5552-975-0x0000000006DC0000-0x0000000006DF2000-memory.dmp

Download

memory/5552-974-0x0000000006820000-0x000000000686C000-memory.dmp

Download

memory/5552-973-0x00000000067E0000-0x00000000067FE000-memory.dmp

Download

memory/5552-972-0x0000000006200000-0x0000000006554000-memory.dmp

Download

memory/5552-964-0x0000000006190000-0x00000000061F6000-memory.dmp

Download

memory/5552-963-0x0000000006120000-0x0000000006186000-memory.dmp

Download

memory/5556-745-0x00007FF9D77D0000-0x00007FF9D77D1000-memory.dmp

Download

memory/6164-5559-0x000001E5D8670000-0x000001E5D8671000-memory.dmp

Download

memory/6164-5557-0x000001E5D8670000-0x000001E5D8671000-memory.dmp

Download

memory/6164-5562-0x000001E5D8670000-0x000001E5D8671000-memory.dmp

Download

memory/6164-5558-0x000001E5D8670000-0x000001E5D8671000-memory.dmp

Download

memory/6164-5561-0x000001E5D8670000-0x000001E5D8671000-memory.dmp

Download

memory/6164-5560-0x000001E5D8670000-0x000001E5D8671000-memory.dmp

Download

memory/7192-5587-0x000002207D720000-0x000002207D744000-memory.dmp

Download

memory/7192-5586-0x000002207D720000-0x000002207D74A000-memory.dmp

Download

memory/7648-6762-0x0000013DB5C90000-0x0000013DB5C91000-memory.dmp

Download

memory/7648-6756-0x0000013DB5C90000-0x0000013DB5C91000-memory.dmp

Download

memory/7648-6757-0x0000013DB5C90000-0x0000013DB5C91000-memory.dmp

Download

memory/7648-6755-0x0000013DB5C90000-0x0000013DB5C91000-memory.dmp

Download

memory/7648-6764-0x0000013DB5C90000-0x0000013DB5C91000-memory.dmp

Download

memory/7648-6763-0x0000013DB5C90000-0x0000013DB5C91000-memory.dmp

Download

memory/7648-6761-0x0000013DB5C90000-0x0000013DB5C91000-memory.dmp

Download

memory/7648-6760-0x0000013DB5C90000-0x0000013DB5C91000-memory.dmp

Download

memory/7648-6759-0x0000013DB5C90000-0x0000013DB5C91000-memory.dmp

Download

memory/21996-24740-0x000001AE20800000-0x000001AE20801000-memory.dmp

Download

memory/21996-24613-0x000001AE20800000-0x000001AE20801000-memory.dmp

Download

memory/21996-24736-0x000001AE20800000-0x000001AE20801000-memory.dmp

Download

memory/21996-24571-0x000001AE20800000-0x000001AE20801000-memory.dmp

Download

memory/21996-24739-0x000001AE20800000-0x000001AE20801000-memory.dmp

Download

memory/21996-24745-0x000001AE20800000-0x000001AE20801000-memory.dmp

Download

memory/21996-24652-0x000001AE20800000-0x000001AE20801000-memory.dmp

Download

memory/21996-24689-0x000001AE20800000-0x000001AE20801000-memory.dmp

Download

memory/21996-24595-0x000001AE20800000-0x000001AE20801000-memory.dmp

Download

memory/21996-24685-0x000001AE20800000-0x000001AE20801000-memory.dmp

Download

memory/21996-24561-0x000001AE20800000-0x000001AE20801000-memory.dmp

Download

memory/21996-24575-0x000001AE20800000-0x000001AE20801000-memory.dmp

Download