hxxps://api-v1-launcher-service-prod[.]erafn[.]dev/api/launcher/download/v3

Analysis

user interaction
yes
max time kernel
201s
max time network
199s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://api-v1-launcher-service-prod.erafn.dev/api/launcher/download/v3
Sample260910-crtrcsterc

Score

8^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3716	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	900	chrome.exe

Executes dropped EXE 8 IoCs

pid	Process
2176	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
3700	Era V3.exe
4516	Era V3.exe
4740	Era V3.exe
3576	Era V3.exe
5248	FortniteLauncher.exe
2028	Era V3.exe

Loads dropped DLL 22 IoCs

pid	Process
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
2176	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
3700	Era V3.exe
3576	Era V3.exe
3576	Era V3.exe
3576	Era V3.exe
3576	Era V3.exe
3576	Era V3.exe
3576	Era V3.exe
2028	Era V3.exe
3576	Era V3.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
67	discord.com
69	discord.com
75	discord.com
86	discord.com
66	discord.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Era V3\snapshot_blob.bin	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\ro.pak	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\app.asar.unpacked\node_modules\@sentry\cli\node_modules\@sentry	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\en-US.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\fr.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\gu.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\hu.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\id.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\ur.pak	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\app.asar.unpacked\node_modules\@sentry	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\binaries	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\ffmpeg.dll	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\es-419.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\it.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\lv.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\sr.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\tr.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\vi.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\workers\diskWriterWorker.js	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\vk_swiftshader.dll	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\sv.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\zh-TW.pak	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\build	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\build\Release\dll_injector.node	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\workers\downloadWorkerPooled.js	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\LICENSE.electron.txt	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\v8_context_snapshot.bin	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\sk.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\elevate.exe	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\app.asar.unpacked\node_modules\@sentry\cli\node_modules	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\binaries\FortniteLauncher.exe	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\workers\downloadWorker.js	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\ja.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\te.pak	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\app.asar.unpacked\node_modules	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\af.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\ca.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\fi.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\pt-BR.pak	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\app.asar.unpacked\node_modules\@sentry\cli\node_modules\@sentry\cli-win32-x64\package.json	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\app.asar.unpacked\node_modules\@sentry\cli\node_modules\@sentry\cli-win32-x64\bin	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\pl.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\pt-PT.pak	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\app.asar.unpacked\node_modules\@sentry\cli\node_modules\@sentry\cli-win32-x64	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\workers	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\nb.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\chrome_100_percent.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\dxcompiler.dll	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\icudtl.dat	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\bn.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\hr.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\sw.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\bg.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\ko.pak	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\app.asar.unpacked	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\chrome_200_percent.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\LICENSES.chromium.html	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\ar.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\fa.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\hi.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\vulkan-1.dll	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\fil.pak	Era Setup 3.0.9.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_874310163\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_1780041491\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_893840398\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_893840398\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_2099482598\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_874310163\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_1780041491\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_893840398\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_893840398\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6124	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Era Setup 3.0.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Era Setup 3.0.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
900	chrome.exe
964	msedge.exe
6776	msedge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Era V3.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334803677313367"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	Era Setup 3.0.9.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\fluxapp\shell\open\command	Era V3.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\fluxapp\shell\open	Era V3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\fluxapp\shell\open\command\ = "\"C:\\Program Files\\Era V3\\Era V3.exe\" \"%1\""	Era V3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\fluxapp	Era V3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\fluxapp\URL Protocol	Era V3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\fluxapp\ = "URL:fluxapp"	Era V3.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\fluxapp\shell	Era V3.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{3F160AE8-FE99-43E0-B38E-44FC1828A1CD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1156	chrome.exe
1156	chrome.exe
3716	powershell.exe
3716	powershell.exe
3716	powershell.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1684	Era Setup 3.0.9.exe
1156	chrome.exe
1156	chrome.exe
4616	msedge.exe
4616	msedge.exe
6420	msedge.exe
6420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeIncreaseQuotaPrivilege	3716	powershell.exe
Token: SeSecurityPrivilege	3716	powershell.exe
Token: SeTakeOwnershipPrivilege	3716	powershell.exe
Token: SeLoadDriverPrivilege	3716	powershell.exe
Token: SeSystemProfilePrivilege	3716	powershell.exe
Token: SeSystemtimePrivilege	3716	powershell.exe
Token: SeProfSingleProcessPrivilege	3716	powershell.exe
Token: SeIncBasePriorityPrivilege	3716	powershell.exe
Token: SeCreatePagefilePrivilege	3716	powershell.exe
Token: SeBackupPrivilege	3716	powershell.exe
Token: SeRestorePrivilege	3716	powershell.exe
Token: SeShutdownPrivilege	3716	powershell.exe
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeSystemEnvironmentPrivilege	3716	powershell.exe
Token: SeRemoteShutdownPrivilege	3716	powershell.exe
Token: SeUndockPrivilege	3716	powershell.exe
Token: SeManageVolumePrivilege	3716	powershell.exe
Token: 33	3716	powershell.exe
Token: 34	3716	powershell.exe
Token: 35	3716	powershell.exe
Token: 36	3716	powershell.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
2276	msedge.exe
2276	msedge.exe
1156	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 5580	1156	chrome.exe	88
PID 1156 wrote to memory of 900	1156	chrome.exe	90
PID 1156 wrote to memory of 4412	1156	chrome.exe	92
PID 1156 wrote to memory of 4412	1156	chrome.exe	92
PID 1156 wrote to memory of 4336	1156	chrome.exe	91
PID 1156 wrote to memory of 4336	1156	chrome.exe	91
PID 1156 wrote to memory of 1676	1156	chrome.exe	93
PID 1156 wrote to memory of 2764	1156	chrome.exe	94
PID 1156 wrote to memory of 1676	1156	chrome.exe	93
PID 1156 wrote to memory of 2764	1156	chrome.exe	94
PID 1156 wrote to memory of 2700	1156	chrome.exe	96
PID 1156 wrote to memory of 5000	1156	chrome.exe	98
PID 1156 wrote to memory of 5000	1156	chrome.exe	98
PID 1156 wrote to memory of 5140	1156	chrome.exe	99
PID 1156 wrote to memory of 5140	1156	chrome.exe	99
PID 1156 wrote to memory of 4716	1156	chrome.exe	102
PID 1156 wrote to memory of 4716	1156	chrome.exe	102
PID 1156 wrote to memory of 2344	1156	chrome.exe	103
PID 1156 wrote to memory of 2344	1156	chrome.exe	103
PID 1156 wrote to memory of 2268	1156	chrome.exe	104
PID 1156 wrote to memory of 2268	1156	chrome.exe	104
PID 1156 wrote to memory of 2120	1156	chrome.exe	105
PID 1156 wrote to memory of 2120	1156	chrome.exe	105
PID 1156 wrote to memory of 5176	1156	chrome.exe	107
PID 1156 wrote to memory of 3008	1156	chrome.exe	106
PID 1156 wrote to memory of 5176	1156	chrome.exe	107
PID 1156 wrote to memory of 3008	1156	chrome.exe	106
PID 1156 wrote to memory of 1412	1156	chrome.exe	108
PID 1156 wrote to memory of 2176	1156	chrome.exe	109
PID 1156 wrote to memory of 1684	1156	chrome.exe	110
PID 1684 wrote to memory of 3716	1684	Era Setup 3.0.9.exe	111
PID 1156 wrote to memory of 1264	1156	chrome.exe	114
PID 1156 wrote to memory of 4800	1156	chrome.exe	115
PID 1156 wrote to memory of 5800	1156	chrome.exe	116
PID 3700 wrote to memory of 4516	3700	Era V3.exe	120
PID 3700 wrote to memory of 3576	3700	Era V3.exe	121
PID 3700 wrote to memory of 4740	3700	Era V3.exe	122
PID 3700 wrote to memory of 3576	3700	Era V3.exe	121
PID 3700 wrote to memory of 5248	3700	Era V3.exe	123
PID 3700 wrote to memory of 2028	3700	Era V3.exe	124
PID 3700 wrote to memory of 6124	3700	Era V3.exe	126
PID 6124 wrote to memory of 4092	6124	cmd.exe	128
PID 3700 wrote to memory of 2276	3700	Era V3.exe	129
PID 2276 wrote to memory of 700	2276	msedge.exe	130
PID 2276 wrote to memory of 964	2276	msedge.exe	131
PID 2276 wrote to memory of 4792	2276	msedge.exe	132
PID 2276 wrote to memory of 4792	2276	msedge.exe	132
PID 2276 wrote to memory of 3252	2276	msedge.exe	133
PID 2276 wrote to memory of 3252	2276	msedge.exe	133
PID 2276 wrote to memory of 3252	2276	msedge.exe	133
PID 2276 wrote to memory of 2816	2276	msedge.exe	135
PID 2276 wrote to memory of 2816	2276	msedge.exe	135
PID 2276 wrote to memory of 2816	2276	msedge.exe	135
PID 2276 wrote to memory of 1228	2276	msedge.exe	136
PID 2276 wrote to memory of 1228	2276	msedge.exe	136
PID 2276 wrote to memory of 1228	2276	msedge.exe	136
PID 2276 wrote to memory of 4268	2276	msedge.exe	137
PID 2276 wrote to memory of 5060	2276	msedge.exe	138
PID 2276 wrote to memory of 4268	2276	msedge.exe	137
PID 2276 wrote to memory of 4268	2276	msedge.exe	137
PID 2276 wrote to memory of 5060	2276	msedge.exe	138
PID 2276 wrote to memory of 5060	2276	msedge.exe	138
PID 2276 wrote to memory of 6236	2276	msedge.exe	139
PID 2276 wrote to memory of 6236	2276	msedge.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://api-v1-launcher-service-prod.erafn.dev/api/launcher/download/v3
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd1a24c728,0x7ffd1a24c734,0x7ffd1a24c740
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2060,i,16853079955108699032,15556512430010836450,524288 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,243310326163577199,12058364518993407928,262144 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,7107058205784712667,8248428624075540000,524288 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,4311658385208303353,16550269188213673398,2097152 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,12215809519180027740,8383159864932606233,2097152 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,9129499853468128402,15523754086819035291,524288 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5940,i,13065509478353600438,7065721645530658732,2097152 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=6012,i,13450819959566595054,1762378952912051298,2097152 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6192,i,13946888200189068592,11835226798671613620,2097152 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6148,i,2718539168050701113,16775507528405801330,2097152 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5884,i,1120853808005386691,9530020415472617124,2097152 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6016,i,5722127778916962248,4638197188178909303,2097152 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6032,i,5081524392826451212,12844061279272726876,2097152 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6292,i,12998484068651384694,10078942981958031820,2097152 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3208,i,15851673308289995690,11920210317613737894,524288 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:14
  2⤵
  PID:1412
- C:\Users\Admin\Downloads\Era Setup 3.0.9.exe
  "C:\Users\Admin\Downloads\Era Setup 3.0.9.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2176
- C:\Users\Admin\Downloads\Era Setup 3.0.9.exe
  "C:\Users\Admin\Downloads\Era Setup 3.0.9.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Era\dll\era.dll\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,2582696410975353878,12149123099863769191,524288 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,2859365696814375598,15972814846425114179,524288 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,2839337721076116968,13620679470273795108,524288 --field-trial-handle=1900,i,6892080107692073013,10458078980116773815,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:5800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3420

C:\Program Files\Era V3\Era V3.exe
"C:\Program Files\Era V3\Era V3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Program Files\Era V3\Era V3.exe
  "C:\Program Files\Era V3\Era V3.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\era /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\era\Crashpad --url=https://f.a.k/e --annotation=_productName=era --annotation=_version=3.0.9 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=39.1.1 --initial-client-data=0x510,0x514,0x518,0x484,0x51c,0x7ff7a8812a4c,0x7ff7a8812a58,0x7ff7a8812a68
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Program Files\Era V3\Era V3.exe
  "C:\Program Files\Era V3\Era V3.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\era" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2040,i,2950777096476326113,12837118717660799839,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3576
- C:\Program Files\Era V3\Era V3.exe
  "C:\Program Files\Era V3\Era V3.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\era" --standard-schemes=app --secure-schemes=app,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=app,sentry-ipc --fetch-schemes=app,sentry-ipc --service-worker-schemes=app --field-trial-handle=2040,i,2950777096476326113,12837118717660799839,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Program Files\Era V3\resources\binaries\FortniteLauncher.exe
  "C:\Program Files\Era V3\resources\binaries\FortniteLauncher.exe"
  2⤵
  - Executes dropped EXE
  PID:5248
- C:\Program Files\Era V3\Era V3.exe
  "C:\Program Files\Era V3\Era V3.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\era" --standard-schemes=app --secure-schemes=app,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=app,sentry-ipc --fetch-schemes=app,sentry-ipc --service-worker-schemes=app --app-path="C:\Program Files\Era V3\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1789006152469399 --launch-time-ticks=654323897 --field-trial-handle=2040,i,2950777096476326113,12837118717660799839,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2660 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed"
    3⤵
    PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://oauth-v3-service-prod.erafn.dev/v3/oauth/authorize?response_type=code&client_id=75a06114-0fd0-4a5c-b6d9-9fa33bfc5d77&redirect_uri=fluxapp%3A%2F%2Fcallback&state=eyJ2ZXJzaW9uIjoiMy4wLjkiLCJjaGFubmVsIjoic3RhYmxlIn0%3D
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x370,0x7ffd01cbc188,0x7ffd01cbc194,0x7ffd01cbc1a0
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,11310574273392950925,5565630513107788205,524288 --field-trial-handle=2556,i,17676065423028305306,5480734266760918646,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
    3⤵
    - System Time Discovery
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,10220245862083517247,14649134196975025279,524288 --field-trial-handle=2556,i,17676065423028305306,5480734266760918646,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:13
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,12999578363217202186,4852672080720847976,262144 --field-trial-handle=2556,i,17676065423028305306,5480734266760918646,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,1977968289323447354,3678329179532769134,2097152 --field-trial-handle=2556,i,17676065423028305306,5480734266760918646,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,16789228289554959071,331789976101272992,2097152 --field-trial-handle=2556,i,17676065423028305306,5480734266760918646,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,11742342458295273325,6607027354456700252,2097152 --field-trial-handle=2556,i,17676065423028305306,5480734266760918646,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:9
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,10051721224265815499,10759846629996630193,2097152 --field-trial-handle=2556,i,17676065423028305306,5480734266760918646,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,851211153787539005,16116159762880924704,524288 --field-trial-handle=2556,i,17676065423028305306,5480734266760918646,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
    3⤵
    PID:6236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5608,i,16176288600959016542,17029365864923685480,2097152 --field-trial-handle=2556,i,17676065423028305306,5480734266760918646,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
    3⤵
    PID:6296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,9723797198349117568,17801998785774042498,524288 --field-trial-handle=2556,i,17676065423028305306,5480734266760918646,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
    3⤵
    PID:6172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,3895568815209334679,678664995345840212,524288 --field-trial-handle=2556,i,17676065423028305306,5480734266760918646,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,17156184116046757024,879424987042386683,524288 --field-trial-handle=2556,i,17676065423028305306,5480734266760918646,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:14
    3⤵
    PID:6220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,8544530308154644705,11867951227963953444,524288 --field-trial-handle=2556,i,17676065423028305306,5480734266760918646,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:12
    3⤵
    PID:6224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x32c,0x7ffd01cbc188,0x7ffd01cbc194,0x7ffd01cbc1a0
  2⤵
  PID:6524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,14279031208250457391,6059284575137533416,524288 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,15674376050813529685,9695962337854282697,262144 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:6860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2824,i,1028892214986025185,11116603862097851417,524288 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:13
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,8013077657899741309,9481691516626419810,524288 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
  2⤵
  PID:6620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,8013077657899741309,9481691516626419810,524288 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
  2⤵
  PID:6576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,6056983314949551857,4830594606223181989,524288 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,9198319269212487670,17494119787311898019,524288 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,9374591434843868445,10458801786079062999,524288 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1240,i,9295038467116092297,15230169909695366460,524288 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=1232 /prefetch:14
  2⤵
  PID:6676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1244,i,2161819091462426105,15627674261324108356,524288 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=1368 /prefetch:14
  2⤵
  PID:6608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,2292462308300742705,13690377209540209308,524288 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:6684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,7001713188615886635,2454696782659908706,524288 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1340,i,15159985703946205657,10019031369012853654,524288 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=808,i,13745501543134973635,3282541405421412998,524288 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:14
  2⤵
  PID:6812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=808,i,14197104655199503369,433481333721350340,262144 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,7363733159181348232,16604963124355319185,524288 --field-trial-handle=2328,i,16325738021862465502,9786467479128235260,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:6256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d68c4ed30f831a85cec2ba11b9e49840106a2703323f07a2d97a876c86911c55
MD5 6654e7a6938f99720b99b36130c2d74c
SHA1 d636822c2361f0cc2392a9aff9329b18f7e9c7ca
SHA512 275e099aa16d4c7725c52aa36bef5e18547f096e791df25f9094d58471ffb6c3a0651ed6d832010402cc3e92c19cf82779ac0ccd2716ea8a6a11282010ca2b5c
TLSH
T14531ABF793B0957E8A1192F4EA15AF2FCE6A0524031C387689D46E2783F2872E10475F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 4483e5859eeea810a05c177f15963a6b8de6265e62a932ffb70a213b4491b3e9
MD5 a947a495d1ac44711c4c1974e00783a7
SHA1 f0a7c1e3a5e0c92e0ba4e44596b892a4ff302da3
SHA512 f5ea1b2a1cc3416b0eff14ddd4f0a87ea7ddd1ed92fa4e620fd285f0c6d711e1f75ea5098fdca06238fa30dce63508634e3def3f5a118a9460c8589117badc11
TLSH
T1D2F0597BE67D7167107A05BE5E00BC4969B7A4710A4128E4CF6B836CA0928F31B02143
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 41fce650abf1a9908b0d650c630429ccc46799cc4272522554eb2879a2226f07
MD5 50c1934ff8d0ed965bbd4ed0d7b6501a
SHA1 23470fb565cb016b03625c9e949ba56481b9d304
SHA512 458996686244d919fc669d2ca72e17b88911772f1942acbe7dc1905b2a65fe2689d9e908480846049b80f3cd33580dbd4d5b27b672a3e7c37c2ed402d0736d26
SSDEEP 192:5RC14MpALyv7JnvAPRp2799Hsb+WNnw0vPMrEeySaEhVyIsnAUgR:5RC14Mp0ed6Xcvw7PGa0R
TLSH
T1E132A62EA914253B9CDBD219FE227B63E7F6102571D42E84EBFC8A2C15D79CC2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 74b7be7a321cd95b789c45fa37b46ad3993222740dfb2526871e84709316e3cf
MD5 22888ed1b8d63cd7d075aa60b657cf0a
SHA1 c168f72bbe1a1b3903a4409c12fcabb6e1c10a57
SHA512 54b985632a560dee0fccc47adb5ea40fef6f320ce2b5c5e5adf4f843662c570ae9dbd53f8e63f739e048bbaf54c28aad8008b0e2af97c92898868aa4c0bfab36
SSDEEP 192:5RC14MpALyv7JnvDPRpn799Hsb+WNnw0vPM9pEeySaEPVyIsnAUgE:5RC14Mp0edzX7vw7PYaQE
TLSH
T16E42C82EAD14293B9CDBD219FA267B63E3F5102571D42E44EBFC8A2C15D79CC2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a6cf6c967b5bfa28493b4e6d863132a295d2dd63c41739d557e12a8290cc00be
MD5 63d9fe6f9fffb023f9a79ed29f92eea9
SHA1 bc5e0dd224438e5d8d98a0e36efd2aa8d7c2891a
SHA512 0e70640441d4d98077acffdd1143cd7f06675a8e98e638e3b8d72180930169d957db7b8073e191a61c38525bf3063ff8567c62d8326e446e88adb2de93b6b03d
SSDEEP 192:5RC14MpALFv7JnvDPRpn799Hsb+WNnw0vPM9pEeySaEPVyIsnAUgE:5RC14Mp01dzX7vw7PYaQE
TLSH
T10E42B72EAD14293B9CDBD219FA267B63E3F5102571D42E44EBFC8A2C15D7ACC2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 54b0eea83d0e1a051b4f007a55427a1fed53e624e53da6a57c90836075dd8938
MD5 6560bcac7a7f731129acf32fe41d855d
SHA1 9d1985c5bc722cb20a3b650fcd14a3bf5a1fc2ee
SHA512 cea92d14cd933545a134829c02a2e092324d913b375cf11c0a2794447929eb8028c5fc6b6afb6699435fb0bace921eb275b7818e32d6c9823c0e30ecbb5072a0
SSDEEP 192:e/Q4K6I+7KxkXqK4I40pUZNCgVLHrKHfFKslE8nRXzKD/KB+ErUkKN9MFUxpElbC:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZRu
TLSH
T1DF32C72BA48D9A3F4FA8D50DDC126F4BACA5025776780C2456FB9D0803A5BCE115A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 62e4ad3acca084bd7ae2af220be776e49ddddf4d68aa0338aabddf798d582c5e
MD5 6b2664ac6098ca13d769d2a10cf9f4b8
SHA1 266d16eef977e8346a606109e6b9592b3965f16d
SHA512 6a91645bc7052da00c1a120c60b6c677bb4bfac020fa17afe2043ac0ee5637d0f5f8548e78289594af1540947b7dd726f291378d7f5a1d59373a5b5df15f3193
SSDEEP 96:QVbJ0d+CgjAe56y7nKZwpOfs7AzuaVSl8h4otok5/pPDvB6hXGyvk5Em3lTkRNC2:QVt0Ngjf5ZKSN7iPiUD9ZRWm3lTku8xh
TLSH
T137C119B1E46E1DBB48F6E589B1032E43CDE511AB6964BB58E9E94F4D00F74DD2382223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a021970122982a08cdbb0ef4476a4c7f615702ee4471af57a0df9816548be3b1
MD5 c9811c4d6ef2aa8ed38a9b5078b430a4
SHA1 d77696ea8bec965c89df13a44b3acfacd4831c81
SHA512 398c91c06156ad572ee5c5b1863305f890404a4300c8afba454f8757ce80d2e13d0f217175b653f1a7279f89f4cc9074005d35148d24f84ab4887bba681d46e9
SSDEEP 96:QVbJ0d+CgjAe56y7nKZwpOfs7AzuaVSl8h4otop5/IDvB6hXGyvk5EMZH1Qzb/Zr:QVt0Ngjf5ZKSN7iPiU2WZRWc2PKWlTWq
TLSH
T185C11AB1A46E6D7358F7D295B1033A43CDB511BB9560EB50EAD94F1D00FB4ED2382223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e2729934c64f10f05eaaa8332059b1fa56c4c5c7717935c4ce762455979d364a
MD5 bed1feaef694537f0b3010baaad9b490
SHA1 20d5f0ce3936bf45f06621cf39bb967daa93fe80
SHA512 e4f8bb7b14ac10ea155725cdb90cacfb92166768cacc062ebe45c6958728a09adb1a161ce05e3e179fa3500877e774fa1efc8e5fe5ae40cc7d652739a7bd2500
SSDEEP 96:5C0d+CgjAe56y7nKZwpOfsobajcRDotok5/4DvB6vGyvk54ETTboRYv4a:5C0Ngjf5ZKSNqDUDmZ7qETTbog
TLSH
T15BA119B1A46D4DB794B6C589B1437B43DEA521A7E571EF80E9DC1F0C40FB1E91382223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4b57d38d5f09dff20ced44f093bb51251e4598e07b6566b978f2ab812cdf9948
MD5 f8a47cc94263f336e449903b5ff7fb63
SHA1 1631a8839a32ae11268fd2ccfdcac3595838a8e4
SHA512 415baee16a5820a32622ef1ad09b222dcc36d591f6a46d61fb38a5aa6305ffe40bfd88add6c50a5891742d58fa9d967a06fc64468249e1ade068f9a10b4ed483
SSDEEP 96:QVC0d+CgjAe56y7nKZwpOfs7AzuaVSl8h4otop5/IDvB6hXGyvk5EMZH1Qzb/ZZE:QVC0Ngjf5ZKSN7iPiU2WZRWc2PvWlTWq
TLSH
T17EC119B1A46E6D7358F3D299B1032A43CDB511BB9560EB90EAD94F1D00FB4ED2382223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 4b27a2bac883575e7510789cdf0e2bab2a06c0c2871c435a6617687d19f77e7e
MD5 66c9e6e38271f74bf96c76f32d9252fd
SHA1 07c549a49f4ca22bc5ed159a464d025a96d41abd
SHA512 21d8579444a521bd488c33afccbe6a8f62fb87d8468276d7c46afca57d17ae14561689ed34ec3637a03db4e5b22a16eea37b34389807764622fadd51aecd55df
SSDEEP 192:QVt0Ngjf5ZKSN7iPiU2WZRWc2PKPlTkuCmWs:gtMgbySN7CnsczTkuCmt
TLSH
T15DD128B1A42E6D6748F6E1C5B1032E43CDA911AB6964BB54E9E98F4D00F74ED2383273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f0f891e396c08be0729089b4393b1ad737e005020a8f0a7c9e5f371800f449eb
MD5 8d1f5c6ad1c321f34c85534167fb2768
SHA1 3cacb5555098dfa062ad40597af5e3028ca2ca0c
SHA512 c4e50e7eaed701fad94c26da093465ff62f5bfe9e9d6de6a3382cd43dfcb61e03bc89476c556530782ef837475f64116af76f4fd2dac0503244ef4940943d092
SSDEEP 96:QVbJ0d+CgjAe56y7nKZwpOfs7AzuaVSl8h4otop5/IDvB6hXGyvk5EhwlTkRNC3Y:QVt0Ngjf5ZKSN7iPiU2WZRWhwlTkuCmO
TLSH
T16CC109B1E42E5DBB48F6E5C5B1032D43CDA511ABA964BB54E9E94F0D00F74ED1383263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e7194f3fc4602477857ed883c46a85cbc46865ee4a133386a117b4a1b8238618
MD5 233c84efbf11a1a4def2a18d345be2a7
SHA1 79e30020f129130a008d5dbc8d591f8cbb818e81
SHA512 a07b501ecbb4d5b7a3f4e418fe538e86edb2b8d986b5d69453ac5c3793730a0c7c46b96b826a0417b59badf45d96abda3b243c75c7a7269fb10b7245ebc5e899
SSDEEP 96:QVbJ0d+CgjAe56y7nKZwpOfs7AzuaVSl8h4otop5/IDvB6hXGyvk5EmwlTkRNC3Q:QVt0Ngjf5ZKSN7iPiU2WZRWmwlTkuCme
TLSH
T17DC119B1E46E1DBB48F6E5C9B1032D43CDA511ABA964BB54E9E94F0D00F74ED1383223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 315c4810e4623d00435ee4ef0fa1edc4c7a37fc4e088b1aa4bc292ede79e3cda
MD5 c2deabe318b73c09e830cb0f500bdd42
SHA1 6173111f7b0be5a20ba68a1cf793040f18f6b710
SHA512 df750081ea28e44e98a10e233f761f130ddb7715d5b6104c53ca031c72b823e4835d1a6867bab8d9c60335a19d0fed6975caf2cfbc8d5e73976d9a1d4233dabb
TLSH
T1A3D023303818F7C8C551217288B03300722000B278B103081020AC1CCE300C337DFECF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 536c27f3213e5bbb330e659452ac54d6b8cf11a5fb8324a115f811be9496a5f6
MD5 c398c0d3fe320ac4d1fb5a4fbbe230c2
SHA1 642cbf193c2b15b305cdad69cb3249d97568cc90
SHA512 dfacd2f999a62194cedb743763f56532be777c5a2f1496938396a3c1f22b5ae73fca266d0ceba4472fb8bc2742b564195d026a894feac318037f71af0546b580
SSDEEP 96:Rd8FjY9/e0GgMf/wDuAu0mezrcf1zsAhnevm5/:Rd8Fuel/wDu0mEosOnek
TLSH
T18BB1B24313A32CA0EB409EF641DA54A335F1C5F99207DE37AC88D3F49523B80AF5B251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a98c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a98c7.TMP
Size 2KB
SHA256 4e52cc8d82107baeb553545f7bb0cf1e6a6454610039ba59aa7cada51202713e
MD5 9a6052be79d0a26f50b8390039868008
SHA1 be5c704412ad4b1437d01070dc413d1f9c018e2b
SHA512 e14f13bc6db557dcc868ae038922776c1d0c8494858e12697f244f1dfc4e255bc744d47b4c20c86b20034bd8c791c26b3ed4e42b7372e021eff1dd6fabefa3f8
TLSH
T12551529103E228E1EB549FF650EE69F736F0D879E2075E3BF5D812345936F046B41262
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7f43c1c4846b0e2de5dba263cdb13ea0b4f9cc9af2da6b3cf24cd081a5d6b617
MD5 1bd468c12b468532ba81dfd7de36f41b
SHA1 9a85130a6c5493aff14ff4c146726ef85507ae5b
SHA512 300b75aa9ba4ecc7cd80c9344459e133ddb6900265afaf6bb12c074085eb41b64c39c7f9ced859a3576f99b05a8ce866ee1eac8f261e7d579362cbbac8fe61e5
TLSH
T103518DF3C3F4862D8A1196F0AA146E1FCE5D0914432C7D6AC9E4AE1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bc3907a85ceb7dcb9f4b49db549b66d82d9a8bf78ab66f8518d2a2f1fcd803c1
MD5 6f645ad16c110d2e7f8fa2f5bebbf40f
SHA1 3312eaf0cd395620aa61a3a4e9fe4e78f2641589
SHA512 c4627c3b27cf530f3ef82ac079a21b53d36ae38af53657f0be47a9da0fc6914f4d531afede72ece0e24709ee6e286aeea64263698f80834e002b0e332acaf0f3
TLSH
T1F6519DF3C3F4862D8A1196F0AA146E1FCE6D0914432C7D6AC9E4AE1B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7714937ed2e5b2caeb387561a0a61124f1b453b2d7ea89801b08195b1df68765
MD5 83cf3fe9e04cc39c2fa70cec7fe5d170
SHA1 6d735d48209cd0d95224237725b4df05f6c4ebb8
SHA512 7fc7cdcaf2e1deca67cf40e24acc366bd5f2cd365fe4e92310d4f5a232e08ee083b0e75a21a4c2fbca9d69b68bec75ab4eb072739d0ea8ce39a0c656d0550fa4
SSDEEP 192:sxRPReCt/fSs6WpVh/xkzoA8plW/g6+WNOSxd/Y97E0sdgUIgVCJ:sxRPHt/fSs6WvhZFQ/59/p7U
TLSH
T1A242B8166D28A93B9CC7D31DFB55BF53D2F95036A1D11E48AAFC8A1C05E76DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e886926d709ddfcc317bca53b7d722ebb00bc30bf54716e4c7cb68d6c4a9bf53
MD5 ae8e97004ab2097bef52c7a7231d3fca
SHA1 9ea7731bd81b04cba1f7b8a185d0c11b16febd65
SHA512 ba58039940a45234cb9aa2bd92a4d89d49b693aee2e5112c8efb35080c1795752df2ed23c4ac2e3a9f661d5dccc17f5f1a8aee9593aa662b18d22150fc230de1
SSDEEP 192:sxRPReCt/fSsCWpVhdZq+zJKkzoA8plW/g6+WNOSxd/Y97E0sc+GUIgV2J:sxRPHt/fSsCWvhTLNKFQ/59/pcqM
TLSH
T1F842B7156E28A93B8CC7D21DFB567F63D2F95136A1D11E48AAFC8A1C05EB6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 934687953896606bb06b45e34a68bca7fb903f6bdef5dca0c19ffec85dfd0b1c
MD5 1648f48b83b67237881e7a7f9ebf7546
SHA1 65fc581fef1a7d92150bf69e0e1778ca46e8b777
SHA512 41b8c2f6d192858fab60e77494fcee3d93260b16f28ace81baa828a45f2252b34c56532a0db95052e8182f0f2e55ded9c2cf041634970c6b836080154dd4c8d0
SSDEEP 192:sxRMReCt/fSsFWpVhdZq+zJKkzoA8plW/g6+WNOSxd/Y97E0sc+GUIgV2J:sxRMHt/fSsFWvhTLNKFQ/59/pcqM
TLSH
T10742B7156E28A93B8CC7D21DFB567F53D2F95136A1D11E48AAFC8A1C05EB6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2357050b21f57309c90b8f11a20da11ad75defc0040f724b8ee5486d834100ef
MD5 2ce17192f3b9210e7fe7e3285a2e2ffa
SHA1 83a253009e35365e9d3e88fac9d931605b1bc554
SHA512 375546b4a7a2559ee5a5121528ab62e900ed00730c0cd21b96a8787d605fd76de4015f519245aa302fa93a4d39ca428140dd1668b00042c6d2dcc147315a9e5b
SSDEEP 192:sxRMReCt/fSsFWpV4dZq+zJKkzoA8plW/g6+WNOSxd/Y97EWsc+GUIgv2J:sxRMHt/fSsFWv4TLNKFQ/59/zcqa
TLSH
T1E742C7156E28A93B9CC7D21DFB567F13D2F95136A1D11E48AAFC8A1C05EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9eab36592c8aca835ad0576fe91ff6614394909b0c1d205f108faba797cf7608
MD5 16db85a0caa2d82f0452f83bcdf7f348
SHA1 ac4a2f6df47bac9c70311c48f21d751237aee6f5
SHA512 65e6c6e27e0546da9b3d9d60e88f6f3daaf58bf18b9e7b23afefc6bb59a39730ba27a951001d42259afac1f571fef6bf3675a2845c842e866a1e026271b91104
SSDEEP 768:ky2ScS7pLuL7evWgd5f7b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzSV4Mror+Z:ky2ScqE7evWgd5f7bu1ja8U4XaZ
TLSH
T174C2CA7B640CCA7F4F804ADDA8197F9A6D6802CB9698CD8047FE951C03C7BEE51264DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\c8484e4d-b8f2-42ca-b3db-db61c203300e\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 e1987626141a64920866614c20960e2ae370762caa6ae333b117efd041da464d
MD5 98c4909a3dc58e4c11aeac13362c902d
SHA1 74cde9cb5f8f7e5c3420a87cee96b0ec3c1ac9d6
SHA512 a7dfc711cc739fece1b6b239567b3650c86492eb188f77b1f1537568b012dc62b21647cc2b20c3032ead6ff025723a50182648b8f1c3cc9fa425c9670caa4fbe
TLSH
T116D0975BD2201990DB260F906A3201AAC6242CC86981A008A402282E9C79B8BD210FD7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 62e0cd3b160b57ae52738c5dd064462cd58daba65bc0df93c2af184c34f4b565
MD5 b1dac2dd72a3df463148ed20c7840d21
SHA1 1ca4e712557a4377cb089403c50de129161dfdb3
SHA512 476e70b4485324ee16eb617eb4bc1b0ff1e1ce3770ef0acc8e2392f9abb00555bb99a02ce4b689796940bab58e596ca0353c535051a69f6e0379b747b15a0612
TLSH
T150D0975BD2101A80DA6A0F802A32007A86103CC864C5A0086401082A8C49B8BD201FD7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a94df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a94df.TMP
Size 138B
SHA256 aac6d1c128e51f896757c9c98d97dddcb44791a9fa7d82f6b88077188e8ba994
MD5 4aaee3dab8cbb81c9d6c6933236dcb6c
SHA1 df36c3ef3be43450a9390c0dbfb031275b1a062f
SHA512 e6d86d9ebf7594f1fa656fc1df0fe2360ec81d80a392d1ca385613b3bf706e8aebb3dddcc456f9349c2f6823d81b1d0bb359fa3f2b8f99ad08883717f3516d74
TLSH
T1FDC02BF7A0002940C7180B509332402DC3002CCC8E82D04D700331365476F5B6201FD5
MD5 SHA1 SHA512 TLSH

Submit Download

1be64b19-d254-4bdc-93ff-ed1f5db264e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1be64b19-d254-4bdc-93ff-ed1f5db264e4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ec0f7f82a9800587b00ace8317e974ba68d38a0691587ad64cf2437ad27f3a2b
MD5 9d20fef09f57f6c96f914b3b685b5d0f
SHA1 ffc86abc7272d58dbfffa3909c462ac01749cdeb
SHA512 b83382a69f3cb15d5baa769b7c52d76caea0a88f1f7325a812387e76931d6b97e71136eb69c9129fd09fa0f0b17ca7d3e7716094857d4112014afb63df7b7249
SSDEEP 768:LV3/Wmp+LjcAam6aQMGdjWca4GhfeIjc3EqJi4Z:LV3WOmaME6pPjCEOD
TLSH
T19DE28D349C69893BCCBBBB85B21A6643ADF05277D5E80E44DBD91B0D826359E2703C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b9f7a0c14d3c8131ebce7cb5c8c6325a9cf77c70add16324ddaa96653c5373c3
MD5 94bb7dbed0c0f5185323d0e65f1516d2
SHA1 d03aa6b3eddc807f1bbb780c8c80c536212f5fa2
SHA512 f1ddec31c281615aecc0d5853dc3c763b3a3735cec35de83a86746876c58088ebeca4c90ae91f20dc2f2e54aec7df5219635310918fd32472c9a32a8c4b58413
SSDEEP 768:/rv+4UNbdq30IqiLjAAam6aQMGdjWca4GhfB3PeU/:/bsbc3LKmaME6pvH
TLSH
T174F2AE31A86C9573DDB79A99F21B6747BEF021A389D40E84C9D96B0D439708E3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 3771398768017628422d71678a567a984f42f066aebdb827fe501741f5c4aa9d
MD5 091a488f7f4b758001751192c06e35f6
SHA1 8d447c9c82c806fc21d727dbb81f8548bfbd4e23
SHA512 98e91ef0b4cf9fc814bb00b28a64396689ed4491354cfdde43d89eb6a70648bebdc407c657645320c594e01e746056079d06d4aa6f2bf536b3cb4b52018276c5
SSDEEP 768:QV3/WmqiLRLO9Aam6aQMGdjWca4GhfeRh4Z:QV3YnmaME6pw+
TLSH
T101E29E315C69CD339CABA295F72B3283EEF4517388C84E84D9E96B1D029359E2717C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 22526c97b5e0b910c3b9711f05d1b982d21e8d04fba2a130a1989e12d308c7d9
MD5 6e652b56682c0f84f70d7b5d676ae6ed
SHA1 994f24229e763647b920d9db08b2082129f4782d
SHA512 dd5a54efbb3f6ea5c15a122fb61d1d4a0ecb47069ad98c39f6bbdc1855c19bc86e74c50c1e9c1ec31b1c6b149e785617c2b333b3854150a344d55728bd6e9845
SSDEEP 768:/rv+4UNbdq3sjmqiLRLOvAam6aQMGdjWca4Ghf9Rtc32Mch:/bsbc3u5maME6pRtC2MQ
TLSH
T185139D3C9C28893F8CAEB748B21E26577DB41277C8B40998DBD51B0DC27649EF70791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 8679079473d4ac4a9adcbdf8048d52d43d3422d4a7ea1a11abf87141d12ead07
MD5 24b5edaa9fb838bc63ac9457d52f6450
SHA1 776f8d86e2f117ab7262c1695ced79517c5c5881
SHA512 558db9d080b861acc47b49466ee1d0a6e540966dc4dfdab1f4899dacb293f2b8edb84636022304d61020f0e455ff8d326c32e0b9feceb7e9d34322cccb4ca869
SSDEEP 768:JV3gWmqiLRLO9Aam6aQMGdjWca4GhfeRh4Z:JV3HnmaME6pw+
TLSH
T1E0E29E315C69CD379CABA295F72B3283EEF4517388C84E84D9E96B1D029319E2717C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 57KB
SHA256 df257d3507c1d00ea15be4a2971e7f7a34865907cecb60abf9e0db143b513270
MD5 62bfdb80c3c975f9eb4bdc8b3997d45d
SHA1 0d6e8653a87e56b8d6bce3bee6d84d5c2952eba2
SHA512 d123873503951df6441b592e539f4d0ca6e9a00fbd52cd59cdd4d6ae01c880fd798104960e440a29d92412c5b3115f9c1f74e0594f35bb9900bde45500553c23
SSDEEP 768:YFtV3MwgStjbAam6aQMGdjWca4GhfLf8zmlz1Ou7XdTwVcYF9YIjc3EqJf4Z:EV39maME6p1fLl5OMXdRY77jCEOs
TLSH
T1EC435AF598E7893BD8AE9B87933D6D0699BCC167B4984994FBD40E0CCD520BFD306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 38037d9330bfd06ea866aaa33e7dda0d0007eea23b97af1e8532199bc0dffac7
MD5 a7d6342fa58590407fdae23d95d4e1b1
SHA1 85c2d6fa029ca6f0be6cc167e1f299b98335f594
SHA512 959f7e96965220c77c3aba69c2d1baa6d3fb7f6f76b80434b1465b81dbb6eaf81cc95d50bd4a8b1c9425576fb1e73504862cf8fcae1215b012627f18cceaf520
SSDEEP 768:Qrv+4UNbdq394qiLRLO0Aam6aQMGdjWca4GhfwMPeU/:Qbsbc3XWmaME6p3H
TLSH
T108F2AF31A86CD9339DB75699F21B7687BEF021B388C40E84D9D96B0D429718E370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 522B
SHA256 532e27b1c35cecf3833a063deb0a05850d18f45002890d4dd9c69509841b7738
MD5 b809bb2b4dca57c6dcf6e141ab343c71
SHA1 3d858fed3e81f1ca3d3c105aaa579c0359654edf
SHA512 089d37cbd8d0d641052a8ffbbf4ee41489551f876cafb2dec05897f131d309580b9872e3493f6cec359efde76d766ef4a7f8ee86fa084740fbcbd049e7f749e6
TLSH
T177F0051380DA34D2EA6B00A0F1446DD4120FA1FA2919B7746975855681986716144736
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

6fb57736-d871-402d-97a7-a43b5df3ba7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6fb57736-d871-402d-97a7-a43b5df3ba7f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

364d32da-6f42-414a-9e66-2ef6ffe80e1d.tmp

Path C:\Users\Admin\AppData\Local\Temp\364d32da-6f42-414a-9e66-2ef6ffe80e1d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

bdcb9b1f-f501-40ee-91e6-0cef88094ed8.tmp

Path C:\Users\Admin\AppData\Local\Temp\bdcb9b1f-f501-40ee-91e6-0cef88094ed8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\LICENSES.chromium.html
Size 14.4MB
SHA256 c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396
MD5 adc1ff1ecd313896455e610d15d4eaa5
SHA1 22180374f927b9132c3963caff9c1f28155010c3
SHA512 e0ac562a8eee4ac0d816ff107793176bfe00d6a91900f6f8ec1a7c9933b2078914d8b722da51cacdd40b31030537f57298e1a5d9121b6807b8acc43b736f75e5
SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDuKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwReXEn8mb
TLSH
T11AE6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\chrome_100_percent.pak
Size 112KB
SHA256 45d14a4278b1e152b363197401a5604aa5a3cee6512a6b52df978038fa521a0f
MD5 e7bbddff3081eeecf7f56e76ce1d48e4
SHA1 eb83b418ad0e8f502f12a339cabc2fef8ec06cb4
SHA512 2caaa851d095d1a641b959cf092a2ce02328298aafdfadafc773eb0a0054054ae54c41574328694f6a37928203509a0c7e38f3beff1f4fd2ded00b5ed5531d85
SSDEEP 3072:z84PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:zRYWFUbGz8LI1TnjQBQCrC
TLSH
T13AB3D0D7B7B0AD7DDA474BB783560170FCB30B2D0682120A5A99E479653AF88C8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\chrome_200_percent.pak
Size 182KB
SHA256 aafc61b89748d17fcbc9fecd9844a77be2c584529a81714c98e0c4d453ea9496
MD5 1e1744b9410d29e7d1ed28c4f67d6317
SHA1 4f3fcf3db1f8a1eeefd5a4c2f3f2d2b34c094a82
SHA512 10fbcc89ae3251f4c163beea1dd3a53bca239486e1ed7a997e9b04d3a6193266cd96db4a1f8b753942429305ae9ee28b1e9d3fee7e2ddfee847a4db40c8cea93
SSDEEP 3072:dl4J8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:tGQ+N6uSZQDQYakvyAkcjQBQNd4
TLSH
T13804F1D373B8AD3DDA570B73926610E0FD7A20291EB3110A5A9F98397925E8CD9CD343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\dxcompiler.dll
Size 24.9MB
SHA256 aca2fb078fe994aa3cb7773d5919c8822c94398f216371f214045ffca2a4320b
MD5 2f5501f38f1a2f37ec178b9059d3bd55
SHA1 f0092390a8a14d2d04a45101e64cafc0443fd7f8
SHA512 7ed07ad76368ef627b357f1544e5425090665c33c1481332c746093404aac3ae8acde134342a8ee4d30472eb31176d06049e7abb8d4a44aa9ad93bd3375b20ab
SSDEEP 196608:KINfcxXBXSsTP5HtTz2HF0guYYl8Cqe59luxQpB:KINfcxXhSsTPduubGa9lu0
TLSH
T1944729122246D49DF059C878C3678616CA6C34E73FA778EBC0B461252B7BEBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 e2e85d40ac197934302822be1f1202fa854e26797010dec6f8f743607ba1a390
MD5 41e9050778ba83ba6de2eec71a625e6e
SHA1 1669432043922f864702dd61cf30a3ad591be7d4
SHA512 1b5117a79cb7a188bd848e2b4b3fba2f9fedadf227465a44f5e7d912dff48a697b0c58d2e7fc9a2004a4a64e26aed46a096aa4c3896a59a061414e5ffd5499b6
SSDEEP 49152:q43V5jmDptM2VrfQQdFiO82PHb1SKj0vVr48vCkvjvvMHMnfDKmggnxu/zR7GI2U:qQ5sM4FiOLvbq59vjvvMHMnfDKmggnxS
TLSH
T1B9E5AE03F6D650DAD029D17197AB9313F631380A4F2056EF2A804A253FA7FD86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\libEGL.dll
Size 492KB
SHA256 690daa1746a91728a33e52c275e3d3842a4bc8e8621688abb8e56131cd38c37a
MD5 20b2b93cc2ed687c8cf30ac56d93ccec
SHA1 87f4b61a375561cf0a05231ae5253042b7506835
SHA512 0cd9f61615405e050b405e972a23e99e89193b26f2312f393aeade637cb761793f399be70e9161a12deae2891c8bc154807bb18da531911ee031cebdb54898aa
SSDEEP 12288:Hw+rH43DMhDrlUZbQn7k9OpcYumlRtHos:HzrH43M1cmj
TLSH
T1ECB49E15F3E945A9E06AD0348B434643DB72B8560B65FAEF03E092792F37BE45B3A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\libGLESv2.dll
Size 8.0MB
SHA256 626f667e2991bde6986a7fc5bc740f351a23854bf66b6879417b4fd29ef5fdd9
MD5 31a901c697bac9c3a777a4d6e091b09f
SHA1 abb8682386807abc5bbd77e48744c570e94d8a2e
SHA512 c288acf86aa6f26c56b34548ff84dbc106c62956a6a6d16478740453df7ea8529c2aedc52191558fd1708bdfc9f50ac8cef6d30db67d94c198c35b2cf0438c44
SSDEEP 98304:Woq5GKNYmZJsRM2lORqToXVEIrFPgvzW/:WdvZaRM4T9IrSk
TLSH
T113867C03F69541D8D05DE2B8875BA227FA31B8490734B6CF2BA413152F6BBE0A77E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\af.pak
Size 567KB
SHA256 ebfdf1ca739f74b0b58a7965094274523fe2deb44fa0afff5bed98635b70326a
MD5 b5f869b49f8c3889eb01c015694acea1
SHA1 7388d387be5ed74c3405c2c164816c3e9ada6622
SHA512 1fe89e4e22264e3f292b041ffded2a9c123c5e04281a0f4dbdcd62f8ef0ab740c1eecdb53b7db8851859566fd363bcc1fc6749831316f8061fba9a4ced6a9dfa
SSDEEP 12288:KZGxy8RXxgtRGt+vWiRwONM8KuY3GB1sz4H2Jyn9N+saAQGmQo0v4JIAga2NF+UL:5E8RXutRGt+vW+wONM8KuY32sz4H2Jy7
TLSH
T110C41B0BE781173D09B07696FB0845B7BB9CA26CC770B2B6DDA982320966DFC11BD1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\am.pak
Size 921KB
SHA256 e04aff8c10e90113e7fd281e067ad2b95703a1ebfa2cfac5a38c7090ae58d5bd
MD5 9bd74d3269c71b8767f9c7ee05ad8b39
SHA1 b004407906f559e3cc761af02cf5a43d3d18bb52
SHA512 f9121d86e5125628837359e4df8b1c27c7b2f8e6bf35375994f24c96892d64a316d8023714144878a534155ea40d0f237b2652007e9272c12defa230fc70b7ef
SSDEEP 24576:UZOnXTe1jEthTCMpyGvxVdDSjyicVzAVXjf5530iA7V6zZYPhW:UZZ5n
TLSH
T1AB15AB547EF9F7570F8E8A19A4320E4E9594AE4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\ar.pak
Size 1016KB
SHA256 44c7e802f47dd41335825b824d11a50b7122f065469378da258fe68df5f59c0b
MD5 ab758b0129241bfb7e59cfa9f254029b
SHA1 70bc796dae0f2386dee47fb3c57256a4ca1347af
SHA512 fba366e14d7035181c95e5e3d11a8931174cd305e35731d4dfa29d2b70af8fd4ac5b210897abf691c972e2592645b390423d056308e4b651337d78cd2727ed0d
SSDEEP 12288:UJy+n0zKLnBTLVJTLGLawjh8u+7v4UDWdBMkM+S158pNjpPEKfL82X:UJ5PLH5oEo
TLSH
T13B258BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\bg.pak
Size 1.0MB
SHA256 c66991330d9f7423ee26ecb8737f234e17982d782237121352ae925c2e44f904
MD5 ce4262228ea06724993f54c16280bb63
SHA1 6d6d12c1167e99a3877eacd9a647442e8954d5ba
SHA512 810e1dd215740d2f9bf20e95d0a56549518336c6b39dc1612247d7d04643845918c7c9125cdac38dab6251fda529ab573b8a2e9afe8378d95b7bca6a9066c4ed
SSDEEP 24576:c2nzPWNy/LYJzQkECtUrVb6tbGdx373ZTm1z3GjK4UfVDIMX74u2VZsxI5e468K5:c2zPWNy/LYO6UrVb6tbGdx373ZTmZ3Gk
TLSH
T1433524A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\bn.pak
Size 1.3MB
SHA256 15a6cefa698a938d2212d1b0d275299dea5a2e8a3c292f80ef7ca43fd27472a4
MD5 05add4cf1c1fbd73134a5db1583b32d2
SHA1 fdbbbddbc53535ff44cbe231974b6f1706399c67
SHA512 99414c084085bdb17e9610ee3abe0d2de8730930def6e104e19d411a403747999e6a7df1446dbcffb547f0b78a43daf3f17f8887da818d4b488f52a65e293d4a
SSDEEP 3072:gDjCwY53JKRjXcc259J9gJfifHRIkWvLypUBbxVQL55BkwuHX:5wSJQjX3kWvLypUBbe5UwM
TLSH
T1A355EF209C6E81B6A8C5CDC9434C6370C523AE9B9B61F74DDC17A14938ADC7C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\ca.pak
Size 640KB
SHA256 f65d82a9e81a8c135e35de1086bb1728e84125e650c5a9bb3a1a5592612ca4a0
MD5 a03efd9fc5f507a844604ab1c25edce5
SHA1 bb57848fbe5d5830912054e7822670c3698c92c0
SHA512 8e31be9fead4776817848b26473b878e777fdacff95eb96172f9a5543aa8a804e70ce9e276a7445fc3614e4428859896b2c345ea0df5a00b90145c822db4e0d9
SSDEEP 12288:FKqcdGB7hjGlCiGh3UQU8K5PsFYN3Mw2juwHzejm0t3l7b7T5+vHlw9LX/fnWyF5:FKq42oTLAD2l8MNc30K5M9ZUy
TLSH
T102D408239FC93B7704D2330EFB46C217A48CA9847B16D254F4AE1B1622CCADCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\cs.pak
Size 663KB
SHA256 d1b71e5fc5eeae3fe3a0e7434d0be2a72db1de4b8e2d7a7bd2ef8aad111a3e23
MD5 b421ab641622c26fe5e7cdbfe010c7c8
SHA1 cad38c1b9dcedd46087141b820331c4b1b355c06
SHA512 a22985160ecf1b46e16b458c81c21f2cfe07fe89abe7f9b0306f83b48b9b2a6e39e674ea9cbe1b2a04305eacd3c99ed699e19d031d17e251c77e58b116a6cad8
SSDEEP 6144:Gx3MCCBEkuNUOygLE0z35AtcJlA7af5qzp/GZ8OwwJSBW48Qz:GiCCBEk35O35AtSD5qzp/GZ8OLJSV
TLSH
T1E3E4491EEEA36425584002487FBE4128BD1E83540B6EB9BB7C8F9D91267577E8FF0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\da.pak
Size 598KB
SHA256 6c6c35e64f6a9213f64b76cee34d7f18ed5c456355a449ff2c51201600915fd4
MD5 4c9c77cef880fc43b39a911144606ed8
SHA1 58018fdd2af65b8d45c1592f839153d50a1ba815
SHA512 ddc1ba42bffc38010545d20a94f9c2075653a30d5c2ca5b62ed349f08ad12eb015eb498ba11205abb1923d42f2b3e8c1ceb83f39975a971ac3ea195fa0f14dca
SSDEEP 6144:SSSNvSxprezjFNoWKTGzVIv5MJNJBE/evTXwlAnsJwaLobiq2aag5dofwcYsgh8C:9SDzh1QKNVTa9W5do4ns+9
TLSH
T141D45B4BDC9D732FC9A90725F3118DA7EB5D943CC684264F65D8943A09CBCA093BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\de.pak
Size 641KB
SHA256 0f320e62aed97197de2e27bb06a797b8faeb2674f53fc334af525905a987a707
MD5 f7f19ec0f0d13561bff960f018cefe65
SHA1 25965685bad7c5281ee430f0dc1886b55a68ea6f
SHA512 1ef9b9761b85c7ae083af5f7f1b6e14a7d612b6da019b54b27868ac6dd9770c02794c2fae22fca34dc4131e6e7ce0e21190e27621e0779e5da6314343b9b6c90
SSDEEP 12288:xoho5NeZrQ5X3K7UpNgZaKzsK+F35saU7UdChT:xoh695X3K7UpNgZa0qt5rChT
TLSH
T124D41803ADDF621ED68673617305CDB77B19E36BC346322788EDD02B614B5B283AD522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\el.pak
Size 1.1MB
SHA256 c7e3ffd6424050f77a204cd243da7ad615e7df6096474589f33f5bbbd992dd8f
MD5 7a390cd9c011c9fa51210ad6f4125384
SHA1 959da38d29da871bd5e107bf1dcdbf4ad2502faa
SHA512 1774a682b0d4f3877aabe1cc27e2a381460a3f82017f4e8b80025978e34ef47c1f0aa954fafb1d253a3d323cbd0915a27e6eb3a50678a680b1281d16a4953536
SSDEEP 24576:HIRLHWFbr4K5Yp9Ck2txZueOJXDsSHCmu2Od7IO2USnBs3PyjkHvFz4VoyNJmIWC:oRLHWFbr4K5Yp9Ck2txZueOJXDsSHCm/
TLSH
T16845CEEFB4582DED8046950785D8F07C2BC66D6CE749CBD86229CB60BDF80719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\en-GB.pak
Size 518KB
SHA256 d25573feb04edd24b29f3f1e6139a3348ea31ac5d50586cf032a8f56a5bbe198
MD5 c0a2a59c29056daaf97738c7d4302ac7
SHA1 6d7824a0a8dcfc16be3760e1053e1cd396566245
SHA512 25f5d2ace69a06e9f6718d246dc81592dba1181779d56773f6236ab61c4cb43fb65b2462899744d2b9d329adf324962b9c3074338407defdc39c20189809624b
SSDEEP 6144:ISh+Z/KHfrcpF4yVEMP9pQRIBfaYHHDjko5bZDG1BcERJu:IU+ZeCEMLQRI7F51Dx
TLSH
T1C1B43C1FF784126A059352A2BB0AA562FF23D07CB35112663CBD805C33B6765837B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\en-US.pak
Size 524KB
SHA256 d4b35269d3b629c9895f3a6f98178f8578db37a7e840c9ea496c53044729b796
MD5 4246253fe6f0e8e7cf43a758769a3517
SHA1 b4b09f76552783fbbe0bf0cce8f8a1f8b65a1344
SHA512 6eed038be30300188c38ef202d8081216050d8e7641732f49b9b41a47884cfdaf2afb747d941ef2e6bd54ce55e58008b9d99e447674cfb8e712d437c4dccc387
SSDEEP 6144:IqZMW8YN+8MRF0PTMP9QQo94faYQ6TFB+5P2jdnngP8/s1wf:IiMlOHTMCQo9+C5Ojawf
TLSH
T11CB44C1FF744122A05A352627F0995A2FF32D06CA35112663CBD812C3377B6AD3B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\es-419.pak
Size 630KB
SHA256 78480bc1b80a923f8bf4209ea6ee3f6963518864c54c09888e8a531eaf298fb0
MD5 80d8c4e406d814087a48dc6eab520fb4
SHA1 8135c535407cb82965087e64be933603ec4067ff
SHA512 a50ac1cf09889500b466ab4ca65a78ffbbb30a94a6a20dcf3fdbc1426a02f3ec43a8278f7dc23bc5f8cc70e086809b516438a8689478cd8af15bd0cf357d6f8e
SSDEEP 6144:4Cq+PlkTOt58MLnHFFYjn3oZCV0a5iePr5AAiR6Cl:4CldkSt2Merd5ielAjl
TLSH
T15DD40822BAC81F5310E3A388B743D757E4D89545B408C29BE8EB876522CCF8CD967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\es.pak
Size 628KB
SHA256 e97de891605549684ccb3700871b448327d6777f14f1946cd33de326e10b7d9d
MD5 04998a34faac5263efbd1788a7985b81
SHA1 1051b7cf252626b1665e50253bfbf978a8897b17
SHA512 4249e4cd011a306ddd969e97b55422782cf672e789ddca925b10c959324f68ee6bd2eb74c9d71144e173d601a95ca36bc994ad8d84408594d4a782c062346b7c
SSDEEP 6144:ZWwtcH5rknMiezJqsq1FYbUngtE++5Qh4wmty8ji5JOvAJLlvJi8J36PZOW/:ZZ4lUcVdbUY9h4Vy8ji5AoJJvY8ho
TLSH
T12DD40826AACC1F6310E39389B743D753E8D49545B408D29BE8EB876621CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\et.pak
Size 573KB
SHA256 f304e16a3820f8f9f624c1c5ed1eae2c2fd20807616280f0aa9736d50674d694
MD5 44bceee5e47659faa8b574d1e9cc4f6b
SHA1 d6b361e5fc049142dc433211bc4e1b7104b27855
SHA512 c29d659ff78df9623b7bfedf01478df4c76988e8720ad57c1a1c6bed0ca99038861b23fba8879a3f6e236dc75240c3343471ec6a380d88397e44248e8642da78
SSDEEP 6144:KzYJkiE8+dZyuRKgf9ja0+IPe6yH07nFdGpNQvmdsIPOTQysogWUiofoflLXhS5u:2YQfZFRtMkPe0nFdGphoPfljhS5Zq1r
TLSH
T14BC44C42A27D771B242412F9E737E923DC9FE7D8B4000D9668974A1970EEF8C38B6B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\fa.pak
Size 946KB
SHA256 fac7c1836c64eeaabcf437fbb8f9b6c12060686b6502e7f28c60e31605f58474
MD5 3bd70feaf9db7bac46f88ee3bbd8c3a5
SHA1 4ca4f6354f7c927ee991b71eb4c3ac95676366ae
SHA512 8a26c3eb112df909c5d98c59e3d98216493e8fcddb3f1e136590bcb9708c0c1b81e789d9b7c8d79effe81f91af20550da5705f23d6ad920a027288a93a91409d
SSDEEP 24576:z9Yy8u313uyqoz+sb2VRmXnloTUoXtCfGk62Yh78ai/78MX4UOVU8Rkc02uWgmuF:zKS51d
TLSH
T15A25B1957AAC9AB15747CA0341E33834C773EF12D349FE40ACA1076609A5B139B5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\fi.pak
Size 584KB
SHA256 29220b9d2e2aacb542ee0905b676b914a748332bc7831fe0da0f453252f88235
MD5 2c5c6e6addf2cec9cf438553926d9b27
SHA1 401722d2be89dad0bb49c6af12d2b5588d893bbc
SHA512 728a0d2b492c614b624e5b9ae0fb20be00e333a5549117bd291189955a44d4a4b85c6320fed237bbc1d4d66b6bd366d2aa64a21bb439d66515cf13f1d46c1fc6
SSDEEP 6144:jyKo/VMzr9U19cU8utNtmS6r5DDgK/sKC0WOERHboaQaLO5wJw+UH0RI8pvWaHGj:u/VIS19T/a5zaW5wJw+UURI8pvWamvaG
TLSH
T1B1D44C915219C22237C4D29E7DB0903EF5E5E3DCCC284D9AE843C7D849EA9887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\fil.pak
Size 662KB
SHA256 9c2c3db51dd197c0ece433fa103829a96daa5a4b3335324f1a98bcd7345cafaa
MD5 62b223bc93bf11543cab384bf263ea2a
SHA1 638cdf9d2c8d4f1c39878b43ae2dece53066604e
SHA512 ecbdd03efd82b2c8bf030d58a48b9feb5bc9c3a03949ec8828748d3302e629ab4bf309a76e8ca7d0d8ec0098a6a718a41a07c41a1ed10a87be64b92eb71454b4
SSDEEP 6144:IUtF/LqfvSrVFFfgy4DQ+ZyITltRFhsAcJ56SGvla9boV8A1cOO:bRmi5yvO
TLSH
T159E4C715B7401748DBC352E55360A82F6AE560B83F827C6E0FBF269B7BA7CD5D270182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\fr.pak
Size 682KB
SHA256 38139282dbcd2229e4adead79ff4763c60d261b55c64057c66d9db666be2cb02
MD5 009a9759c05ba29222d7607c5df00c6d
SHA1 deb836fcd77265985bb383c35c8543a1a1165004
SHA512 111ea1fa93bf6342a353c8483333785fc3778a2b6405f6a3139faf778b24afbfef1ecc503871d99cecd99fd017d9cb3cd324e61ed97fa9922648e37320c54d15
SSDEEP 12288:c3prj0doRNZLAqp5dZb2Z7R6QuaSVYLyH8CezBIGBiZuYnYY8jw2wTxUDzLQdxSw:c3prj0GI6V78X5iF
TLSH
T18DE4E66FBAC431CB19C60277FB16D663DD348248F215E340D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\gu.pak
Size 1.3MB
SHA256 149237780840b625b95321117cfaeccf5d54d6ac870a9886fcb9a3bcb1e6080a
MD5 48eee10b179362671e8d98d2689bbeba
SHA1 a0dcefe9ec3ef67d822e36162fe5c71684254609
SHA512 d2dcad2134acf9ac0325cd27ec2ff0aa4cfae6f9cfbaeb0bf982ffe362c798f092bf6bfa776efecd93b38e3c2aa9cb6ee3c09cfbdbdb1ccc53c5ee5db9794334
SSDEEP 3072:kVN5X6tUNyD+hyKZguSrWn1jxuYBoLC0PjAwREJKVMjNiT7llj63rAulfcSi5Nnd:kVv86BhyKZgGQjtsQI5qCPCk1ssLw
TLSH
T1155509D0D7B9F07019DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\he.pak
Size 829KB
SHA256 c4a828d6425bfc888d6e79ac1d9220926af6737c3eea05d86f0796206f7eef62
MD5 3ee266e45dadea5dec4da1ea91b7af64
SHA1 c569e3dc34fd34bc237732df9e360c92f7fe858c
SHA512 d59ed3dfc74e23cdcaceb962240f46b0267f403643d5c83a6625ac19df938c3332aa0f52e544ee66365169e400385f9bbf4b655b8a5ea4565975c498f7c78dfb
SSDEEP 12288:ks73bXB7hOF2a+TmoBrAfDuBAlGWq+/+J3OC0AACXlXeQCaj35RXjv60jsXk5mO5:T73F55162
TLSH
T11E0599C4B2E452255131AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\hi.pak
Size 1.4MB
SHA256 2acf2e5770dc1d8ca5fe4b93eef94f0395e44780e97eac8c03b3707c0e0e40ef
MD5 c526e67f2d73b6355aa87a01679bef9c
SHA1 dea1fb2488003c0a241add700d9cda5669cee9d6
SHA512 121f4967fcd2dd35cb786eaeada317be670285835907ca8e10176d847e33963f8763506ef9c4be60761616215b74d04a3041ee6659fefe653379192d1100a598
SSDEEP 3072:IfKw3xXncyTHhaJvBYel0EsFV/B90ZV1d3uGlqvN3dgNJEdtDVeDn1s4f4/BtROX:cLxXncyTBkveel3mG75pAndKBD
TLSH
T14A65050CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\hr.pak
Size 639KB
SHA256 a104df3eadd5a8217d58204b7407724c3c7731a32fb47fb6265090ece347ee86
MD5 38aa1c8229bab08e93234fb08c1e3d0e
SHA1 5df709024aedbbfe90dc4a964852aca6d66a68af
SHA512 00fe9d206e36cb8a587076ba1170fe4678c17f98cdd0d61c53c3d5adb625bdf5e3c926816c848438183faeec5d23aa53a1f0fe437e7d9ec294d20460c44c6fcd
SSDEEP 3072:zGIg2g1tc3lpiMgWeq08faLV08N0xo+pfpzWBkfBV038YtKzVMOSAqfnpskV60uX:ReHW9svX/KRBYE/5wQCOR7PrzpJ
TLSH
T162D42B7DBEF3570A0897B34AEFAA434479BD08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\hu.pak
Size 684KB
SHA256 0e3d482b4b09cacadf58043acd55baa2705fa631d1217ca0e10c7a8cc114fa73
MD5 5d20203d5c88ea08b090cf5b057ce9ba
SHA1 09bac276417a0349732e93be31586e0f49a4b1ed
SHA512 7476b2b1e455c774059cb6e02b1701c8e5173e19e63e006933b9e641dc202729a3c71ef3c72d4cab602f8c31c6db34a886dd94e58bc6e58d55e379a2df316fed
SSDEEP 6144:rXDSuMnMY0M7QtdyTpVHiLl/5kgWA4ZtOu8U5UTt8gZ494rYhCi/YtmuFNer2Ene:rXDgMfFtCAjU5UJ8Lta5Tys
TLSH
T15AE44BBB93769059B86C179778643F15492E481BAF2B36FB2883846D34A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\id.pak
Size 565KB
SHA256 0b35177ee2ca68f9ed7b516d6920696971cc9dbf2187c92f63adfa8e696e4921
MD5 1e6003d6cfb55840f293b8dc184006e2
SHA1 3e78aea5d74d2ddfb49f96e21b16c0b6ed83bd17
SHA512 0e7165b2069ea2e683277a24b44c0fd37061863b621c18b606a89382b9ade2a790700fb054b714824794304e971b5d6000bd09474d8fcf90585b783c7c45ad04
SSDEEP 6144:EKjJAf0Ke/tdMpPyQZ3ZA9tK4AfjzTFjlFtXmBmiFH/Q25R619KOBCTmGiTv8oy6:rlA8KGd23ZWj8TFjlFlmAi95R61v4a
TLSH
T124C4E8632ECD310C494842D5F2CEA91E7CCE233BAF05B76E8E348F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\it.pak
Size 619KB
SHA256 ed64dadb92c0113bd03c56c0417e0c1930d0ef17d76f5f6c356e6ede66a094eb
MD5 40c8eea9f4937cc8ca9560dc2a89c3cb
SHA1 df3b2e7f5c6e6c182f12a25d0f72d8d0a9bc1a8a
SHA512 ac615db102639d1602213d05b028c1b8ebca5654bb1efa7b6bd190822be9a7ecae6026de011dab1f99a5f47f0af354486d2c57cce4f9b9a6451592ac7259946e
SSDEEP 6144:JHOwZe5qNmiX97+2N9rYS/qBRRs61wtM/RT9TbOKkgEgCYrqCqpzSj9f3wBYUJf1:J/DLiZZeW8Y41AmPs5f4SliVr
TLSH
T1B3D42B3AA5D6212519976359E611F085FB6EFCDCFA417218C99B031C22CFE80F2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\ja.pak
Size 753KB
SHA256 25b71276ae5ddbe98e8cd237031d25954d02883584dba4a86ba5e16d7c308493
MD5 4214af7402afb56aec5545bd8cf082a2
SHA1 cdef2c623f68d2a43e9521b41b8bf4e57a15875a
SHA512 a321a4ed4a141b6a984c4e75a23c0fc6eb94858b669f9e9985d8cebc010bfe9fa91b52130569325f7f8a906cc45a4b5aead9aac9ec55773fe45c4f286b010562
SSDEEP 6144:DGhVgnaJybiPfSHm3y/rKWur8mdfOWV+Z8Q2E0uRPdbn5zQEu5tzV3:ahVAAyLG3y1kfF+Z8Q2E0sPt5zru5v
TLSH
T1F8F43F7CE3C969369D6152A22C4E36E17506AC5FFCA23A3A443DC074BD70BCEE415AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\kn.pak
Size 1.5MB
SHA256 1ba01542213e2d3e9da15d930922a12c0916b002665d6d7d9a2fb2f483f3aa6a
MD5 20652187154ef4e526b4f579e272c964
SHA1 2022f6eed1800e62394f7ef66793f9a3f9dd2792
SHA512 46a212c10de24b50149b823d4e6572f64a863aa2f88af126877cd00e67df3de0ae552aed4cc13ef81a6ddfbcfd85c8395b97fd22773ebd6938a15759b0db2b01
SSDEEP 12288:nx0YTSABwErftlzAE1TS7ZhsUq4FWqM7P5JLHMt4EryjEi:na4vwErEY55Mw
TLSH
T19675CD18ADBA7D301BD5006B24EC643ECFF16BE29CA907D2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\ko.pak
Size 640KB
SHA256 baa4dc565c14119a4cae9016314b284d2795fbc427a76e54b27799910d3b777a
MD5 bf8ea40532d935d96d50180fc9722a2b
SHA1 28616a160a1b07059a4b000d9513eac9e372e33f
SHA512 43b4f87d16967ce207018c1c37f33acf668e4963acb17cf6659e62937501bb71c3cff4ab04b53182a50786cd31f075edf59cf9f03fda7b5e62b37d7d6a5bfff2
SSDEEP 12288:zBLt40ilgukiiM1WNiPszcbifYj4ZGRymIeYs14bLwLCMrI01xWSJGRG1zLhwEti:zxt40EIeaR5S3iHuI
TLSH
T108D4C5F238DB63CD1193CD82AEF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\lt.pak
Size 694KB
SHA256 cc3ad14a054ef5db438523d56f33cec0eddddcec82161c3ff231eeb6cd747e4f
MD5 d290658a4689886b945fb22e01b2a49a
SHA1 9816d258c03c3f4c74fe3da2eb9f2b2643d28159
SHA512 586982b9bcd6bdaab029d3be3ae6a9b642d5bf676ba0a9df37e021bd46637ac835d8d1496c32d78c737c6afa8cec4e015738fd3af08e7b4e78e934df4bdab2fb
SSDEEP 12288:nvZZkeR4oMwQJz0PrVKrB4bi5P7MIAAJP6StA:3JrMuBuqi5oItJ4
TLSH
T152E42B0069E3AEFB9A4467C981A4CE78DEFD50009767B861EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\lv.pak
Size 692KB
SHA256 b792d7adf76e8a87cd0fe28947b0683859e91d0f05b119a14964239d28165b2e
MD5 bd10e7ec31bba5bda9057fe4e6e144a1
SHA1 f761e7030024f1725b975a6cfaa83960d02cd583
SHA512 b8f0b607643fe591ba134767570781c6c6668100034c2c95c77c680380773dfa9e8cefefbecf9b11d9ec6295641d8d020d26f7e7a8444fcd2dc7a5383986c6de
SSDEEP 12288:ZQ7sqmcACylMd9ztQHINT5qchTyscSx5S:ZGRACylMd9ztQoNT5qcrc85S
TLSH
T15CE42B959EC68FA94D904DCA733AD132A8CCD740FE07E112DD7D8B3A650F52822B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\ml.pak
Size 1.5MB
SHA256 007fbd34d82ad4faf6ff8c0192a09783b37bf988ef76f4dc6ce8a93cd7364fff
MD5 f5e0485d52971724a697a7aabf499a43
SHA1 db8c03cb330bc099ddcfebeef4de3fe4acc30464
SHA512 d85bf79ed1adf3d112a1705a6bb144231e7985e23ad9df630f32587d1a18acb934ab37d7632d49fe3c6a1d2731d9224f9f39c4b2a2c0f045931aeabe6781e474
SSDEEP 24576:rkroUYF/oZAuuxyYl+9y9XBkx/em7KfyBR+zXcb+v2uiLl3751aaiAD3e:rkkUD5g
TLSH
T12C759D57A036CD3B0FD102267B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\mr.pak
Size 1.3MB
SHA256 c0b460f8fcf6a46f94385ffe57d9be6ca1bbff317cc866bd2c7722d813c04df1
MD5 6482bcffb438f682d0717995d5e4b0a3
SHA1 4b2f449d92fe9fcb236725d9f439c5994acf7dc2
SHA512 36c83f350b2e220c9f080cc0581ece6ea075899fccba843e6d2d0355651fe26a0634b88aa034e885396fd78e2d05342b3d84995e3720b28540bc284c6e3cb63c
SSDEEP 6144:fdAJQ/QbwOumXTG53JRiWUPZ90PRQo4Y455mAAy2:fK+QSP53+25Qo4Y455mAAy2
TLSH
T1E855D24DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\ms.pak
Size 595KB
SHA256 195a63e82ca877f07e12eb531779e2b93f35b4f45accaea4e9d133d6b52f1883
MD5 809264adf764ee15e33d1ba5d8f8b28c
SHA1 edf63aa96d8d7d52ab4bda9aba562b68d4556861
SHA512 502d530bdcecb835b710a21695b20a955fb4f932240f41882391b701054d85b0cbb38629105594ac246288ec50b308a004e347024df0922613038cea0016dcdf
SSDEEP 6144:b1ytBQp+1BAd8cXuHxze6L/rg42Huqwo9I78AVzZY5b4tVlqL3VDhh:b1sBQp+1BAzox66Q/Huqwo8fY5GlqF
TLSH
T144D4B7569EDE3118085843D9E2DEA91B3CDD3332B705AF2B4DB08FB0126E7A53315B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\nb.pak
Size 572KB
SHA256 0eeca6206c27b7246a9ef09217b00e60ba3d0f72cce528e9dc21836c32ac2d66
MD5 74ce9ab0c53178d375d98efed98994e6
SHA1 4baa8ffdeb6039b8c3d8800266e6cdaf1a4a1c1f
SHA512 2b47badd713bbfaddee88118deef864f82777f896f688d29b44138cfaa17acedb446fc8f1a8ec3f7fd20df2bdf7b72969f442f2aedbbb8cfeebdcbd2596bb519
SSDEEP 12288:PzhR8ZQXbO2jOp7fI4R3sv3qG5wmNBdls7FDu:LLOessv3qG5XNB7uA
TLSH
T1C0C40883EE46B72AF2A443A4F519855B9B7D942CCE98199B54CCC63E0CC7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\nl.pak
Size 594KB
SHA256 8189f284e1e1b665c17b91becf084cdad8e88d0574dd99f165c994885a7668c9
MD5 b1e6f1e2d4ef63f31c78ac0de285ed44
SHA1 8e63709cebe9484afc4162ac3574eea25db5eb18
SHA512 cae030a96e0ded04690d2abdcbe09bb9c0438c072908e69a7a7818b2e1db25093d63df853b164a08116161da28b69e75c76ab98754f2defaee4a01ce6c92bb8f
SSDEEP 12288:1hxKm5plbJWQusNUSW/gKf6095btbyUigqHgGfDTF:1xrlbJWQusNU3f6095bNyUVqHgG7R
TLSH
T1ACD4FA07AC4E253E59C1A349FA098FBBBF2ED22CC26CE6BD94DDD5340443F68429D589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\pl.pak
Size 663KB
SHA256 504077baf20983656f334b7a2bd78e97ad267c1243ffaca05d83723724c30508
MD5 2d6c4faeed5f1e98582beeab57d1c9a8
SHA1 bdcd89feefa78c72fb7dae0de98b14e8324382f8
SHA512 a36788143e83fd1fa2d84d729e97243377b8944d7134805da6aa4b6d20215cc8f36ec00c257019423f8df3eb4e470f59ed34f5b8efd3e7dc9198ce342a80216a
SSDEEP 12288:+P+Bp2nMKiIFwfQfuzSJabZ6bEYPPxCUdTe3mbUUmMrma1Qh8j5RMJRolEqtT:cCEcIuYbmM91Qhk5jB
TLSH
T1C1E45C0E5AE58A4E8CB008E6F2E70B7CACDDC808F109D35FE45F4526615B19ECABE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\pt-BR.pak
Size 622KB
SHA256 423059732c14cd00c450ea2d6b9204c34954ac117169abb506ec248da6250052
MD5 d7645414b7216089ba6460959d2602ec
SHA1 34f4f30c7d7972cc6f04418e9aa58e9415d5b250
SHA512 374e4a96bc9eced177527a2594654803dd187b5de48c3c054f1641655924f7ff76aae4ec6ead6eda6237630fc4d360e190efcb7675794a0485108699fcd5e7a1
SSDEEP 6144:tzFV9V0TlNBXBLWjPJQnyli5mEN1hzgMsRUJyMM:t0+o5mERtsReyP
TLSH
T114D42C2A6ECA136604225350774EDB47E5881745FE0ACA87DCFF4F06A3DDE40DA33AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\pt-PT.pak
Size 625KB
SHA256 6ae5c44e2044c1fa754d2cfbd79a33d3b9c2bd24702622df0f641bdbc7991435
MD5 82ce340cf07022445f4a8fe497323046
SHA1 3a1c2228be107555713dda735a25c708e14fbd1f
SHA512 a6029f1c3b1b0a987bc62f74d8fd7ab0dbd99f4a20d98006bbf531a2e871313334059e05ecba6c116d6742381146db9e5cc5ffcec0d59a69ffefa9438079d6ff
SSDEEP 6144:mZaE2UVN5P5znieJVJJxhwID2fbPGfDUh53nsusGMSRod:ua+5P49h53ns6MSRw
TLSH
T1EED429286EDA136605135341770ADB03FAC86655F80ACB87C9EF0B4272CDF94D6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\ro.pak
Size 648KB
SHA256 8880b2ee29244efa9fe250d88f17dd5ae8f3e56a354c8208c5d4be4ff7cc3b74
MD5 6388f9a13bbbfa1e084a15acb046594a
SHA1 3c7d73066d2322fc99d409bc36afd30b36e35047
SHA512 71c9dc9eef7111883253e42b2d983af9514fac48ef1c7890ebdbad604b18ba822c28ecf009f19470623cc91343c2038d135b8df02aca607d6d0d6f072926eac9
SSDEEP 6144:1Kc+X3Mgrjd+RXklwj9yvnB3ghgLyg24+xDG8f5LAEK5se7W2Oja/9rVf:1K1sgPmkuyvnBQ8d2/j5LAZ5Bc2/ff
TLSH
T10EE43C23A1C82A97295153B2B73624D3E88D105DF641E28DA4DEC97D10CDDDBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\ru.pak
Size 1.0MB
SHA256 4de88dade1118467dce77afa84802c2e52e49a574bf91cd8db9262d687f86000
MD5 331676f3ca97d2ef68747ad05ac06a6f
SHA1 08d95c85657c793de48823e45e4751846c9de77c
SHA512 fddbab0452834df2cc9f45158693ab09a72679be2abb73d7b25c40932b638761b578c72d651a4935cd498a85f6195757adb2b5c68b31984326885b7b3f2e2421
SSDEEP 12288:EPzVrx5pXfQeRo4YwSspSzJ9wF+oasUWXv6HzW/oqSv9s2WTaENtgA8Nb6dwYHyT:ipxw6S5Ro83
TLSH
T1B0358760669E64EE1101F01BDD08BE0D3CEB45FE3FAAA31619642D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\sk.pak
Size 674KB
SHA256 d0aa4f73024ae7f8bc95a6e6e8975fdf65cfa52d0c500f7e04db483d13fc1566
MD5 305572572fa84d145c7c71b7fa11cd79
SHA1 bee43d29143bc311747a929fa0bfde45151aab1c
SHA512 4bf0499ca16dfa4640179dcf609030d652985a70c05dd4d5525ae7a558a4bca1d098f20eaadee458f90200b5ddf33177d54e6fe1977fcee6e3a6f1bc512018b7
SSDEEP 12288:g7ihjBq77PNUANi5i2Tj5Bnyf9YQH+8pTjsxt9iv:h8PNViR5cYV/twv
TLSH
T1FAE44D3FDFE7181E8E8D0148EFEA7110F97E8650864EB4A6944F324714E26EDCAB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\sl.pak
Size 646KB
SHA256 7fb4f5154e2f158777bb5b03dfd35f1037bafa6be772203f96e5c53f7a771643
MD5 1ae72652bcc4f16b152076d75cfcbe65
SHA1 99c0397671c02fc6790917de3715afc96c4b1bf9
SHA512 4f7b11ed743b4a970daff3d8d1fe03ebdc7099df2b31f5bdacd236b0f7cd33e4623a55eeb63a0196702c82cf876bf3a789780dcac17cfd35b9156f74de71b1fa
SSDEEP 12288:E+uorNEWpcB2BcBwYL5lbH80WOq9Myi/fzeDJql/ad:puoGWYwYL5lbH8ji/fzeDj
TLSH
T1EFE41B397AA75E0F0C9AB28FFEB606007FDC044CD252A6A2FC4F33695415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\sr.pak
Size 993KB
SHA256 39dffe2ac8a038bc8ab98b3796da08109d7b0201299a0b8411d0290b507dafda
MD5 c6372c8181a08f478f283d1998147084
SHA1 d73f1353660e62ea9a958c29a21e7637f165710f
SHA512 48ccffa2d0f687618ad7ee32a9ea5458e6e02617d3bdec2aa13a92b2da1ac26bed7d005efdaf25b00d11b1275395be04ffc7667b3b91161d2ed4823abdf4d9f5
SSDEEP 12288:vdSMK+z3nIAhuSOd8CC0ili4gCkHvs5YEZ/XC4xKGZ37GduEU/k/D:1Svuo05JCTT
TLSH
T16A2556B19B9E64DB0901F41BD808BE493DAF41FE3FAB975211601DBD34E10B847B929E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\sv.pak
Size 577KB
SHA256 78c25c86c120e4db41ecce3d91ebe550d127a97d8b72c719d3a2a433973946d2
MD5 2bc74cef723840ce2edd3efbe4c15059
SHA1 38501a37528f40e83d9d4158d8a25b7e166c6e17
SHA512 1bce472fe61d47c66c6bc4589fa862164259b76f9feb6e5bcb5975368cc225d6f9f23d4e5af85d32dae21fb8fc005d17026ee48080e1e1e61fba01591a0108f3
SSDEEP 6144:aQvuXkfeldQywJ+T6Id2NxbINlejeLAVRFcz5RtGmL+SM49mFMBZSOGQ5tl/UiRc:alXwTM2Ev5MiVw8o
TLSH
T12BC42D438A10F526FBB2530DB609015F0AEDE25CE7E2954EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\sw.pak
Size 610KB
SHA256 c2df1fc14a64c19c92d9b9b891aee74ee1d9319cc054642251c517ed00363bae
MD5 f66c4a25f772976f544da0cb6260b53a
SHA1 67c338601e0e11da7a0ee4b03a0cd5185dd88940
SHA512 f28d9b276450623e9bab2ff9fdf48b682d08118ab421ce18cf6c6bf28b6d9569c2372536bd5227e7ce629185f614170a11efd7b9a0e979e670b8cdf4bc0f3321
SSDEEP 12288:iU1fV/4hyZh72yxGC2qMCZ5CmedqNGjRdpvC574FqHKLC6y5IZSLQB4GFpP2NUiJ:xfVQG5GFDi4j5WcQ
TLSH
T11BD4D6629871E1191233518603DDFF732BDCEC5C292B2D936A46BF0F118F98C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\ta.pak
Size 1.5MB
SHA256 b7dcc6f63181392752f4522d3bbb573fd4a6ec65f9058a922ac61ce21b257b76
MD5 50db620acda7e481c9fe7341ec7d7977
SHA1 dce3993f0fa2c930e95cb4764b1de7865e83ddec
SHA512 6f5ec91f0b59813113d7d822fc77c900cb1a3c1698e7267ca7855aac97961d508adeb2825bc75a845108d262979bc90371efaabc02f9b51468be17a3590eb505
SSDEEP 6144:v+YllkNs6KnYEkdWkGP5w55q3tR9Ptm1vYpiMyO:vt2s1YQkG655qBtm1vYpiMyO
TLSH
T151750CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\te.pak
Size 1.4MB
SHA256 72cf1e05c189751946df56b1847776ffbbc2b4460fad07a070c4c33396516ef2
MD5 2e85b6f1e3c3ffb73390c6bfb78fc8c9
SHA1 daa3bf1fa61655cdefb5cdcd9ec4df55716cc92c
SHA512 a58507f4e68621321da8311f8a065eeb03350f672f44e71a98b9ca25f3e812465a04f4f5004d6c8d50abb18b91e8d40a3949329e58dfb83fefede2bdde7e69ff
SSDEEP 12288:ciIU07McKNxywG6USF602ygIC8ymoRRT5bbiu52C6WuB6SI3p1FG1Ya/C/lb2B36:iY154RcaF
TLSH
T1BA6592023A6AD310DAE70273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\th.pak
Size 1.2MB
SHA256 45a573589f11c1694490913c00bbff65d57e232d33ca2270ac2e443207b971d2
MD5 79b81841fde5ef8edcb46d2ba86dca09
SHA1 7d9fe5a44d137dd4cecc6009d597f77587e84c7d
SHA512 31641437d3c012ab0a88db26539731c7c60d141d10646c4b457691c0827f0a0459adf479579b52263e6d4c46728642cceeaf6ba59a2249ff76a4c7bd5c59d056
SSDEEP 12288:lvJJLN9LyZYAhzYLz8AsShukJUseTPsO5eXffpbDFDS6Sd2N+Qj4B1qsl5URqE3D:9J0O5Ssf
TLSH
T114453BB37247DDD479441B5B262A7789672DAE693F73F8E00089215A73F071A8432EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\tr.pak
Size 621KB
SHA256 a75be19b6203daafc5c01f8ada1ba464076346a4d4959a2e05e91523ac56c446
MD5 5c351d664330c6edca0165973a953503
SHA1 88b055a168d8bd7c31e6430f0483a46f203f1e87
SHA512 a9aa54f9d1fedad97a7f2efe2e8596860de96d53bf82e72d109a034538e853adabed76060e35ffcf100d5ec69c7dff2d3596b2c16887fa97f34f1145648838fe
SSDEEP 12288:/jJSKGxGzkqABYgB5Hz6sgwpIfZFMzGRkKkG5MA41:/NSWK7KkG5n41
TLSH
T117D4E98178EF682C8BB9278FD6E90666F89F0766B331F446DA168636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\uk.pak
Size 1.1MB
SHA256 01989ebc539c272ed8eddd3a9d25810e39c7fa0276a19562492f5b332ddc380f
MD5 84dad3e9efdddf304bf5f46c1d2999ce
SHA1 c9ae490d7d47d356f7d555558a086a06c3e338a5
SHA512 63453f1d7bc1f73cb2bb0a40fba92735719474d727cd3138ad88034cf637378066797a41f17df33baaf6a928451cb7ba7222dd7a73d79dec959e1b925e1d61fe
SSDEEP 12288:PoWQSGLEHsGjIwkkmV4EjvC6sSr+f2nxu6CadoBEIKT3/5iNvcA6Qqe860YudLNQ:PKSGKgZ548E
TLSH
T11B35A9A19A9D54EF0105F05BE94C7A0D7DA701FE7FA6871625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\ur.pak
Size 933KB
SHA256 d99ccf422979a0dda1c46919934e6eb599d2b75a7c724c34b761da8215a727db
MD5 f17ef5c00e2e537a25a67a50a4e42519
SHA1 b5e42db115863b8ee55343a2f7f257b1796e689b
SHA512 e4fd68988b8f5f637d22dbf49ccea38adb7452376c9b21a4035530ecebf0e0ea09ec6e1e45766a31670e99b854a1bb4720bc9697c1752c728fccf6000ff6e19d
SSDEEP 12288:cCb7IdSoew8Pl1eqtdQlrIvyRKXpt5gnpEhjGMOd+DyQYrsKYjwadcJKwUruqcos:6yD5xGXp
TLSH
T10A1500D2E6B896B34A21D92780D33C34CB735F13D34AF285E56246C54E9A0139F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\vi.pak
Size 737KB
SHA256 2b28fc3de60a6f3e75423bde8bd681fdfd149372455070e6aa0508581707e94d
MD5 105fefbb728ad849215a6081d859c12d
SHA1 8723e3a4549108c8fa623c8d7ef3a3e42a97465a
SHA512 aff23c74d733bd0ca28c0c688724860e7d1a1ae17d1eb8c2d711b868d96984db374f053e9dea4c781cf96a49d444cefb36799911680eb1980e75490392988890
SSDEEP 12288:fljen+Y6+cDZ7oE1sVpMhbg50+0sVN5OFWd7aWx3p5a8iVy7oINFZIj6l2eziuRj:fV+cDOVF0bFGu45a8JVC+l2Yiuhfzq1M
TLSH
T124F4851217E1302680AC553EC6CE540D6FCAE42FF7C18FE56FE4297476221A46F25BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\zh-CN.pak
Size 529KB
SHA256 03754412deb511ddac23a23e0858bba40373b5053bf97cc21e9e0b3c5d00ec4c
MD5 ddf51184074c6edc7884b95165e1437a
SHA1 f3a18a95ce6c4336fd088037c02d7889c3ca9405
SHA512 8b4213f6efc2668f5b4bef913dbe9dcd10c152e390361e0eded352db211e6b3b8d827588c4675af3818dceb08ddbac1da63b691a6ba45cdb62372f5873ef978a
SSDEEP 12288:zLpL+sVdi1uzOjnc0UHERA+5hhjYYcVLL:z1JdVzOjnc0UHQA+5hhjYYcdL
TLSH
T118B47DE910F9BDEC004650A03729613DBC41720BF66BAF766ED248DD1AA2FAD0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\locales\zh-TW.pak
Size 523KB
SHA256 d97e1a4b2b3b7b64e92dd419480f8abe84fe3148834cdef5abc31b36f69391bd
MD5 7ac97a3a13af0429a1037725dd7639bb
SHA1 b7a9529837c85031a2931eacf9c42016fb9ee0e2
SHA512 b9588fe570200afbca51d130900b2bea054b6b39354fc811c4a0ea1c4565c04b852b72bb405c3439c957985ad969ec7526b8f6f1955575df1bc508b80d5ee453
SSDEEP 6144:xWlKhKK6Cp00BxTWovVJVXKf92duTm9M405PYUoH8DnXmVX20X5mrT4:xWshKoSoBXa7m9M405AUoH3A09
TLSH
T11AB46CB619FBDBEF0901E884B7CD523BBC9B342CDD777632FC8518D42E6AA640A61045
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\resources.pak
Size 6.0MB
SHA256 948252e0a45d6d4395e7efe0c9378e23aa342b0ba4b9823d148eac47c10d6705
MD5 52d6b30a3f69fbfa6094b99aa361d869
SHA1 214c6f363a7fa5d20d96bfd95d29f67c00c14fa4
SHA512 160802785009ec6db184b49731d810a1526ad8327736b90c22e783df7e16e7959f23b056fed126e26148c797a36d4c5d90cef52ea7ad55c64e79948e965659f0
SSDEEP 196608:lsBRFlDPw+WkrYtJ/eA5hF/F/eZFFfD5CcowhJT:mTFdQkrI/T5T/oZfD5N1b
TLSH
T1FB5633F2F360287FC498477942D187755F3C998A1942A0270AACF265CF5610F9B89BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\resources\app-update.yml
Size 172B
SHA256 78e3d079839e8ab5c2537a9426ca445ec36b8199cefc459dd83636a0b662a6f2
MD5 094ad6158878f93f169a555ec079a13a
SHA1 af0d2fb1821c840ba3dce553a7408cef33531e58
SHA512 134d4e44f1474322d99423fae97a7795c8c8ea2749b81046a80222d5dcdd2a40d0c1daf530e8baf2b6cbb916cd71a0ea0a80834a1cc634644e33c8f779af1220
TLSH
T159C08051CB2483344922479870087B64F05E0666F4DA7B5141AF571F62174398D3939C
MD5 SHA1 SHA512 TLSH

Submit Download

sentry-cli.exe

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\node_modules\@sentry\cli-win32-x64\bin\sentry-cli.exe
Size 11.7MB
SHA256 e3df9ac4efa1a8407bab95beaa2adde6f7addb39312c37796d9f2c9d12441a0a
MD5 1eb21fe71d38e4c109d078a538dac860
SHA1 4039dd99d8b8e10d07e318c5eecc07ef4cfac740
SHA512 e3274b609e9a1930b212da70b55b1cfef8ba7cab6b66fe7052415b977fc15efa3a804aa3acc259d8918b1da9e02a802506e0d42d3db8f326a12e41ae5ab90033
SSDEEP 196608:SvvpkJAxXEouPQ20C/vgS6HlcVe4Ei4eGUae:SHXEoohZvgS6HlcVe4FgUae
TLSH
T192C63943F76291D8C06AC174835A6232FB71BC4D47307AEB5BD08B212F66BD09A3DB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\node_modules\@sentry\cli-win32-x64\package.json
Size 365B
SHA256 9b0041b4799756ce82651b2ad149d7c07ddaddf034d413ae2dd24fc8a438c3ab
MD5 a851ffed31758f620ef28512796731aa
SHA1 b9bfe17febbd82f1584d9d14e646094f0e23727e
SHA512 0d52bff75dd7591ccc60a8b22b5ecf907dd50ac1cdfc255240cf4a0dba4631e0579034ace668d0fe0c47d26075d6bac7b38417677c8b95d6319208cb8ba4fcad
TLSH
T1FCE0687142701B2309DC2B60DD1D518663120C53555D3F086AE762091B2E42374751AC
MD5 SHA1 SHA512 TLSH

Submit Download

FortniteLauncher.exe

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\resources\binaries\FortniteLauncher.exe
Size 52KB
SHA256 31eb3c804c7a248fe505d948ad9b3891b6b6f9210bd84aaf0eb716478c490b66
MD5 aeaa6f47b71614437c0d47828da005ca
SHA1 f9d016d3817ebbc28556967b8b8c05d120acbc58
SHA512 6785eb5ae5d6d78a9c2f004ba5c91dd6603fd8efb39cb50f4bc3ac16d7377fb1317ba12658b63d575c17de04696b88c09c8a812340c4c40394196dab99d41a60
SSDEEP 768:XvoQcESFi3EadmMYDH8B85W2Fb9bCm/fOhgrv3B+o:QQ5AijdmMYDo85Wkb9bCm+Wbb
TLSH
T1CC3362D43AA89CDAEA10527C40FAD331253DB6E0865347576A30B7320F13BE17AD725E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dll_injector.node

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\resources\build\Release\dll_injector.node
Size 121KB
SHA256 dab11fce07f57a740ae7c9d58dec72433794eabf2d672c82d5d48795affba111
MD5 d021187e242f1c4d789c6a8004e9f593
SHA1 c93f9cbf02956f675a6c9d58e0226adeed6f8b45
SHA512 4ab021d5bb96a37d2bb3041c9d3ace2afe6a9cdb11ca241ab26b4acea32efe954c8585959a6d0b16f24cd0d7bddb58b53e8fe3b8f673b04a2bc9ad47bf28b310
SSDEEP 1536:gRZ4STUtKwik1O+tSYmKjhpSRagSNiJoxOlKw9cirW5KzhUsWUodw9dlLSCdXjGX:UlUHfrqG0RagAtgKw95CKiA1SYXj
TLSH
T160C36D0BB3B900BBE1778279C4530A46E772B8451A60AFEF03A406561F637D5DD3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diskWriterWorker.js

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\resources\workers\diskWriterWorker.js
Size 8KB
SHA256 61dec2a88c00909e9a41b4e8d26310c3667235c3cb6ef38c81845d4ac31452fd
MD5 4a3d4ab4d552940217e3914e76813c79
SHA1 28dc56d0fd2f5c1099568cbd84667370180b69d1
SHA512 55388e3e7f03a6216d1a4f9d1ee07cbdb31cf587f930155375bd3a238d27ae769ea774db1c726cad016b1c7a2d088d04e81948e5ce0c83130d8d1d3b134f576a
SSDEEP 192:L+YA68hxpz9BVRGhwzJVgQktNV/i25aou+DEv4GSbEyQBod1mnnhYvVfKhLCUbS6:yrNhjzihwzbghrTQlSo+c1/XP
TLSH
T1D102535A0AF62B29806332562E5B5413362EC1675618FE98FBCC83F46FC413C9DE17AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloadWorker.js

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\resources\workers\downloadWorker.js
Size 920KB
SHA256 40339feba98cfcbd4ec5531cac27c07c86515193b195da788d7b96ed7b2cd3e6
MD5 0ad19db6b64cfeaf17947f4d255f3ebd
SHA1 050ea0ae66bb828a4316e60cbf1f354de6d41292
SHA512 098df16fde90462f4ebf4c43c727c97a73ba9e9dfca559f6e08c6e2b59c18736d1cdb47bda6530b1bf74067043a8d3195c8964836805453466baa268720d59c5
SSDEEP 12288:5YtWXGdOnDK9IG4gVm72bICY6R27rlBtIzfRnxRDss:5YtWXGdOnDK9IG4gVm72kCY6R27rlMn
TLSH
T17D15F4891AF324129363B17E9F5F9402B134D003260CDE98BD5C97A55F899788BF6BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\snapshot_blob.bin
Size 394KB
SHA256 53b1d8a58564147d34384e6dd4e6f4eb76c9c78eae8c9e48baed031817c18937
MD5 4a959a0c78e5befe281fae1b73a31d22
SHA1 0380555565b257bc5c05aac87f24b34ba1a50755
SHA512 af89537d8ea7a62431baaff9197e2ca9bbdf2ec404e74171576047de5b8964cf7a3b1b602943f7832d10ebf623fe2414afe120a60326e40cb89dc387cfbcbdb7
SSDEEP 3072:mU6QtROt+xeRvISYOXFG7Qi7qSkvcfB+sE3qfJjtN:m7t+OcRCvcNjz
TLSH
T1AE84A909B349CF36CE083A756CE887896526B18D6D96F31B7519772F38B35740E32A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\v8_context_snapshot.bin
Size 758KB
SHA256 18e61e7439cac6193040e2590e47c43fa59ae74d86c881e581852554c29fa06d
MD5 cd08f880a9ced26c26bce558f1e00417
SHA1 ff7baf2260eff45fa08c84cc7615c0bcc93fe408
SHA512 9fbedffe901a08046158dc5fa31f9a56f85838a2a10dd94626c89ccb0b352d02ec49f0d49ee578113d61de6bdb9199abdf3427d673e10d97f01243d262789aad
SSDEEP 6144:AU0ckYOkGt+Oc0CvcUoNyuZaVaBgJjdOSkvh8mQu/INZV/peyWBOI:51RbvloNyerT8mQuANZhcOI
TLSH
T1B4F48565F74ECF2ACA4537B86DE547463835B04A6F8BD21BB518233E38B65B00E3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\vk_swiftshader.dll
Size 5.4MB
SHA256 461995d47666c0cfdaf8494f606b6511d96f4f1b50ae96c81c5edfb033b2c2d4
MD5 40cfb8f567e63a2f5ccfff7f4b832436
SHA1 16f7fd12d09ddcd0d9f3e9ac87d387e1be3dd13f
SHA512 4b8183b3705759912455b3305082e349ae1e3c4f6424b983becf8726646bbdbdd99efff7e26c96060121a3a6ed82a32a0995baf6dbe0dfdf2bf960c0cd347f6d
SSDEEP 49152:zvnCO26zzoxH35myRF71jieroxfGDZIM/swoJ030NLxGq9lBEw1vEkl1l6SfRP/0:TnCkzoxH35myRjoLt2HUOJ
TLSH
T1F2462713F28681E9F06DD679875AA623F231F8844B2276DF16A01F192E77FE06739710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\7z-out\vulkan-1.dll
Size 922KB
SHA256 9dc9b00151609244872116fcc8150c6a4701ca376564cac58aa752263bb381c2
MD5 cb21a3e77e11d533d05ef4e013c86d95
SHA1 9e9e784d40803b279ab37d94b2dd92c36b7eae36
SHA512 46cf3b9213cfd464c8a86f5cd8751806b58f8af5fb509bfba5895184f937602adfd3de4e9a81af26f2a5db6f021d1a6b1c514da0b7a1545aaf245fcc453d0c37
SSDEEP 24576:806dvAb4CpKAvlSlQP9s36Z5WGc4DYsHQDy6g3P0zAk79oOHAF:8tdYb4CpKAvlmqs36Z5WGc4DYsHQDy6W
TLSH
T163156D23A65485A9D47AD034D9D18707C9B174822326B9CF02A81718BF6FFF47B3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Registry.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\Registry.dll
Size 25KB
SHA256 4f585d4dcb449fc1b0e002d7e850a059bf254769aee0fb83841f73064ec63014
MD5 5408d183e7e2098ffa0290a7a5f9af49
SHA1 5e8402903bd805ea136796032115b72f2d728c8a
SHA512 2f3936808a257aeff0c1daabc274abca583e04395287c2a60778a4c01b5449c9364c6b42ef6a1588dab6823456b4f196ed22a7a911eb5cd65806a01da4d4c398
SSDEEP 384:wUsbaKAjqsQZlJee0QwFJM5LPnnqutjZGmaZUjeVRVKY/raQWBQqLN9AYUVf:uBAoBwF2ZtN77j0KUeZBQo9AV
TLSH
T17AB25C8171D1D4B2D09F1579AB862F19E3EFAD603270E85211A67FCB33918A2D379B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpiderBanner.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\SpiderBanner.dll
Size 9KB
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
TLSH
T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE333.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4616_1504966460\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\era\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\era\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\era\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\era\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\era\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\era\Network\Network Persistent State
Size 1KB
SHA256 53fb4da9331ab8dffb2214e414fd290f6aef5d9f0a15054ce5c8eb6b6ab58040
MD5 980fb59150abbc55c2624f5f907c6dc0
SHA1 32227c2f3a0fa01330a23edad9ffc62809c6231d
SHA512 7541e7c3d5adf2573183a045242a73505cb9a78c083e16328aec18debe86c3dd8ee067b6438cd7067fdb8bf7d4c35737c2b50517c5ee3ff3c984f1fc233715a0
TLSH
T1B621DD9BC3E9877D45A257F01E267D23C5BE091C12283C42CAD8DF8E43F1872560114F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a9c22.TMP

Path C:\Users\Admin\AppData\Roaming\era\Network\Network Persistent State~RFe5a9c22.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3716-224-0x0000000006DA0000-0x0000000006DC0000-memory.dmp

Download

memory/3716-213-0x0000000005B80000-0x0000000005BE6000-memory.dmp

Download

memory/3716-221-0x0000000070000000-0x000000007004C000-memory.dmp

Download

memory/3716-229-0x0000000007D90000-0x0000000007E26000-memory.dmp

Download

memory/3716-220-0x0000000007980000-0x00000000079B6000-memory.dmp

Download

memory/3716-219-0x0000000005E30000-0x0000000005E7C000-memory.dmp

Download

memory/3716-218-0x0000000005E00000-0x0000000005E1E000-memory.dmp

Download

memory/3716-217-0x0000000006500000-0x000000000685B000-memory.dmp

Download

memory/3716-214-0x0000000005BF0000-0x0000000005C56000-memory.dmp

Download

memory/3716-225-0x00000000079E0000-0x0000000007A83000-memory.dmp

Download

memory/3716-212-0x00000000059E0000-0x0000000005A02000-memory.dmp

Download

memory/3716-211-0x0000000005EB0000-0x00000000064FA000-memory.dmp

Download

memory/3716-210-0x0000000002F40000-0x0000000002F76000-memory.dmp

Download

memory/3716-226-0x0000000008160000-0x00000000087DC000-memory.dmp

Download

memory/3716-227-0x0000000007B20000-0x0000000007B3A000-memory.dmp

Download

memory/3716-228-0x0000000007B90000-0x0000000007B9A000-memory.dmp

Download

memory/5248-969-0x0000000000400000-0x0000000000412000-memory.dmp

Download