hxxps://cdn[.]alpha[.]flightsim[.]to/0027/123flightSOUND%20Setup%204[.]1[.]1[.]exe_3E9r4[.]zip

Analysis

user interaction
yes
max time kernel
303s
max time network
308s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.alpha.flightsim.to/0027/123flightSOUND%20Setup%204.1.1.exe_3E9r4.zip
Sample260810-hdblhscp7t

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2572	powershell.exe
4544	powershell.exe
4484	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
3256	123flightSOUND.exe
2184	123flightSOUND.exe
5904	123flightSOUND.exe
2240	123flightSOUND.exe
716	123flightSOUND.exe
352	123flightSOUND.exe
5852	123flightSOUND.exe
5620	123flightSOUND.exe

Loads dropped DLL 26 IoCs

pid	Process
2676	123flightSOUND Setup 4.1.1.exe
2676	123flightSOUND Setup 4.1.1.exe
2676	123flightSOUND Setup 4.1.1.exe
2676	123flightSOUND Setup 4.1.1.exe
2676	123flightSOUND Setup 4.1.1.exe
2676	123flightSOUND Setup 4.1.1.exe
2676	123flightSOUND Setup 4.1.1.exe
2676	123flightSOUND Setup 4.1.1.exe
2676	123flightSOUND Setup 4.1.1.exe
2676	123flightSOUND Setup 4.1.1.exe
2676	123flightSOUND Setup 4.1.1.exe
2676	123flightSOUND Setup 4.1.1.exe
2676	123flightSOUND Setup 4.1.1.exe
3256	123flightSOUND.exe
2184	123flightSOUND.exe
5904	123flightSOUND.exe
2240	123flightSOUND.exe
2184	123flightSOUND.exe
2184	123flightSOUND.exe
2184	123flightSOUND.exe
2184	123flightSOUND.exe
2184	123flightSOUND.exe
716	123flightSOUND.exe
352	123flightSOUND.exe
5852	123flightSOUND.exe
5620	123flightSOUND.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3132	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123flightSOUND Setup 4.1.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5556	msedge.exe
6060	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Colors	123flightSOUND.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308174273802460"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 61 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	123flightSOUND Setup 4.1.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	123flightSOUND Setup 4.1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	123flightSOUND.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	123flightSOUND.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	123flightSOUND.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	123flightSOUND Setup 4.1.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	123flightSOUND Setup 4.1.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	123flightSOUND.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	123flightSOUND.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	123flightSOUND.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	123flightSOUND Setup 4.1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	123flightSOUND.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	123flightSOUND.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	123flightSOUND Setup 4.1.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	123flightSOUND.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	123flightSOUND.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	123flightSOUND Setup 4.1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	123flightSOUND.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	123flightSOUND.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{86D1A2EC-9B90-46CC-9A5B-AFD2750EA8E1}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	123flightSOUND.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	123flightSOUND Setup 4.1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	123flightSOUND.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	123flightSOUND.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	123flightSOUND.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Documents"	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{8DD6465A-D874-4F70-9CC4-4B0D27C3593B}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{ABB71F78-5B1C-4FF4-B784-A45D80585612}	123flightSOUND.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	123flightSOUND.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	123flightSOUND.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	123flightSOUND.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	123flightSOUND.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	123flightSOUND.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	123flightSOUND.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "5"	123flightSOUND.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5940	msedge.exe
5940	msedge.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4484	powershell.exe
4484	powershell.exe
4484	powershell.exe
2676	123flightSOUND Setup 4.1.1.exe
2676	123flightSOUND Setup 4.1.1.exe
3132	tasklist.exe
3132	tasklist.exe
2572	powershell.exe
2572	powershell.exe
2572	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2676	123flightSOUND Setup 4.1.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	3132	tasklist.exe
Token: SeSecurityPrivilege	2676	123flightSOUND Setup 4.1.1.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe
Token: SeCreatePagefilePrivilege	3256	123flightSOUND.exe
Token: SeShutdownPrivilege	3256	123flightSOUND.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
3256	123flightSOUND.exe
3256	123flightSOUND.exe
3256	123flightSOUND.exe
3256	123flightSOUND.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5620	123flightSOUND.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 5868	4100	msedge.exe	89
PID 4100 wrote to memory of 5556	4100	msedge.exe	90
PID 4100 wrote to memory of 2448	4100	msedge.exe	91
PID 4100 wrote to memory of 2448	4100	msedge.exe	91
PID 4100 wrote to memory of 2924	4100	msedge.exe	92
PID 4100 wrote to memory of 2924	4100	msedge.exe	92
PID 4100 wrote to memory of 2924	4100	msedge.exe	92
PID 4100 wrote to memory of 52	4100	msedge.exe	94
PID 4100 wrote to memory of 52	4100	msedge.exe	94
PID 4100 wrote to memory of 52	4100	msedge.exe	94
PID 4100 wrote to memory of 256	4100	msedge.exe	95
PID 4100 wrote to memory of 256	4100	msedge.exe	95
PID 4100 wrote to memory of 256	4100	msedge.exe	95
PID 4100 wrote to memory of 4980	4100	msedge.exe	96
PID 4100 wrote to memory of 4980	4100	msedge.exe	96
PID 4100 wrote to memory of 4980	4100	msedge.exe	96
PID 4100 wrote to memory of 1780	4100	msedge.exe	97
PID 4100 wrote to memory of 1780	4100	msedge.exe	97
PID 4100 wrote to memory of 1780	4100	msedge.exe	97
PID 4100 wrote to memory of 952	4100	msedge.exe	98
PID 4100 wrote to memory of 952	4100	msedge.exe	98
PID 4100 wrote to memory of 4820	4100	msedge.exe	99
PID 4100 wrote to memory of 4820	4100	msedge.exe	99
PID 4100 wrote to memory of 4600	4100	msedge.exe	100
PID 4100 wrote to memory of 4600	4100	msedge.exe	100
PID 4100 wrote to memory of 3396	4100	msedge.exe	101
PID 4100 wrote to memory of 3396	4100	msedge.exe	101
PID 4100 wrote to memory of 3396	4100	msedge.exe	101
PID 4100 wrote to memory of 2084	4100	msedge.exe	104
PID 4100 wrote to memory of 4392	4100	msedge.exe	107
PID 4100 wrote to memory of 4392	4100	msedge.exe	107
PID 4100 wrote to memory of 4392	4100	msedge.exe	107
PID 4100 wrote to memory of 3620	4100	msedge.exe	110
PID 4100 wrote to memory of 4916	4100	msedge.exe	111
PID 4100 wrote to memory of 3944	4100	msedge.exe	112
PID 4100 wrote to memory of 2336	4100	msedge.exe	113
PID 4100 wrote to memory of 2336	4100	msedge.exe	113
PID 4100 wrote to memory of 1104	4100	msedge.exe	115
PID 4100 wrote to memory of 5940	4100	msedge.exe	116
PID 2676 wrote to memory of 4544	2676	123flightSOUND Setup 4.1.1.exe	120
PID 2676 wrote to memory of 4484	2676	123flightSOUND Setup 4.1.1.exe	122
PID 4100 wrote to memory of 4468	4100	msedge.exe	125
PID 4100 wrote to memory of 5540	4100	msedge.exe	124
PID 4100 wrote to memory of 4468	4100	msedge.exe	125
PID 4100 wrote to memory of 5540	4100	msedge.exe	124
PID 4100 wrote to memory of 2072	4100	msedge.exe	126
PID 4100 wrote to memory of 2072	4100	msedge.exe	126
PID 2676 wrote to memory of 3928	2676	123flightSOUND Setup 4.1.1.exe	127
PID 3928 wrote to memory of 3132	3928	cmd.exe	129
PID 3928 wrote to memory of 4612	3928	cmd.exe	130
PID 2676 wrote to memory of 2572	2676	123flightSOUND Setup 4.1.1.exe	133
PID 3256 wrote to memory of 2184	3256	123flightSOUND.exe	136
PID 3256 wrote to memory of 2184	3256	123flightSOUND.exe	136
PID 3256 wrote to memory of 5904	3256	123flightSOUND.exe	137
PID 3256 wrote to memory of 2240	3256	123flightSOUND.exe	138
PID 3256 wrote to memory of 2240	3256	123flightSOUND.exe	138
PID 3256 wrote to memory of 716	3256	123flightSOUND.exe	139
PID 3256 wrote to memory of 716	3256	123flightSOUND.exe	139
PID 3256 wrote to memory of 352	3256	123flightSOUND.exe	140
PID 3256 wrote to memory of 5852	3256	123flightSOUND.exe	142
PID 3256 wrote to memory of 5852	3256	123flightSOUND.exe	142
PID 3256 wrote to memory of 5620	3256	123flightSOUND.exe	144
PID 4100 wrote to memory of 2992	4100	msedge.exe	145
PID 4100 wrote to memory of 2992	4100	msedge.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.alpha.flightsim.to/0027/123flightSOUND%20Setup%204.1.1.exe_3E9r4.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff9d7dbc188,0x7ff9d7dbc194,0x7ff9d7dbc1a0
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,8892301802095893382,6373846457317913860,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,15683719535364285520,15072617553610359706,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,15553987568310448788,14955073918789855360,262144 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,7116193210684628292,11221069461300488548,2097152 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:52
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,12515492129076674902,6352365558274714309,2097152 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,14070462071016696353,13754156163926321380,2097152 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,8905914108024618312,12365093205067037858,2097152 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:9
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,12518567466129166288,437738636751955240,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,2953457360917781560,13902953400138480098,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,9096940000121585477,12999748147016549517,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5884,i,12882949061080542587,14355983933221080789,2097152 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,7577692491777279609,7235209909896045935,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,7577692491777279609,7235209909896045935,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4476,i,7612890864740173952,7656940128053812475,2097152 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,14791610260696605991,7365508212556869972,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,2584757311636697346,2041607649334053333,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,10772031003018635023,8969197179124844320,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,9764380805414506067,11675898224633685179,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,15782667717023216406,13180104470907534559,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5964,i,863674489629913662,3511737486601413565,262144 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,4869313663167547859,15604571550267953106,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:14
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,17437016974569576293,12933908592317074182,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,7447206382127272668,8696784039065410190,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,5113049101954882723,17877228743097138570,524288 --field-trial-handle=2636,i,6947344563916059117,18112648503842556714,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff9d7dbc188,0x7ff9d7dbc194,0x7ff9d7dbc1a0
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,14584994957121065787,18216997969181789448,524288 --field-trial-handle=2320,i,2156633286017536860,7189003920975289603,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,13395794573331067332,9091218907701743575,262144 --field-trial-handle=2320,i,2156633286017536860,7189003920975289603,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,10158471354800189791,7036112099953248205,524288 --field-trial-handle=2320,i,2156633286017536860,7189003920975289603,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:13
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,14302418257818213979,236912207304922017,524288 --field-trial-handle=2320,i,2156633286017536860,7189003920975289603,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,14302418257818213979,236912207304922017,524288 --field-trial-handle=2320,i,2156633286017536860,7189003920975289603,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,763526910203816177,17018890922774716192,524288 --field-trial-handle=2320,i,2156633286017536860,7189003920975289603,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,678970624146465477,14006947747000786942,524288 --field-trial-handle=2320,i,2156633286017536860,7189003920975289603,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,7368844543731765210,13768316171829119042,524288 --field-trial-handle=2320,i,2156633286017536860,7189003920975289603,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,6022366294058935649,7664349174764402663,524288 --field-trial-handle=2320,i,2156633286017536860,7189003920975289603,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,8374899984517398141,2855307026320557940,524288 --field-trial-handle=2320,i,2156633286017536860,7189003920975289603,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,11843713223942007399,8358846466416693216,524288 --field-trial-handle=2320,i,2156633286017536860,7189003920975289603,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,16539818417839113052,5457201102531506824,524288 --field-trial-handle=2320,i,2156633286017536860,7189003920975289603,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
    3⤵
    PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2060

C:\Users\Admin\Downloads\123flightSOUND Setup 4.1.1.exe_3E9r4\123flightSOUND Setup 4.1.1.exe
"C:\Users\Admin\Downloads\123flightSOUND Setup 4.1.1.exe_3E9r4\123flightSOUND Setup 4.1.1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\detect_msfs2024.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4544
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\detect_msfs2020.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq 123flightSOUND.exe" /FO csv | "C:\Windows\system32\find.exe" "123flightSOUND.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq 123flightSOUND.exe" /FO csv
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3132
- - C:\Windows\SysWOW64\find.exe
    "C:\Windows\system32\find.exe" "123flightSOUND.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4612
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Programs\123flightSOUND\resources\install-msfs-vr.ps1" -CommunityDir2024 "C:\Users\Admin\Saved Games" -CommunityDir2020 "" -AppExe "C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572

C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe
"C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe
  "C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\123flightsound" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1720,i,4042721656331789222,3690220059174986638,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2184
- C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe
  "C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\123flightsound" --secure-schemes=localfile --fetch-schemes=localfile --streaming-schemes=localfile --field-trial-handle=2204,i,4042721656331789222,3690220059174986638,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5904
- C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe
  "C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\123flightsound" --secure-schemes=localfile --fetch-schemes=localfile --streaming-schemes=localfile --app-path="C:\Users\Admin\AppData\Local\Programs\123flightSOUND\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2588,i,4042721656331789222,3690220059174986638,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2240
- C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe
  "C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\123flightsound" --secure-schemes=localfile --fetch-schemes=localfile --streaming-schemes=localfile --field-trial-handle=2872,i,4042721656331789222,3690220059174986638,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:716
- C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe
  "C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\123flightsound" --secure-schemes=localfile --fetch-schemes=localfile --streaming-schemes=localfile --field-trial-handle=2636,i,4042721656331789222,3690220059174986638,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:352
- C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe
  "C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\123flightsound" --secure-schemes=localfile --fetch-schemes=localfile --streaming-schemes=localfile --app-path="C:\Users\Admin\AppData\Local\Programs\123flightSOUND\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3636,i,4042721656331789222,3690220059174986638,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5852
- C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe
  "C:\Users\Admin\AppData\Local\Programs\123flightSOUND\123flightSOUND.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\123flightsound" --secure-schemes=localfile --fetch-schemes=localfile --streaming-schemes=localfile --field-trial-handle=3908,i,4042721656331789222,3690220059174986638,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5620

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D0
1⤵
PID:52

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b569abebbaaf26f699fc69b66ce0f336d08065af2ccdaaca5421accc53b1c38
MD5 15b32961d6a7ecf7cfd3ed499d358e3e
SHA1 589fb245bb41b29e13242bd8947dc01c5b630829
SHA512 3a094a8184c961e25b25654d47755c2deb772e3e1b40c8e2d156493c5e3abf0dc6eed344ee5135af14f7c22f3d3e81b8799bc96aef8baa0b1a851cef7f08b753
TLSH
T183D09734A536AA91E01A813504A0360021260133359BAB8321A0840C89B000092F6DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dc421755f0cdc35c06ddd1b580c56162910bb4f4262e127f075f9317547e0547
MD5 52140efeda9d439eb7cb46042dc87df8
SHA1 875b980575d7c7583eb6ec3d91b0f815d3120c8b
SHA512 529d0ffae14435bb3185afd2e68fbb378425194ac8605506ccdbaab7cbfa606e0aa8e709184682b7fc77c4093305f634ad174508747f202f2ceec4067ed7180d
TLSH
T1CDD0A774A315DB51D50AC135489177106673413174AFDE6360A1940C59A401892FA899
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

0ffd7f38-cb20-4690-9967-f9ce1b7d77a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0ffd7f38-cb20-4690-9967-f9ce1b7d77a3.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d9f9da5-b9f1-4c97-874e-6baa6a98a74d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d9f9da5-b9f1-4c97-874e-6baa6a98a74d.tmp
Size 414B
SHA256 3674a6fedb9d88146fb1b2ec0bbd1b357994b9a75059e14d7ccda27fe64287f4
MD5 e64615c0138ee18bff177f6d4ace47fa
SHA1 d602a350a5349f948755c387230247b691f8b421
SHA512 bc574b5d621852e89177a323ce7176cfc5684b01883bed78f6a0afbfcf2b4b5f8ecd74fe0a22449a1af071c91fd5143d2a38b38ebd74b276bb0a09a95c02c1c2
TLSH
T140E02BA6D9609C2709FD1B1D14184B46E79013172B50495B7A3CC24ECFB1636464689C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 941f13f73734b6659c69816d7a8c5f973591de5d86c62bd6be5f033013601bae
MD5 8187b7bc2d52eb57d6b6bacf5fa20cdd
SHA1 7d24b9aa6eb6765ae85dd5b646327bbbee4f45dc
SHA512 51ab1738a25b4cb5adc3ae2cbf292378d94d7b9c5cad2ca74706a89ef79fc67e31e99ae302c6f2a8d5e76c12094ed6165a720abacd4734fb34e796ca66e37c1c
TLSH
T1C5E0C0D858CCC21FFF04614711A8530CC2913B8EE3CCF899270484893106840E6C3950
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 dc9a8d8bff4299f19d7816f155a553a8b67f9afd20575a83f1c9a92985725e29
MD5 18fc3542edd93994532e2350b81d9537
SHA1 a05065fa5ea6bce24fa5b7ea57e7e708af729abf
SHA512 4fa8fce19b54e098d641dba5ffcfdd7cf6fcd3bdcd5b0954fe7b8458bf1f274b4d1847b000cad38ba8ba842defcc82dc82eb168780c7e8e2a6af1ef2cf648242
TLSH
T14B5152530321CBC1F3E245B260E97549BAF9A8590627AE01834CAD789D72F0C91F9F53
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59931e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59931e.TMP
Size 2KB
SHA256 f95a85f3e4576cafb4778157c31692e75e9079440fa209fb05e849f90fe3dc9e
MD5 bc25d7ff0c72cd66f8f586f59fbda73a
SHA1 56eb7aa7d22f88255c600871fd5bef6c994e1642
SHA512 ee678d4c5fea8cfdb64b16245d48bf2a9fee8b57ac53959729ee25ed4c7bdc23ef128abb89f3a94622d2639a169f0008f6a06f7d3f2a9194768d9a236f88818a
TLSH
T1D55152530311CBC1F3E245B265E97649BEF9A8990227AE01834CAD789D72F0C91F9F53
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e91db7397e6ca8dbad2cde4a9b63515007602fcb25a4181c540c39a2991678f5
MD5 3962eeffc4cc2669c309ed16196310b2
SHA1 873938ad36ac4314d464ed17889e2ea386086559
SHA512 3b2d8ede1620939559b9e9fddb7312c6a1964785e88dbd253224e06b7d23017e7f82f6de02c1d4128491f17a4dfadd631e477acc61e4d75092e075e524bc2e70
TLSH
T19041AEF787B4957E8E1196F0AA146E1FCE1D0515432C7C6A85E0AE27D3F3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 80ed6c102b4d900538c86c09d022b21e496a01e0854f3b09f231d7fdba51c1f5
MD5 0200d08ca0effb2c020378e429fe6543
SHA1 19d877e2b1ca0b64960310fe8bcbf32b12c1be68
SHA512 9ef1b88843f09f61fff2059a35d4494b6387f9efa938e439532027ae9a7956a92376a00e9966659ca0d30c41048360b426748918cae9e62b3fad76b74c052850
TLSH
T16941AEF787B4957E8A1196F0AA146E1FCE1D0525432C7C6A85E0AE27D3F3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dbb0bec7f196b3e3ba31c907f9d2601d9d54c54714ecfe417af8eac81fe71b0d
MD5 cf59f7a72c26e9b1bcd75f865e8e4964
SHA1 d0ea67f5f8a7232a34ea176113e68379a51f9e34
SHA512 9aaebb3604b62b64ae2fd07b5ff3b2328eec990b63827f15bfd1c7fef848316a6edf3f7c2833c7248cf59c46b3ce053f250b2ca74066fc2d947814153c2a001f
SSDEEP 192:sxR9RqOz/fJs9tDde5lSKzoD8pi/g6+WNIYCtAuOsG7IgDfJ:sxR9fz/fJs9tc5lvi/5IsLV
TLSH
T11642A616AA28A93B8CCBE20DBB557F53D7F9503261911E58E7FC961C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d4830d66d15d32a77d294ca4828ceca7d24330ab2c649bf0ad0ca0471556a409
MD5 c2b599c2074d3e3c490cf5f4278a97ca
SHA1 5d3a39238601882e76238d1af10aaae3dbf240e3
SHA512 aedea841dc96c1aa0fd7420be3b8b0eda3c2413a608df4321b9b0703c9a9aae7ab390bcde5bbfab05300e70c8c2831790afe731d6217087a86e52c3814b372d1
SSDEEP 192:sxRyRqOz/fJsgKDde5lSKzoD8pi/g6+WNIYCnzuOsG7IgIJ:sxRyfz/fJsgKc5lvi/5InLs
TLSH
T1213296166E28A93B8CCBE20DBB55BF53D7F95032A1D11E58E6FC961C04EA6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c89df0d253b95e2897f75e9fa3aec5e843dd4d60c9067693570b2d6690b48621
MD5 047972830551fbcb8380eff32b3b2f59
SHA1 12fa75f61b646c223dd0e547ebffa6cf19c9acfb
SHA512 ef73fd1d543938ec54bea13a648b546de48c46d3215d53d0a9dc3b599ddd78ba425d204602ac21b9319fb366c0bae94e8961fe1e49e8fb2f1e3bf74d25cfdc73
SSDEEP 192:sxR9RsOz/fJsdWpVetDde5lSKzoD8pw/g6+WNIYCx1uO+rg7IgDfJ:sxR9Fz/fJsdWvetc5lvw/5I3+MV
TLSH
T1FB42A516A928A93B8CCBE20DFB557F63D7FD503261911E58E6FC961C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 959892605075519979bfb3266d24de6519eb9985432cea4810c02d5a58b737d6
MD5 b2b47cf50f17a125b73e95aebb4bd1a8
SHA1 0a00665833ae5df3c6fc6443a285adf2e6952be1
SHA512 8058b87bb89fb375db7d195686f27c9acb41328fabe74dda89774edba405a38a2e63c741505d76173cbb164d120cdf7fa43efdf350ed35cf2e8a96cf25df0943
SSDEEP 192:sxR9RqOz/fJs9KDde5lSKzoD8pi/g6+WNIYCn4uOsG7IgD5J:sxR9fz/fJs9Kc5lvi/5IGLX
TLSH
T19232A7166E28A93B8CCBE20DBB55BF53D7FD5032A1901E58E6FC961C04EA6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 c7a39c3787ac9f3a51c3928a48bc2422d5775c4264a6124899114144917d7882
MD5 453bfd43b8b1945ccad7dbbef4e0fcce
SHA1 637933a2997ce8cb82cb6825ddbcebdbce627cf0
SHA512 e98b226dddeb189665e37e1f5e61b38e9915ece017ba299f6e9770904451d40bf5b5aa679ef8be3c5f1a08edac8bb80297b2e892a60bdf58972f37f63ed08942
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvKroZS9:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0V1
TLSH
T151B2EA2B600DCB7F5F800AADAC196FD76DA802CB97589D4047FED94C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1856727a-518b-4328-979f-4fab57550eef\index-dir\the-real-index
Size 552B
SHA256 ca3d1d8613dfe5cf4e0f212ec2d40c3ee822de230083276189fc6c5b38eca627
MD5 155e8ee085d7dba4d00c3d1310556290
SHA1 4ca678d485c4a266708d89b1706cd738f8adf43c
SHA512 f728151a15278c59a37bd14515a456e2e4f34d53f7443e27f83d90129fc65f3516c2cca831ef43f9c636925391c897cf705af1c52064d3cd6d64d29f6ff3ef5c
TLSH
T17AF0A39B5CA79847C92664BA15352547333E05FD11116DCB104D302995625384380641
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dd564.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1856727a-518b-4328-979f-4fab57550eef\index-dir\the-real-index~RFe5dd564.TMP
Size 552B
SHA256 99090f82d2c03ba9247877700df9b1ab689437c0ac70b38fd6ee74d10dfaf12e
MD5 7f8b5853a4620b12620c1064acc705dc
SHA1 f9d8f364372e81f208c201e04a4faa7f182fecce
SHA512 a6c352f314835fa4e3614814e5239b415fd77100d2d6fc1f7d8bed714ebb4da37b4d961b047a1304ccac8a7c8e0772167c6378ffd371d5f48350f8fddc88fdcd
TLSH
T16FF0F1F70091ED43D82554F521216017333E0C303115DA8B608B242A583277C8281A51
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 82121d3cf3202b98f83d8680ddde6f666146723cd66688635990612aa04e5300
MD5 d771cebd26df2efcc1412c0badca9b6c
SHA1 ec9a4737332cde3c07e27958f3a893947d04a155
SHA512 056ab5c7b00f4ddbd27dae766718b91b1f3607efbeafb1ef39db2225544a3574f0107b8663e9c348a6ac4ae385fe41ff70e7831b91e7e8a5239a8eeacb59c8a8
TLSH
T17CE0DFF62EFB2934A82F87F7187194E44149B9588525ED4E202AA2C710E1756245ACBA
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b4676ee7d6c4f0f78a8e8cc99710eb4b0b5e115d48fd055d250e111e1514eed3
MD5 539dd5c89dad5717db5a068c282cfe14
SHA1 edd5b89abdb3801b94d6aab32494b5bb404b5a3d
SHA512 2a7be42d17e177b39da33e8533b41fafe9227e4301564c2e76a4aa8c4d91a993c03e73412a8f29c4eab990701a5e446038dac0f8acb73e73c2bb19e434e32084
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHIuoIuZIusIu4IuqIu2Iu6IugWIueIuDI+:CbEBVj5JAdSp9/EgTK7j6dJOHIuoIuZz
TLSH
T1BA910804357A0290787EB50C807D8C2E86C6B4B33619E52B7B6846661F66F47BEFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a9b95.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a9b95.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 409669bb76638e5fc53d0c7a22a87b7ba0cbff337e78e9663f4181888ec212c8
MD5 6648ffaec39fefe0a07e562731eb07e1
SHA1 2e254ff2412f1d2b323779a629267026ff8c150e
SHA512 085da8db278de3b72425f1622ccf747472ab6a0d7432ed826707edeefad7bda8e2a163e37cbc54081f62d8dd8af7aadb63e185593fb3e4f012574bf94b021670
SSDEEP 768:Eg39WKty9oGmp8+p3bd66j+4BRv86aLIWBhy6Dq5:Eg3qCGQ8+p3Z6n4yfTu
TLSH
T14CF2BF72E8A49D339CFAD644B6873703AFF8515396C41ED4D4EDBB1D00972AE130B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 50d0f2cc1a47cd5ede75f629f25b7701bfa94444f0c51530c46d0c2200175048
MD5 c74dc4fcd31deeb5ae7fccab43105db5
SHA1 47553490551e0e23f1bfa521e971bc557fd468ed
SHA512 a5749402c6464400ae1da348c574ac61a8aa830fbcd683b4f38a01156a599fbc85478390b6be555db0e58a892c3de51f4eaa58fee77edf880e87d616374f3c55
SSDEEP 768:8g3yWKty9oGmp8+p3bd66j+4BRv86aLIWBhy6Dq5:8g3JCGQ8+p3Z6n4yfTu
TLSH
T1B1F2BF72E8A49D339CFAC644B6873703AFF8515396C41ED4D4EDBB1D00972AE130B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a1487a4b48f3caef4d5f36be4608e2be83c2933f3034e8b739515a4ae2e282d0
MD5 842d2a81620ef31dfbf0acaa1cf0fe83
SHA1 eb3a6af602445f23adf664e663fdfab77deafc6b
SHA512 4d6e297687f12e45444d3ab69205bbeee43c66c1635e932979c1f04759071bab980a039e4c858b5dd10d70743a7c2c8b4391bf4cc8eb897d417e7e5b2d11e271
SSDEEP 768:drv+4UNbdD3JkKty9oGNp8+p3bd66j+4BRv86aLITB2bwCl1:dbsbp3UCGL8+p3Z6n4yk0ww
TLSH
T16E03CF73F968A9339CF6C644B1867A437FF8519396C00AD0E4DD2B4E409B15E230B97B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 633886338a1a60e43d2143cf9b9f657d88f87fb47dc346b799a16b137ebba94c
MD5 2f70e5399775250583df3687873f2d00
SHA1 b938056969499ce1af418531469e14259a69f3de
SHA512 f973a6516dbda096d49d1f4c0c78c224e0a6d6423fae07c957aeaca5fb599abf48f9382d2e74e2734976f230bd96ff0a89ebec7a7e92a3b1f3921709926f02d4
SSDEEP 768:MFoe3XwglWKty9ofp8+p3bd66j+4BRv86aLIWBhy6Dq5:Ne3ACx8+p3Z6n4yfTu
TLSH
T12703AF72D8A48A379CFACB84F69637039FF44163D6C45EE4E5DDAA1D00871AD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 c28d5676edaf132bf57823e7cfb92c71cf1c7953b13fe7fab13e8449476098d5
MD5 109b902aa2f0771753a1d1259007fd04
SHA1 70a2b3e85b60fea25cab6d61e3ebfac53f010199
SHA512 d1eb72ca3c6f1dfec61410e10f8317a74f0a42105a51a53ff502d26cb8f834d4002a65ea65a47f5089e91aa7cb680e7b0012e0a722b60e0e48eaaa4f8ab341cd
SSDEEP 768:eFoe3QwglWKty9oOp8+p3bd66j+4BRv86aLIWBhy6Dq5:3e3XCI8+p3Z6n4yfTu
TLSH
T1AF03AE72D8A49A379CFACB84F69637039FF44163D6C05EE4E5DDAA1D00971AD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4d00dd84a6559b0961637e2997bb030170dfda301f2fd476292f8c27b569476a
MD5 74a5c24b738601d37019165d111a1ffa
SHA1 8890724687131a27bc24646610bfe94f51c4c181
SHA512 b336585c7829614d7f65a75cae7a4650f9505d8d52013e47673e089c2819fb67f8a58f16450549283cb76075673a27885794af1274b1ff8529f36876527f41c0
SSDEEP 768:043iWKty9oGmp8+p3bd66j+4BRv86aLIWBhy6Dq5:043ZCGQ8+p3Z6n4yfTu
TLSH
T17AF2BF72E8A49D339CF9D644B6873B036FF8515396C41ED4D8EDBB1D04972AE130B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 aa7ec5d153e13fc713dc84ade50fff7ff4cd5fa3125fd9db125902ea76ccdfe8
MD5 371ed87aa990cef5391917f052236313
SHA1 9a141842ea0241ded949b383960e5ce572b5bfa8
SHA512 03d54f4de59bfda1a76243bfc5b8241fc46aa78de3698dbaaa022bf362b01756c7729143fe165c97e0640df7eb91495a9bea5586485be82ced9a4b58e8c83cd8
SSDEEP 768:eFZ83RwgzWKty9o2p8+p3bd66j+4BRv86aLIWElK7xjhMhy6Dq5:K83ICg8+p3Z6n4yOlK7xNMTu
TLSH
T19B138D7ADC94893F88BEB708B28E36129EB80173D5F049A8D7D95B0DD07219DF70B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a68d236ca7eb7ece8a3d673686b7be216c940dc77bb1e441dbf7a25e9e8c0766
MD5 0b740fa63c434955810f228043931297
SHA1 c5526ef7ac7e4f3f09a673b65ea25b4e0cf36ca7
SHA512 c4527e6cc7108e6fab089c7814af82435ff9c13b8194e546404e1ff7fa36d0c220ec15953360730a1c73b120c20a08259a30e636963da1cbea680a289de76c13
SSDEEP 768:Irv+4UNbdD3ZcKtyZNp8+p3bd66j+4BRv86aLIii2bwCl1:Ibsbp3kZL8+p3Z6n4yI0ww
TLSH
T18F03CF73F96899339CF6C644B2867A437FF851A396C10AC4E5DD2B4E415A19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6df72ae-199a-4a52-abe9-ea7609efd88d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d6df72ae-199a-4a52-abe9-ea7609efd88d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 dbcd62e1e2fbe6727ad1da5e8b7e889d847b5da66a0174d403a30e0ac41d37f0
MD5 86771eec6343069d3ca371d333411f89
SHA1 ad54b013ad2b40a7ca2d67f03e0de2ee5ae5a7c4
SHA512 e44cb04ad408a37158f48cefaee9d3ea866236b2dee3928a27ff3b1811607a3a961130cb5bcdafd74abe9132524623935c9a78050c749f779eab222c13dd886d
SSDEEP 384:h1TB1GMm1i5y4boa0rsPrXeCJ62PnBIAyF47Xil30f/xlPs43Pd8ZbhNT+9:7TOMSIrsaS4rVrZIAqUSl3Srs4/GZbhi
TLSH
T1B4727768617F6DC7D8D122B410D602E7FBA4E08CEB755198FE27CD3B1CA1ABA5B60520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 c73f90d3ea27fdc3d6c5f5f477ec55c7b578bc48aec734b9eaf7f1febc4a4681
MD5 3fda0a0dcd354d9998a621f6ad3a705b
SHA1 d810e351255f897a0d7cfa8a9441705bbf3e6b0d
SHA512 206c4449e98b5bbdab379c247740615d0c77b924166e4f77d9aa80cb77f596eb5ea3a5b86ee60ffc8281fa6ab95b26c7caf40463001fe4ebdea1d7ad8dd99f63
SSDEEP 384:IR1TB1GMm1iF4Z2smJCDRFR2P2PiUDzdCN6F47KnlBWfpf2esMtQoIK8wMbhbzu:eTOMSMPsmIRWu6UFC8UKnlibsMtQo38i
TLSH
T11A72F81C56AFADC3D890227111C5039BFBE8D0ACEB71915BF98BCC272C55ABD9B900E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msfs-install-report.txt

Path C:\Users\Admin\AppData\Local\Programs\123flightSOUND\resources\msfs-install-report.txt
Size 1KB
SHA256 9ee3042dc58019a8e43f72bde09e319681aaaca6be126ee7a298abfc27123889
MD5 eb6b946cb76bdbe98abdb6936d04e62a
SHA1 459b689d5ca5e67d6bd42999d23dc3a72962c7b7
SHA512 c365feb05289a0ad16cea8bdd8ff9ae1b26d0f602b9be4f70952bde756f72e7e9b549d623d00d350e6b6a8e6af505d1118ac916b18721fc83c11c3dd5ed5b7e4
TLSH
T11111358A8AFEC26E8C5FB66F41A1EEAC005AB183374027757B71C58D70C7D4CE993416
MD5 SHA1 SHA512 TLSH

Submit Download

123flightSOUND-install-msfs.log

Path C:\Users\Admin\AppData\Local\Temp\123flightSOUND-install-msfs.log
Size 1KB
SHA256 c6dbe2b87ef128360b76795543761f57d9cb3e8d5df0c10204b546713974a51b
MD5 2bc9d499e62ce9848185b9e365862f69
SHA1 093d43230396b41a88fb7ea7353f659a58b016c4
SHA512 a94202ffb317d1353d921ed3f585ecb886654b92269c71598f21dc10191a86a0ba67b292aaaa5c62a5fe3549d397b18537b841b2b9c0849c90a695783a11d244
TLSH
T1AA21568A8AFEC26E8C5BA21F8191EEAC010AB182364057347BB1CA8C70C3D49EDD3412
MD5 SHA1 SHA512 TLSH

Submit Download

9db6d3e1-9a33-430a-879f-9f7266cc8619.tmp

Path C:\Users\Admin\AppData\Local\Temp\9db6d3e1-9a33-430a-879f-9f7266cc8619.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_1t1z2dou.btl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1t1z2dou.btl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b49a5278-3f45-4280-8309-520c2d353c73.tmp.ico

Path C:\Users\Admin\AppData\Local\Temp\b49a5278-3f45-4280-8309-520c2d353c73.tmp.ico
Size 30KB
SHA256 627be502be146fdb6e9eb1c50386180c3d67b304c5fd163cd8bb66e1f618f4a2
MD5 465f80faf1bd4558aec478e42ea2055f
SHA1 44fd6b7b463194e696b02d4e30cf62ede3d0d454
SHA512 ec3b4181c78de272f1195412347bb6859a93042290533963889c1c00a850bc22c5e19c49e1d702f3822191718a869520b0df9a3a6daa8898760f6b3251bed67b
SSDEEP 768:AY3O1kjJbBydtD8zldswO4dIpF6HUL/NG/jYAu:3QkjJbOtD2sf4apFwBu
TLSH
T156E2E0FE5B8C0029C7D2EA7162479458D878B3AD4F8297BD06B6C1A0B0ED78CA1FD407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\LICENSES.chromium.html
Size 9.8MB
SHA256 c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb
MD5 0ff177fbf2a3873dd573077840e0b8f5
SHA1 03d06bc7cd894399a5fc6600a0210f6e3226f92a
SHA512 3264becd3103c905ab7f9cc034320885f18cbecaa45f582a4a9567ca4bcd620d64dc59fb03532964e775c35f07928a4497f5529cf1b9dc18379e4e9cff02ff8a
SSDEEP 24576:K+QQM6Ms6x5d1n+wRhXe1BmfL6k6T6W6b6f6V6GeGj/3BIpx:LUzeGdY
TLSH
T134A6A52F7B48037706C642627B8BA5CAF21E903F3B561654344CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\chrome_100_percent.pak
Size 146KB
SHA256 2fb9826a1b43c84c08f26c4b4556c6520f8f5eef8ab1c83011031eb2d83d6663
MD5 6c2827fe702f454c8452a72ea0faf53c
SHA1 881f297efcbabfa52dd4cfe5bd2433a5568cc564
SHA512 5619ad3fca8ea51b24ea759f42685c8dc7769dd3b8774d8be1917e0a25fa17e8a544f6882617b4faa63c6c4f29844b515d07db965c8ea50d5d491cdda7281fc5
SSDEEP 3072:izwJCGIekwusTAaegpIPMKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:izw1IekQTARgSK18Gb0OV8ld0GecQ3Ey
TLSH
T1CBE3E1D7B7F4ED7DCB9B56B3A21500B1ECF346280A91424A168ED4763A76B48DCC8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\chrome_200_percent.pak
Size 220KB
SHA256 83d9243037b2f7e62d0fdfce19ca72e488c18e9691961e2d191e84fb3f2f7a5d
MD5 77088f98a0f7ea522795baec5c930d03
SHA1 9b272f152e19c478fcbd7eacf7356c3d601350ed
SHA512 5b19115422d3133e81f17eedbacee4c8e140970120419d6bbfe0e99cf5528d513eea6583548fa8a6259b260d73fab77758ad95137b61fe9056101dd5772e8f4a
SSDEEP 6144:SDQYaSN6svyd/I8M+RgHgx5GMRejnbdZnVE6YoppO4:3fSN6svydl26edhVELoXO4
TLSH
T19D24E1CBA3F49D7CC96746B3622A01F1ECB215394AB6420B17DFDC357A55AC988C9383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\ffmpeg.dll
Size 2.6MB
SHA256 18b1f088c7a1261c5fedc46eec98f34e79655128110a6f6c0b9bf62be22dbc95
MD5 7826cf6f81ef54e9fece6a9d5a0b7bba
SHA1 17f0ace5f39dc276790ff4f427f3112de9ae9baf
SHA512 1db8e1fb6da58401d384e26e9353e5461ccb8d5a5d98fe1cdd43455d3813358b3fcc010d30090f78c59d739a4bfd84a77a0c4eaffa4f270460964301d5c6f4db
SSDEEP 49152:VC8lp7/1UNZrhOP9YJQHUOWwGen6yfW0OfShPdb5x:ChOVYJiUOWwQaPB
TLSH
T1F4C5AE02E6D904DDD02DC0348B9B9223F63174468B24A6DF1A91CA253F6BFD46E3EB75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\icudtl.dat
Size 10.2MB
SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
MD5 74bded81ce10a426df54da39cfa132ff
SHA1 eb26bcc7d24be42bd8cfbded53bd62d605989bbf
SHA512 bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
SSDEEP 196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
TLSH
T19AB63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\libEGL.dll
Size 469KB
SHA256 76efadca4ef6d2abe6ab3701b4071e04470eebfeed8d8d22c7252683bcbb37b1
MD5 f8b7a8587b0826f969b2ccddce77879d
SHA1 028af2adc8d467fab7d9d1ed620dffcb9a4bf3d8
SHA512 fa7b8903aae02f57548754ff6ed8ba8be35e4b18a2fb06cfb9246a0c67105650f08cf9284521a291d387e5216e32533825a4a41d7260a4d80a27c9e35577d57d
SSDEEP 6144:DmfOX/zRR8yWTDLMoqbAIbqkpXy0/KQPJVIJAG:aczRSyWTDY6IlpXy0/3hcH
TLSH
T13FA48C1177D444B9E06BC134CA534642EE76B8960F65FADF02A492392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\libGLESv2.dll
Size 7.6MB
SHA256 150a02e43426a0886f023e88cd88454fb0e78696ea3881347a6256920c7a02ba
MD5 c732c32f5f2f8736f9141de29cdc2a9b
SHA1 d4cfc6caba27f21b75eca36d7e4b5145c7eea7d8
SHA512 a55a09f63cb1c46f31e24f42049c8374f6adef49c6a69da136b37807efdb912730d63f712035b0214688ae5b86f02f828b9ec326ccc9b4fea65227ca1292cbe2
SSDEEP 98304:OlaVNd6hP9OPvwfWm6sGnoDgCXm3o7KXy:dClGwpvGngCuK
TLSH
T1C4867B03F29640D9D04DD2B59B4BA223FA35B8850734B6DF269413253F7BBE06B3AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\af.pak
Size 481KB
SHA256 716e296c2f663ad90cdde85c5134582fc2305e5ebe10649fc9653bea533500a6
MD5 94af96b7f60a4cfb9d596cd8927ba37d
SHA1 556833517bc6ad77b5427000f2c3dccad91b92e6
SHA512 6605688a373a358ff1dfbeda1c09dd031e4a63de662555f5304843c31eb3afcedbc8ffa4dae8ddc1483b04ea24cb709ecc639a9902caa68731d8e44d04cdbd83
SSDEEP 12288:Fio3WJBL9o3w7irJGiCJYR2+H2JynyaI4IR6ro0v7ENgI2CRwHM+2rs3e0lOX5gU:SL9oA7eJdsYR2+H2JynyaI4IR6ro0v7e
TLSH
T1E1A41B06EB84273D09A07296BA0846F7BF9CB26CD770B2B6DD9D82360566EFC017D1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\am.pak
Size 782KB
SHA256 9cff5c4af5997b45fb2a384bd73560e56bcb7710149e1a7e3e172d64e6eda025
MD5 34b24f035bad74764b7cc57420488180
SHA1 fac3fdba1a94d7676ac4d71447178cfbd1fa4e82
SHA512 a01da4c45c6295a57248603f01a6b6231c4ce400aa3ec94e4228b26e8cea995c31d52b2008f99d0f17482aad80f1d67725c32e0f37cad6b012b1022ecde998f0
SSDEEP 24576:lHR3bNjTZRfxxF1GCj+Fmtz1L5KJgDHVHB7yPGX:ltJx59
TLSH
T1070599547EF9F7570F8E8A19A4310E4E9594AE4652803C38C35AE3FC2B2DF1B4DDA219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\ar.pak
Size 855KB
SHA256 516584da5741e7bb49ba6a70c9cf2ac47ff190ca9c4f692c3a30bc03a4560f50
MD5 38b30dfa8ccd369c747c46bef204e2f2
SHA1 047976a9b0aad536cc61ac3dfbc37b20f39ecbf4
SHA512 5396af2e915808abb6f0ff8c4a1c3a7675e620687d717193d5e69905a070accce08925b7e243b54b922e1b022fd6210884fd12b18681e1b7d08f28c542cc4c3c
SSDEEP 12288:TfDNBjEw/0/R/mARz4bvPUgtR3kYG5dN0W3ZCMmXY:T7DWBz5r31
TLSH
T1A5157BE21B2984720B96DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\bg.pak
Size 892KB
SHA256 d223e994ad1aa6e747507187f724cdede8c369d2e8e0def50c4a6c912dba3880
MD5 d08e8e493f0b3c8ab19070ab05a78af8
SHA1 c5fa430269dc2d32baa6885de2453fa84c36f2fc
SHA512 4b415fa2ae6ba399674f90ea67e571d90a35fff1ce93df77f20bf692b52c92bfc41e5a3622776e3979b1662fecd2d9665209d5d1d53ece1bff3ed01a28e499d8
SSDEEP 24576:ixiUOgGCBfqWPnLYazQkEC9U3VbvcHU373ZjH3aAKUGVDoIglumpod2OQ5cGF1YT:ixiUOgGCBfqWPnLYnWU3VbvcHU373ZDw
TLSH
T1161524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\bn.pak
Size 1.1MB
SHA256 1e49980f89360b395a70e844ccd0c43b3a34eab84461b1499e7621f757149e3e
MD5 696016f43190747d63befa354d76e50b
SHA1 3399e641930b820b627a4e28dea0a79fc457f929
SHA512 3966fcc5988ceeb4dca79c0053fb428e5180029d44704faa4723334c69413a6eacf622e637857c1dcc096e129dd84e2369e4595ea50316cf8eb68696611a8430
SSDEEP 3072:tDACbQFusRUVOA2nRRGYUXay5b2cq/j90Yuf1i/QfqTNl2SQRRBbJ/QL5I2DbMJQ:tJbQ401nRRlwR5LPqTNISQRRBb455bR
TLSH
T13945DE209C6E91B2A8C5CDC9434C6370C5236E9B9B65F74DDC17A25938ADC3C8CADDB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\ca.pak
Size 542KB
SHA256 7e8b5bd0a7a9835f20130ed17fb68242d7eb277cfaa2be6407f08c8d0dfcd500
MD5 1ef1e76e7028cf6e0b1f93b3218feddd
SHA1 20c76258573d7499889147b5532a919a827f6de7
SHA512 7e1a7e8cc5e5a2d32192dd38005553961037501a3b000210d92a8796cf65e025c60674d206bd9ca6a9dea5007ae322b2f87b233046d5dc1b838ad3e5b5ad91bf
SSDEEP 12288:o9R7tRE1Dvkd3k5PqF4N3Mw2juwHzejm0t3lvybrTsn/RCHWIsjc4jlLEY0CJkoV:o957dPARIeCPMNfXI8C5UhWal
TLSH
T1F8C4F9239FC93B6744D2330AFB46C217F48CA9847B06D254E4AE1B1622CCADCD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\cs.pak
Size 558KB
SHA256 21916011c2668389727c8970e1407b9c0806812effab9552106da963951d9f27
MD5 c942efb2a8c25205b66a056028a8bda7
SHA1 30b74bd9398e330ce5e4f4d3eb343a4e67ee0a41
SHA512 319fbdb304912b5628c0e5330416f000c6e0090e26a60ed8005a66aa5ba698892415ed3dd0e4f4ff8afce7986566d8557b76eed15e493f01f889b7a664180cf6
SSDEEP 6144:u/psEYul+pKqZBznoA10nDA+AO5xDzrc/DNOOAzSBlmPy18Qu:apsVul27roA1A55xDzrc/DNOrzSLmPH
TLSH
T1BDC4492EEFA36525488002497BBE4128BD1E83540B2FB5BB6C8F9C91217577ACFF4D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\da.pak
Size 505KB
SHA256 10dfa841d08a3ab094f83e151fdc1edbd66bf8f2392f1511e325628e4e9c7a0d
MD5 4345285a4690b023767e352aa2a587f3
SHA1 9646a3a5662f2bf233e553e51e7cddf6212f8fd9
SHA512 2d466e285b44eb0c30f1847015c0056a517dc1dddd4d49c907f070eef5f071d81286cb0834c2a30253d8da9eebb6c6f34271f49850e9bc0cfa7dab0eebdad52e
SSDEEP 6144:j3epfYF7e6DZgzVZsA5hbqWj1se8jhwlRfxJwe7obR+uaAIV5wbeMcLotd44Fbwg:j3efY7Yq5j0Wu5w6MnL
TLSH
T1D4B4494BCC9C732F89A94B65F3108EA7EB5D543CC684664F64D8943A0ACFD6093BE1C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\de.pak
Size 539KB
SHA256 400f965d457e958b063e60131d88eaacd74fdb6213ae14cf84c4b6b45809e04d
MD5 be9b3438f622428f971c92cd84681750
SHA1 80278ec6889973ba0fa47e542fb3e85ee52a3534
SHA512 8ec4388dd11829324f72b2828a4282cad5205488d4d47d90da83e25fd9f4b43d1aca1d67f9470a93fb0a23b21094b4c17dc68247fb285317dfd2b01f8e312cac
SSDEEP 12288:qypfwKw/chC3K7Up0gXajTPyt5EUnvtCC3:qsfpwUhC3K7Up0gXajbq5bFCC3
TLSH
T11CC40713ADDF625EC782B3613305CDB77B19E36BC346312684EDD12B624B5B283AC526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\el.pak
Size 979KB
SHA256 58ca76aa55e11a475c830ac89010d4431f455f531079c1e8a0943490b4dd8e4b
MD5 271c3234e3a07223e6db8f6ab1c18f92
SHA1 dbc1ecc686eda75627f3fa60d034ea4021da0acf
SHA512 50e6fab168889a283e26eacd7731367032db41841f39fef0f99543b98266c3784ee62a956cd4415c83a6fb7451b3f618f4f3dcf9807cf9b0f2f595ce26e24aac
SSDEEP 24576:JKZYcaPdGgxh1hxFGiYX9nFJXDsSASmqHv3D2Np67Tj5eAVH8yeSd8Ct2rDQu3tE:JkYcaPdGgxh1hxFGiYX9nFJXDsSASmqp
TLSH
T11325BFEFB4582DED8086950785D8F07C2BC66D6CE749CBD86229CB60BDF90718622D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\en-GB.pak
Size 439KB
SHA256 a672387f6fb84ade1b0c44c456ff1a19dcd464c4a9e65e439ca95a115455340f
MD5 b98c06126d26961d99a7ee6e397afc94
SHA1 bb5249dda1029597c461564798b77efc1fc0d402
SHA512 ad3783d03e3e7bb343eac48f179a3e3f799146a8ba7b25e2a02e860c53738b01518dbf5e66097366f0b7202e6c02dc046c6b51c116115cffc02aca3ed962951a
SSDEEP 6144:/2ARv3EaVtxYS3GjM0MP9eMAHMfaYnB/Y+/5tDrhBcBRyO3:/jRvZVXYSF0MvAHGt59rA3
TLSH
T1FAA43C1FF744226A069311627B0AA6A2FF26D06CB35112667CBD802C33B6756C3777E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\en-US.pak
Size 443KB
SHA256 95fd54494d992d46e72dad420ceee86e170527b94d77bfaaa2bfc01f83902795
MD5 88bbc725e7eedf18ef1e54e98f86f696
SHA1 831d6402443fc366758f478e55647a9baa0aa42f
SHA512 92a5c6cfc2d88272bb5144e7ee5c48337f2c42083bc9777506b738e3bcb8f5a2c34af00c4ccc63b24fb158c79f69e7205b398c9e22634dae554410450978a2c4
SSDEEP 6144:hbvP4RZJvMeriSIgRMP9evkD0faY0+p7W5PtrbngQH/2z5wB:hD4tEuTRMGkDtZ51r05wB
TLSH
T1A1A44C1FF7482269069312627F09A5A2FF32D06CA35112567CBD812C33B7B66C3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\es-419.pak
Size 534KB
SHA256 dba56ab390a959dc40cb79db195e4ed6b17d4009235063f738b9ebcf41c4b5cf
MD5 aa187b593ff0784db94718e4bb7aad2d
SHA1 fd0a95dcfb08cc6e85a4b61e13e2be705f7cac8a
SHA512 66f38fd0c6c6c2f87d00a46c41df57e82c11f260a1cf247e95182628b62f143a6707034f77577348f46a21d633966ff96e5a568cc9da587ae6bda77715c3fd1e
SSDEEP 6144:DbpEr8BMnbVP5mgmpuYYKBoA5z6yLugjnaR:PpNMnxwpT95z6gulR
TLSH
T103C40922BAC81F5310E2A389B743D753E4D89545B408C29BE8EB876562CCF8CC977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\es.pak
Size 534KB
SHA256 ea54cbe126cdd85b2799ad9600b86ca98c994e69251344163037139296ecea7c
MD5 fe679a1a0332b0f36183421a0a41a478
SHA1 7230d8646db57466b07a0d700db35838e5030481
SHA512 8b5da5c0e2c55a2dc849050a7d092c78d4bf4975c885ce69d360a0245b1f40bcc9c4cc6eac67d83a6e98f77eb84e1401fc025ccba058be94e962e6f6627c37fb
SSDEEP 6144:+vz+kXQk0kYsAyf1RrXOWO8g0Hkp3+c4uV1OnjK5JAEiufMto6PZjHu:+vLXQk02AC7OSEpWuVUnjK5FiYMrO
TLSH
T173C41822AACC1F6340D39389B743D753E8D49585B408D2ABD8EB876652CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\et.pak
Size 485KB
SHA256 3610615dcac844cc9a64b843da606f4f8d29b1c945ecc19b288b54829d0e92e4
MD5 818d154524c0c900d15a8a25b3659c14
SHA1 4121be86ee3869c3c884e3467d82ca6b8f4ae0cc
SHA512 1bffdc771102997bc16b3b5fb01ba009a61a85e7d9c53f32a2b2e713ff70f396a9be9431cc45ebdd28dc5eda43490b8d8d82866b42acd32f49e6368ec0b779ce
SSDEEP 6144:sHrGl6E7WdyJ1HNR5s6U+VX3/Fb0WmFostTKIYOgPNiZU06H5iWFZeiCKM8af5tZ:sHr5dQs6BnJmFosS06H5iWpW
TLSH
T100B43B42A17D771B182412F9E337AD23CC9EE7D9B4000D966C974A1971EEF8C38B6B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\fa.pak
Size 794KB
SHA256 34d79e8a7fa478bf3b350412160a59249e87d31932d728f0167cee89aeff2bad
MD5 08fcd4a7e857c8b42e61152e437566e8
SHA1 018c041227f307fdef2fc38b42a598b73992667f
SHA512 8405365949f31aeedfea0ecc7634abc81147b0dc163ee432f294926acfed3a71af469e2f4427dfed2877bee5fd38f5ffda6793d564f11c8ed4a6e64a78529d35
SSDEEP 24576:Ep8u313uyqoT+seq+LRmX1loTUOmdAQifaQ2XxFMJGk62ahZdriMHMX9OXndpxHV:E8F5It
TLSH
T1A105C3956AAC9AB16757CA0341D33834C773EF12D34DFE40ACA1076609A5B139F4EA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\fi.pak
Size 495KB
SHA256 01f9669cd2fa17965f882e2cd81c39fa2face2f13ba4f024c3799f1841111ffc
MD5 32391a1b0d1bf56bca591971974e8fb7
SHA1 b578f82db8f42d9bae763320abf7c8bec886ca07
SHA512 06e066ab26ceb75d157b35bd283a55f40e2d15698c3f1b62c6596586975e09f5f3fee7d765b10a667b98b347d92883124bbb0f436edf7addea77871542f44bf1
SSDEEP 6144:KK5UU9l19uAA8NWSy8Jrhh1R+gsp2qiOE5ia4BVLN5oggkW0b2epyWacz4EiHTWL:wU9l19nAh+haaa5oggkfb2epyWa8mqYM
TLSH
T1BDB46D915219C22137C8C29E79B0903EF5E9E3DD8C288D96E847C7D849DE9883D7277E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\fil.pak
Size 559KB
SHA256 3265ae5b6c16a09b1ec9ea53181de78df75e951c3ce28f33d4c483088a9ab37b
MD5 4990033756bc1b2410e77a607bb62f8c
SHA1 a02c0f347606bf50aa6f281e42d2d66ce6155299
SHA512 3d45c6dd30eea6d6929039c0cdaa7bb6f7b665fe67fc7a5ca79567d4fd3f907011857e5cb43c16cce9c558d4f669618bc5378f05fa583b19360df58b12b5f913
SSDEEP 6144:s6Sd4uuakFu+z28qQysDQj0A78u0enG7Nmb519oWMoQSARUqK:lS49Fu8MYsb5/o+
TLSH
T175C4B71577402748DBC352E51360A82FA6E560B83F823C6E4FBF269B6BE7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\fr.pak
Size 577KB
SHA256 8a283001240c59a552945d0466e3118dc125fbc9f1a10bdea4ca4197460102ba
MD5 1aea0f212cb96575b119da1f7b84633e
SHA1 3d540d9f7fccd4a5ab03824e3b4894aea6b7ea48
SHA512 be10aadf5a127e7cd354cc2620e162e377e7263ae7c97ba1f026e9711cc8e9655d7a0bb2327ec1f09eb287f68ad4df9ecb133bc6d72adf9d8a5cd6929fec51f4
SSDEEP 12288:080jfytLjZLqtHjp7gZy6QuaMVWXKz30glZtZRMYnYF9L59ujzx6s8hxMJSWtl49:NEfIoIVV3l50X
TLSH
T158C4F65FADD432CB1AC21277FB12D663DD348248F216E340D89F4295129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\gu.pak
Size 1.1MB
SHA256 74c62dca0b7a310aa593d1dcca8b0b0b382b052837e7cae6b87cf05b8b346b1b
MD5 86b829b3cdcf383f11ffa787a32446a0
SHA1 c9f626a97bcf00541876caa7a49d23e0b84b83ef
SHA512 72b69cc9846fb078a8c03afd60154a3b55bc828b9e13b5124a473c0ee528e3cb3ed67f67d7d763ec8e78883640c53d4c88a7a14552b851d493abf65e269353f8
SSDEEP 3072:BMswiO31g+I5PcxxX+ZFP8TD8TcIq1hHIwjAwREJKVMjNiT7llj63rFulPCpMi5Q:Aig6+I5Pcm/PBYIqGEjMx+5qRV615FR
TLSH
T1AF3518D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\he.pak
Size 696KB
SHA256 25281efad59a66f310cabb92da67198451567da553f2c437e52388e8fd25b9a9
MD5 8cac9a900616961967ba5d0c9b3317d4
SHA1 2fd04055155222a1b220238edb3a20a908e7947f
SHA512 337deee8affc46670d3263ca17c2f8b7aef8450010d4ff2eb39a4bf66e2c6f639643639b2e576961e24a7fc772f331d9ef23085f557e605cd499f6992000c0da
SSDEEP 12288:MafInzZSh43Xy4kwxyrSpm4KWqu/YfWJ7ACWXbfeQCajb5O64HlbgCEe5nlmmJ+9:MaAldI5Kbe
TLSH
T10DE4BBC4B2D452255131AAC39FA8FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\hi.pak
Size 1.2MB
SHA256 4b5585a8cc1a21e2dfcbd0d33f6cea87b7a583b8690f0f3635bd74bb5cbd2ed0
MD5 3ddd4ae85a39fe6675365404dca77bf5
SHA1 2a3c2fc24612938edd46738f127098496262125b
SHA512 fbbf103af336eceba0855f341c9e424bcb09c0527a63ce6ceb4773ddc228fdd5996b2b3bfbc2d11c77d82d012f9f4650317044cfbe50fa5adc0acb71c26e7da9
SSDEEP 3072:8CyKBb6JUKKTHzwKOsx0JN6VFjN8VOoNV/BB0ZV1dKuxlRLiW3VTOEOTByntDPtT:8CXbyU17zNO/NK/1oDtR5tLmh4E
TLSH
T11645F60CEBBEF3B55DEC3C8A32890D37D59D3674A3E5525348D5B3DB9844CB8046A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\hr.pak
Size 538KB
SHA256 d1f8093b91663d061bc2fa20426e2c430d53b06fc605ac1b0b2279d446dc9317
MD5 427d00ead5500f7480cd6ef8de88b0cb
SHA1 4f271a9009201f00959a3eab337130ca9fad7557
SHA512 93190a72013d7fe155404585080c12b64f57948e829888a75d60284ea93cf59b6771956eb325b00eac484c7b424f8b8a1d5d293d90b221b7440ecc63c2899faf
SSDEEP 3072:LfmWESYNimVj8tG85u7iHuDmOEaBV08H0rxy+wsWr9yB+bhp8OSAq0rYpTd0uP5z:LfJYN7b85J8iXwrXh4gz5jVqOPSFQK
TLSH
T12CC42B7DBAF397090897E346EFA643446DBE08CCE52597BB684F522E0003F4D6AF8159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\hu.pak
Size 581KB
SHA256 0a62d168c0f6d9d651dedb4e01be5b533b94e8617535cd70ad22717748fbbc64
MD5 92995b10868e466811b909c9702f1727
SHA1 6cd34086b876bf07dc1222cbd33e8fac60e401ae
SHA512 412d0f253d31eff5819fc05ed0da6284a39cd5dbc3f8dac81153511c69aef9cd3f1170d3c6a74616e3d9c51bc457045e9715456b1ef50e139f68f667d5662f53
SSDEEP 6144:ie6uXZufG7hq80LM9dHf2DfaAjokitlV5YmBFZfpdVYG5CnXwemKwnjDi54ROy54:bT8OM/WAQV5YmBnz3Kd5rCVe
TLSH
T113C44C7793B6905AB8AC179778647F15491F481BEE7B26F72883886D30A078D0D83CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\id.pak
Size 478KB
SHA256 d9fc19e683240404a60d57037f24e1d8b20cfda4c8bcacfed577b86cd8988517
MD5 fb42de6be21c78da1b05c518c5625882
SHA1 7d8d4e28ea196e3e48df4999d94a04c0be31de16
SHA512 63885e8c82dbef4902c75ae7bc4c3f953057236b07d6919bf3a9f8d1e6ec0ae2cb94cbe0366e56e1272653087faf2fb07b92b18bd312e8e1b38fc76ff5eb3922
SSDEEP 6144:pK5GzBKVBK8yZrOwKRtBgtYwf+eVnjHFWTmiZK6a5KKptwkK584C37IEji4XHn:lzgORZrJytAYYVnjHFimsKh5KKpxn
TLSH
T191A4F9632ECD310C4A4843D5A2CDAA1E7CCD233BAF05B76E8E748F7055A67682716BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\it.pak
Size 527KB
SHA256 f38e6b6d975f8148f46dbeda89563cf71bf07af98e9b79c1a8d158b5f8f1309f
MD5 d7c45df7f6d29d9a2775f531817b2fad
SHA1 f8a11fc014007e7ce2fd0ff137df117146a48a5d
SHA512 c09b0f026077eb1f0be2206aabfc4bcf201fb2d8c6bb9072f27b7b95ab7fec18a837ecfcdefee2256b2508326e577e6e098572c4d3b0bba4852a79585d4bd522
SSDEEP 6144:67P+YFNoCE5Tx92/FoF7NjiESIqRRRsO1Sta1VRT9TjexaqtjxLcaPpzHw9fLwyA:6z+CuCThx3Z/n8lYesjihC5afLJ
TLSH
T12AB42B3AA5D621155A976359E221B045FBAEFCCCFE417218899B431C23CFE40E2ADF47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\ja.pak
Size 644KB
SHA256 6df72da472ee171acc440c20a2a194a2a4af4839b6a88323c4654c50ff8b492b
MD5 ace3fef3bcb086a6caafbdfc9562ecee
SHA1 ac86efa1b8fe88f050a8936926b96b055485a8b9
SHA512 da5425b10b239ce941733781b6994581d37c8b683946b97d759c2915e96808e18ba967849354687b2ba5ba492387b740dc8e6e67badccbd1a812e349693eb9ff
SSDEEP 6144:G/CXAY2N8giZ7GYjtbpZXQ2OPEbT5zxJUeV7:UCj2N8g4KmpZXQ2OPs5zTB
TLSH
T15EE44F7CE3C569369D6193A22C0E36E57506AC9FFCA23A36442DC035B970BCEE415AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\kn.pak
Size 1.3MB
SHA256 333725ea1045d44acf2c19efc765bffc38cc5cea6e9977fe583ad6e203442582
MD5 a48fa9762b3504adc3fe4ec828c75149
SHA1 043f6ced7e30cee906eb15dcdd3ae59b9574fb1a
SHA512 40d983b3df4b6cd8e3df855f4062e163bdbdd5142882088e6e8d5ca30bc538af44044f61803d33e94f4527cceafc44059c5de67c847567190767d3246bb93396
SSDEEP 12288:qR3VEQ62HIQO0RFUAbi7s5a8l64+41/ju:4VDf5LlK
TLSH
T10855CE186DBA7D301BD5006B24EC603EDFF16BD29CAA07D2F4DDD7802C66C6A90869DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\ko.pak
Size 544KB
SHA256 3ad0012db772293073acb05d24b8dfb26697d6cc5dd1612150df023dbc31b674
MD5 c524ce72c7049c1c401d8685772e8d74
SHA1 56d28e03538e2fca873ac453ef2698fabda75a4a
SHA512 ab764fa9b9f82c7146e1b108a2af792c35cba91b0e3be9accba48bac87a13612a61ec026705b77f006519d65a6415a5978139898239093b249ff583af0dc6aa3
SSDEEP 12288:VA7JJu02NRUUT42IyxxMSVG0GTzRXfwYIst8OQ4E3hzwYolCqZ5dEp75nSBGu1d0:O7JJF+q5dGXKXU
TLSH
T1F1C4D7F238DB23CD1193C982AEF4FA198382D976F7530294ED44CE44DE645D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\lt.pak
Size 583KB
SHA256 946351ed2d74f247dea0f2742fc36d89225355480f0cec99d71599ccce3ea9e1
MD5 1bab0f6c08b1cb26db455aaf581490dc
SHA1 3a32246b812e8ed35ddf0a6842b8bf26b19be9d3
SHA512 c6e4502fda62e2606e31a7c67679d59d21a04342c507e1fa39ac59156a4d1e1cab1923de4bcf30b735d5bcf89824d4283b57db11af9673b5b956c2f883a3bc7c
SSDEEP 12288:fuFgnvLMLcFYpSaTYC1s15Tz43Wad+Q6SNM:fuiTM1121543nd+L
TLSH
T162D43C0069D3AEFB9B4457CA82E4CA78CEFD50005627B8A1EC69C79BC43BF4525A4F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\lv.pak
Size 582KB
SHA256 1e6f9a40f4fa1206117063234399bd7c1e7d198cbf6c4ad633e5e18ad0929836
MD5 e4993f39d6fa671658aa3ce037aec60d
SHA1 2db9bfc42b07060f6e256c74a01c348cd6c2ac0a
SHA512 4192274330be238a93e370fc3fc8ada444b38fa1464889f0e3d0f6c5e548f7f7de14248937d45f8aa84c043078a69174ac1c9a5894fc9b4ff8f10deef6f77e5e
SSDEEP 6144:WXZ4vLEp284/98w9NatVFpB6N3e3gcD6/WbOW5UtH07KTsh5yeP0ZnhtySMEVA19:W9GazwxeVEHW5p7KT25qZfA19
TLSH
T1C3C41A959EC68FAA4D948DCB732AD122ADCCD740FE06E112DD7D4B3A510F12432B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\ml.pak
Size 1.3MB
SHA256 f2fb440eb0518dc695810fcb854b20b72aa47e5ffc75c803aacf05861d35a94f
MD5 9f0422326953a0c48c1db82ca2a9d639
SHA1 2305bc895e9ccc5b9a3d661e891c4f06d8a503ff
SHA512 a899dd975a56a53503b5cbc7448f54423b18bfbd917f73f0871840d6cf6a574bbaac8d735ae8de6a074cd78c43b6640e3e46be1550dcef8f8cfd1971cc1513d6
SSDEEP 24576:kwQvTYbMjKfUBp1tXpDf3ei5e46qXQl3X:EvUa5g
TLSH
T1FC559D5BA036CD3B0FD002257B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\mr.pak
Size 1.1MB
SHA256 a674db4e60152fc17a32d4b92add129adaebfc02a1a783a12653f984447c535e
MD5 b0e1f36587445f28f22777d555683a0f
SHA1 42f7cd3c596c2f52662b86df9d9096bf822a80f3
SHA512 575fdea827497ceab51df5fc8783f960b87d180f6031f0947525279d224189a6299943df37a014f7bcefc637ee23327fb1ae82eb77c175d63c515b29947ac0d1
SSDEEP 6144:0dFOUyOWZERu0EavXgKZm7jkUDuLoIL5kSpOsY:0PJTI0EavXpZCkUDuLok5kSpOsY
TLSH
T14135C24DF77AF3685DECBC8E36580D3BD8FD21B1C3E9925648E1B3A74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\ms.pak
Size 502KB
SHA256 7707f79a2a4aec553e68af87802a0f19d3714a25311fb7b8afdc6ff4a5b6c5ff
MD5 c8d605a91b2b66603b379f5557783afe
SHA1 d6f294eb91675182f658158ff9399592935c779a
SHA512 a9f100dc1fe0a19a0a0a4360fff392af4e07eaed6613ab6dc61548d36afe55e4c9183e6584ca4e15feb477947ee8a79a96775718197129a555319a162281b9c7
SSDEEP 6144:zfPhAqgQGCSSS7BEiyxeoKtaRlJaxxcUcPM95bu4MOEnZnf0VJw:zfJw/pBmxBRlJIf95fTEz
TLSH
T1E1B4B6069EDE3118085843D9D2D96A1B7CDD3333B705AF2B8DB08FB0126E7A53356B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\nb.pak
Size 487KB
SHA256 53b12866e7265661c0088b89653d2c1cb9220e1ec0ce0049f3095d53356b3f1c
MD5 4914ceee005991ad76c7cd75ed8bb645
SHA1 61d2732f5d5a20467d7f667b54ab654849d23289
SHA512 fdb51c9239eb894bc807d56a6afeaa06cabdbaa25cedf3d0b3763c6670321ef7087a35258737c0627b450932aceb7b6859224735bcf53b4b12f6f531fb066f99
SSDEEP 12288:2i3w+CqIG5Op7fbSSCuxqbp5JIM8RqANnvt:2ww+MrKuxqbp52M8M81
TLSH
T144B40783EE46B72EF6A447A4F018865B9B7D942CCD98199B54CCC63E09C7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\nl.pak
Size 503KB
SHA256 4736b7ec56cb845c14795e6e4fa98ddaba47c75aecec86e931f61222dff45ad9
MD5 ed94cd5fe4846c197ebcdc3fb3dec939
SHA1 3239425517ebc508a449f3998036c21370685e32
SHA512 0f0a79ae99e8f74aab18c3673e640d4ea5f24d8b88a3ba63ea262da77ee3fe630296a818337c7b36b6603365f43c6f60720336fab9f594eb755f9c7efcdb8fe7
SSDEEP 12288:yRJtuyVlbWus3mgy5ilx5btoaOTLoqqn9BOTy:pyVlbWusk5ilx5beaOTLoqqn9o2
TLSH
T1B1B4FA17AC9E253E59C0A389F6094FBBBF2ED22CC26CE67D94DDC1381443F58829D499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\pl.pak
Size 560KB
SHA256 2191f77aabe75522166a3325e2660395479633b936d5173d150120367ed501a4
MD5 12c3e7597522f09e87ff438ff2cf5c23
SHA1 e634c8bcd7d5f77fdb227f7428c146cac3e87b81
SHA512 fd58c466458496316c659dea6afcd8dd8269b312c56a506d65db4bbcbd28d37edd137947f3c78e783cd1b3fbe9014480f3c625dc707ec4c27a63115ff8d877b4
SSDEEP 12288:+p3WdgWoOB/kE7zXfQfR6HALbFVP3CUdCe3mOUSMAmW1QhqbY5uj74Icdy:k3oPOJMe1Qhn57I
TLSH
T1EEC45B0E56E58A4E4DB048E6F2E70B3CACDCC808E10DD35FE46F452AA15B19EC9BE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\pt-BR.pak
Size 527KB
SHA256 1deee32edff320827dbfbe22aa42e83d8caf79f95f7cf18013424da7cdadb975
MD5 576c1c0bbac545348532ffe36bf27fc1
SHA1 55c614f9d31c5e6466080afdaca79b6daf8ab10a
SHA512 11caaa048778e258fdf2af5b442eaeadf3412921d2e50065b7217de2277980a5fde086b7d6749cb918090daf4feaeb5e89ad7876ded2fba9f62d9e809593ccda
SSDEEP 6144:4Tc2tfr+LcxwBNBXBL7kofydt5/cc/B98sRN/Ies:4w2YLq35UcwsR1It
TLSH
T1B3B42B296DCA136605225351774EEB03E98C4646FD0ACA87DCFF4B06A3DDE40DA33BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\pt-PT.pak
Size 530KB
SHA256 fcd194e5caf36be4958c559acbde4f28a957083bf2aceac893f9e5c9e65d8a95
MD5 e4565bfa531c9c4344f84dc8be207c93
SHA1 5d1084ad5bff80383129850a853fe1319c23199f
SHA512 531a318e8ef1683abe4bc7b44e7d3a4d6ef907d5e7ddfa1f5cea20414dd33060981afdb8d1f4813b05be90985f10fb892f9060f6c1f2b975984f12acc8cdce6a
SSDEEP 6144:tBnyItVum8igeZieJVJJxhHuxRDfV7P5jr5kSRYi:Cm8hP5jrmSR7
TLSH
T1D0C419296EDA132605135341770ADB03FAC86655F80ACAC7CAEF0B4672CDF94D6B2F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\ro.pak
Size 549KB
SHA256 06c6486e8a42b447a55bd789bf2bc794354fa4be062139481e4612550f16c755
MD5 8c922129bfb61fe14fa035d965108823
SHA1 aa8d8dac978053163a303c1f1206480144d4b330
SHA512 25f9c2b75febfe607cbdd872a82338aecb5f277ed2d3d80fe0ec01289e3361445102392ea23207658ac347a774a7f47bbe19672d49f080cd6aea220da5ac3618
SSDEEP 6144:iotvDEg6kXCG59yqeyFoVxIPN8YKGGpq537iNwCs212/z0O3:iSwg6kXCG6qRFobIar3q53GNz2/x3
TLSH
T172C43D2391C82E972A9152B2B73634D3E88D105DF641D2CDA4DEC97910CD9DBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\ru.pak
Size 902KB
SHA256 6e53b1b54bac43c07798ee6507bd05806fbd2146ac0f987a7f03aae3cf5d9985
MD5 dbd513d5ff195a0068677ba4aa417648
SHA1 9d6304911c1bfd9449a661baab44518f17ba64a3
SHA512 58b903eab4e0c769245c56f1d92dc020690b617d30495e8b436e0e052978c23d38219ad6a89493c116443e8ec4556f59de782326e567088d866751415abde40e
SSDEEP 12288:k0ERNB8K1UpfQjRo4YSWKCx/KHizJ9ZF1WAarlaUqSGsNaz/XYHVeXN2hVO3j/t8:WRNlYeR5k53o
TLSH
T163157661669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35619A42D7F35F2024C63E61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\sk.pak
Size 566KB
SHA256 7a1db23a5b4f8e4c7cbc80a832f4f4c33fe29e31d4ae78a814bd8ca85620968f
MD5 b74b01d80d6edcf13ba6514dcb1bf3f7
SHA1 405ddedaa9e3c9f3b5ddfeae6f440085c155a6f8
SHA512 2f649b116eb297c7ee7248a35858506f5329094c14be2e6c2cf52bca42170c519ef0446773be096c1571d1cb4502a5a840c3c934710c4900c8cd8344e4e9bd1c
SSDEEP 12288:lG0lqsxk5UDiTi/wX5z03HWPTSWTjPxt9+q:lG0lqs/Diz5iHCrtgq
TLSH
T161C44D3FDFE6581E8E8D4148EFEA7110F97E46508A4EB0A5C40F364724E26EDCAB8D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\sl.pak
Size 544KB
SHA256 7235e631afff75cad9d25b2e5a0e74696ea6b7f4b2a05753331bbd719a0699cb
MD5 998585ed4b877e6cb29bef5ec5675004
SHA1 d82e9c2127062187a0ad3906579cdc491f6ecf04
SHA512 b0d4ad73c4e1aaddd156cd115dbadcda692e314e6f5629e26aa13144e2bac5fdb432db345b68eb79f732e6e102674ebf8cb90c06570ea4d49e4045fbd8cedba4
SSDEEP 12288:9FZV2NucB27+EMXP5Br3DWJU8gsi/fzBCqc:9FZV2NMIXP5Br3yi/fzB4
TLSH
T114C42C357AA79E0F0DAAA2CBFEA606007FDC044CD256E2A1FC8F336D5015A3817BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\sr.pak
Size 839KB
SHA256 35e57d972a60e161f123a5783e67e250f5cae1f66a2c11b119c10b81c43bd03f
MD5 044954b860180caff2b57af02aa4e1ec
SHA1 c006f910386d7a11c9d074586c60b629131caf0b
SHA512 33d8a0fb6c76364b756eb199f629f930d419ea31f631b8e6935b2efdefeca7f755a87bc3ec5422f9ca9f00da7ed5564fd90e228b0f1e9951a82cd1a4deb9b2b3
SSDEEP 12288:q2KBTh7Meaf8tISolSDdrdOrTo6cP5B5Y/TS9kx8IkW37hjeBd/k/p:fK597iUB539vK
TLSH
T1110557A19B9E64DB0501F41BD808BE093DAF41FE3FAB975215601DBD34E20B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\sv.pak
Size 489KB
SHA256 bcd070d70a4284fd3144bf37c5e56994ca3a69c8f65aa72a9231748b30210e00
MD5 d5925395fb791adebe0d06ce055ce976
SHA1 73163c7420f6a70ac7fcb52bb8cd97f4828a3ded
SHA512 6e0bf0f4d488eaf388431f05effced112e597be52b9c8f199c88ebb6e7e6a28d06f9a180ba3a9e7bf9da5166570077ed895249af7806db74343a64bb598a4260
SSDEEP 6144:nJUsTdMs90uIm1jOrdLXjViuaCdxGAqliYG4RFcz9R3GOGEFPiRMASOmDE/xWcq8:is2s9rOdLX6C7I5WpzvER
TLSH
T1AAB41D438A20F526FB72530DB608115B0EEDE25CE7E2958EB8D9883DAD8BD5405FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\sw.pak
Size 515KB
SHA256 eb96ab83e2e08e811928742590178e97454863bc581dd8574d6a644fd3c6615a
MD5 0787972a076c6690e7938758c2a92e24
SHA1 dbf02e5a3ae26acb060b533bb006756c19122bfe
SHA512 9f3560a3b648b1a7025cd8a98c39ec7634883aade1ac2c7836fde890cc04bd009aa5c1bca8354ee1259ebcd9482326c51a7d21bdee3caf92984ecbefab35d34c
SSDEEP 12288:ssEtffl7cF65YMCBfRdAjURbQWy243Eai1bqq8O7Jg6gtN5Xm8WcwNH0MMkJPeE8:ssKfl5Xx
TLSH
T181B4C5629871E0191233518603DDFF731BDCED6C2D2B29935A46BF0F218F98857ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\ta.pak
Size 1.3MB
SHA256 e213c963248c93fcb4b88b1a45936dda28a5fe39cc0428a16556c6d737fc9940
MD5 85403cab968fbdcbf7f92f3a4d49a4b4
SHA1 eacf6ecf2bef4ed5275ed237d3830754db9e1149
SHA512 b49bcd260c38f302fa9fa83a2b17d2f7bf576bae14b64882ce9b38152141504a69fbb73d1f9ef8b47ae1a7a995a41e1127df3689c1e043e3b110cc35b73c0fb0
SSDEEP 6144:EWa77y51DNb1BHGKQ51v8tRdRtm1vYpiMyY:E9fuxb7H5Q51vqtm1vYpiMyY
TLSH
T12A550CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\te.pak
Size 1.2MB
SHA256 8dd7d206379445bd9afa4e01ab986c439cf70841d080fca6e152b453e94fcc49
MD5 d251d089aa789bccc27a0b473d39e46c
SHA1 283d8fb6b6195b3427144773ffc4691c82e31f0e
SHA512 27e6f13f6c7937c8121451d70ee90d2a2ce5e519d17e882a86b29a6a78764427022c36b6a99178e9933e01500b55bcbfd0dc79a6f028a046967c2c53f78424fa
SSDEEP 12288:6JNIUNDQ7McKNOJIGyt56dwI/gb0DjWX7hBk3p1FZN6iFll2wYgTNFqXrOrHXAAn:6JGUOqY5ntyq
TLSH
T1564591023A6AD310DAE60273752CF66C49781B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\th.pak
Size 1.0MB
SHA256 a4c2c305aa9d3df52d988c4da2bda398e8ee81d320e9da1de7d4d366e826dbc2
MD5 f30b74c4203bc2cdf830681b14651943
SHA1 47f541c0b5ca948dd371e657ac24f7e61b402ceb
SHA512 a92ac611d43287060fafc66070d7b40d4d253d32cec9cfd01c15fd7892eabbc49c1ba63d03c39919bb2ba94e974f93c73f6e455263ce4e0080fc8161587f09c6
SSDEEP 12288:gcN9LyZYAPTJz1L/L1XLJws5hzyhcW+v/V5UUoqL3ftj8wXziwunRILG4L++w11o:gv358Wl
TLSH
T1FD354BB37247DDD479441B5B262A7789673DAE693F73F8E00089215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\tr.pak
Size 527KB
SHA256 f842b56ddc4145e4474c5cfc67893900b577c131a4b123cb16cfcad48ed0f338
MD5 a4520237e44d35110e003a26cac98052
SHA1 8e50c8f88200a417d2d792c67e52ca115340902a
SHA512 b08e577ebe680383f9fb228162ab21e8aaa38abc3e5d0b95326cd579454571738845f4bd86ccd316643f45bf5b6b619dd3f77f67b68b056dde68ee1697029b03
SSDEEP 12288:ZP1bw+xoqYwNsH48sO/qKFNUTglM5MuJ+:bbwufNTglM5FJ+
TLSH
T1FEB4E98178EF781C8BB9278BD3E90666F89F0766B331F4469A16863A774535303E760C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\uk.pak
Size 902KB
SHA256 5dd2fcc64ef09be0775c2efe7e07dddfc18f5ba6059f878d0c22b9b0c2207cdc
MD5 8f894b4972b41dc4c7b65847ba856ff1
SHA1 63ce84840a90485fd376908c39a4125dfd53fc2d
SHA512 77ecdfcfd31803f308da51e6b2bbd47b7c0848104925b642cbcf877c6ee228c5c7e9dc7746a208d0640455daeeb6dfcbe954d7268119b9c096588deab3c2b53f
SSDEEP 12288:14dwERlK5TUXhBWYDhB+V20ZgTEIX45rB3IjCqALDT1zcuNLNiXEqqbj+1w:14dn7KVUY5BTp
TLSH
T1641598A19A9D58DF0106F05BE84C7A0D7DA741FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\ur.pak
Size 790KB
SHA256 a0c752a805da7dd6608ad04625734f4d27cb75b682f51b2dc8ef08350cc7a2cc
MD5 7b5fed5150135b728bf8865246f7c8fc
SHA1 214b0f507ff6384b1b305f1718db43023499eeaa
SHA512 81fc55db4b0635e09057fd060d9eb72bda5a5fd2d2e1e4284e1b45098b287c609526c766b030dd0eaebc0836a32bcbf6dc0aae94327c103f3f736b5cd051a8a1
SSDEEP 12288:Shpvwm9ZM8PL6Reo2/y8Wwlf53jmEFgPlOWSoGJQYrXYOwadcJKwU3u7co/9Njj0:SnwVw5+PGn
TLSH
T14A0500D2E6BC96B24A21D92780D33C34CB735F13D34AF286E56206C54E9A0135F6DE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\vi.pak
Size 624KB
SHA256 d7f676cf557d43db07b14a22b0b20ca761ced59285cadd75c07c68613486e909
MD5 d910fb70771f06c64f6a2d78ca25d340
SHA1 2b1ba5cf58c552984164e65e30cc05744d8ec419
SHA512 4e3626cd558cc75b8833308c816c45ca106203cc054e214a08ceccd3214aa296097153ad69635f584dbab9def2440ea2aed79c0e02464c164bbced572840f264
SSDEEP 12288:8bEpRo+cywJ2roEYaa0XcJhy0LC3P0j9FoAx5a8hK49w1sh2ziKHznKv0pwtH5:8bERo+cywJ2paLJM0La25a8w4OshAiK4
TLSH
T115D4851117E0702680AC553EC6CD540E6FCAE42FF7C18FE56FE429797A221A45F21BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\zh-CN.pak
Size 450KB
SHA256 48e32f53d07cad6e6dc12040619f7021fa8f0b3254cc6945905b7c6748acb787
MD5 6617a2bfccc344c5dc0dfe03762d219d
SHA1 9f9d5059515af878d273a9b74f32ecddd4a93f83
SHA512 9ad87e1f4b404cfaa80ba4bd617217bd638cdf7255da0c74d03b8b3123e2afe9f1077f27dda07e5dc71edf82d08c69ac20a415157b12519731e1ebd45fc3b5c9
SSDEEP 6144:CXJsGwVzgTq7h56tOO1pDa59uNVnbhh/L9kblz:+zuzok56tOOba5w3nbhhTe
TLSH
T1FBA47EA911ECBDEC054640E03729613D7C40B60BF667AF766DD248ED2BA2F9D0717A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\locales\zh-TW.pak
Size 445KB
SHA256 a8b11c74a0512fed29b11748181ef4b1de84dc99197c48d9eecf316aceb425fa
MD5 197d88a99d2348c9539d388f4b825c4c
SHA1 7b634dcd2cd27b2f8592eacfe314cf23a37f316d
SHA512 da7acb060d14f87743ed788df4e2c6ff3ca18a633e46f4d84c4619802edfc23b363f45cec8d2cb23c3e12bbaa547f6df1f5b60ce7ec7d770f689346b0e06a977
SSDEEP 6144:X50Qhd9hcvcxbFuJwt8+2xuC5iPRF5uekfwBgKwHSM7zeITq:X50QhRcExbPS5iPRF5uekffXt7m
TLSH
T182A47DA608FEDAEE0A01F884B7CD562FBC8B746CDD333736FC591CD52E6AA540A51049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources.pak
Size 5.1MB
SHA256 75e03df55d7d23c840c09288da270285f17d067cef8709252451c0a8aa1254f4
MD5 97770ebb513490dfb038bed3bc444128
SHA1 2e459ca458879ac8f427080764bb5d668a912235
SHA512 7f41708f8f29f0a9730e461c7a5a6780824ec31dac6278abb2c42a50919c10e01ce00aa7e4cdef680d667c467bab4683df90d5db2c61aef8dfdf77c2eb3d8d24
SSDEEP 98304:UZM993/2Pe5MgzYUrC/jbKb/jCErwrfqvqtEdpQcwL7/xrJvK:0M9UuMwkPKDjCEkrf8quPgPS
TLSH
T19846339033681436E414523E00AC4E365B5CE56215A336A9F32CF33E6B7DD46EDE98BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ICON_TOOLBAR_FLIGHTSOUNDVR.png

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources\MSFS_Panel\123flightsound-toolbar-v400\HTML_UI\Icons\Toolbar\ICON_TOOLBAR_FLIGHTSOUNDVR.png
Size 6KB
SHA256 0486fa06b8a1621d3eb816a5433db4169990df11b51d4cbcb2333a20c1ec6bac
MD5 77713973b858a89e93e6b6cf1c35fa16
SHA1 ad7c80c1823c1068740abbe85d481805c7b22334
SHA512 82b7403feade9456bbf4778b251b1329aa5a5e6d60a08b2abacdf97b4c18db8c4d8037078063271a50bb8fc0c3a4f6e4d17df151001d7468bc722b4fc12bfb88
SSDEEP 192:jUeH/CDCNMBX+yZ+147DuIbz2Jph+3dFD+2j6+:jUa/C+AjDRWl+3dc8
TLSH
T1D3E1AFF425FA3536D2B0EFEC952AD605C9F6EBEF4A043C11DE8806E4AE4309E591C390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ICON_TOOLBAR_FLIGHTSOUNDVR.svg

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources\MSFS_Panel\123flightsound-toolbar-v400\HTML_UI\Icons\Toolbar\ICON_TOOLBAR_FLIGHTSOUNDVR.svg
Size 1KB
SHA256 a8463270af42cf69ff1027647e61834ac6c0fba6d33ee8604937fb546fd3acae
MD5 37815233b4c99191d8f4eaadd8e31944
SHA1 3ad4ec3c8c5b74e823fd1b6d9c0907ed602c5a17
SHA512 4cba959c61513c54ba88688d48dc31ba5e0bff91f44fc326be1e2dd68058bd90df3bc5aaadcc33b5d74f317f261a73b0c17f76d13f16538bcf827c234b4232c9
TLSH
T10311AB5592489C2CE6500B0CE31CB1A832AB94EBA70D6025F818263A906539FACF76ED
MD5 SHA1 SHA512 TLSH

Submit Download

FlightSoundVR.css

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources\MSFS_Panel\123flightsound-toolbar-v400\HTML_UI\InGamePanels\FlightSoundVR\FlightSoundVR.css
Size 11KB
SHA256 de417ad20636e7d9e91f7e1aa90faf698d7060c709d15b0fa3dce16b31c7dc9d
MD5 f9e39fda591725c82f682515c66eef3b
SHA1 667b63be6db4b8fa65d2d452bbc904a47db1f136
SHA512 d0117452780c427204d3b4f372e9c354a869938cba8893ca78bd2e02d3975183369e1c1f94ce2662f2095d7fa87bb9bf87f541504bae742b8f2b3b1261dfebd2
SSDEEP 192:elDV/cIQQYykGotRoLMtbybuIdC13h4zF5QJKsZIDrOu7KZzTyQT:mMqrlSiO
TLSH
T1D9322097FBF14644743F98B46843BBEEBB2D9122A60DCEB45AD0701C4F890DB1961B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FlightSoundVR.html

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources\MSFS_Panel\123flightsound-toolbar-v400\HTML_UI\InGamePanels\FlightSoundVR\FlightSoundVR.html
Size 1KB
SHA256 d83de7abe732dc6d44979c1420df156f7cf22a267b39a3c09bbf308e6420dde3
MD5 52f03954e754bbf1ce98062caa00db38
SHA1 5530993f30f0e3c5d5ab893066d78a84a9102929
SHA512 fd32dac6aded1f6a626d324c38605e3702545c52fa56e92511d9e50dc3beb1bde3941a36b849a6e90d8da1fa6980b5942a4951b25b457dc2fe6c59c62c64d570
TLSH
T167317ACB9CE7C865A0502AD6D4B2F138EC44F21BC314DCA876E581B66F89BDC0C3B994
MD5 SHA1 SHA512 TLSH

Submit Download

FlightSoundVR.js

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources\MSFS_Panel\123flightsound-toolbar-v400\HTML_UI\InGamePanels\FlightSoundVR\FlightSoundVR.js
Size 14KB
SHA256 6b3c2f44febbb393a93fa8f1d24a9ab75a866fea30083bff1fa510d038df8e8a
MD5 ce50ea986d34d085550e84a12a2dab26
SHA1 95157272c2e6e12817666fd494478db31943ca44
SHA512 d3b0fbeb4d5e12a155e042ba9373ba5d3b515433bf6122021e676ee648b1002773914842e151ccc29fb6a8470564777ef8671bafd0998ac037def8e348f1663b
SSDEEP 384:YoXzXOs3xlJO1YaNHeGkCz+T/ZurovjXe+n8t51f:YoXz1OHeGkCz+TpjXe+E1f
TLSH
T1BA62C60A74FB203F8A274076AB9F2A9771196107664BD848F6BC46D41FC1C7089EFDE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FlightSoundVR.spb

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources\MSFS_Panel\123flightsound-toolbar-v400\InGamePanels\FlightSoundVR.spb
Size 684B
SHA256 5231157cdedcd04a2280fef16be44ca73faa347fab139adafa81da08417d831c
MD5 10c1bc1546b2fcab19a5235e152aebd6
SHA1 14aa9f9f638df5e60dcfbec2cded80a0aa8ff8c5
SHA512 3e8d33ad019778c2efbd6c64e55d2398c13fda24640aa17190baadf31074af5e3faaf164f06d918b718ec6b86d8564b87a5bad2100f076b02d50330787cc1aab
TLSH
T13A01021855246DA3F4FC5ABD83AAAE043306C5B8E00443524468524BED7C748B82DD6D
MD5 SHA1 SHA512 TLSH

Submit Download

layout.json

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources\MSFS_Panel\123flightsound-toolbar-v400\layout.json
Size 1KB
SHA256 08c2f7e64f2185505c68664cfdef16a8c81beb9a730693c2fda99dbae1885874
MD5 fcd3bf40d9ce9f9388c1d26ab5510cd1
SHA1 8f53484e1d3160544e0acd92036ee4a2d19e73cf
SHA512 77d87acdd295fdeefd917dac9e3e394909a5a4a43911c4cb19cfcebd607f5e3695391ffca465157a5b36f8fce6010d69f1a224de51829e162a03d7cfed409058
TLSH
T1BB315F35DDA43D51C082AA3A286A741BA61874871CCE6E5177CD2269CF4EC8E8573F3F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources\MSFS_Panel\123flightsound-toolbar-v400\manifest.json
Size 661B
SHA256 be3a4d00a84934c46c1c3de4415bf1e1007833aea88e8ebc48fdf51e8d030ae1
MD5 17894281fe1927c3e81ccfb574bdad6e
SHA1 0a7a1cc12f72a0d402396916fcdba500dabe1970
SHA512 3779ca71b2d2c03714cc48dc064ddbbd61ac58e56516725451c17de8f9243d26ce5a2d5de5d77c5d434574c205bd1b6e620b7e5d4996009853fbc2fe488e0754
TLSH
T1E6012D100923D67743C61AA224A20401A3189E2F22847EC5B3C7424DC38EBA3417A61C
MD5 SHA1 SHA512 TLSH

Submit Download

layout.json

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources\MSFS_Panel_FS2020\123flightsound-toolbar-fs2020-v400\layout.json
Size 1KB
SHA256 c35de25fadb01a98bebaf529b322444dd6154c0a9eadf9a1224a7d302da194f4
MD5 d0333555262d9113291b0afb8a91464f
SHA1 cb82cf90dd333c869705ebdd55dfe4f68e38ed28
SHA512 3ddb3aa9a48f09a66ff1968522c835ebeaa1a6fcba0ce532561a1e8b0c970117d4d420acc94828e787875096f7f1f0ac4d87b001a921cb593e37f87db0b5ff7c
TLSH
T11B315F35DDA43D51C082A93A287A741BA61834871CCE6E5577CD2269CF4EC8E8563F3F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources\MSFS_Panel_FS2020\123flightsound-toolbar-fs2020-v400\manifest.json
Size 564B
SHA256 c449e3f5485171552bd2a26f1351419a9e127ad282a63ad82402c019ff76cb07
MD5 faf4c22f33ed33de8f1ef5eb0ddbb930
SHA1 cd9c52308ac7ef565daa7415ec5dba4d31538eb8
SHA512 137bf1843cee5c12e10c75a025369831577af8f19b3d0cf3e96a147f386a82b6d35e1a5e7ca3b1a7b0e7c99ef503fa382c3ad4d671a500d0e89ed7e68a32ac84
TLSH
T1E4F0C0040A23D87743C256A124A61501E7B89E1F62897ED573DB015DC78EB6380BAB4D
MD5 SHA1 SHA512 TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install-msfs-vr.ps1

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources\install-msfs-vr.ps1
Size 12KB
SHA256 afe05f63f63c3e6a24edbeb80164d5bfd09626b4e96a09c9f5f82e201f40ff2c
MD5 31cea10b13c407a4a7ee8eb846a237fd
SHA1 54141db4d8f873bd68db3da1732e328c10a9ff1c
SHA512 8ae7447e1dec7a748b1cbbd8aeb700e5547d38c1a66662712b2f024e2d8c8426209d1065e8493436fed21427889f9e2696c5e50c98aed83839977a5a67305c1a
SSDEEP 384:qNZgvC4aI2fQOP1Nhhd/1hgIq9OzWsNdR/f2sC48lrml:qNZq2x1N351hPq9OzBTHlf8lrml
TLSH
T19F42C9119DA3E2B6168A376E14D6E82832DF014501153AB0FEEED18CAD727FC0E79E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remove-msfs-autostart.ps1

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources\remove-msfs-autostart.ps1
Size 2KB
SHA256 72d9c83b6f780d47b8c533b5eb9a0c18418b69ffb5e6716430554120131ee998
MD5 fa336dbdc6d52318c61b69fe79286ad5
SHA1 7724ec3fd2ff8e7461f03fc5492b0a2b34dc2a6f
SHA512 567591b787bdfc548d1dd7aeca06565bc23d8707021fbf58b8f3568473285b1dc75bf6daa408734821255e94aaaa936d6e37e8e9bf29c4a95f5749cbfccd8990
TLSH
T1594195529867AB31644E33FF84D5A4342BCE81EA471C1764F9DEC2182AA1E7C000AE86
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall-msfs-vr.ps1

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\resources\uninstall-msfs-vr.ps1
Size 7KB
SHA256 34e785288a7734fc51b331d54299b7098aa772be544d6f01ed89b2f321fa6483
MD5 69a73999641b6338b87fa79e0af463c1
SHA1 b0d272b7459696f307ca0e9db2a8b1d5b6299219
SHA512 33e61f235aa6fea5ed37cfeb12b3681524388b335c89bd49c5537d1208b0c5fd5f593c5c7215549977bc0563f65f692e8561e165f4bd2416757a7c2eb9e662ee
SSDEEP 192:APDxdaF49wS9QsTh2YkJrOKhwQt+34P6r2szzqafXUm8KgzOcXlpmf:Au2frTh2YqrOut+rXh92CcXlpmf
TLSH
T166F1A66294B37236644E77BB14CB641C33EE494A450436B0FADD92589AB73F80AB6F4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\snapshot_blob.bin
Size 300KB
SHA256 7f80294b63fb7cd63b43be498fcbe1e34bb05a8011cad9514c4eb9b29dfa5336
MD5 b0fac02004327e545e3dedb29998f4d6
SHA1 3e82da670e899a81d1854fb21d2875edac25e514
SHA512 9a94412e08353b1d088541fa57a4b5a63c83a18aab42216898d9bbaa4271891bd6954f3ca2aa8c7b046be3ec9f734bb82ff01430b6446b7214d710d7ab312314
SSDEEP 3072:qz39kvV4xLwqU1psdzvrCMYIEqNL2SaSVVhWxkhhRAejnCgosB/xOiWaW:qz2vVEwqIXCjH2iWaW
TLSH
T16464D782BB81CB43EB2566709CFAF5997239B1FD6E06921F3745076E39716B40E0E06C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\v8_context_snapshot.bin
Size 641KB
SHA256 0b239cf5ab92a27cfa087b49e6dc943e0c674b62cea643cff2130e1c2f8db31c
MD5 b1b09c057d365720ad26151066bf160c
SHA1 7bbf976150e9b63acd4aea4223085818445f7dfc
SHA512 ad4cbce2e8f367cff9b8b8ca56d1b6b833c3293dd55c1279732abda493b3a366efbefa67d75ab0ba6b93ca0a7545475728f9dc09bda9460ecf13f53f137a9b77
SSDEEP 6144:5PGX3u/nfW2vGgwqIXCHHni9GWHQ/3DByiWaZEd4Hq4qVF+OZchCMv2jwouoDcC:9tfVv9HOGWHoSmnqVF+Owejwouo1
TLSH
T1D6D474E3BB49DB02E7E96AB2DCFAF55A7734B0C89E09512F3246136D212D7B05E0815C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\vk_swiftshader.dll
Size 5.1MB
SHA256 6ff65b7a5faf726cf747eca6d6504e885a70664e37dc5e38e0e0cc68bed3bf6d
MD5 885126e1b9fa17b2d2c70f96242750cb
SHA1 fc28b7d294536c91f704aa8830e507de174364d2
SHA512 ee9f229b798ccda8496e30b1f7aa07af4e7e991820d21989af535a36f0b7dd1a34cc06babb0caea8755caa01ce390cbab1e68f3865a18327baa090f1c295e541
SSDEEP 49152:moaTaX1+4J7dN1uB/t4ABL5V1v+3+mFcpZBqtpM5KZwFlox0ikAiJb1XQGBliYDX:geX1+qULMSx17nb24
TLSH
T1C7463803B2858099F05ED179475BA632F232F8811B72B6DF52A41F192E77FE02B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\7z-out\vulkan-1.dll
Size 935KB
SHA256 715dca5af441dc220a61fb0f8e66600dc4f9f63ecc106fa43bc683098e00fff8
MD5 0004c153cbcc311235a0e0d31c679020
SHA1 45a141107941f231bb49a5278b984a63fa7df41f
SHA512 d45f5815892368de23c985091202d3b1bdd423cb0fc2448df45dcad0fbf5c0107bc6d95c62e21f4842e4f2411a4075aca1a91106df67896cab3e04f8bf2a3c60
SSDEEP 24576:F7t2bkeR6V9+8T28zEQ6Z5W1DYsHq6g3P0zAk7mNmb:FYAeR6VY868zEQ6Z5W1DYsHq6g3P0zAW
TLSH
T19D156C239A954669D476D034CDC28607CAB178912726B9CF03A81708AF6FFF43B7DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

detect_msfs2020.ps1

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\detect_msfs2020.ps1
Size 859B
SHA256 29ebb1c445c54b26065b19fecf29b20f6bd8576ca2287e9205312009b5c2831d
MD5 0bc3109ad1753305ae2e83ec7dc99b9e
SHA1 1aea367264e9b0f72af161a45794580598f5fd19
SHA512 85274b97f3411dc6c502773b1cfac8078dff3187e4e5e4575dff820bece3e46dd144cce8a3d1a3b84325a5aee5e5a3bd0e55766bb24c97b8f6b827377790f78b
TLSH
T1851152101361B1B6402E77BF74E3756CE59F041F021616107ABC508D77FB6E58E56F91
MD5 SHA1 SHA512 TLSH

Submit Download

detect_msfs2024.ps1

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\detect_msfs2024.ps1
Size 858B
SHA256 fe367c4e1e81255813a2520a1c2092d3c040883208e8d635901987b8b0f380ec
MD5 3f8dbbc9c6a3e2a13946587a563e513e
SHA1 1e08f7f88b461d2e77e77839746f2a74663533d8
SHA512 d3296606e928f36f703c85ef0a7328b9161d1646b6bc17e7c9d58f8363a803520696a8e871e71960c7568704f3dc29402f2a72a89e43bc8043cf77dfa4770141
TLSH
T12D112F101351A1B6402A37BFA5E3706CE59F012F022A161079BC508D77BF6E58A15FA1
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj62CE.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4772_1679174237\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\123flightsound\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\123flightsound\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\123flightsound\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\123flightsound\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\123flightsound\Network\Network Persistent State
Size 855B
SHA256 09705c96c41059a4641b65efe61f105bc8bb848588c4cd5c2beffbc74c233eba
MD5 494d19ea962df2369c14edfff914881c
SHA1 53759effb8af504f0be5f38b1083ed58ff9e96fe
SHA512 10e5723359faa071350b7042184d16695d7634a38936deed856d632427e3595da5ff19015eb48b7d63b47fab258ac055e9ae6ef92ee79f038d2326d4440413cb
TLSH
T197116BA7C3D84ABD895213F46B353963C5BE1A2D52683D03C8D8EF9EA7F147A460054E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5dc6cd.TMP

Path C:\Users\Admin\AppData\Roaming\123flightsound\Network\Network Persistent State~RFe5dc6cd.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

123flightSOUND.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\123flightSOUND.lnk
Size 2KB
SHA256 a9c9bae3b0c150e4369f30bd59c02961aff9d99430171a2535e850edeb5df6a7
MD5 b073c33bdbcf7c96a65bfa546e3bf278
SHA1 ea07b42464145662338d866b67cb2b67b172eff7
SHA512 81ed9947b0045dc6ca4e231eea7015c2aada27e055209d51fd2f31e1c542414e2a190dffd9dd330c52f35b03997ef8a65fdec3e69e4a1abd7d653382ff67869d
TLSH
T1F25110089DEB7618EBEFD6751DEB69286832FA11F7039B092085C18D286C9006F15F6E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2240-1103-0x00007FF9FA0C0000-0x00007FF9FA0C1000-memory.dmp

Download

memory/2240-1104-0x00007FF9F82E0000-0x00007FF9F82E1000-memory.dmp

Download

memory/2572-905-0x0000000008530000-0x0000000008BAC000-memory.dmp

Download

memory/2572-904-0x0000000006500000-0x000000000654C000-memory.dmp

Download

memory/2572-902-0x0000000005AE0000-0x0000000005E3B000-memory.dmp

Download

memory/4484-313-0x0000000005770000-0x0000000005ACB000-memory.dmp

Download

memory/4544-307-0x0000000007940000-0x0000000007EFA000-memory.dmp

Download

memory/4544-297-0x0000000005D40000-0x0000000005DA6000-memory.dmp

Download

memory/4544-296-0x0000000005CD0000-0x0000000005D36000-memory.dmp

Download

memory/4544-295-0x00000000054D0000-0x00000000054F2000-memory.dmp

Download

memory/4544-294-0x0000000005590000-0x0000000005BDA000-memory.dmp

Download

memory/4544-293-0x0000000004DB0000-0x0000000004DE6000-memory.dmp

Download

memory/4544-300-0x0000000005F50000-0x00000000062AB000-memory.dmp

Download

memory/4544-301-0x00000000062B0000-0x00000000062CE000-memory.dmp

Download

memory/4544-302-0x0000000006310000-0x000000000635C000-memory.dmp

Download

memory/4544-304-0x0000000007270000-0x0000000007306000-memory.dmp

Download

memory/4544-305-0x0000000006830000-0x000000000684A000-memory.dmp

Download

memory/4544-306-0x0000000006880000-0x00000000068A2000-memory.dmp

Download