3a1343b236a605f8b5cedbadabfbdba7cd5cff15e09ffac07c3ca2fb7b7bf241

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gbfr-logs-2.0.4.74-cleista-ALPHA-PRERELEASE-x64.msi
Size 10.4MB
Sample260810-wc2cfazsax
SHA256 3a1343b236a605f8b5cedbadabfbdba7cd5cff15e09ffac07c3ca2fb7b7bf241
MD5 b5cc6bc815e91d7f805fb4e332784357
SHA1 0a71a36d6447c3058661bb4b64edffb468a28f14
SHA512 4bc89551546e99abbd46039105c55d66fcfe6a3b1891d2bcdcc945a06779a667a0adcf1e3d80a951decdc1516b3ebf555902661c62cbc69c825c323a05c1f910
SSDEEP 196608:M/qysxSwfyfmPmHY10lxB35ImVaoRrdR0QTRyjF9LfCxD9cmtmth2VkE:M/rskw9PmuST35Ik/ZFyR9LqxD9cbL2B
TLSH
T1E7B633137D924532E5BA1F3245B687A05A3DFC200B60C89B6348791DEEF11D1AB72BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1788	GBFR Logs.exe

Loads dropped DLL 2 IoCs

pid	Process
4116	MsiExec.exe
4116	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GBFR Logs.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\GBFR Logs\lang\zh-TW\enemies.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\zh-CN\mastertraits.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\ko\ui.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\es\ui.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\fr\weapons.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\jp\summonbonuses.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\es\quests.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\fr\summons.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\jp\weapons.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\ge\overmasteries.json	msiexec.exe
File opened for modification	C:\Program Files\GBFR Logs\logs.db-shm	GBFR Logs.exe
File created	C:\Program Files\GBFR Logs\lang\jp\mastertraits.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\jp\characters.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\ko\summons.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\en\traits.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\assets\summon-equip-bonus.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\jp\summons.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\zh-TW\weapons.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\zh-CN\quests.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\it\sigils.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\it\overmasteries.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\assets\skill-groups.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\zh-TW\characters.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\zh-TW\summonbonuses.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\zh-CN\ui.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\en\items.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\fr\items.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\assets\trait-order.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\zh-CN\items.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\it\summonbonuses.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\es\sigils.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\es\traits.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\es\characters.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\es\summonbonuses.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\zh-TW\overmasteries.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\fr\overmasteries.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\es\enemies.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\es\mastertraits.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\ko\overmasteries.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\ko\mastertraitdetails.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\ko\sigils.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\jp\items.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\bp\sigils.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\fr\summonbonuses.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\bp\mastertraits.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\ge\traits.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\it\characters.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\ge\mastertraitdetails.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\ge\weapons.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\it\ui.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\README.md	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\es\items.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\zh-CN\traits.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\jp\enemies.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\fr\enemies.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\bp\summons.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\bp\overmasteries.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\zh-TW\ui.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\fr\traits.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\en\mastertraitdetails.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\bp\quests.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\zh-CN\weapons.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\zh-CN\summons.json	msiexec.exe
File created	C:\Program Files\GBFR Logs\lang\fr\mastertraitdetails.json	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e59e1cb.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1CD4930F625D89F1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF78334C08D1530851.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{99815C10-2975-4F0C-88A0-B93E3DE12DFD}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF692D87B3D8220531.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0198D91EC0F4ADA0.TMP	msiexec.exe
File created	C:\Windows\Installer\e59e1cb.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{99815C10-2975-4F0C-88A0-B93E3DE12DFD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE90E.tmp	msiexec.exe
File created	C:\Windows\Installer\{99815C10-2975-4F0C-88A0-B93E3DE12DFD}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e59e1cd.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3780	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\01C518995792C0F4880A9BE3D31ED2DF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\01C518995792C0F4880A9BE3D31ED2DF\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\Version = "33554436"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\01C518995792C0F4880A9BE3D31ED2DF\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\ProductName = "GBFR Logs"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\PackageCode = "56E684717D10D35488B9D8D2BF8F6448"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\817051A53ECEC255BB306275ACEDD200	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\817051A53ECEC255BB306275ACEDD200\01C518995792C0F4880A9BE3D31ED2DF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\01C518995792C0F4880A9BE3D31ED2DF\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\01C518995792C0F4880A9BE3D31ED2DF\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\ProductIcon = "C:\\Windows\\Installer\\{99815C10-2975-4F0C-88A0-B93E3DE12DFD}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\SourceList\PackageName = "gbfr-logs-2.0.4.74-cleista-ALPHA-PRERELEASE-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01C518995792C0F4880A9BE3D31ED2DF\SourceList\Net	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2844	msiexec.exe
2844	msiexec.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3740	msedgewebview2.exe
3740	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3780	msiexec.exe
Token: SeSecurityPrivilege	2844	msiexec.exe
Token: SeCreateTokenPrivilege	3780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3780	msiexec.exe
Token: SeLockMemoryPrivilege	3780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3780	msiexec.exe
Token: SeMachineAccountPrivilege	3780	msiexec.exe
Token: SeTcbPrivilege	3780	msiexec.exe
Token: SeSecurityPrivilege	3780	msiexec.exe
Token: SeTakeOwnershipPrivilege	3780	msiexec.exe
Token: SeLoadDriverPrivilege	3780	msiexec.exe
Token: SeSystemProfilePrivilege	3780	msiexec.exe
Token: SeSystemtimePrivilege	3780	msiexec.exe
Token: SeProfSingleProcessPrivilege	3780	msiexec.exe
Token: SeIncBasePriorityPrivilege	3780	msiexec.exe
Token: SeCreatePagefilePrivilege	3780	msiexec.exe
Token: SeCreatePermanentPrivilege	3780	msiexec.exe
Token: SeBackupPrivilege	3780	msiexec.exe
Token: SeRestorePrivilege	3780	msiexec.exe
Token: SeShutdownPrivilege	3780	msiexec.exe
Token: SeDebugPrivilege	3780	msiexec.exe
Token: SeAuditPrivilege	3780	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3780	msiexec.exe
Token: SeChangeNotifyPrivilege	3780	msiexec.exe
Token: SeRemoteShutdownPrivilege	3780	msiexec.exe
Token: SeUndockPrivilege	3780	msiexec.exe
Token: SeSyncAgentPrivilege	3780	msiexec.exe
Token: SeEnableDelegationPrivilege	3780	msiexec.exe
Token: SeManageVolumePrivilege	3780	msiexec.exe
Token: SeImpersonatePrivilege	3780	msiexec.exe
Token: SeCreateGlobalPrivilege	3780	msiexec.exe
Token: SeCreateTokenPrivilege	3780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3780	msiexec.exe
Token: SeLockMemoryPrivilege	3780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3780	msiexec.exe
Token: SeMachineAccountPrivilege	3780	msiexec.exe
Token: SeTcbPrivilege	3780	msiexec.exe
Token: SeSecurityPrivilege	3780	msiexec.exe
Token: SeTakeOwnershipPrivilege	3780	msiexec.exe
Token: SeLoadDriverPrivilege	3780	msiexec.exe
Token: SeSystemProfilePrivilege	3780	msiexec.exe
Token: SeSystemtimePrivilege	3780	msiexec.exe
Token: SeProfSingleProcessPrivilege	3780	msiexec.exe
Token: SeIncBasePriorityPrivilege	3780	msiexec.exe
Token: SeCreatePagefilePrivilege	3780	msiexec.exe
Token: SeCreatePermanentPrivilege	3780	msiexec.exe
Token: SeBackupPrivilege	3780	msiexec.exe
Token: SeRestorePrivilege	3780	msiexec.exe
Token: SeShutdownPrivilege	3780	msiexec.exe
Token: SeDebugPrivilege	3780	msiexec.exe
Token: SeAuditPrivilege	3780	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3780	msiexec.exe
Token: SeChangeNotifyPrivilege	3780	msiexec.exe
Token: SeRemoteShutdownPrivilege	3780	msiexec.exe
Token: SeUndockPrivilege	3780	msiexec.exe
Token: SeSyncAgentPrivilege	3780	msiexec.exe
Token: SeEnableDelegationPrivilege	3780	msiexec.exe
Token: SeManageVolumePrivilege	3780	msiexec.exe
Token: SeImpersonatePrivilege	3780	msiexec.exe
Token: SeCreateGlobalPrivilege	3780	msiexec.exe
Token: SeCreateTokenPrivilege	3780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3780	msiexec.exe
Token: SeLockMemoryPrivilege	3780	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3780	msiexec.exe
1788	GBFR Logs.exe
3780	msiexec.exe
1788	GBFR Logs.exe
1788	GBFR Logs.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1788	GBFR Logs.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3780	msiexec.exe
2844	msiexec.exe
4116	MsiExec.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 4116	2844	msiexec.exe	90
PID 2844 wrote to memory of 4184	2844	msiexec.exe	96
PID 4116 wrote to memory of 1788	4116	MsiExec.exe	99
PID 1788 wrote to memory of 3740	1788	GBFR Logs.exe	100
PID 3740 wrote to memory of 2576	3740	msedgewebview2.exe	101
PID 3740 wrote to memory of 3364	3740	msedgewebview2.exe	102
PID 3740 wrote to memory of 3364	3740	msedgewebview2.exe	102
PID 3740 wrote to memory of 3364	3740	msedgewebview2.exe	102
PID 3740 wrote to memory of 3364	3740	msedgewebview2.exe	102
PID 3740 wrote to memory of 4844	3740	msedgewebview2.exe	103
PID 3740 wrote to memory of 4144	3740	msedgewebview2.exe	104
PID 3740 wrote to memory of 4144	3740	msedgewebview2.exe	104
PID 3740 wrote to memory of 4144	3740	msedgewebview2.exe	104
PID 3740 wrote to memory of 2932	3740	msedgewebview2.exe	105
PID 3740 wrote to memory of 2932	3740	msedgewebview2.exe	105
PID 3740 wrote to memory of 2932	3740	msedgewebview2.exe	105
PID 3740 wrote to memory of 2932	3740	msedgewebview2.exe	105
PID 3740 wrote to memory of 2932	3740	msedgewebview2.exe	105
PID 3740 wrote to memory of 5012	3740	msedgewebview2.exe	106
PID 3740 wrote to memory of 5012	3740	msedgewebview2.exe	106
PID 3740 wrote to memory of 5012	3740	msedgewebview2.exe	106
PID 3740 wrote to memory of 5012	3740	msedgewebview2.exe	106
PID 3740 wrote to memory of 5012	3740	msedgewebview2.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\gbfr-logs-2.0.4.74-cleista-ALPHA-PRERELEASE-x64.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3780

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9C0B6512EAB6FDF47B00AE9BE8A6033E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Program Files\GBFR Logs\GBFR Logs.exe
    "C:\Program Files\GBFR Logs\GBFR Logs.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="GBFR Logs.exe" --webview-exe-version=2.0.4-74 --user-data-dir="C:\Users\Admin\AppData\Local\com.false\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --disable-gpu --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1788.3588.10419911675819936445 /pfhostedapp:8f860ef2f06efb607753eaeec003d75b3cafcbfd
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:3740
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.false\EBWebView /prefetch:4 /pfhostedapp:8f860ef2f06efb607753eaeec003d75b3cafcbfd --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.false\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9d5575fd8,0x7ff9d5575fe4,0x7ff9d5575ff0
        5⤵
        
        PID:2576
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.false\EBWebView" --webview-exe-name="GBFR Logs.exe" --webview-exe-version=2.0.4-74 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1780 --field-trial-handle=1784,i,1373787247999880292,14536470089212864416,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:8f860ef2f06efb607753eaeec003d75b3cafcbfd
        5⤵
        
        PID:3364
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.false\EBWebView" --webview-exe-name="GBFR Logs.exe" --webview-exe-version=2.0.4-74 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1844 --field-trial-handle=1784,i,1373787247999880292,14536470089212864416,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:8f860ef2f06efb607753eaeec003d75b3cafcbfd
        5⤵
        
        PID:4844
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.false\EBWebView" --webview-exe-name="GBFR Logs.exe" --webview-exe-version=2.0.4-74 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2220 --field-trial-handle=1784,i,1373787247999880292,14536470089212864416,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8f860ef2f06efb607753eaeec003d75b3cafcbfd
        5⤵
        
        PID:4144
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.false\EBWebView" --webview-exe-name="GBFR Logs.exe" --webview-exe-version=2.0.4-74 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3260 --field-trial-handle=1784,i,1373787247999880292,14536470089212864416,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8f860ef2f06efb607753eaeec003d75b3cafcbfd /prefetch:1
        5⤵
        
        PID:2932
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.false\EBWebView" --webview-exe-name="GBFR Logs.exe" --webview-exe-version=2.0.4-74 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3808 --field-trial-handle=1784,i,1373787247999880292,14536470089212864416,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8f860ef2f06efb607753eaeec003d75b3cafcbfd /prefetch:1
        5⤵
        
        PID:5012
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4184

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59e1cc.rbs

Path C:\Config.Msi\e59e1cc.rbs
Size 95KB
SHA256 315866fb6d7d8c42466bb909f4c97502f5549a9d8b25054f1c27f689f7be7a71
MD5 de4e17b6d5ac73c5755804f3aac23d6e
SHA1 0e5c7676894cb348dc76242c20cc0d77773071a1
SHA512 b2e2cc227e2ddbf69d27ae3aa4c62044fcf40fec7dcf66e9b7dcd0ac1dc6e601c748391016ca9b474c0419815e307f8b58c00748d69d90988d0ebf1cd26e06ec
SSDEEP 1536:pZAJceWLtYzO+dYbDTLNrmebieEdfRmcsg3ovDqSvSEehot8R4uCTkv7KyZPgQeJ:D3DLJ
TLSH
T171A33AD6D610C783D29F5A38EEAB17403732C88D539992179BCDB239C8823911FB9E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GBFR Logs.exe

Path C:\Program Files\GBFR Logs\GBFR Logs.exe
Size 15.0MB
SHA256 5cefd7070fcdb4ec7e910745be25d66296390a2fc5350379108066184f90eade
MD5 b7e0530b99ab6b79480e444bd2add643
SHA1 93229970b1e297563f8910b197db5fe940ff2af9
SHA512 6ea89494bee13bd8d231b72870f55a212c6fce48a61f5ba5cc2b4a346ebe6196f6653f7ff59c1441722b4331ac478b76b4d47941ab9cb321c3d226efd616fe5e
SSDEEP 196608:gYnV9n2EqzmSieA0UcWuVbVSaKuRDyZdj:JnV9n2nqSieLU7uVEaXRyZd
TLSH
T178F64A21BB9A99ADC09AC474834647725A3170CB0B35BAFF45C496383FA9AF51F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

master-traits.json

Path C:\Program Files\GBFR Logs\assets\master-traits.json
Size 282KB
SHA256 664c9dddabca2c4918bcd6a30fe010aa042c65e08475a28ce4fe56b2a17413e8
MD5 63409dfe6ef524f2f6a8a405de579f16
SHA1 07104986ccd36013b348cad8d010b6ea9cce340f
SHA512 2574a3c18bdda48acf1c9387eea1f182b747afd2cff4b34033016b2b26593a5343785ecd349986e5f94583141071179d21578c45401c47a7831bf089c8ddd9f4
SSDEEP 768:IaePyvtziCm0QxqC2aQJKCEzgqVeS9RaHYol8TNOIrT2wh:5ePQmf/tnCAgqQS2Hfoyw
TLSH
T15C540AA6C5E50DFB60D90DB50076C561A818194BCEA5BD3DB68AD60C2F4C0FF62FA7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skill-groups.json

Path C:\Program Files\GBFR Logs\assets\skill-groups.json
Size 12KB
SHA256 b8df9afb43aac1c3eac24531eb45bbcf309f10d1969a8cc82fefa3e4eeb59009
MD5 72f259e8a1deb615493b995f19c97050
SHA1 3936dee2e70aab7a730af799cfec4865c9b1d914
SHA512 869984c467da0a4580774ddde02aaed617c6eda7cc8f885b2e6f1988acabc56278ce81050ae638a8e99a64c12821ee2b9b923947e29d1781a584d5dd2ef0bac5
SSDEEP 192:RFjZ4Cei7fGzLbu9l1J7EAO5/5NM/Obab:R4biqzLh3NM2ab
TLSH
T187429E1DCAF14C86A397B1AA0EEE31859234D5D7446C2C69B44C0F8CAF487DDA5B63F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

summon-equip-bonus.json

Path C:\Program Files\GBFR Logs\assets\summon-equip-bonus.json
Size 4KB
SHA256 7d1638c80caf5aec38ff7d613a43ba8f59f1aca7601fde28cacb5c60664f4612
MD5 ad6c30c77a5eca99d2fb4c728435ae68
SHA1 c93a6a89b7bc379243bedd2eb7790b4ec79549e9
SHA512 d67dc255d4725b6c9196635faf9b8529eb5cab30f41f93e2729c70dbcf766ed7a66946e1d2bf87a5d631ca5bfb385a8918c4d780408a59aef50ea14a76099d2d
SSDEEP 48:972z3BGI9cwIhXcocXWIDvxDcAvIRhZelI7q+CGLc7zsZ0+Q:98rCLI3WlQ
TLSH
T1D9913663D9650942B20CCD3C883952829924FA937E23BD18705CC5DA0F5F98DEFBDA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trait-order.json

Path C:\Program Files\GBFR Logs\assets\trait-order.json
Size 33KB
SHA256 7606292be230ac9f05bcd93cbf87b531356ffb49c2da6fb0bd5449459fe069e0
MD5 5f7ad449a9cb033ecf6019c7b0051eb4
SHA1 95f4d7546f08823a29f1e73fadf6c3859fbbd8f0
SHA512 6dc83866eba102cf8a8b636f8da2c0442737fe9a9ad528c6c4e4be9b33d47634951e436ce0ae78d2b7a2522f2233b914f9d3e704afca4636be7d10a30a7d2711
SSDEEP 192:9krSD2nv5L2AVr71R5HPDOxgbIdXbHhJBNWgZnf8d7k:H2ntfJbOgbIdXjhzNWSnEu
TLSH
T15CE23B7ACF3C4CC3365D45E249BA061B65A8DA4B4F673D8B3A44DD8C8F8D81E193819E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

characters.json

Path C:\Program Files\GBFR Logs\lang\en\characters.json
Size 675B
SHA256 2a24f3bb2b1fe46e91398f8eef73fa2cdd1a71661e823bfa53ec379333696248
MD5 7635e96c5762b88a16b8e4673e6ac5dd
SHA1 7357104f8871c64d8b294fcdf3711f458032b195
SHA512 a23468a44520e8c7d7a66835360097c722a3deeb595379340234f79fcdfd0b714f7a12fb5e68ec7e52e295e8b0e8db732f584000b547f6ea9c75ee6bdb815618
TLSH
T1E901BE74BA00496718E10C426C981DCD53441EDBE5A13CFE977721ED130E0772C73A2D
MD5 SHA1 SHA512 TLSH

Submit Download

enemies.json

Path C:\Program Files\GBFR Logs\lang\en\enemies.json
Size 57KB
SHA256 22ecd9c545f2baa04aefd492460fbc90eecf25a95d88f2deab7e34734a0c77fa
MD5 a31760a476feee02c50224b63fe843cb
SHA1 f83f71011d09c34e2d795b5d979ae35f06ab5653
SHA512 14287b0ded81c7687e516f7c9444f5e2cba3d08970bd7b8941ca17a0e1b992f7cf020040b76e7d609556f8365b6ba71ce492ea0e478e53f980459e7b55a19365
SSDEEP 384:1wkuy6/dYLfeBk/aN9lnSznKOrywJK2Mh4QI7E8bwNqRRiwj+Hjah54K4B7eqdib:XuyM0FnfywbjbUB75scf2rwo
TLSH
T104439158F9F88DF750AD86A7267F1C03A220A9937929FE6D7B86104D0F0C41F11FD99A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

items.json

Path C:\Program Files\GBFR Logs\lang\en\items.json
Size 28KB
SHA256 89cadb2251a10d54fede41d09bb3f8f3c47e58b6abcdd297a3d26c38be7bae24
MD5 6d99b1aeeb73f9d80d63736548d61328
SHA1 a6853b11a5d34456bd5ee3a6927f202543b81e02
SHA512 ff46b34201d86280ba79e15bb75cc83990a77eecabdc86bb6b21f9d309488303cd4fa5edc4a826a6953e5b43a3bdb215861e0ebef8274692d116f7f1c4338261
SSDEEP 192:G/bO+CYWSBgJLvudJR2Eyb5NNqR9WsS+A5Qai0RQzocv8x:G/b3zWScQJRy9s45SFv8x
TLSH
T195D28659F2F48CB380ADC673A93E1413A174A997E859FE2CB382684C1F8C51B11FD59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mastertraitdetails.json

Path C:\Program Files\GBFR Logs\lang\en\mastertraitdetails.json
Size 336KB
SHA256 2aa1709e6741c2313ad41a3989030eaea3269fdff79507f7c7ba4ad9e86beef6
MD5 48f68f6002ad30b62b5cb2085047e90c
SHA1 39ae612b7043e8ebdd48c88b6ce56f71b2ad8157
SHA512 59fdec26dc374f5aadf1eb9a23de8fccb09eb868223941cd886081665bdfc37f233241220314e549d3dcda34434cd9c4537451679eb1417b006700290cd62c2b
SSDEEP 1536:sMAV8WPqvXQ/wfvIEhUFszBCkFcMWKLHHKb3vnFkhNPGtXYt2OMnIkdITOkZnmJQ:HWI9VbkIvo1mk9IW9XQczxvy
TLSH
T1A774CB18F2F19CF712AC9222225E5553A731E9872868FE7C7B56022D5FAD40B90FD4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mastertraits.json

Path C:\Program Files\GBFR Logs\lang\en\mastertraits.json
Size 7KB
SHA256 1190cb84f16f26ad8f01540b5851f921ca1a3171c39049d10a0397dbfd71c800
MD5 ea9442a883be04b768b8bf47a597604d
SHA1 f5cc97ea7a06673f3143591622a9c24830c1858b
SHA512 84b29cf0d26f605f0ac069317ab62222f378df2507c921440b99d9f43b8825a61fb9da390203431806f48c1ae0d72022886e5e2de591fc5f7a248b79389d7836
SSDEEP 96:oH2geYhiqjZpgwDQRhK2uAoYflc75jpaSP+S60Rdk9OBON6wDS5/zBH+uoEyxPz:nYBDQzuqc750M+30RdkPzPRJZz
TLSH
T1ECF15208E4F099F7547C81D235AE14437236ED632978FE68B682289C0F4F51B52BDBE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

overmasteries.json

Path C:\Program Files\GBFR Logs\lang\en\overmasteries.json
Size 29KB
SHA256 eac13d8d2c59c850c4618b4c33cf40039e7d3236e79d50d089b33581e513df61
MD5 f305ca5c264fb8ccf7137a451ff8c903
SHA1 979223e490587cce9395459cd5298adee24b9a03
SHA512 693023cd84d4a3d5b609a9b0d6e023e38091b066bbd934b13a83c6dbc735c61c97256d5f0333fdb87ad7f412bc2b9c8c9fe34a0534735c36c95185437e7c8e2d
SSDEEP 192:M5pQMHNhxJmD9dme57mylIGA88xWeO63kQVuV1hbGdSCWeT6XVjvB7ndTAdyFRyZ:M5bfGP4oVltRyrVsUJwN3Uh1qq3D
TLSH
T1B3D24129F6F58CB712AC82A9212E5507AA24ADD36C6DFF2DB792040C5F0D50B14FD5CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quests.json

Path C:\Program Files\GBFR Logs\lang\en\quests.json
Size 30KB
SHA256 d94ca8e22a2131513bd064b7a0ceb0c7f329b55ec2d5fa8416b224b5d716c6d5
MD5 77df1f5bc07eb6e59cb319e0039de3f5
SHA1 3d50afbe2e718b485fe1e3823b299de081e23589
SHA512 3cbbffc36cc942d169022e93a2c76449544cf60fb8a168bd889d0cc9ad96e6758a3b981110e3ee0f8ec602e9ebaa992fb5ec1e8eaa365e3be8c34c7c9692f6a8
SSDEEP 768:7kLXl7scEGMVw93ieArwir7atNOJlUKxJU:7EJ93ieArwir7atNO8
TLSH
T14FD23324F1F05EBB11EC8673665E1063BF24B99325A8EF1D7396224C4F4C61B41FD68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sigils.json

Path C:\Program Files\GBFR Logs\lang\en\sigils.json
Size 78KB
SHA256 e749d7d0080a27aa8da48809364717e98bc435e198ed5f85c0c66839829f263f
MD5 9c6b60d0b1ca16af31bfa46e9e800da2
SHA1 855140ea6943566e7dae1c959c371648f49ecb5f
SHA512 499704c7a9b58f0a72f588fede8aa6b8929541d4d7f5ecadae8d4f83e6e3914b3df7183fc842d05b72017fa6a59642faf967da0fe2776f1b0ea3b5f56907c395
SSDEEP 768:i/OKi4yzRWI+EybCYhe/4OnMIRTZvrJ2YHcdEqbuoteKOlPj5X9u5sj9axXtbjVF:iQR+/hIjbJRY/M0Xxb
TLSH
T1AF83A758F1F4CCB744AD8666226E6103A235ACA3696CFF3D7FA2125C1F6D01B40FD49A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skills.json

Path C:\Program Files\GBFR Logs\lang\en\skills.json
Size 18KB
SHA256 c043b173a7b74d76e067746e21f07d866b7d4079adccd8f6117f06155ea0ad98
MD5 0571c2a5c6e2a9a3b8865dcdcae55326
SHA1 050bcfd7015e446bedabcf31d2b4a589f9db790a
SHA512 436fc672ffa60cd667ae77c2af248905a14db34221d866e29f138c9fc1063e9594c98cadc0744eb6882ae9b0fdc21628b0a86d5e2915cb1cdfcc014e2db6056e
SSDEEP 384:5aHb6r0RC/bZLJgjy/6Fuky2l8IkC+VL9zpWr:O6r0czZLejy/6F3dNkC+VL9zps
TLSH
T16C82FD94F1F49FF380AC8526222E0023B62269936979FD2C7797606E0F0E54F15BF85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

summonbonuses.json

Path C:\Program Files\GBFR Logs\lang\en\summonbonuses.json
Size 1KB
SHA256 9f9e79e43e2172159c053931309b71062a8e02166780a5032388879d6e54e901
MD5 3761fcbb548d0072bd53104ce622c6c8
SHA1 781236b84782ef8091fcb32b65c0f1cef471f332
SHA512 68b8cec32b99cf3d1faa4170ce29a0c6d7584977850b800d50948bca8632c4786c2fb449a68dfd45f983cd077da63f7fb1808d7d67974799a1f1dd47c2c2194a
TLSH
T12F315C29FAF58CB712AC86B5212E6603A624ACD32DADEF2DF391405D5F0D10B14FC58B
MD5 SHA1 SHA512 TLSH

Submit Download

summons.json

Path C:\Program Files\GBFR Logs\lang\en\summons.json
Size 21KB
SHA256 21139c01a4dcb13648c05a8abe8ef3d41d0c8d530a109613ad8e61bcef298d06
MD5 6ccb9cc621d1ef0979bf4c52129c7f43
SHA1 f6d38552e349d63bb0e1bec462d8efd06bd9d2e9
SHA512 1a182447243f2746158c6baabf90bfcc37599b93b56b0d78ad8d6770b07b2781812509e65404c8f1b6c12fd2d7f56114abacc26b4a15474481a9810f3cfe7f43
SSDEEP 192:7d27UT5m/BG3e0lUZDwyd2tm6l+Mgrd7Hg6C6EAEBA+l1Tyku8quJdwohi:7Zm/YO0aZwUAmxrdUKiBok1rhi
TLSH
T1ACA2AD55F1F44CB790AC8622227E3443B7209A532968FEAD37C3157E6F0D52B60FC58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

traits.json

Path C:\Program Files\GBFR Logs\lang\en\traits.json
Size 15KB
SHA256 4d33cc79906c4922779fd5cb6411f4b80357a611cbe028c11f20d97f58bb2bd5
MD5 79069dbcd090dd7ab8ef09686ec050a4
SHA1 cc15efbd546e65928c7b39f7aafc108106f35284
SHA512 85597613eac85b7b3b7132736e92f225dd0450d34584fdbe2ed11fff345626c4285688e91c3ada1b03c495fdfa7af3f9d053076908724f11072a93dfe2058986
SSDEEP 192:JV3mEXyTjPPgQt4nQLhZqHTKTDCjrYSwlyRYSDH4GXUkb:DXy/wIKUTKTKTejEZQH4Gp
TLSH
T1BF721F55E1F49CF304AF86B6226F1103A328A897691DFE2C7762106D0F0D70F51FE9AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui.json

Path C:\Program Files\GBFR Logs\lang\en\ui.json
Size 118KB
SHA256 57681f6b6e7dcbf18cd735c6331839b0c599b41e1d6acfc8c7e3654c0b244b3a
MD5 f7df9fa287bf7a3cf54c4e3d4131d341
SHA1 719d347a479d897984857644e44242eadc802745
SHA512 3c752c859610aae51c238f57030bab56b9d1dba597b30d5988ef38b64c21b0df162f6fb1c92ecc784f5fe924fd985fa72d65e07d6148a5e0b49aabf729621d6f
SSDEEP 3072:I4Gv68RkHiH1UqHh/btAZ1GLLRmmABY7qRT:IM8RkHiH1UqHh/btAZ1ILRHqRT
TLSH
T1B4C34174CA090DEB299CD4AD648766236A586213CE917B5EF78C01CE4F9F02F40FD96E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

weapons.json

Path C:\Program Files\GBFR Logs\lang\en\weapons.json
Size 28KB
SHA256 c21b141a220110c84571a7db195bdfd05bebfa1dbd3425a37e1799d9c0ede9d3
MD5 0eeab389049e23879e86c1948770fd0c
SHA1 44b0474130cee49ea1e2c97379894f9db258029c
SHA512 0ce69ae6f6e04565aba9b6ed82423f693a3bd4851d0362c3a3b5688d66fce45ff24a97511a33c49e48bcfdfae40e885f5b9293f8214c336b8cd634c8314024db
SSDEEP 768:fZKjCvRd3SJeogis5HEYWrYz4bEbmVLqO:fZUW/3SJPg9HEYWUz4bEbm1qO
TLSH
T17AD27258F4F0DCBB909C962663BE1453BB6169936869FD2C7B82214C0F1E44F11FDCAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GBFR Logs.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GBFR Logs\GBFR Logs.lnk
Size 1KB
SHA256 14d223785c3e9a1bbc505020de440d3cc638aa669330f885abf4d9f5d2157f62
MD5 a6a5ef4619b05af6a7dcdcbe3a61c430
SHA1 f3cc0c0ac7e7ded20731d7f3f10a302435d9d9f6
SHA512 1d6ced08c67fc7868f2d0047a9469cd4be1e874a978dfe118c6db93ada4800161c88548ba325a86d830314d48f09009cf1c2a9ae0980ee83b6c83099f194ce17
TLSH
T12141231055F5037BE33646366DE547928B31F411EA380F7F818942851574810DA7DF3F
MD5 SHA1 SHA512 TLSH

Submit Download

GBFR Logs.lnk~RFe59f1a9.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GBFR Logs\GBFR Logs.lnk~RFe59f1a9.TMP
Size 1KB
SHA256 951b94f2de54fa6ae836d70c5f094792292e3a1115571ce1ff99d7d8a7977b6c
MD5 aa64f98c17fd01608bfb2b61762b6670
SHA1 3f5c4b134c9047e03c593ead76fb93553b3b768c
SHA512 d221c59931fb801a43f898dd385db7db19f78fe8cec8de10ccedfd8e7442da68c2908e5a7edfd4d4a2387ba5860af755f25bb7cafd4b9f3d743ec2e9c16346f8
TLSH
T1AE41E21455F1073BE33247366DE946928B31F4119A380F7B859542861564811D67DF3F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI36D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI36D.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
TLSH
T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7EFA.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7EFA.tmp
Size 113KB
SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
MD5 4fdd16752561cf585fed1506914d73e0
SHA1 f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA512 3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
SSDEEP 1536:YImZwomOndvrhsgz56GoiFmntw1ebC0fsWk0FlcdOJKJpPpxyNokVbY4:jewOdvregz5L/mxb7FUOsrPpxyN7/
TLSH
T19EB37C1275D0C072E8BE0E3D45748A715F7E7930EF648AEB635812694FB42C0AE39E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1eee902cd1316d5be09e87ed87069dbd9a9345baa7a3d437dfc323a5ca9d5f97
MD5 b86fb0fa18bfb13b3a9578d346dcf905
SHA1 9553bc35ef07dfae0fa25d002ed7f2e43326b7d1
SHA512 ea815aa49586979ca27cdb4830a21127a37cdf7301935be9c6bcb6096d22f3a376db4dc35506c4bc23544326f144e9fd84fb5b842380f46a794a993893e4a692
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 41145c1080396d7665fb4b7d4527dce7270c66f4f491d5ff9b0c4f74f883ec50
MD5 af9defa47d527d4db659e01e05a4f68c
SHA1 9cfc8e8541ac08311fa19c6a7833281b6966f720
SHA512 7f29b62b094759bf77f4e171280aba5a3e9bc1382d9c3ed832ae7b5feb56e8d05444b5caa81ad49e1ed6cd93cbc04fdbbf230383d59c79223978c2312782a719
TLSH
T1E0D02433330343F5C01031371D13714C3440D10F40574000743CC51D5F140500D1F4C1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

507a835c-510c-4630-a879-ff2bbe82790c.tmp

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Default\507a835c-510c-4630-a879-ff2bbe82790c.tmp
Size 6KB
SHA256 4eb87d03ad3a1d88b231191e640e0877a75e76fd8bf2e67f29f44faf72f661f3
MD5 f34d70ba4610316f94f5c20d0f405608
SHA1 da36218045f833c7f79d7baae9dae30e7e8437ff
SHA512 be2d4008c40a236318d692091f6639d8cd91af3f7e1e43adc7e317746743720bfbec7862a057e8aebea3b492890e1c7ceb6359738cbb9d2ee62fea16050f7fa0
SSDEEP 96:stm/dACfRu+ppb91kIo5h16ZPis7/x+6MhmuecpTgMkkjenK+g6S28XM1C7K:stedN5Po+isV+FNTgwjpUSG6K
TLSH
T12BD1C8025E28797B4CCAE118BA39BB17E2F9507170D51D68EBF8562C08D76DC6317E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a7cef77077fd17c3a9eab388b800f6872c8472a4dac98dff345f68db82cfecab
MD5 d08f8868ac8e7165425ae3f00317d8ea
SHA1 9a361167dae69f1764de36619b432a1249b8c4f6
SHA512 caf8dfcef1f5539d36ec17739dde2144049a7fc1180b12a15bc2f39ffd99a743a248ac18c69e4e25424b91f352ccae2fbffc4bf7a9e19c733ce199f2c820b938
TLSH
T10CA0025041C000C2E352077127D1055836304919060B07514A9A2FFDCCDC3908547011
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a616b.TMP

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a616b.TMP
Size 48B
SHA256 75d1c25aa847154ee86ca5b2c1f09fc7869dea2d744f19668f56df06dd9b9f96
MD5 ac0ecffac617eddcda219f017930adb9
SHA1 1f4b9754a6bd418c788b98f9d6dc9dc6b385ad9d
SHA512 28daf89400c544b410d6b2d528f43d9bc229d83daff2fc50f6167a2fc5746cd6e1a8b01ffdd3f66ad3d62bca6a0512fd69a45b11874066452deab59d7e8b4f6c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b391d.TMP

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Default\Network\Network Persistent State~RFe5b391d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Local State
Size 2KB
SHA256 7474d5f8f89048dba99c23ffd674835abcb4141f075b8b79d294be2f1e04f85e
MD5 af8bc83b56e4f7d5d35158d13158874d
SHA1 afd1f8595b1a1832630d6d02338c086745e876dd
SHA512 120bf7d2814833ab609f17544b07d3229d70ffd38e323397e8dadcb195094efc008f1914de73d9b20ceb396a66e588a127e081f1fcf618f9b2c115a35f63c661
TLSH
T1E3517233B814ABBB99E24B087D4B3F23DA7691A5EA512F6096DD1B0C02D724D2306D37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Local State
Size 3KB
SHA256 682a2a56d534bab6e83ca263d3314d00f9f610f1bdc1d9ba78bed0f9bc671dcf
MD5 54b52c3571271f10af44c1fa8cc9dca1
SHA1 69545dddb84b4966fc2124b883de00fe04841707
SHA512 d34f3b92905de6237e6394d06d34b0682ea2a357241807c281894447374802820eccecabae328d98b3ff6d2418e119f5fdd8c090613721f4a124dd8043000ac0
TLSH
T158619637A934A97B8DE29A057C863B17E7A55067E5813FA4C6EC1E0D02D738C2352D27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Local State
Size 15KB
SHA256 6fe8ff1025017e8a0e0471341dd6e1a9025da67ad510a1ea45adef582910bdf2
MD5 008bb111b6d5cd9607ff4b6aee41810d
SHA1 4e9a5c62aa866ea067255a5d71ad08ebdac8da8d
SHA512 658e20b6ebc75eb757f7220b44cbabda7547f5959e51703ae3f7096b42c55623d7e1990f225c0caaaf8483e3ab857049dbc2a9e2a5c18472fb91e87fa273b6d8
SSDEEP 384:S+aQikB+z/xvxjg/qhECNBSI8hfTlAVdpLqE9z7:9/UxvxjgC+/9TlULqEF7
TLSH
T1D372AE2765693E67A5F7EA053D4D1B9BCAB884B290C16EB44AED5F0E03C72D81302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a0f82.TMP

Path C:\Users\Admin\AppData\Local\com.false\EBWebView\Local State~RFe5a0f82.TMP
Size 1KB
SHA256 fddb449ada34c7e13909da7ee21c996719cc05369e9a4d6cead8cfe6c3f7d289
MD5 9e6e25ee0516ec285d370eb0955f29ef
SHA1 69445037d5dd5435403f02e3e8131d7947376528
SHA512 9c054a22d828451f3b48ff47e6b60392d7216cd80335155b01c6aef2e57ba041c91a8e57a23a4b48c3ca15fb759b7b80386a311e745831f51482be0e87b1644e
TLSH
T1C62187B2F0246BB2ADD6134A3D073B779E3190AAC2505E4092DE4E0D03E714DA537E33
MD5 SHA1 SHA512 TLSH

Submit Download

e59e1cb.msi

Path C:\Windows\Installer\e59e1cb.msi
Size 10.4MB
SHA256 3a1343b236a605f8b5cedbadabfbdba7cd5cff15e09ffac07c3ca2fb7b7bf241
MD5 b5cc6bc815e91d7f805fb4e332784357
SHA1 0a71a36d6447c3058661bb4b64edffb468a28f14
SHA512 4bc89551546e99abbd46039105c55d66fcfe6a3b1891d2bcdcc945a06779a667a0adcf1e3d80a951decdc1516b3ebf555902661c62cbc69c825c323a05c1f910
SSDEEP 196608:M/qysxSwfyfmPmHY10lxB35ImVaoRrdR0QTRyjF9LfCxD9cmtmth2VkE:M/rskw9PmuST35Ik/ZFyR9LqxD9cbL2B
TLSH
T1E7B633137D924532E5BA1F3245B687A05A3DFC200B60C89B6348791DEEF11D1AB72BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 a6c543cb0de7b24ddc053772a04ef7c62b4c979f18b0b9932b8eb627b6f1f865
MD5 b9d770c6854b9ca81e441115c1bfdeed
SHA1 a1c6c6d1e8527e83105f14ecbe2e6611a3ce8cff
SHA512 b1fb74013a96a76bb986d95f6f17401019f315d1760643a8a822c216427b0ec5eac388feb207e3c7d81e3623f040c7879fc94b44c224d554660619a4026b5699
SSDEEP 24576:zFo3DMPTdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeC:tH0
TLSH
T1D757B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a68c2027-b9d4-4c92-b00b-993a4c8ba885}_OnDiskSnapshotProp

Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a68c2027-b9d4-4c92-b00b-993a4c8ba885}_OnDiskSnapshotProp
Size 6KB
SHA256 77ea43147e4b9357a7b0e9eb53b8d6aad0644c60abf5d529d39ccfce26315280
MD5 9af8855f72343f09896686416a374222
SHA1 494bfd2164e74a8d29c96f4b306e1800edcf23ae
SHA512 64689b310fdd7339fab53f513fb26536d7d1a8d6276696cdb2cd14ea964a0383499832b50ad234821928bd1305755c074f4bbb60687ecf46891cef3210ed30f8
SSDEEP 96:FTzW5mG2lDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:hKN2l/b++uVmN
TLSH
T16CD178085AF54711E2B3AB3129F14557A877B911FF33CB8E0298238E6671A10F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2932-244-0x00007FF9F9450000-0x00007FF9F9451000-memory.dmp

Download

memory/3364-218-0x00007FF9F9450000-0x00007FF9F9451000-memory.dmp

Download