5b8da4892efc010a814656bb1ee2a8f366e3e2b4f407c0c53456a63714b33554

Analysis

user interaction
yes
max time kernel
1798s
max time network
1727s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Downloads.rar
Size 43.3MB
Sample260910-npkapawtbt
SHA256 5b8da4892efc010a814656bb1ee2a8f366e3e2b4f407c0c53456a63714b33554
MD5 f16ee4eb02fbd6e371b9b820defea0a6
SHA1 c34d7c0f1c79b7c2fd820cbbb7c68670e5ad11ff
SHA512 8c4de1cb0f927569104dd43591894b9c166530bbd6cc29d8634ae26bd3d5b071e9d04e9c39019eaa03297daee835f8ee119b33e195e30f52719cbbd06599f4a9
SSDEEP 786432:TYFCtk1NJVbOqrWVT46TGds3FrUvL/ip7wuC2prkRTvzzmAzOfBW6hRP/XKQ0K1E:UFMk1NTqqrsT46TlVIveZjBpETXvWBT+
TLSH
T1E2A733EEC56D2A19BC3BCA23D365E42A897E10690C63AD3F50D0171699C7FB4F2F9805
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 64 IoCs

flow	pid	Process
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe
212	4852	prismlauncher.exe

Executes dropped EXE 4 IoCs

pid	Process
556	javaw.exe
4488	javaw.exe
1760	javaw.exe
2044	javaw.exe

Loads dropped DLL 55 IoCs

pid	Process
556	javaw.exe
556	javaw.exe
556	javaw.exe
556	javaw.exe
556	javaw.exe
4488	javaw.exe
4488	javaw.exe
4488	javaw.exe
4488	javaw.exe
4488	javaw.exe
4488	javaw.exe
4488	javaw.exe
4488	javaw.exe
4488	javaw.exe
4488	javaw.exe
4488	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
1760	javaw.exe
4484	msedge.exe
1064	msedge.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5488	GameBarPresenceWriter.exe
5596	GameBarPresenceWriter.exe

Drops file in Program Files directory 55 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_547587513\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_649676261\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1184595914\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_2063147412\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_649676261\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1795151458\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1659465709\female_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1184595914\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Mu\Entities	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1659465709\english_wikipedia.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1659465709\male_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_649676261\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1786506387\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1184595914\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Mu\Advertising	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Mu\Staging	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Sigma\Content	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1659465709\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1223923112\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Mu\Content	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Mu\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Mu\Social	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Sigma\Analytics	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1659465709\ranked_dicts	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_2063147412\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_2063147412\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_2063147412\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Mu\Cryptomining	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Sigma\Entities	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Sigma\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1659465709\passwords.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1659465709\surnames.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1786506387\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1184595914\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1297368289\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Sigma\Other	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Sigma\Social	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Sigma\Staging	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1659465709\model.markov	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1297368289\domain_actions.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1223923112\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Mu\Analytics	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Mu\Other	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Sigma\Advertising	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Sigma\Fingerprinting	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1659465709\test.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_547587513\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_649676261\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Mu\CompatExceptions	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Mu\Fingerprinting	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Sigma\Cryptomining	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1795151458\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1659465709\us_tv_and_film.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4456	chrome.exe
1232	msedge.exe
1168	msedge.exe
5748	msedge.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Identifier	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	prismlauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	prismlauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\VendorIdentifier	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\VendorIdentifier	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	javaw.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\VendorIdentifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\VendorIdentifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	prismlauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\VendorIdentifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\VendorIdentifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Identifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\VendorIdentifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Identifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Identifier	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\VendorIdentifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Identifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Identifier	javaw.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	prismlauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Identifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\VendorIdentifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Identifier	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Identifier	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	javaw.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335139911938441"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{C9129059-7A88-4BF3-8326-850B8EE20A27}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{D5EEA3FD-C0AF-4E2C-B1A8-E394200D0BB7}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{26F0635E-8A8C-4E4F-A856-C314EEE3C75F}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80922b16d365937a46956b92703aca08af0000	prismlauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	prismlauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	prismlauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 000000000200000001000000ffffffff	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	prismlauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	prismlauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "5"	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	prismlauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	prismlauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	prismlauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	prismlauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	prismlauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	prismlauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	prismlauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	prismlauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	prismlauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3"	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "4"	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	prismlauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	prismlauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	prismlauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	prismlauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	prismlauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	prismlauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	prismlauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	prismlauncher.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
4444	prismlauncher.exe
3444	prismlauncher_updater.exe
3448	prismlauncher.exe
4852	prismlauncher.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
4792	msedge.exe
4792	msedge.exe
1064	msedge.exe
1064	msedge.exe
5588	msedge.exe
5588	msedge.exe
2044	javaw.exe
2044	javaw.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4432	7zFM.exe
4444	prismlauncher.exe
4852	prismlauncher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
4020	msedge.exe
4020	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4432	7zFM.exe
Token: 35	4432	7zFM.exe
Token: SeSecurityPrivilege	4432	7zFM.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4432	7zFM.exe
4432	7zFM.exe
4432	7zFM.exe
4852	prismlauncher.exe
4852	prismlauncher.exe
4852	prismlauncher.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
4808	7zG.exe
4852	prismlauncher.exe
4020	msedge.exe
4020	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4852	prismlauncher.exe
5540	OpenWith.exe
1760	javaw.exe
1760	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2700	OpenWith.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe
2044	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 3444	4444	prismlauncher.exe	99
PID 3444 wrote to memory of 3448	3444	prismlauncher_updater.exe	104
PID 3084 wrote to memory of 2776	3084	chrome.exe	127
PID 3084 wrote to memory of 5564	3084	chrome.exe	128
PID 3084 wrote to memory of 5564	3084	chrome.exe	128
PID 3084 wrote to memory of 4456	3084	chrome.exe	129
PID 3084 wrote to memory of 5836	3084	chrome.exe	130
PID 3084 wrote to memory of 5836	3084	chrome.exe	130
PID 3084 wrote to memory of 2052	3084	chrome.exe	132
PID 3084 wrote to memory of 2052	3084	chrome.exe	132
PID 3084 wrote to memory of 4820	3084	chrome.exe	133
PID 3084 wrote to memory of 4820	3084	chrome.exe	133
PID 3084 wrote to memory of 2948	3084	chrome.exe	134
PID 3084 wrote to memory of 2948	3084	chrome.exe	134
PID 3084 wrote to memory of 5336	3084	chrome.exe	136
PID 3084 wrote to memory of 5336	3084	chrome.exe	136
PID 3084 wrote to memory of 1536	3084	chrome.exe	137
PID 3084 wrote to memory of 5008	3084	chrome.exe	142
PID 3084 wrote to memory of 968	3084	chrome.exe	143
PID 3084 wrote to memory of 668	3084	chrome.exe	144
PID 3084 wrote to memory of 5688	3084	chrome.exe	145
PID 3084 wrote to memory of 5688	3084	chrome.exe	145
PID 3084 wrote to memory of 5420	3084	chrome.exe	146
PID 3084 wrote to memory of 5420	3084	chrome.exe	146
PID 3084 wrote to memory of 1840	3084	chrome.exe	147
PID 4852 wrote to memory of 556	4852	prismlauncher.exe	152
PID 4852 wrote to memory of 4488	4852	prismlauncher.exe	153
PID 4852 wrote to memory of 4020	4852	prismlauncher.exe	156
PID 4020 wrote to memory of 1912	4020	msedge.exe	157
PID 4020 wrote to memory of 1232	4020	msedge.exe	158
PID 4020 wrote to memory of 1240	4020	msedge.exe	159
PID 4020 wrote to memory of 1240	4020	msedge.exe	159
PID 4020 wrote to memory of 1240	4020	msedge.exe	159
PID 4020 wrote to memory of 3968	4020	msedge.exe	160
PID 4020 wrote to memory of 3968	4020	msedge.exe	160
PID 4020 wrote to memory of 4700	4020	msedge.exe	161
PID 4020 wrote to memory of 4700	4020	msedge.exe	161
PID 4020 wrote to memory of 4700	4020	msedge.exe	161
PID 4020 wrote to memory of 3332	4020	msedge.exe	162
PID 4020 wrote to memory of 3332	4020	msedge.exe	162
PID 4020 wrote to memory of 3332	4020	msedge.exe	162
PID 4020 wrote to memory of 4328	4020	msedge.exe	168
PID 4020 wrote to memory of 4328	4020	msedge.exe	168
PID 4020 wrote to memory of 2356	4020	msedge.exe	169
PID 4020 wrote to memory of 2356	4020	msedge.exe	169
PID 4020 wrote to memory of 5888	4020	msedge.exe	171
PID 4020 wrote to memory of 4484	4020	msedge.exe	174
PID 4484 wrote to memory of 6024	4484	msedge.exe	175
PID 4484 wrote to memory of 1168	4484	msedge.exe	176
PID 4484 wrote to memory of 4540	4484	msedge.exe	177
PID 4484 wrote to memory of 2556	4484	msedge.exe	178
PID 4484 wrote to memory of 4540	4484	msedge.exe	177
PID 4484 wrote to memory of 4540	4484	msedge.exe	177
PID 4484 wrote to memory of 2556	4484	msedge.exe	178
PID 4484 wrote to memory of 3152	4484	msedge.exe	182
PID 4852 wrote to memory of 1760	4852	prismlauncher.exe	184
PID 4484 wrote to memory of 4500	4484	msedge.exe	186
PID 4484 wrote to memory of 956	4484	msedge.exe	187
PID 4484 wrote to memory of 5772	4484	msedge.exe	188
PID 4852 wrote to memory of 4628	4852	prismlauncher.exe	194
PID 4484 wrote to memory of 2328	4484	msedge.exe	195
PID 4484 wrote to memory of 2328	4484	msedge.exe	195
PID 4484 wrote to memory of 2328	4484	msedge.exe	195
PID 4484 wrote to memory of 3368	4484	msedge.exe	196

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Downloads.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3336

C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.exe
"C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher_updater.exe
  C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher_updater.exe --check-only --dir C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3 --debug
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.exe
    C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.exe --version
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    PID:3448

C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.exe
"C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.exe"
1⤵
- Downloads MZ/PE file
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\bin\javaw.exe
  C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\bin\javaw.exe -jar C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/jars/JavaCheck.jar
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:556
- C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\bin\javaw.exe
  C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\bin\javaw.exe -Duser.language=en -Dminecraft.api.auth.host=https://nope.invalid -Dminecraft.api.account.host=https://nope.invalid -Dminecraft.api.session.host=https://nope.invalid -Dminecraft.api.services.host=https://nope.invalid -Dorg.lwjgl.opengl.Display.allowSoftware.OpenGL=true -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xms128m -Xmx2048m -Djava.library.path=C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/instances/1.12.2/natives -cp C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/jars/NewLaunch.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/java/jinput/jinput/2.0.5/jinput-2.0.5.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/java/jutils/jutils/1.0.0/jutils-1.0.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/lwjgl/lwjgl/lwjgl/2.9.4-nightly-20150209/lwjgl-2.9.4-nightly-20150209.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/lwjgl/lwjgl/lwjgl_util/2.9.4-nightly-20150209/lwjgl_util-2.9.4-nightly-20150209.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/patchy/1.3.9/patchy-1.3.9.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/oshi-project/oshi-core/1.1/oshi-core-1.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/java/dev/jna/jna/4.4.0/jna-4.4.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/java/dev/jna/platform/3.4.0/platform-3.4.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/sf/jopt-simple/jopt-simple/5.0.3/jopt-simple-5.0.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/codecwav/20101023/codecwav-20101023.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/libraryjavasound/20101123/libraryjavasound-20101123.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/soundsystem/20120107/soundsystem-20120107.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/io/netty/netty-all/4.1.9.Final/netty-all-4.1.9.Final.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/google/guava/guava/21.0/guava-21.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/commons/commons-lang3/3.5/commons-lang3-3.5.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/commons-io/commons-io/2.5/commons-io-2.5.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/commons-codec/commons-codec/1.10/commons-codec-1.10.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/google/code/gson/gson/2.8.0/gson-2.8.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/authlib/1.5.25/authlib-1.5.25.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/realms/1.10.22/realms-1.10.22.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/commons/commons-compress/1.8.1/commons-compress-1.8.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/httpcomponents/httpclient/4.3.3/httpclient-4.3.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/httpcomponents/httpcore/4.3.2/httpcore-4.3.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/it/unimi/dsi/fastutil/7.1.0/fastutil-7.1.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/logging/log4j/log4j-api/2.17.1/log4j-api-2.17.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/logging/log4j/log4j-core/2.17.1/log4j-core-2.17.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/text2speech/1.10.3/text2speech-1.10.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/minecraftforge/forge/1.12.2-14.23.5.2859/forge-1.12.2-14.23.5.2859-universal.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/ow2/asm/asm-debug-all/5.2/asm-debug-all-5.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/minecraft/launchwrapper/1.12/launchwrapper-1.12.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/jline/jline/3.5.1/jline-3.5.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/typesafe/akka/akka-actor_2.11/2.3.3/akka-actor_2.11-2.3.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/typesafe/config/1.2.1/config-1.2.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-actors-migration_2.11/1.1.0/scala-actors-migration_2.11-1.1.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-compiler/2.11.1/scala-compiler-2.11.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/plugins/scala-continuations-library_2.11/1.0.2_mc/scala-continuations-library_2.11-1.0.2_mc.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/plugins/scala-continuations-plugin_2.11.1/1.0.2_mc/scala-continuations-plugin_2.11.1-1.0.2_mc.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-library/2.11.1/scala-library-2.11.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-parser-combinators_2.11/1.0.1/scala-parser-combinators_2.11-1.0.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-reflect/2.11.1/scala-reflect-2.11.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-swing_2.11/1.0.1/scala-swing_2.11-1.0.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-xml_2.11/1.0.2/scala-xml_2.11-1.0.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/lzma/lzma/0.0.1/lzma-0.0.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/java3d/vecmath/1.5.2/vecmath-1.5.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/sf/trove4j/trove4j/3.0.3/trove4j-3.0.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/maven/maven-artifact/3.5.3/maven-artifact-3.5.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/minecraft/1.12.2/minecraft-1.12.2-client.jar org.prismlauncher.EntryPoint
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mclo.gs/L58MKsC
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff97579c188,0x7ff97579c194,0x7ff97579c1a0
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,5450325687978660368,12154790640942171979,524288 --field-trial-handle=2360,i,10296672356891818277,101903617909727216,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,13620936944360330670,16935592555460904756,262144 --field-trial-handle=2360,i,10296672356891818277,101903617909727216,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,16888958379385183677,13737705722683829676,524288 --field-trial-handle=2360,i,10296672356891818277,101903617909727216,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,563787456617486830,15258536402399346725,2097152 --field-trial-handle=2360,i,10296672356891818277,101903617909727216,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,7010589397804296628,14434237035332827728,2097152 --field-trial-handle=2360,i,10296672356891818277,101903617909727216,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,11357272155974423157,16288374444011011623,524288 --field-trial-handle=2360,i,10296672356891818277,101903617909727216,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,3276318139233660521,3225324358870471094,524288 --field-trial-handle=2360,i,10296672356891818277,101903617909727216,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,1750937065787934591,17399003319995004035,524288 --field-trial-handle=2360,i,10296672356891818277,101903617909727216,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,1750937065787934591,17399003319995004035,524288 --field-trial-handle=2360,i,10296672356891818277,101903617909727216,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff97579c188,0x7ff97579c194,0x7ff97579c1a0
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,18198633194218344204,8335289654526361734,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:3
      4⤵
      System Time Discovery
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,10819976698614633382,1844282553987648587,262144 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:2
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,2148121666955914347,1120338886471499478,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:8
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,3067886899662585569,6409235865804690419,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,3067886899662585569,6409235865804690419,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,6265508749457277545,18231615427765443026,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,2693328828621865679,4647216606649541677,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,11462018385899100530,11058409776657181144,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4896,i,771988003898476290,13330340747120967661,2097152 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4900,i,2723532504755649653,4753092902151222767,2097152 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,2332074846977218127,8491894844929714320,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
      4⤵
      PID:1984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,14418604900856481247,6258136470693182307,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,17342530508267074941,14168052891400592888,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,14289822547383650590,3633250023689575828,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,13627679150948167110,1822974988963355697,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,13925301959189196198,7493157358957177930,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6292,i,2769896800393082097,15037481456077002876,262144 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,8968715745974715628,1963162239365862182,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,5414750962918306671,6356768760375837469,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,1550809548516434820,13474461791693237008,524288 --field-trial-handle=2820,i,13544401992334400387,4924096582830725713,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Loads dropped DLL
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:1064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff97579c188,0x7ff97579c194,0x7ff97579c1a0
        5⤵
        
        PID:760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,7101643907340258942,4357486617597089934,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,5764220529891827176,5720613722297438049,262144 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
        5⤵
        
        PID:1812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,6602989987122159342,8643003542816387261,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:8
        5⤵
        
        PID:5808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,6975292510547213090,17887937019826921565,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
        5⤵
        
        PID:3188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,6975292510547213090,17887937019826921565,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
        5⤵
        
        PID:5608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,4268333932865271258,369230581414715150,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
        5⤵
        
        PID:3756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,2851696066815887040,14109453203567785932,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
        5⤵
        
        PID:384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,17996075351328521227,15149870064680963500,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
        5⤵
        
        PID:2704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,4893325762055350366,12915896887403451499,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
        5⤵
        
        PID:3324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,12029662501130235506,15228911859629329041,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
        5⤵
        
        PID:3188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,6006803417604615373,18269764940939552523,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
        5⤵
        
        PID:5252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,9028306106168015167,12729248827733123049,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
        5⤵
        
        PID:5724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4900,i,11245686277123826054,5734272537016884132,262144 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,1270341910057963703,12754261779054912111,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
        5⤵
        
        PID:3268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,16878106117515408181,6195205182483067442,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:8
        5⤵
        
        PID:5068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,780889795281406047,18400211901677192880,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
        5⤵
        
        PID:7120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,771352638499782865,13220985201668099290,524288 --field-trial-handle=2308,i,17820781398725793838,11441101854761187241,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:8
        5⤵
        
        PID:4216
- C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\bin\javaw.exe
  C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\bin\javaw.exe -Duser.language=en -Dminecraft.api.auth.host=https://nope.invalid -Dminecraft.api.account.host=https://nope.invalid -Dminecraft.api.session.host=https://nope.invalid -Dminecraft.api.services.host=https://nope.invalid -Dorg.lwjgl.opengl.Display.allowSoftwareOpenGL=true -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xms128m -Xmx2048m -Djava.library.path=C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/instances/1.12.2/natives -cp C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/jars/NewLaunch.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/java/jinput/jinput/2.0.5/jinput-2.0.5.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/java/jutils/jutils/1.0.0/jutils-1.0.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/lwjgl/lwjgl/lwjgl/2.9.4-nightly-20150209/lwjgl-2.9.4-nightly-20150209.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/lwjgl/lwjgl/lwjgl_util/2.9.4-nightly-20150209/lwjgl_util-2.9.4-nightly-20150209.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/patchy/1.3.9/patchy-1.3.9.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/oshi-project/oshi-core/1.1/oshi-core-1.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/java/dev/jna/jna/4.4.0/jna-4.4.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/java/dev/jna/platform/3.4.0/platform-3.4.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/sf/jopt-simple/jopt-simple/5.0.3/jopt-simple-5.0.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/codecwav/20101023/codecwav-20101023.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/libraryjavasound/20101123/libraryjavasound-20101123.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/soundsystem/20120107/soundsystem-20120107.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/io/netty/netty-all/4.1.9.Final/netty-all-4.1.9.Final.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/google/guava/guava/21.0/guava-21.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/commons/commons-lang3/3.5/commons-lang3-3.5.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/commons-io/commons-io/2.5/commons-io-2.5.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/commons-codec/commons-codec/1.10/commons-codec-1.10.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/google/code/gson/gson/2.8.0/gson-2.8.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/authlib/1.5.25/authlib-1.5.25.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/realms/1.10.22/realms-1.10.22.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/commons/commons-compress/1.8.1/commons-compress-1.8.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/httpcomponents/httpclient/4.3.3/httpclient-4.3.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/httpcomponents/httpcore/4.3.2/httpcore-4.3.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/it/unimi/dsi/fastutil/7.1.0/fastutil-7.1.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/logging/log4j/log4j-api/2.17.1/log4j-api-2.17.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/logging/log4j/log4j-core/2.17.1/log4j-core-2.17.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/text2speech/1.10.3/text2speech-1.10.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/minecraftforge/forge/1.12.2-14.23.5.2859/forge-1.12.2-14.23.5.2859-universal.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/ow2/asm/asm-debug-all/5.2/asm-debug-all-5.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/minecraft/launchwrapper/1.12/launchwrapper-1.12.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/jline/jline/3.5.1/jline-3.5.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/typesafe/akka/akka-actor_2.11/2.3.3/akka-actor_2.11-2.3.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/typesafe/config/1.2.1/config-1.2.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-actors-migration_2.11/1.1.0/scala-actors-migration_2.11-1.1.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-compiler/2.11.1/scala-compiler-2.11.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/plugins/scala-continuations-library_2.11/1.0.2_mc/scala-continuations-library_2.11-1.0.2_mc.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/plugins/scala-continuations-plugin_2.11.1/1.0.2_mc/scala-continuations-plugin_2.11.1-1.0.2_mc.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-library/2.11.1/scala-library-2.11.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-parser-combinators_2.11/1.0.1/scala-parser-combinators_2.11-1.0.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-reflect/2.11.1/scala-reflect-2.11.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-swing_2.11/1.0.1/scala-swing_2.11-1.0.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-xml_2.11/1.0.2/scala-xml_2.11-1.0.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/lzma/lzma/0.0.1/lzma-0.0.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/java3d/vecmath/1.5.2/vecmath-1.5.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/sf/trove4j/trove4j/3.0.3/trove4j-3.0.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/maven/maven-artifact/3.5.3/maven-artifact-3.5.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/minecraft/1.12.2/minecraft-1.12.2-client.jar org.prismlauncher.EntryPoint
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mclo.gs/ZEY74lE
  2⤵
  PID:4628
- C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\bin\javaw.exe
  C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\bin\javaw.exe -Duser.language=en -Dminecraft.api.auth.host=https://nope.invalid -Dminecraft.api.account.host=https://nope.invalid -Dminecraft.api.session.host=https://nope.invalid -Dminecraft.api.services.host=https://nope.invalid -Dorg.lwjgl.opengl.Display.allowSoftwareOpenGL=true -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xms128m -Xmx2048m -Djava.library.path=C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/instances/1.12.2/natives -cp C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/jars/NewLaunch.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/java/jinput/jinput/2.0.5/jinput-2.0.5.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/java/jutils/jutils/1.0.0/jutils-1.0.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/lwjgl/lwjgl/lwjgl/2.9.4-nightly-20150209/lwjgl-2.9.4-nightly-20150209.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/lwjgl/lwjgl/lwjgl_util/2.9.4-nightly-20150209/lwjgl_util-2.9.4-nightly-20150209.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/patchy/1.3.9/patchy-1.3.9.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/oshi-project/oshi-core/1.1/oshi-core-1.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/java/dev/jna/jna/4.4.0/jna-4.4.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/java/dev/jna/platform/3.4.0/platform-3.4.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/sf/jopt-simple/jopt-simple/5.0.3/jopt-simple-5.0.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/codecwav/20101023/codecwav-20101023.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/libraryjavasound/20101123/libraryjavasound-20101123.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/paulscode/soundsystem/20120107/soundsystem-20120107.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/io/netty/netty-all/4.1.9.Final/netty-all-4.1.9.Final.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/google/guava/guava/21.0/guava-21.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/commons/commons-lang3/3.5/commons-lang3-3.5.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/commons-io/commons-io/2.5/commons-io-2.5.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/commons-codec/commons-codec/1.10/commons-codec-1.10.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/google/code/gson/gson/2.8.0/gson-2.8.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/authlib/1.5.25/authlib-1.5.25.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/realms/1.10.22/realms-1.10.22.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/commons/commons-compress/1.8.1/commons-compress-1.8.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/httpcomponents/httpclient/4.3.3/httpclient-4.3.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/httpcomponents/httpcore/4.3.2/httpcore-4.3.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/it/unimi/dsi/fastutil/7.1.0/fastutil-7.1.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/logging/log4j/log4j-api/2.17.1/log4j-api-2.17.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/logging/log4j/log4j-core/2.17.1/log4j-core-2.17.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/text2speech/1.10.3/text2speech-1.10.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/minecraftforge/forge/1.12.2-14.23.5.2859/forge-1.12.2-14.23.5.2859-universal.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/ow2/asm/asm-debug-all/5.2/asm-debug-all-5.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/minecraft/launchwrapper/1.12/launchwrapper-1.12.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/jline/jline/3.5.1/jline-3.5.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/typesafe/akka/akka-actor_2.11/2.3.3/akka-actor_2.11-2.3.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/typesafe/config/1.2.1/config-1.2.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-actors-migration_2.11/1.1.0/scala-actors-migration_2.11-1.1.0.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-compiler/2.11.1/scala-compiler-2.11.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/plugins/scala-continuations-library_2.11/1.0.2_mc/scala-continuations-library_2.11-1.0.2_mc.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/plugins/scala-continuations-plugin_2.11.1/1.0.2_mc/scala-continuations-plugin_2.11.1-1.0.2_mc.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-library/2.11.1/scala-library-2.11.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-parser-combinators_2.11/1.0.1/scala-parser-combinators_2.11-1.0.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-reflect/2.11.1/scala-reflect-2.11.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-swing_2.11/1.0.1/scala-swing_2.11-1.0.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/scala-lang/scala-xml_2.11/1.0.2/scala-xml_2.11-1.0.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/lzma/lzma/0.0.1/lzma-0.0.1.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/java3d/vecmath/1.5.2/vecmath-1.5.2.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/net/sf/trove4j/trove4j/3.0.3/trove4j-3.0.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/org/apache/maven/maven-artifact/3.5.3/maven-artifact-3.5.3.jar;C:/Users/Admin/Desktop/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3/libraries/com/mojang/minecraft/1.12.2/minecraft-1.12.2-client.jar org.prismlauncher.EntryPoint
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff988d6c728,0x7ff988d6c734,0x7ff988d6c740
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,15032587386194316874,12355146914157585724,262144 --field-trial-handle=1960,i,17430627860126202527,5724734715916566924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,6224801717451848864,2249591408726259617,524288 --field-trial-handle=1960,i,17430627860126202527,5724734715916566924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1604 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,388104697075111030,6409415855906454097,524288 --field-trial-handle=1960,i,17430627860126202527,5724734715916566924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,8176015769112825279,5564086471571532694,2097152 --field-trial-handle=1960,i,17430627860126202527,5724734715916566924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3568,i,15928594638157119379,15900653496233867198,2097152 --field-trial-handle=1960,i,17430627860126202527,5724734715916566924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4556,i,11379020855841372350,17744474052791609445,2097152 --field-trial-handle=1960,i,17430627860126202527,5724734715916566924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:2
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4744,i,6868361496652779947,10552343875770044897,2097152 --field-trial-handle=1960,i,17430627860126202527,5724734715916566924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,13694849414826768902,9187856466389796294,524288 --field-trial-handle=1960,i,17430627860126202527,5724734715916566924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,8642657709332103326,2085774503531272825,524288 --field-trial-handle=1960,i,17430627860126202527,5724734715916566924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,3096955869980373302,3278458288274974444,524288 --field-trial-handle=1960,i,17430627860126202527,5724734715916566924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,12675630250050122495,6433243393670712588,524288 --field-trial-handle=1960,i,17430627860126202527,5724734715916566924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4532,i,6207730552674686693,10321924444116781798,2097152 --field-trial-handle=1960,i,17430627860126202527,5724734715916566924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4856,i,16129541179461842635,18312645322307159274,2097152 --field-trial-handle=1960,i,17430627860126202527,5724734715916566924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,18093697804348432980,601719103075390055,524288 --field-trial-handle=1960,i,17430627860126202527,5724734715916566924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:8
  2⤵
  PID:1840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4908

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\mesa3d-26.2.0-release-msvc\" -ad -an -ai#7zMap11359:112:7zEvent30790
1⤵
- Suspicious use of FindShellTrayWindow
PID:4808

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x158
1⤵
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:736

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:5596

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5464

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:5488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1223923112\data.txt
Size 151KB
SHA256 1c271b4577299894f3067f9cc9c1ea1e65b773d00ace564931e0cd8f6e6e584e
MD5 9618e6ae9cc98d7b1fddc19e1be020c1
SHA1 60fb455dd66d62644837051fb1e161416196e7c2
SHA512 18c119ccceee04b8e3636a4678037504f3098e9eefb79eddb69df67bb612fe836db6b19ca243c2399b92204595ac7548eaa2236d5c89ceaabbf561b21b5faece
SSDEEP 3072:8vPAgDcCHaLHl65aynyosxb3+BLvHtAu/3r0YJqN9HDwUB/g:2X1aI5aZoKzMGAr3JqNpUmI
TLSH
T1FAE3F1108DC45BECDBE82D1890BE0B0DA7E08A4E852AD989DB67BD0FAFD7B0457135C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1223923112\manifest.json
Size 53B
SHA256 920ebcad2d6434116e19e96be9f39cded421dcfbeaf67c20608f1ee2bb8387e8
MD5 f33d006d7963db8ed6ed284375c10db4
SHA1 bfa356b70526e3e7936e7ee409951753a475cfd8
SHA512 795af91cb503b6bab9a76037fd84d71ffc0c563ed4f5443522ec3f0ada6007bcfe11800eb4d2d6d2d3140200a5a3c779c2ecf8167194d562f55c05076656fa9e
TLSH
T19E9002600414921716C10E506570B8C1A391661955891D1D04451568029586CE051298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1659465709\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1064_1795151458\manifest.json
Size 118B
SHA256 3b016193250b039b35ac491c466e94318296bcc7ad261e5eed2c0d308502c446
MD5 23ce7a7219aa81fea6884bbc24769a96
SHA1 fbedafd7297f6837456ee70ee1a40268ea1b0597
SHA512 39a2006d9882e5dfcad025d8a3b0a47bf14ba66f0e87d5e9e9540474bdf161f1360ef699434ed6ef45d683b17dcb21af5dcfb3e6b4cc4c7a187d5feb30b3377b
TLSH
T13DB092B00C2AA03B22C19320ECA0668283F80229E8021B1E088036481F8827881362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1064_547587513\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1064_794648861\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1184595914\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1297368289\manifest.json
Size 165B
SHA256 880b2b81f96f7ec0799e2939e82955327f65a8e4edadfdd89cfebb70d8fb6f2e
MD5 3ef32f0bc4059ed77b8df1ddc1bd32d6
SHA1 180f08a503c8145e50e715a1dbe202b491de0011
SHA512 036d08f722ca62b9f5a21d79d9d6d0585f7255ff736ce717f72aff31ef0e194adb3481da6c690be7306818947efcdf1e6745d0d14de0c32bd088a5f93415805b
TLSH
T1EEC080029400197419CE47150D5CF388A722D7152D80B0165BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4484_2063147412\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4484_649676261\manifest.json
Size 177B
SHA256 45365e90d3acff2e5fb10c9b757b61c676642330dc7017716633d829d8ef60d3
MD5 f3a44d4655f9ad316e79d5f3590176d7
SHA1 952b40e69ca34b8f0d80505ead13aad242be77de
SHA512 08427567f31b668032d2508d0b95034fb045cccf5a24686ace2233cc55f85989a6a2c388c1c15d08f77f0e2f2d97e718e464236f2b4ac96c04f0bd026ca16c2a
TLSH
T1D5C012DFDC509DB115EB4322156D53C4E733CF0B1547450935FB66482E25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

181232523600D8388BCE10B57D6A3331

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\181232523600D8388BCE10B57D6A3331
Size 176KB
SHA256 066dcafe5afe07e43a1b2839bf6774e723898dee58fb97e0a1b1bd7c080b30a7
MD5 a33f3a3d6656a24a3dc0480a45fb643a
SHA1 11c77af08c87273bbe8e8a5c0233b18f1093b880
SHA512 4444fe1960e1178586dc42295f800975ec5d7165777a5d73e283146d2ff74f8025091255b66cac0e55fc577c0dd99e2b58e814c5bb00ae418a818a3306c6050e
SSDEEP 3072:hLIFhCDwkjEDifO03GsNRp7aicFmsvxdmSA+6n4xW4ZAJ:ShC8EEDifO03Gyr7aicFtmSAbJ
TLSH
T174040A645C7BBEA1BD4BCE52CC9EC67616F79DD92813632A8E346E505C03A9FCE13480
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

181232523600D8388BCE10B57D6A3331

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\181232523600D8388BCE10B57D6A3331
Size 246B
SHA256 010522ad68285a41cf3f8a712163fd5802a80a7713f876692fd13c034824b810
MD5 010ed76c2d08091c65e8da4a144ec436
SHA1 a2011086362e98fb9f77bacd52d65f965de67461
SHA512 0fdfa55526a3c2fb8eb7228a30401cbcb347da4ce5ab2a75da561d091ae3c94eae42125a3321a997c8633e4d9270d7b0b31217228e13cccaf312d82c57fa60c1
TLSH
T147D022283332111AF03A03B301548E51AE16F42BBAC30F182BA2032C8C2CF4108B3D0C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 fe314eb754d1fd08a4b3afd136ba908c33fd8bd8871bc427f166adefc3694a84
MD5 1551940b8b2db2ec51a3fd0e539972b8
SHA1 98f2bb04dd5f50b4f48730b682f7b3bdb415ba2f
SHA512 e65cb8fa80d99bd3291682996771658c2a5843416af92dfa6b06e0ae02103b5cd7e741e850234b9180ecea639c25e237f44c102c97d671ce1a703a94a65838be
TLSH
T183C08C1D16610606F6A893F812C229838A208110F3819F1126B12A18CE29F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0cc06eef0d26d324531ddc061889ec3bcc393b929732cbcc19e677b416ba2fcc
MD5 05c13a80c8456ce1e7ff141c7c3d7f60
SHA1 18c25d239f84421728438755e19e331e60e60141
SHA512 5a2909d64975310e605f3a1e8abb21c8160763137db499f6c219864a48441295db83a7a25714da14510f307d32c0d3e154ac5500b7df73a9395ba7657657f2d8
TLSH
T1DDE02BEDC965DC370CFD171D60500745F65513573A50544F7E3D89198FB463A824685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 72f315bb9424d412af1a4c7c628ad72974ceb714677faadbe45dc89d40e1c58f
MD5 3f32e60d895a1e26d6f7d4f70789787d
SHA1 804210556ff044409fe4c909b4e4d63785f84e45
SHA512 6df711ef54ba757542ea617d1ec9f4b4ac176265091945708865e26c9ba026731217a8e42e9c1809f41c7b444289b8862b7a5fb107cad82f52c0890650c0e796
TLSH
T1F2613CFD24A10115FB9805BE63CC1D5FB136E2154B977F222CE0E1F90A263712832E93
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 22fafcfeec54f0ebafdb7d701b951b54ea11956d8edde432165847786938a977
MD5 39f60027034977177c015c294677ca6a
SHA1 9c2a35056fe1b547ac7925481600ffed5563401a
SHA512 a8160a2447a19cf3d9603443d3480ba193319fc9f4e87db3ddf1745e2cacf2166376aa3a48ee282b65ee8efffb1f9aa32755813e053d69361de694a7e329ae6d
SSDEEP 3:MsEllllkEthXllkl2zE/lkT:/M/xT02zVT
TLSH
T1754402446B80140AC6401130405183A01778D4110B225743246184625D856400C60000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 43713e00a64e479c64cf40ee2a01199ef4735a82a971c7093dd2461d676e85b6
MD5 b2ba90994b5a579b77581ec8a262d183
SHA1 d1419d628ccf078fd4efdbe2577b3640f411e39d
SHA512 5768db430361aa8b850715fe433243768157b8723363f93c77e9029b267af52d01b4101571ec20d44aea2027ecb41869ff627e195357b8a88c601e4178fc99db
SSDEEP 96:DDBqmumIaaso5gPQHmxm/mRmmm4lmD0mgmOZ:DDBqmumIaaso5gPQHmxm/mRmmm6mD0mA
TLSH
T15D91BCF787E5966D8A0196F0EB14AE1FCE2C0924531C3C66C8E4BE4B93E2972D25174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 5b1d709a41de1691dd3edd37e28ff14b61f5de55017c99c525621cd6b8a94618
MD5 9183016111d6f3a5821709c192bed11a
SHA1 bae49803a138f6b2d0dc6ba5dc5c4e247fd35389
SHA512 af0e2390ab0d3e05a3cd957feaae20ae37afc6116f22eafd8af9de284d89627c280ebc3366978f4f5b7b9bb96540128595aa7938246d3a269eebe52f31c3bb1b
TLSH
T148317B93D1BAB82B10AA48B71E44BC051FB9AC3A15425CF4DB66C36CB1C10F74BA3457
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 498acdbcd4103325a7800824f07c1760389c08c9179ca8310ad75ccbccb381b0
MD5 3b8fd96c52a065a1960561d9d7f0f226
SHA1 12bec5b70e02e35839f8247b00b5551f81a38f93
SHA512 4b8827cc57e6cc54ba8e16f22f400ae5159a9a6fcc01210618b2c7decd929ff57087bf92c897ce91cb52c2217f07b1a553bd2a255e35bd962c2e989aa02ed979
SSDEEP 192:iRBhInVWeYv71hhAPRp2g92Hsb+WNnnztLT2mwkwUauKVyIsnAUgtaJ:iRBhTeEBh8XDQwztH2n0aF8
TLSH
T1C242C46EE920797BACD7D22AFD223753D7F9112125E41E84EAFC892C14E75CC622701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ea99b1fdc1b7608d422d919cc4dd1136efeb436a1d50482d8ec345b31ea08e11
MD5 4919d07309d9094a2b732a58029fcfc1
SHA1 1290920321ba189320b1c30cbe156aa7996879ab
SHA512 9bcdd90b00eda2dae0b55e4caea432bc35207ba8a2e8230ac4281b810137b50f9b8a30c0fc6ab3ed0d32e645ae41d16b84ba81bfac57eca82df756d02eb1b0e8
SSDEEP 192:iRBhInVqYv71hpAPRp2g92Hsb+WNnFF09T2mwkwUauKVyIsnAUgtaJ:iRBhZEBhUXDQwP0J2n0aF8
TLSH
T1C842C56EE920787BACD7D62AFD213753D7F8112125E41E84EAFC892C14E75CC622701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 06f957fd482b46f2df2999bf930450e96a8d1d01c60b348125bb9ecc4290143d
MD5 26b5f5fe2ae87d49ee172ac541b68127
SHA1 3193e27a59381f3a0c847c30a14da63b465857e3
SHA512 7d661f4f8ac72e763be2e4f61c512c7bbe6f88b3e0f9dfa45ac4fe712a04af14665892f098a64ad63ff0311c259f26625e028c02e20d72116fc6f7a142f2c15d
SSDEEP 192:iRBhInVWUkxv71hhAPRp2g92Hsb+WNnnztrT2mwkwUauOVyIsnAUgraJ:iRBhTUkhBh8XDQwztn2n0aJe
TLSH
T17E42D66EE920797BACD7D22AFD123B53D7F4112125E41E84EAFC892C14E75CC622701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 786c348d6c9fea3129a64db3b5c729049be45bf42cc113b9eff1c6aa3a781e99
MD5 f8811a6ae00c405ac0b65a5a74bc5956
SHA1 e77185e5b08fc81941987fde58ae8f8674cd7f5e
SHA512 b4593dc0286c801e9c1211560526efbc546ff73041bc39fb9d3c55f98de2d27ba382cda728b3487eafd86ec67e34f7c935418db725b7655c541c92904e98f446
SSDEEP 192:iRBhInVWUkkv71hhAPRp2Xev92Hsb+WNnnzYwW2gT2mwkwUauOVyIsnAUgraJ:iRBhTUkABh8XrQwzO2u2n0aJe
TLSH
T18B52F5AEE920797BACD7D22AFD123753D7F4102125E41E84EAFC892C14E75CD622701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2bc9bb7bdba8ce1165cb1c866e521c226b9ad230d86ddc4568919db4ffb77921
MD5 663bd87350733c5ae479e6a2b56bbd53
SHA1 5d9852ce5caaed61c4e5d2cbc6503683bc3196b9
SHA512 8edfbbf2c9852ef7ded3cfad8d57e41e2b6b22d2632a308c202d1899d3554de86b144b9a53cdf9e9c492c9b349eae05d252f9a3d8d66fbdf0d7b37dcbb10232e
SSDEEP 192:iRBxInVWUkkv71hhAPRp2Xev92Hsb+WNnnzYwW2gT2mwkwUauOVyIsnAUgraJ:iRBxTUkABh8XrQwzO2u2n0aJe
TLSH
T11E52F5AEE920797BACD7D22AFD123753D7F4102125E41E84EAFD892C14E75CD622701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4486826ca405eba2b8c35583013197d77afcdf78c7c2fbf82a8d9177d242d073
MD5 0aee8ed16bcde3081a9689f188d61d32
SHA1 dc665916b29da5c800a2c1f2311ee2a9c44b7c9d
SHA512 84f1066efbc7775404de365bbc67159a04fb0523a700138ff9c0c3f978306a07beaf5d71b126fbc44adb89f16559fd8e75edddb480ccae9f48099e130374a33b
TLSH
T145B0120080055241C04602F015431C8C71147F28970B370183F0ED62DC391618115091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf208.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5cf208.TMP
Size 96B
SHA256 f0a0617152aab70ec01ce1a6dfb7063a141d7fe8383a89b4a91088ef25122a53
MD5 632b1549d9de55b4244e04a3320fd36f
SHA1 63cd93b7305efc030df5da75b1115521714b5194
SHA512 58de09aaed7d16b2e7acbb73a960ccf2f553e085119e8f6d842b31b22cee59beebfc6f20f4ea0195052d9d3d38c9acb351e70b324848240bace3a1b28ca04cde
TLSH
T193B02202C023A322C00203F220A2CACC3020CF20C303830283F08BEAEC32BB20030020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 59abe909d3f14c209c7ffff9abda9221e775f168e95d64615400708849661f07
MD5 c51a644f9339deed5bb8ae4054bd5dc8
SHA1 a2eeb625330f7bf2e0a1e692a9bc7b9e9e617a0a
SHA512 3a811baea0c281bebbb460f2ccd55835ce2a6007662f935f137f31da3dc38b4efa427effbd5a3e69b46e2128eceb599bace09f645c2b73655412d3ba73916eaf
SSDEEP 3072:FGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Mm7Rkm1tYpBeh2BAo3
TLSH
T1D2C312275E71E9375D79AB4EB08E0B1F1EF14AA6CD30DE92C8D85A0437EA7CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 7ca69a0fc8c5d48e252e5d2885209ec68c12b62f0e72358a7ec2f4b88c343aae
MD5 d1073331501a1b58da61c577e5584f33
SHA1 a7070480d29e336ac457918ffeb350645e4dc018
SHA512 db3263859b65fe3035a3e7590347615677d25e11435f771e0ec2f10bd64683621f40418c1e0133f2fcde67ea404aff68bbe20502a2c669c0862d9ed8c9995d6f
SSDEEP 6144:kQ5tTbRIn7e2f7vwO6Zm7Rkm1tYpBeh2BAob:k+38eiCw9oBGcAob
TLSH
T1C334225B6DA0E93B19BB9F6EB44F0F2F5EF35A81D910CBD188D06B058599BC0484AE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 53a4ae682821ab333514867f33bafbcd2774d8774b3a494605a3da9349a229ba
MD5 de4223b82c5ddc6d69ca38927ef4c299
SHA1 8dd175178930104a5bd8f1ad1003ed00dd4461d8
SHA512 d2cb52304c305f22a79aa7a2dcdb878eeaa2f272912c7b1c67ed39e88f780507458269c5904e490036f256a58be198456a04b4771da7b5d8d0fa83023c92396f
SSDEEP 6144:lQ5tTbRIn7e2f7vwO6Zm7Rkm1tYpBeh2BAob:l+38eiCw9oBGcAob
TLSH
T12334225B6DA0E93B19BB8F6EB44F0F2F5EF35AC1D910CBD188D06B058599BC0484AE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 313KB
SHA256 fbb4480fdca55f2272424acc6ea83ba6982554f6bd0238321a3ec41ebfc20a1a
MD5 3f9e7bd7b7c216539b7af6733e1b92c4
SHA1 26e75aad61dbdc6fb3279f33956e3f42e7c25379
SHA512 19486e9e93d7ee08735fc61f8fdd85727022f84e9f00a266ee3f5c711755e4521b4c1c4d81d89e387b727f68a440229484266a383daf6fb399e0fd0e756b753e
SSDEEP 6144:C1uC7MJF5jXBYNQ5tTbRIn7e2f7vwO6Zm7Rkm1tYpBeh2BAob:DF5rBa+38eiCw9oBGcAob
TLSH
T16264232B1DA0AC3F19FB9F2DB40F2B2F5EE396C2D550C995D8802A46D55BF81484EE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dd7796929e25b7481ac9bfb39d0ff633f397d26802b1bbce3ed377f96986e8ba
MD5 bdb8bdbd572dfe712d2385875aaaa438
SHA1 0816733137bca4f5625a5c3a81998c6d4da2849b
SHA512 1c865cc89d10b2713358f4d3229e03e8ba233a4258df3b01ab531111e475c7f8541e1c407894555474cac356b9ae57aed4083c61e4d1af12dd955b9fc8d33046
TLSH
T176D0A7E8599DF5E0F03A1D3A61244600B29C1AD26D53A30AE16805099D6E05222D55DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 51b89eea9f115a56d1fc7761dbc5429c3ab4a1dcd69096791d5b5178b3ab10ff
MD5 12adac44798c0b644146a39778dbc5fa
SHA1 8396529ab10f81ca04c17d80adb12d84e9dd0588
SHA512 c0825055915f5ba6e410a7ca2555b692f410a52a93008be94bdc4c400e55ba991df41fb489237e5eab4081b0995e0eb9971a068cae82852fafd3faa71abb9baf
TLSH
T140D0A7E8B78DB560F1670C3575184615B2AD5B816C23E319F46921495C4E42223D8189
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a70b96d65cf3a98d1d8f1616cb441e370c46acc90f68d4b903afcc8858a52fba
MD5 cfa769cbfaab4f0ca8e3e39dea932494
SHA1 2332c655b624c0db7b0e9e06c80fed8faecd493b
SHA512 3c1f4ec0736b1e7537c48feea272edff2047d9318f5bb9f80b9d98b1ffd96e04eec07e6ad86d500fc3b0c2634c70dc839a7dde795da5bd138571a209d3328285
TLSH
T161D0A7E4B789B660F1670C3575184615B2AD57816C23E319F46921496C4D43223D8189
MD5 SHA1 SHA512 TLSH

Submit Download

529b42f5-e5e1-4de6-b595-155bab8f2dc4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\529b42f5-e5e1-4de6-b595-155bab8f2dc4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 8fe6c0d3f49d6cbec7d51518d9fed39a8150712a7f99ab2b5256c327707cd42a
MD5 fa536775edda38a668b86266c8bea176
SHA1 e133a670f019ed5bd96c0f66cf718c4d6b8df173
SHA512 b7969f18045416dd13871e91ca70a226cb50ad5402f0458db124ae6053e43a511f237de70ab9d4aabd57c4ab15b04ac325a23e44226579dd7d05eb2d5b5ef7d6
TLSH
T1EEE026C447C8CA7EF288A5C743F4770C9A843B4B92CC7E0A1740848C3086648AFAB6E0
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6e13d9a76210bb07c65e513430e7be41629df8638ecb0fd07f6ceeba825022f8
MD5 3f3c9a5fadd39f5f0a22a2f5e5252b3f
SHA1 29c8a29136c01bfc6ce56265c55a9b27e608de9e
SHA512 87cc86b38fdb8952afedb70eb8903c8836728df2d8314b9d0ef3249c940b3bb387644ea8fc35d51efa1408517d5d16bae144ca961d5d086e1615af4812c39542
TLSH
T123E022AACD26FC270CFE0719A40D8A46F70013273A80994F3B3D820D8FB462A85C685C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 8ee243c0c4dd2924bac84a3e2da3cca808f872cd7add1c5d721219f26d56f93b
MD5 b20907a8a4ee1c7dbb0ac8680a456daf
SHA1 df0a459b56d0490ae39f9f596d8ba4445875afd2
SHA512 3d523b306d01a033139afa1abfb3fbf5a791933e385d70bbd2cde9e79003096653f7dbab1ea8d6084921e7efa3f630dfe40a27dbd1a8b8be9176635a52dab694
TLSH
T1F871D73E8D0F02AFE71961B068D20649373ED9C8FE936F860192F5742E09BD5F0D5654
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3997238c14f6dc8a952892d9473aac453cfe0f9e8b0683b826fa582178508d0d
MD5 06ed467ffb964931e30ad822b0b46137
SHA1 66df6da060d95d7a624fef7931495b273120d2af
SHA512 b833f8be199203177d823ba3bc6062fe6f1cd38158b22c5cfc9f903cde81c36bc91845f0a62698d566d5ff684ab2fa124bb3cba8d3bf1ff3a1c02d8b26b947f2
TLSH
T19961E83E8D0F02AFE71960B169D10645333ED9C4FE836F820182F5742E09BD1F0D6644
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f655a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5f655a.TMP
Size 3KB
SHA256 e694b19e12a5049a13db326d49630d257f940025ee98f886afbb8dd2f41418b3
MD5 82e1836eae7b45e3018eb432d0642dbd
SHA1 73ce6fd6acd33b867edd48b80d839b2b5ca07aec
SHA512 39dfec9be65e723aefb1e9194f7eef2319c6fb56b57992e0e734005ee7a88bc9e1f229d7e25fed01d1ce09f109224f62102394eb8933afa7a35909dfa26fab24
TLSH
T1B461C63E8D0F02AFE31961B169D11648373EDAC4FD936F860192F5342E09BD5F0E6654
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 394c42c8c967a211dc4a1a27065058e0dba3d659bf6f32e743aa730db33618bf
MD5 b9aab6bfaf322fde00007693f35aecb4
SHA1 40dc22cd9e6c848cdc71c1ce916bfb439fe10016
SHA512 c32dc65e1098376ee0756b4be780da81f5fd3460630cf40ef137f2bb103254f3b81fa08310b441b89cb47b184793c67e38fd615cdb79bc53b579f4cfc3e70fe2
TLSH
T1AA41C2F783F4856ECA1196F0AA18BF1FDE1D0511432C7D5A85E4AE27D3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 109f06ee955d351e0585ec3bdf8c5c58b8121108a02ae2a980b6204e95e01cbf
MD5 dd81cbdfa6389d6709aae707a1f6d179
SHA1 768cdb5c80992a8c081ca16e6db5a21293af00e0
SHA512 81103b0515370540ccbda02f2f5ec661a20f7e3f3f064047659f512cd5f946859f01bca75f71bc35c54b5570a559234a0a4ca142a3c04d77d4d94bc1751919d0
TLSH
T12041C2F783F4856ECA1196F0AA18BF1FDE1D0511432C7D5A85E4AE27D3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 69e0648763ab48840325cd2df2b603de9ca32878dec5d243925ec07007e78dfd
MD5 e5dea657bd257f29c567064a3b229153
SHA1 bc58ee1ce111155689c1f12da5f580f6770fc79c
SHA512 4407844740d098da7459ae264d576704718530697657d1195ffee009a90d8a46be10fab41840f11f9c82b8a072e50739abb45c032fd5bf9fe3c818346cf80ef4
TLSH
T19231B1F783B4856E8A1196F0EA18BE2FCE6D0511432C7D9A85E4AE27D3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 353B
SHA256 7acac1f034fee7f2d0d411c852a4993d3d089f7f70cafaead1d84408bad07ded
MD5 c83e91794291ecfd23d29d63d834d1cc
SHA1 874a87e0569d16715623b2837c6338dd83e15dd7
SHA512 7736bdfe5c9b03711bba16e7a0a07885dac8dc2f54b79e2ace8aa230cc52177ec67e21877609e3c0d68230ed196d988d81c88ee917ce09d1aad81fe5a7f2ba5d
TLSH
T1BFE0D87680BEF4321128597B5E44BC80AA7AFC3600529CF8CA96972C71C08B36A17029
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 21acefad6a6cd4048350c3de5bb36298f2d856740c0e58ba518b4b93a5e5c963
MD5 1f41a3a3b7ab88d005fe6839ee6c2885
SHA1 7780a9d7951b7ed4c7821b4ceb703cfbfaa47a08
SHA512 68a96b467a5c85fbf32ff30f4747b6d71034688c3aba37a19a4a6f4b71f135b9410202e0018e48ad281c484ecd1658e124bc98ebdfe82f3080d8af0270154bbe
SSDEEP 384:sxZTOcB/f/sFWvr1uazIKYN0HbI4/CXn7:s79B/f+YrYaz/HbIqCr
TLSH
T11D72FA06AA24997B8DD7D219FA457F53D7F9153396905E449AFC8E0C01E7BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 36b6f4b083726575d1fc50ad8ce14ae27e206861572c1997bce1c675554a6f73
MD5 bbc13ef4f3314e18e0ff5611897cf578
SHA1 527090cc541155e3603084db804115235ef97f69
SHA512 efd8b81037e0f8ed7839b10eb84a37da427e210c8f857d200480a22263605aff8f0668fbab77dd1a95bc69487309699dedc1d5f84580f0fa08d781be5069abce
SSDEEP 384:sxZT/cB/f/sgWvO1YzIKYWaHbdxfBM8ib:s7UB/fzYO+z4HbrGt
TLSH
T14E72F84AA924997B8DD7D209FA457F53D7F90573A6904E4499FC8E1C01E7BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 bec78443cd0ed1038ac7555ba5ead826be110a87ad563a3246ca8f18a8f0051e
MD5 0c1939aa8df80a00762060641fba4677
SHA1 7781ecae770d817f4d80a4f5354068fdd781fc4d
SHA512 d4b2114da0c0b31726cce68ad7350ad8517963c9b0240eb74013cce0853cf2fbcc85eda29afe02871018fa495660e0c3614885f71843be09104d37a6a0d5505a
SSDEEP 384:sxZT/SB/f/sgWvO1YzIKYnaHbgxfUJwib:s7KB/fzYO+zLHb0wR
TLSH
T1F172E70AA924997B8DD7D209FA45BF53D7F9053396905E449AFC8E1C01E7BEC620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4dbffc08f4f29be15b042f4a00b9641bf4fb6df62ce6e15899c50dd5e3d77a5c
MD5 325898fe770062d26e11b943b6407b25
SHA1 8b6a51073afcaa04f64d5de0af9e40667ac49e2b
SHA512 104af2c5949ac35f2aac076c4ce612712ccb8746f78f149dfb9ea78fdd8f43fc747c10a6b46a5922ef77eb5d385a2fc98c7e9534b43a4f1ffbb8e7dabf796f8c
SSDEEP 192:sxZTRtyMqZjK1Ml8MjB/f/ssQ1uaZdIaRuv2zodp+XHW6+WNT074/Yv4u+0gaIgH:sxZTO7B/f/ssQ1uazIKYN0HbE4/CZj7
TLSH
T15D62F906AA24997B8DD7D209FA457F53D7F91573A2905E449AFCCA0C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 263a5ddd44befd8c0e218c6588e107bba07f5632228c907460ff52391b7981df
MD5 d5ef2cc9fbb30e21d9e12ee10495badd
SHA1 60d725bbfefbd1626b2ffe4a1c44775c1d2b9687
SHA512 8f89a9660401f71fcb917fd9f8a7273a1622489e4115df3a2c1806457ddf700b301f2d95fb118329b4799de7cd91af4ad0dbcb4531123981c17a69900f385900
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpysy10LlJ:eY8Od/HEnFhWvFvmXu1ja5t10Lm2NuXi
TLSH
T135F2FA3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 72facb32303f077ae957b601bb264d97ec1d62a4a1be5089c42d0fc7a100fb19
MD5 5b3993ac101e03137384f41ae96a1f98
SHA1 0fa8f8cca885a565e0d55586b2017183e810ff37
SHA512 86de782e5db5e139c250330351dfb2cf3283aabbc9b1ee923ad62d4018b73057d169de4bfeacdbdc424aa97b60af45eb9b1fd1f25cd22fd91d7fc630c7cc26c2
SSDEEP 384:0LppY93PBZJPtN531A5sAe+OrWXwQ4nqSnwYfqAFdu/DFXHqrQnLRkqVI9FYrD2:0LppY93PBZJPtN53Jpi2
TLSH
T1ACB2695A703E0212397E2988B39596364F4235A33058E4AF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 32fd82e4176e60739b9a68519b3eac54e00666438afa825c82a34493ecaf7efc
MD5 c40bf997fef4104253230ee0ee00c5a8
SHA1 a5c5c6e25f476839784b500075742ee47dcfd01e
SHA512 3aa9b10cf21f98a10cc0a091cf5918066233d4e96569d3ea686abb7c11aa3777baaf3eead05ae84ae0ba4f7403648d731f0ddf166cd023e463e41fd80893a027
SSDEEP 384:nqiFPZcIosNq8TUNTUlI4zQckCruF6pvBftGp+Mgj4Q4L6esa+VY+gL/7IzSoN:hFHo3wgGkbUjGPVQ7ehgmy
TLSH
T1DAE2B2F198D78976E8EE4B87A77D2E529ABCC163B4884984F7D41D0CCC821BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 152c72db031dc9cc97070e40e48d92a89efa67f499831e164d22131eba6a011a
MD5 dca5adcf0f01d2188fe71f923a826751
SHA1 630e2f3358b0cc2a88a5c595d2c32140d3a32229
SHA512 13633b3e34040aa7e8744abc5708b14ba84eef365f63fd904157d0e1616914d2933196ef2cb5dca2df8f2cb24e42d11de9eb50edf6b52e2a7e3e88c6b8a0603a
SSDEEP 384:nwiFJZcIesNiv8TUNTUlI4zQckCruF6pvbf86/p+Mgj4T0DtAWvCsG4Jva+VY+ge:LFBeTvwgGk/UN/PVTqKWvCsG4JSgmy
TLSH
T190F2A1F198D389B7D8AE4B87673D6D029ABCC123B5885598F7D82D1CDC8A1BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cf8e678137dc7516f5ee1d289662dec62d3fd03453804c586c0d63a615087cd8
MD5 0d66fbf4834f9d738bd5402255b247c4
SHA1 7f14582fb3509dc1a1c551434384b06ac4dfd859
SHA512 d9d913c0b01bd645107d4c02e4052dc7b2b4200ce888c5fbf53e1ff93f24a96513cb47e8a97cb893f6af8aa800fc655ec88c43b99d9ef0721daa4d0d0c63ff4d
SSDEEP 384:nTiF4ZcIaVNq8TUNTUlI44QckCrEcu6pvBftGp+Mgj4Q4LdNesa+VY+gL/7IzSoN:+FGauwgDktUjGPVQCehgmy
TLSH
T138C23A72D864CA7BECEB4B85B74A7653EEF0016389CC9AD4D5D85E4C008769D070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 837d6710e4334f1204275c98995d3dff4ea5084ac6900178f9c872ecf5615048
MD5 df42177e008fe67b763a6fb4b2df2fbf
SHA1 cdfd900aaa8fc531212154e60cd36d19bb34cab0
SHA512 eed3cf1370f3759720c7579c75920c3efec0f6fe1c29a4ba8f2b17874fc96a88f3ad6923a7e6d67cf1e581ade1272df557b216e74962ed71361641cb5fce67bb
SSDEEP 384:npCiF9CcmyWCs3sNb8TUNTUlIm2QckCr9DUbpvBftGp+Mgj4Q4LKWe4KV8p0PHTw:pJFccps3awgbkUg1jGPVQpWI8p0PU
TLSH
T164C26C32E864CE7BECE74B89B74A3A43EEE0117385D89AE4DAD81D4C00971DD570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4758f92c585fa796e36e390a3db852168bb2c2a001d7f29d43464fa1e8e48792
MD5 5087cc3074e1c4a6dabe97707a1b7f8e
SHA1 c33a20008aed6b870b7c3583023d3f5facba94d8
SHA512 427faafa93cb85f4342f87de37e5e50a4770a39dfa0a25d760d00df692fb7a79a078a3624a940100793686d012c13d260ca563c1b19d52f7cfa98dd49f32b8ed
SSDEEP 384:npZiFiZcIG3sN/8TUNTUlI44QckCrfG6pvBftGp+Mgj4Q4LdFWsa+VY+ty/7IgSA:pwFQG3KwgDkLUjGPVQqWhg1A
TLSH
T169C24A72D864CABBECEB4B85B74A7A53EEF0116389DC9AD4D5D85E4C00932DD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 a8195b88501628122b75727458aa49d948714c800686457244feeb84774c572c
MD5 5726ad31b08d05426ac71cef1fbe1624
SHA1 17e1eeeefb13785a88152ad0ca420661560cb77e
SHA512 61745a69b82fc8c802c3ea7b4e17186abc49833a90926b41ff995e3fc53b7819340e8f8b75643db0394fde0a551232c5986e3a86e3e405d52e396792c68e9c91
SSDEEP 384:npZiF4ZcIasN/8TUNTUlI44QckCrEf6pvBftGp+Mgj4Q4LdFM8ASC/olCK4GHyir:pwFGaKwgDkTUjGPVQqaSflCK4GH1hg1A
TLSH
T1DFE21772D8949DFB98E68EC9A746F613AEF01133859C859CE6F87D2D309B5F80306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0202b30622e2e30c9014f2e783b73c8fe78e62e54d5539d50b5bc7090f571c62
MD5 9a340436f4a8330a4393be39141bde63
SHA1 25bc94de45acf4bfdbe0a4f1b73ef9940f943d47
SHA512 02d131f83c87b6ddf78bf4a118d6476e896873d77a96690faae996a55bc5e4f19080ad72e311bce126423f2abcac54ca0e37b0f142cef84dcc1ee7145955df30
SSDEEP 384:nqiFJZcIesNiY8TUNTUlI4zQckCru96pvbf86/p+Mgj4Q4LcrqASoS/o1gFlKRsW:hFBeTYwgGkLUN/PVQtxSS1AKRshLhgmy
TLSH
T196038FF198D389B6D89E8BC7577DAD1269BCC123B4884948B3E42D2DEC8A1BFC706415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 33f2c3a3d8bfd5d6078417d6ce043cdf2424600b5d93efc33b8894447058febc
MD5 989c5607c3a2329c818afe204cf12ba8
SHA1 ed77c4ddd2a297705f6fa71cc4e2e6d6b1dd32e6
SHA512 4d3059ca6f39513e1efc844d3218d306715f24ad356f5c37bdaf3088a74d92b70c14251e69609457d6e60ccf3fab3d3433624b376b881c8c5eb949bb29f82ded
SSDEEP 384:nppiF9CcmyWCs3sNb8TUNTUlIm2QckCr9lGKpvBftGp+Mgj4K7phe4KV8p0PHTt+:pAFccps3iwgbkUYkjGPVKTI8p0PU
TLSH
T1FFB25C36EC68CABBEDE74F89B74A7A03DEE0126785D859E4DADC1D0D00931DC570B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Advertising
Size 19KB
SHA256 231be4e0be45f588b161634c816b9a5a49f530c0dcb55461d37715a94482dca1
MD5 897eefe311c18078a34e06f3cf624a6a
SHA1 98246e769fb513b8aead588024d1ceadc65422d9
SHA512 0fad93ec06d6cadb4c2e72b3355b509d5b9995706d6b7e9e69df21d9907dd3d4156eaba62a6c64ed34a6747046ffff841cc79020aff0a29690258ab487bbd6cd
SSDEEP 384:/j+Vafk2xyJEYoAYiQZU8rYvepdFhQXVVRwjSTV2quzxmVUiKF4EysZ4y5:zfEHoAYiQHriepdFWlVmjSTV2qwFOs1
TLSH
T16A926151887035622F2F50CDE0583F8E1199667540AEE6DE9FE48666F28C0F37894EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Analytics
Size 3KB
SHA256 bba2063d20d70f4ab06dc2ae04c2564cc2b8c631b6dab68248957dbdf107fdd2
MD5 b55f84fa839160086b8b337b59f80ded
SHA1 0fde6cb65ef56264517aab0eb5ea93667f5985c2
SHA512 6750626e0efca608abafe63926229887a68c9f3e657cb78921daf9c6b3ce11d6bfe1ba83fac775a8d1b6b69cbc00dc193fcb818c70ded3ea159b6241fd2823ce
TLSH
T1CF815415A4A014433E2E5668E03C76B912E8253880E9FBD9EFB19965F30C0D778E597E
MD5 SHA1 SHA512 TLSH

Submit Download

CompatExceptions

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
TLSH
T1E101E6F18EBD58313C74967C876C0E8FB9A5636F2898F2E96502CC87E3C054761A6C78
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Content
Size 4KB
SHA256 9a63f38e22b8573cbd47a4ef7b67ccb0934b87239e075c5cfafc7a1014e340c6
MD5 0e3ce75aaf5e674dcd7508251bb839c5
SHA1 35d4a84a8d946263e6b1d06fadc31c5753a946f0
SHA512 80d49bfdbcce2ac21c5c39c6c538135a9768b5fadd73137f6b5916fe6740827fda06c154508c0f9810723c397a22f3d93542f3e972ed3b736f7478ea2e6dc0a9
SSDEEP 48:lAHJBLfUUIAPMsb2zIEcySe00woiyKIdw5uZWhDNB+jS+3NrSA6CdM+3+1oH:lApdOAP7bercySB/1ylw5usB+WB8x+yH
TLSH
T13991B7037E4409276E95D105C0ED209E2C71ABB0C85DEDC99B964B7FBBC8C8BA4961FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Cryptomining
Size 552B
SHA256 bdee796bf07922c152d770cd5928955f1b12c12515c4db6fc0ab8d2ad0c44c4e
MD5 39461c6ea4ff09d663a65d133eb47c98
SHA1 c41f5b5ac9a202ec7dd12122e64b858379a9a815
SHA512 a8e195fb9bfa68dbb064a0f8a41cd86aef5fca43349388294d364b5fd556f0a01674bffcbb5eb2a36e3fea9c64bf575b5e7ed674661dcb7544ed7a961686d4f8
TLSH
T14AF0C0E5C82197766FD544A1E05E7389F4844BB26094F3D50B56321996E8A432684DEC
MD5 SHA1 SHA512 TLSH

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Entities
Size 68KB
SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
MD5 478a605d5578236f2d1ddc93c2f22456
SHA1 917f05453d497b3e3de684a905e141972c34a267
SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
TLSH
T152630877BC500D3384FB804BB09D2D6C21249FE5D8ABFED89BB1516612839C4B5D86FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Fingerprinting
Size 1KB
SHA256 05b29240a28bb75b4535d558edc510eb92df0ac27e9502498b99cdbc576b8298
MD5 f665b35df3c2a7b4efd9dc396f2af9bf
SHA1 2833c37d7d92a4cd1e413eba0d6717e90e69f973
SHA512 e7930341af55bae220962d79ce9aa056bbd1c9fe3cfaf0fd4181d9aa4257b5679648e4aa19561c2f9b5c8fcc6e6757d3616726eb28e77a2b899fa25f7d1b6706
TLSH
T1DF211F8295D038716E6E1488D55C3F9C129A2B7001E6F5DCCEF486A1B61489F7180C67
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\LICENSE
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
TLSH
T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Social
Size 754B
SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
MD5 1d06d58fe9131c14ba5ba5ff740b020f
SHA1 e6ed812e23e201b20170e928686a5d612165df85
SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
TLSH
T14E0126DB1A1450027FAAC495E4458B6948B00630445DFDE582B8D27BA08EC97F39F7B9
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

TransparentAdvertisers

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\TransparentAdvertisers
Size 105B
SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
MD5 57d5a3548911886de2f3bd3172e808ed
SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
TLSH
T1FEB00170D480008ADF4062C1D032DD98E08D5377A138C4CAAAF80C66F2433CAD1A38F9
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Advertising
Size 21KB
SHA256 5c62ee354070033dba1bad40dcde115a81db45943b2274fae7059a5aa5c61d33
MD5 452f3e9d40539cd65cafbd008308b5b8
SHA1 34203b4a803009ff56bb28d3a14305348082990f
SHA512 08504c06b603db3cb12f0ed6e30e733c2a2c830cad1124771c64b0e7b8480113383440325c56116fb57bde458b393ce182a3af75f0cef146ad6a8872ab9a964b
SSDEEP 384:oQh4q3kwr8CPLo3AptN7NoTn5LTDq3ZXmRHAez/GRQMKWxV1R:wqRr82LKAptNJoTNT2JXm1AezO2MKWx5
TLSH
T16CA2B361996025513E6F009DF1993FCD5AA8233080E9FAE9CFA0C676B35D4D335948FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Analytics
Size 3KB
SHA256 d303be86132f8d7131941d41736694c2e29647ebaeccb38c0976fe66616ec8af
MD5 c4c782264f4a6a6ba84801c8c148afdd
SHA1 f138b8f526133c5dd612f79825f4706569fd18b2
SHA512 e1d3b123a7eabfe72d4df981e1015ca616c51fe7d94de91223e9c7f4eb98ed7d3ebcf7b5c7e08579db502c7b3529e095d314dc71b8cf5e79081c678e73aa646e
TLSH
T1F261C814312434212E1A126ED55E3E8E6AF8223904FCF7E14FF18A71B2194DB38E873B
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Content
Size 5KB
SHA256 70c295600066e9d3feeacd6bfc735bbcac6243694e4259477822d3db252729e1
MD5 7c5f5e42e885211f783a06b1317ba145
SHA1 079ab890b012120b89f776e4bfe67f3789f67096
SHA512 ec581f41917ee010d71a021cf16648fa757327198113dc3daff3adb33ee739da3f40d87a6f3e49004106770ea705e6b800fe263d21eccd33d7883fd1ed8c82eb
SSDEEP 96:02KCCvwLR/tE1LYSeyTPXD7fOiCrC400uvuJEjchVEy8Upy4uILrqNaRq3:02KCMwtWLYSe8miZHvui68kRBg3
TLSH
T169C183B2495079522F3E01C6F9E6265488E483715CBEEBC787E0C62CDD0E9E335A835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Entities
Size 128KB
SHA256 a5409d2c6a8cbd9339a95a5e09fcaedd4546a49d47fc4ebeda2d8749cfc66987
MD5 87b4b75312dedc7106ac746153153c1a
SHA1 54fd4b67eb16620ce0dafe8eb641f6a256dfc4f0
SHA512 f594a5039c73db236f97dd50c3eb007f2fa2ff44d558222cf983dcd703d89f9b1e832bd3c249a20bfa592656e9c2e61a41f90df1b927fdd8f490d36734f92d30
SSDEEP 1536:e9nKLDxqghS81HcmcgqPvD2E/FwoqtK1Gmbpq6CXkkqGqnuP7Sr:GnANN1Pt3/oqtKAWvCJqGqnuPK
TLSH
T1A8D30938FE60C8185CEB041B91296DDC5B801BDA5AA6FDC9EF7F78190242DDD33285B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Fingerprinting
Size 2KB
SHA256 5306139881e81eebffd97de016130fdbb04e3ae976d94ad7a74e5dee63fbafcd
MD5 427724f72baa3d5c91671853a89245e5
SHA1 a33deaa88143c298e0732ecb233663c372cb0e2b
SHA512 bd0027e9bd25fa3426dfe85f67bac14bc3124bbbd6493c1d1aafc33343dcb008a8a418134deda235b71377ff970fcdc45ce4e6b1eae79fd3adf1bc3ba2e2103e
TLSH
T19441552354202051BEBD498CF59A3F4D29E5623984DDF6D5DFE08936721A8E734908A7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\LICENSE
Size 66B
SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
MD5 5b7baf861a48c045d997992424b5877b
SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
TLSH
T1A8A0025216021A6312E295EA5E589B4FA50A1AD5255C0341164904D898B01D995E87AE
MD5 SHA1 SHA512 TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Social
Size 3KB
SHA256 28ac79097cf67587a228fdfe4746a1a9b31dae94d5a63bb3fcaa82443d69e7af
MD5 af4c6f2598c45087a32c4f410f242553
SHA1 cad2a50e20ee6f699e21e78c58991a6a25a55ec0
SHA512 7d378b90e3cb7feac3580bc7858b6d8a4967c77196be5b7d94ef076a7e1e8166156e62954998fa6931593db5c8a8dcaacdfe3421bd39e6517f6c6094caf4f4a1
TLSH
T17B61DC32C550A9932E5D0C81EDC55E704DD8067ECCA6F4E287B082F8F0AD8977D90BAB
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Staging
Size 1KB
SHA256 f90f4cb0976a046e93978971b58fba24bc93b0129e8612fdd0e5646a1bebed22
MD5 5d7f5a0c242d9d1290c8ad0bd57be3e7
SHA1 d454811443284aeaa0294d30caf65e624182b150
SHA512 5d36ffb2ec4d162c49e5dd1207bee8b51f36d91ab38d23ff85d4467ced3a7e0f4f639b230623804260d8b03e49ef124e6ae9714f63c896c024215bfbd13dbc88
TLSH
T1A621E2194E908CB11E596745D20A535ABDEA617D38E7F4CB8EA8DE7FC2CE85702344A0
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.10.1\typosquatting_list.pb
Size 1.4MB
SHA256 f33ef5edf4edd45b7c9ae5dbba08241f9562cadd7c7a853933bdc299a6aa6126
MD5 e86844d7eb1a24201da0867d8eb4c2c3
SHA1 d069e2cb8be53a3be4035e6c8e17b0360147ab61
SHA512 e3a97b831fd361c40d4246e3a137207e609663b061d47514bdbaf37203050a7cb88003deaa310dad5f054a126a1c6f07ca87acd59b829d70d985e824e6e7b1eb
SSDEEP 12288:Vc9yACkEwVhEw98UQfIy0nXYXHulq2YcCcfMHNS6/Onz7uC:oj2w98d/0nXYXHulqXcCTSB
TLSH
T14665B5B9DFC00194DAB8112D20BE71D8081412A540F9EFEAFE7C459F2BC69C977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5fe7b48be0c1c47c24e098ad776f22eec388358c5ddc0f9e4e50c9028fe51b89
MD5 236676c37a81b42e4c6dfe769fceb39e
SHA1 ef9ecd47d9044413601ab6e6d278742fd53c6524
SHA512 f490027f796b33bc73936d861f4274d2470174ab4e179a04f37e6031f52b8a6253021b9d87a9435eafa2f3f8532ad913e47ce137e312df489b9c80d2a1125254
TLSH
T1FA3121E01C390AE6C5BC0E7FB49339FC94D8D726B5A470382894E958472950E705183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 015926c2cbb98c1daf5cc299f98e7cf2ed6ae98ffb102d83b1eac5ab5e9389d6
MD5 5b89c93f2cd6cae33d5aa554f9a8d6c6
SHA1 4db6df81765c5b5e197bf9794fca41613f7cdbda
SHA512 6a21fa906ecc2beda017ef73596420f5fb6a51ae38f2f0e62ab12d6d99c5aed8378fb96ffbce6b78a14c0debcf6058abc0c328bc79e36fa211da63a033876de9
TLSH
T1FC3141D158381AD2C4BC0AAE749738FC85E8C32AB1A8707C5898E9A40B3D54D744183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9b10f006551aae623305367d81cafb9d45ca37d611b83e0f0ca66ac1f1e9998a
MD5 490409ac656673f884bcfe3b2894cfc9
SHA1 b61cec6a47c64b34b42db6e9a5857677a40ff7ac
SHA512 75c04697561a88bba5c021f7a177f0e4213cf6d79933122a58ffa04e640f3e4efedb695d0196ab8e0eb68512fab932213a7bb59b8703da242476907d2b1918c3
TLSH
T163312FE01C395AE6C5BC0DAFB49736FC94E8E726B5A434382894ED688A3D50E714183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2978c6d89fafbe5a7f8db27a740001132f3065e135e2fd0a69b61ee1d332c5cb
MD5 b131d88d78e279de58931dc984b1b33b
SHA1 9fb3cda8503fe45fb86b8cffb3cfa9688c4fe643
SHA512 b3eb5ba0652c34c580c18c4834f2dbd425917ff2a68d836ddf3abeabebde1acd4cfaaabfb7371782e1a3907c003f72972b8b282bfdbca669903d685444d3391d
TLSH
T1BD4110E10C395AE6D4BD0E7EB49735FC94ECD725F5A4347C3858DE584A2A51E204183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 22abb303f86d6d8b10bb6ef94279cd4caa966c672a524c929652aa7f8b53358d
MD5 0a9736f6e83d6f45373bc0678e846691
SHA1 d743372941607c73a061815ec718cb6fda5220b2
SHA512 8ecb7b6324552126932dc6efee7d139e1d43b56225fb1c0198d0675cda69a5ee39385339211c9ab69dc3db27a2b2d41d9e12d5bccf0d45b267e909ecf9d44b5f
TLSH
T1D5413ED14C380AD6C5BD0EAFB49739FC84E8E726B4A430382898E9A8462950E749183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 01351d2a1cb55664466577fa251185c147a98b0a1e0ce199da27d3bd29660f9e
MD5 2c96271ed45bf4fe6636be559206293b
SHA1 0db6997a07d562677ec7a555e93118765baa4daf
SHA512 6a08df2d536ad4b75a5cadb39b19f879868b9805b92eba32bb6c935a9642a42c53def5f40a900a34a79ff8847546f05fa5522bbf8c6b6000261ba1bc6acc7dfb
TLSH
T1353121D148380AD6C4BD0EBEB49739FC85E8E736B4A470386888E9A8476D50D749183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 99114efe3a6f75461f17c0a7965a61b0f74a3ac9ccfe12b5a2ce941e35d61714
MD5 566f5f95f7ec03da3c2efaf76ef2f4c2
SHA1 f1d90812e9b323019a12dc4fda51233b310e162c
SHA512 74d4a7dafde0e03c5525acfb96dfdd0573e8c8ba95b3c1e0c37085d3c32a93ae75a49b7ad2baeed030214f6d39fd51311f74c626568d3028aef0933c353b11b5
TLSH
T1E3411EE11C395AE5D4BD0E6EB89735FC94E89326F4A4343C3898DD588A2990E214183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 92e6483eb03b25ac034d1f3e471b04b9590fa5752a8077565b0a46e977c36e92
MD5 a12601806573cfae6a7905439ec3a98a
SHA1 2b65a2e633cdc3c9b19e8514ca3c6f6fea5e5b70
SHA512 0ecbce88c7b8dd4581119dd33c425e643893d322d8ad0d7396d7073a7c99988471b93a83eb63b45102678be54460e6d62b3b4c17a97810fe556d391f5e602847
TLSH
T1E13121E10C395AD5C4BD0DBEB49335FC94ECD326B4A434383894DD5C8A3A50E214183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 57b7f1854c3e6bac06bcdabf8d681d17d4239c0f098065e36b00fcbdd98dda98
MD5 9c2e02702af9907b5404a5230f537028
SHA1 1d8378c8073b05afb7a4eff54920707bcc2ef44d
SHA512 57106d7c33dcda2277597eb33b0eec55528e6c1bd594554431bcc9490097aee1ad18c4b6adc8626fee80c3480f22d8568df0210dd9de2e2ee1613e28edc79ca9
TLSH
T12A3121D158380AD2C4BD0EAF749739FC84E8D73AB1E430786888E9A40B7E54D709183F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 17703f76375f47d7acb908893d1aa1d62d62b43e5dc1cb72c86facf3939f6693
MD5 931027668ffb6cb481a91c5e54020203
SHA1 974ff069b5bdcef58337d02a2b4528388a887d20
SHA512 31a75db2e69ed985eb5f72a30446b11b9f757641c422bf41ee70221649cb2ae128503d76b910815f9dc74b9403336f7f596b23be0d0834cd3a0d9e4382747095
TLSH
T11D412A5CA6E95108B3B76E6A9BF7746E187BBD771F0AD0AD00110E4F0A63A40CCA1733
MD5 SHA1 SHA512 TLSH

Submit Download

jna8449796840725252645.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna8449796840725252645.dll
Size 240KB
SHA256 19e394e5d7a64f1e5063043f6f8d23243db22ff87d67e9e930bd13f8b12bf275
MD5 68bf293ed84fec43a17dbc830b6001c1
SHA1 e2841508e29f91c168c0a620c57cec387f681a6c
SHA512 31679b608c01138c97dd0cb6692a00359e398623097650b72a8f4f2701955232657431df41dc3b1f5681de0c30ae6357d1d8343c6124532f2a067210bd1c9fb8
SSDEEP 6144:mGWyWK+wrp1cJakX7dHmLm6rj6vPhxnZKF13nMH32fHy0AXN3:mGW5PwNNrCPhNynMX
TLSH
T14C343907E7B248E5E8B7C13949236A12F57278154320EBEB87858B534F67BE09B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accounts.json

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\accounts.json
Size 685B
SHA256 ccdcbfbfc0c40670c7370fa8f56e21e9ccfeb5919374d99d7204113993b916b5
MD5 62b08d760d70ecc948fd5f3843def084
SHA1 cbc1cc1582e8c5b7671975be307efc890e0a7eae
SHA512 64b2466b37163bb862623378438744db829cf80262da159565b44bb52ceb816ec7281980aa4afb06d7aca3a2358ad8daf6a4ddf8cacee7ca3a3dfe401a01b990
TLSH
T1B401221DC1B50CA70181672028BD0286A46041470E2A3D187EACA9DC6FAD93F0AFE7AF
MD5 SHA1 SHA512 TLSH

Submit Download

accounts.json

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\accounts.json
Size 837B
SHA256 bbf6e9a1a8b31c48e1852ff4c20f309595ba4eba3ef1bc624c5d28e73f8822ba
MD5 8f9036df8a6c3554d496b1dcb3176baa
SHA1 7ae20ccd53602f31bd0b5ddc03006a6c6c246f06
SHA512 b05cf04b1c451aed0b52a5d2b919cf19d119f20da499fa80fd013fa9913b3c9018639e5a320ba8726a4d76fd8f0d1118085280ed17fec128f578f4ce9ae5001e
TLSH
T1C001521CC2BA1CB70085722028BD0182A43041830E2A3D2C3E6C958C6FBCA2F09BA3DA
MD5 SHA1 SHA512 TLSH

Submit Download

1.12.json

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\assets\indexes\1.12.json
Size 139KB
SHA256 7a87ae9278d129fc60285547332b8c17c1ae7f72b9c8017cb0a6898df743eb2f
MD5 837546708c50e9fa4614edb5a44d4d5f
SHA1 a21e1ded1a24ea1548dd8db0cf30b6acb02655a9
SHA512 51ff2c0e72afe85a5231647d551932bd342a73ed59c5788c03fe759587e39d605eca7ce915567cf541d6ae9ecad23389eded1cbe5d752d0f31d3d2d0a71648bd
SSDEEP 3072:sUXmSmjb6rY2u9JT6NjDd/cFMmyFxagK64wokSvJ9FcL4mBhy7thegE2SAGqVvNq:sUXmSmjb6rY2u9JT6NjDd/cFMmyFxagJ
TLSH
T1DCE3BD96D9DF37A7F809DC61B57F09039324C21B9708CB8CA66E734365999DF2022BB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7596478e3ec703ee1879706d25b92ad0fccdf8b

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\cache\ModrinthPacks\logos\f7596478e3ec703ee1879706d25b92ad0fccdf8b
Size 16KB
SHA256 13232c4850db3285b4224c9c8b6e4b5cd176de7a857444129d0725bfab3353d7
MD5 6338ce30cefeb3e75dac504aa00235bc
SHA1 0296f222b748ed2982cc268d18af22b571d8a4a9
SHA512 fdceca29c218f5aec5cf9d5eb6938761b62c840d1d2f3e967b611d07f8dc42bf3b53d4ae1b561d1eab60e213f84c553195e4c407b9ca70fb65f3790bf46753d4
SSDEEP 384:FDvcFBiQBEp1EfzIH708NVmNhH5wzJx9e5ovatWSGu4SXNIy:BcjiQCKEHY8Nc185yb/4GIy
TLSH
T10472E13E51D948C7E472BD6C7970C0F8A539A87526AA0BD83E21F64A39D0B08D9DD181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 51B
SHA256 ea73fb793bcc1107859afc199952a3c90527bd1968410793a0567f514e10a90f
MD5 dcc3bad556fed4baabf1b7904c455b52
SHA1 635adddda4ab45e17163b33ff57201f271a8e1a6
SHA512 1e33f79edfc1774c45f9fc30556a9ec963bad3455dfc8c505c520b490584a5e5173856f590ba9afbe69582d3b2dd4c868458d27886719f89d5a7f015bc13137a
TLSH
T17690020B5311207A04990745C1425C414F7202409128002821696D87A748D4665DB529
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 1KB
SHA256 a7b8c9593acaa8cd44e61a671508dfd0e99342115840da222b639a2844a919dc
MD5 a17f3f3a7c8da95294a54e9bf722860b
SHA1 f74c04e22072293b3fbd079bcbf75f2d63773411
SHA512 0dfbaa0997cffb53aa34f322673aaceb57f0b2e8cc9af2945035ee8bc841095cd5af019413d78e80f5198b3b1924f8820a0aedbb2489f46cd8bc7443859a40a9
TLSH
T15A21D0730223FC574D382E10FA081C580D68B8A7BFACF284EE8961F5A4EB101CF660B0
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 1KB
SHA256 d97523be3197980660658659a52bbe5ee9fa42f56f9b068ece01a41d0a1d27a3
MD5 9e516a8604bf6bdcf5a17914a37ec7bc
SHA1 f97bd2d4bd2a05a66a506465c08a71da83e737de
SHA512 1e67e2f9bcd8edb089ca045ff299b97e13dc52ca54127b1e26676a2f77ac0372d5ee392e9b87dc975576a6bc7354263e5fcfe182c74b1ca5ac1f7c39e5f6349b
TLSH
T18F31B2730516FC7B0D382D00EE0658261E5A7CABBEADBAC1FF9A21E174DA5058F950B4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 3KB
SHA256 a9e70e06c53d885d3644c5cbb1da8b0f76d3feda1bc8d12ef441562b2e66029d
MD5 8c4252bd54cb043af6aa6a42eba33ead
SHA1 958fc4372c2358bfcf7a4597db5816bc1142d815
SHA512 61ef004aac7b4a98c05be92ec72abda878ef4c46c26eded6bd7da9c72cdec0e8a27df31e2692506eb293316ab4927ff84b04d39435657c66b9c7285d22fcdb07
TLSH
T1D66121730A66FC7B5C382E05EF06643B0E0A7D67799EB5C0FF2824D8B0D69194B950E4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 505B
SHA256 5e71308f2a8840a05d3bd9b1f4d49e96dc750b17452a89c633aa55dc1597376e
MD5 31f209ab102f2f1ab28760a743d27022
SHA1 f07e94ed09a3221c80884dbba7143fbc6c353ab9
SHA512 cde7cf51ae1b95936094e8fd3cef9a9e26cc859612a062c03632843cf56b79c21e31c3e34b1703602644895b898bcc3319c10b23493971e22e281fad4407ed44
TLSH
T169F05E374101FC570D380910FD051C401DA97C77AD2CF384E9CE99CAE6D9001CC9A4B4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 1KB
SHA256 240ec071de6c96f218664199a62033478d83ec1678fd0dab424499beab1fa8ee
MD5 cff1ee8c704a64167bb95a1856fa3030
SHA1 bbfe902bf3410c8d996fc6f14d4dd65271f498ee
SHA512 e23ee29a35331e335dee447d91e6433d77d50c14f36390213f358c33ecacc54ea1cfe7f931e7baaefa0128b7ee418002a19d2344ece21e6823f8577448951cc1
TLSH
T19041F3730516FC7B0C392D00EE0668261E197CABBEADBAC1FF9A10E174DA4058F950B4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 2KB
SHA256 e89ff13a9c134e6227aef834aa390bcf707e5cea349116eba05dad9564cf6a4e
MD5 c9c19c6a8bd1dfa5096762c0859e67b6
SHA1 e29c48bdcbb5d354423e5f5d9747617124b85ee9
SHA512 2b61eebf738d4cfd475838f57f907ca5aac54988f0460e1f19121aa722a5643e440d93b20d2be734454d58037d6437d56b5f3d944d9648cbf8d41bf3509b6e57
TLSH
T1E8416E730516FCBB5C352E00EE06A8270E197CABBEADB5C0FF5810E070D65059F990B5
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 3KB
SHA256 9814ec37d3ab7e11ac3eec267f034c749d759f1d7407e327c6939fa8ed99de3c
MD5 065981faa273c32ba5a4ec29080703c7
SHA1 41b953593c16692a47c6eeec2fe01c6af57e8294
SHA512 45bf3a5e29b736e5fdaa690b20fe33cbe4c1c9f177a21f439183e31ae903c37f2b86ab32aefbbd57c0c44760c6efedf0901a6bf5a4184e5ff7ccaa36c05e96fb
TLSH
T1476100734A26F87B5C382E05EF06643B0E0A7C67799EB5C4FF6820D9B0C69194B950A4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 3KB
SHA256 da00b02b64ec00d6d28837c2a13a3390e8037ab3a2bf9a2c3e9a6dda48528a28
MD5 eec1e61dd6af6d557fa5ea28e323cf3c
SHA1 93e91d56ddf68f091045ac728ac40b48ff776860
SHA512 2231a7f1b363e68508e12afe8b56a7240b532b3d01c901fa2224ca8fbad4e6392dabd97d9023806cc79dcbfe4a9568fbb3439390074baabdd68f4dc00b55ca78
TLSH
T17A6100735B26F87F1C382E05EF06643B0E197C677A9EB5C0FF6820C870D6A194B950A4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 2KB
SHA256 383bb81ce0405a49555854102c274b0829aedbedb2dbfec519a84e1de57e7cca
MD5 0babe775f6ebaa301027b49cd9db1e32
SHA1 7b3ac8b60b256ceb4f01a6ac13ffc18f2d201231
SHA512 2f1deada70c6d1caaa426d265923b3d3f90628506bea534d4edc4db733a14d569625ec33383ccec16821df6ab62d643d325eea9f5efd3b6a097d883e63512dc0
TLSH
T19D51BB730216FC7B1C382E05FE06582A0E197DAB7EEDB5C5FE5910D4B0DA9198B950F4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 2KB
SHA256 a1d5faa9e127a46101a466aeb3d8670ef510b5cb85e708d60fe1eb9db8e86e12
MD5 2cb200be7a34cc5f238d3ffd8dfc55f3
SHA1 b3f32c996b26ca38553169d3b80208926fed42fb
SHA512 ac5327789486158ab8000df51550012b0408ee77a4bda2b563f0a1df2b49cb35f29cce7310124112b6378353ace3d36199ab184ec2d0c0fbb048645e826c37e4
TLSH
T18A51BA730226FC7B1C382E05FE06582A0E193DAB7EADB5C5FE5910D4B0DB9198BA50B4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 3KB
SHA256 efe283f82674dd298f9a790b0a90533962b70436eda20e1e4881dd484a161f30
MD5 d0a7e6eb3faf23775d575fcd03a19fc5
SHA1 ef03d5a211a780b66803d09c98f21d153f5709b6
SHA512 72a3e81a4cdbd83a0deada3bed1333ae6d692f7d73f351bf506d515c423b4b6949722e8ae6fcff4915a147f109485fb1a1232a30db8f251e97713dac3c919ad2
TLSH
T17F6110730B66F87B5C382E05EF06643B0E0A7C67799EB5C4FF2824D8B0D69194B950A4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 2KB
SHA256 aca4d22d685373d1903d96fb964ec8436fa3701df1b002638eb7d73004b2bf87
MD5 35c9163e6942e762dafb7fa1b8c90505
SHA1 359bf37ceed9a0dc48e5ce72642f2b5b28832b2d
SHA512 4601694bb22bada2def9a95aae6cac732f61227ea1edf3f701b09946695157803b1783fd6cdf57e193a9b83a0b1bca17cd8c484f0868feb2940a9dfa7992c19b
TLSH
T15951CA730226FC7B1C382E05FE06582A0E193DAB7EEDB5C4FE5910D4B0CA9198BA40F4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 2KB
SHA256 0202af85edd948b938f33063d6d501d29a42288bdf7d991038148b9baccabc0c
MD5 c2eb669504daadfb56999739b06c9f21
SHA1 0d6c670573d267ab6307310cde2294625b981194
SHA512 0be3cdab1733fface72028b5bda17584b337db50042265f46e10c4fa274836e9c37ba5f1fdbfa968b66533765f57c8034803fcde1273b3c487c85e83ef03527b
TLSH
T16251DA730216FC7B1C382E05EE06582A0E197DAB7EEDB5C4FE6810D4B0DA9198B950F4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 3KB
SHA256 d83ee91f2293efb1048defd2c4c14ad59a3b9662308864d578fcc3107bb8c10f
MD5 6246c197a368409ed51505382dd2d8f3
SHA1 b50faf378e8acb6a1d1d6e9836c0c168fecc76b3
SHA512 4ceb2e981d006f4d25601d24391ba080e7a53854d322dfe34b5717f61e991aa596accbdb11a23db03326e614bb6fbee6e31d2b0d2370998c345cf7dbf17a66e4
TLSH
T1606100735B26F87F1C382E05EF06643B0E197C677A9EB5C0FF6820D870D6A194B950A4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 2KB
SHA256 ba399ec97d795c0072cde0ea55c242dc26b4aaff3c741336c1bc5df2cf454535
MD5 9c53914ea55e3915c543a27be35685e0
SHA1 d6e28ebfa29b5ff7084385ac04e90670f6975cfc
SHA512 585639da7a24ee7e0291ff19f1eed4bd7cc7eeb604843479910a3b5a0de7a161e72cde658358391b64969c74a06669ee5264ce68034d84b240fb785853ca9ba2
TLSH
T1BF51DF730626FC7B1C382E05EE06582A0E197DAB7DEDB5C4FF6810D4B0D79198B950E4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 2KB
SHA256 47cc4793117740004184eaf248dcccdd57b7d988b11d4c9766a95c40d8286d3a
MD5 65cc32ef437058af87ec54e18ac4bf2e
SHA1 fb2fd15dc37ca70c3f5666a62f0aba9af67ba093
SHA512 bf78b77d026489cd7c838862a02972f15bcccfa32a2ea73c3a58fe9872de403cb5266a581bcd633b1de468458c8bfa643fd124c004e0edf48103c7cd13ac7f87
TLSH
T1E651DE731626FC7B1C382E05EF06542A0E197CABBDEDB5C4FF6810D470DA9194B951E4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 2KB
SHA256 5d19173c9c1f5e2890a14ffba98fb152d5766a67df85fcbfae17e750a85087dd
MD5 e48e268b1803442eae2ffee23c2f185b
SHA1 63c3fe03bb8f31b14ae43cb89c8c96e2e9e12d03
SHA512 0d0fcab14e83e1d9d375258aebb82f9d00a6e9214aa6f5979e2daea7b64c1a1efa43888e6af36caaa26f2d4b1bc587a9b425c394f48bdc41ce47fb939880f47b
TLSH
T19A51D0730626FC7B1C382E05FE06542A0E197DABBDEDB5C4FF5810D4B0D69194B950E4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 2KB
SHA256 eb65f127c27c1c98b086292657d5f574b9703ec8599b7da4efcd4bf0f659782a
MD5 b9375d5bfb026483acdc2aaebf679901
SHA1 9da5d10739c933cf0ec3f7f333d8ac77e6441bf3
SHA512 80a44be2662eb04596838b394b101694a370d635f7e172219f1d9d8373da17670f589b5d714bd89626316db97ecab7b9b4815fad71cf1e7b10ce2b12ac36849d
TLSH
T1F151DD730626FC7B1C382E05EE06542A0E197CAB7EEDB5C4FF6810D4B0DB9198B950E4
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 2KB
SHA256 9f885e80413fdbeb9453173b2a2826788c4100a1c7fa3d3f56801e67ac8dbce9
MD5 869acb7bb701942c65448af04cadd22e
SHA1 01f67e2ce84922c869024221e6f7c2c38582b0b5
SHA512 dd8299be6f7f967a12ea168108cc25abbc9d03c6314eda33a53da4d72045fe9bf298cef38f8020b3a46739b729b72421f9314a75e69668fda83ab7e5ca04cf1a
TLSH
T1AB51DE730626FC7B1C382E05EF06582A0E197CAB79ADB5C0FF6810D4B0D69194B951E5
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\instance.cfg
Size 3KB
SHA256 fcec71b4af3467c2488723b714b0a5ceb7235d033a76be6eb719039de6f95255
MD5 0f4ed53fe0755c8d50fac864fb650610
SHA1 7bb0289630f9d5353328834e6265718b9e74d20d
SHA512 34557b18140e84fab62c0b8df7499a3b4154f03b10f6f246ae03c5f2bb108716ed0d62be362e82f90fb686ff7250c6d467af38a0f84ce65aa3a0897aec0e291d
TLSH
T1DE6100735B26FC7B1C382E05EF06543B0E1A7C677A9EB5C0FF6820D8B0D69194B950A4
MD5 SHA1 SHA512 TLSH

Submit Download

options.txt

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\minecraft\options.txt
Size 2KB
SHA256 e099df96d86e17c45585dec66144b5097f5ae8e9e68697e843140048fd28a57d
MD5 9431ef9174f37c6e665d26e36bc57f51
SHA1 45c058b7b94e70ce1742bc7ffec54f5277ee8a2f
SHA512 c88683ce446710bb54b90402eb18c3720b55df31255666ad8b00a26febb8229832076d1258a9acd3b6524bfc3608a7922a3076cbef8a3c44c3baadbebfd33394
TLSH
T18E41AB653338F9F8C1CA291AC8C036071AE50479BCDA7C7CB12D6EEC258B95D9A24CD2
MD5 SHA1 SHA512 TLSH

Submit Download

options.txt

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\minecraft\options.txt
Size 2KB
SHA256 019818b0de1c1542b9b54789b71a841d0cc03f566d68cdb51d45611e586a9faf
MD5 c1485a99a078e349b190af68ae73d753
SHA1 c0fc2c5e211e6d64fe358c9953c405eb9e1b2a50
SHA512 9337a22cd8d8062cbaa1467f3179d095b8ac435c1d02fc2a250f1e70d90bef0518fec6a94f38d5290dbef71df43f274f6bfa6113c955045215e724181ef9f7bf
TLSH
T13C41AB653338F9F9C1CA291AC8C036071AE50479BCDA7C7CB12D6EEC268B95D9B14CD2
MD5 SHA1 SHA512 TLSH

Submit Download

c37754ff-2986-3405-b428-2f09810bcf10.json

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\minecraft\saves\hawkor2\advancements\c37754ff-2986-3405-b428-2f09810bcf10.json
Size 138B
SHA256 36e07948919be2c300902e3f31b731dc6dd0fb95df833dd20cdf283ebdbad837
MD5 e9edf6c75f678bd6fb234b4f4b21a6af
SHA1 f6cbfda770b233e1fe40ac3d14883de40b362d61
SHA512 34b32b88efba8514ed3abe11a425e6cee93df59a1037d32f64051e3e36c3e120bfff9f9ed4343d9ad1d9d345e63f7645fbb60daa42cc0be8e1ca422f2e526229
TLSH
T1F6C02B10D4631C47308B346B0D24C748AB2052D385360D38F10D0A1C9FC026948026D0
MD5 SHA1 SHA512 TLSH

Submit Download

capabilities.dat

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\minecraft\saves\hawkor2\data\capabilities.dat
Size 32B
SHA256 ece263c2d4292a78b928539ff4d5b1a4d6b7a043babda3fbdb74e1f669274972
MD5 b5e0a7dcd273ef1951218102ded6009a
SHA1 3d437e223787289480ca679f48fa7ac4099aa7f0
SHA512 2e164fb05b5f4d41f2fdb8f3f521f71221ceda83dc4eb23d66eda1758991034c548aaa010d68f07a1773ce3a672df1f20d3326def5fde70a4d1c67a8cffa29e3
MD5 SHA1 SHA512

Submit Download

forcedchunks.dat

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\minecraft\saves\hawkor2\forcedchunks.dat
Size 22B
SHA256 8a1ff1d28cc89befe2b93aec31a800604d46b8e653e6a106d409a240cda20738
MD5 87e95b37c11f1139dc218d907fbb24de
SHA1 32d7225738c6ee6ae6e526f16d695d77ea4278c3
SHA512 8fc0c3dbe07eac36330e6a698620deaa7dab18443fe13dacee1cfe7eaa3f18e882aec057f344a50bca5ed5a001541ecab7dd0506206a5d89511c4ee39fce0f14
MD5 SHA1 SHA512

Submit Download

level.dat_new

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\minecraft\saves\hawkor2\level.dat_new
Size 12KB
SHA256 524cf43b32085fe5d5629b2731cb38e7f076361df457173ff02524e13faf6796
MD5 5adaed38c48271f07b3f22ec0a9ad3c8
SHA1 246f5d8ec0c206e70f18bc93441341e13543b087
SHA512 e9418c0cd3622da49d07869c4276280fbb40df55e849fbf893305a89c2fce1f48e9f9623245ca2fe32d8992bc27394e12486022297e65979259157349e80528f
SSDEEP 384:Ok+k27LomzIVWtCJlF1/fTT3HqlDf/lj+eX:Ok+z3kcCnF1/fvuzNX
TLSH
T1EB42E11331E1668E6DE66F2788AEEAFE1503FE50B1AD40923427B51D0EFD98012381CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level.dat_new

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\minecraft\saves\hawkor2\level.dat_new
Size 12KB
SHA256 57956002cd39c18c856ac7707e3e670480f5f4a5b14c28b46592a86a69ab8d8d
MD5 b5b5c5952051d3f6ece8a005addbb6bf
SHA1 2419a78e2b389d17d7d4f1d52dd7728bf45e1ae2
SHA512 745ca171bf3827d38ee9a0fe4f881768d5532decb2b3e4f2ef993db5d85bc9fd0983fe27104077108665420a8d4ae24f2d1fd6655d4a0dee4d8c10dd296ac468
SSDEEP 384:Oa6awCnzR3asgJATWV6z04lU0DERJjb038:Oa6xCnzRqsgWHz04K2yv
TLSH
T1F342C0B1E115511AB7F6F2497DEAC7DA7D6FBC20169C296CA2FDC022F65418E2018264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level.dat_old

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\minecraft\saves\hawkor2\level.dat_old
Size 12KB
SHA256 dcbb964bab8795b886ca6e176b008e2d1e6f114ffbe87c5d931c1c03cd1fc630
MD5 83547803ab96dee6b5cd45634d53a929
SHA1 728c257ba0d3a97e5304c066c717ca763cff3a22
SHA512 10ea57582abea15ad5c15ccf11f89c1077cd6af8f547cd0511aa924b143437162a361ad9f4dd03132835db7af8bc2246a95106b0b37303e2cb303426631d9daa
SSDEEP 192:tE3OGEPZ/R/zmOfR8TZ48aqn4wdv/eAgyCnfL5vaM6NkgVzyV2424:teo/Rrj8gqn4wZ5It0NkgVzyYO
TLSH
T12542C03773661838DEBA0892BDD627AD7FA9ED8DF5386D2E85500D8FA1C014B24C4095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c37754ff-2986-3405-b428-2f09810bcf10.dat

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\minecraft\saves\hawkor2\playerdata\c37754ff-2986-3405-b428-2f09810bcf10.dat
Size 793B
SHA256 48996c3de74c0d0b621b201d15e10df7b2ba51287efa27dae93639e757d55d78
MD5 192e29bcc02aab224944d16b991ca18d
SHA1 e5e5e8b8afeaa9c4c5e42426b95139aacb437eed
SHA512 53ea79d49f0b61933cd1488932871207a6a462283bddae3a252db4830d41a3b7461a1b2ed44d6bb542ab87fa7f4c0261eb1b5675e34930cc3dda0d6307e42ed8
TLSH
T17D0141084A025F8BAB9E94F89546271FEC5D6814C622C8B968C77937AA777C809AC128
MD5 SHA1 SHA512 TLSH

Submit Download

session.lock

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\minecraft\saves\hawkor2\session.lock
Size 8B
SHA256 893bce1f30a59145b5aa095aab6334e1dbff26325f173e4630446f75d9a3f2de
MD5 152d4af5fa4f48fd8710c814d28e8281
SHA1 7fa07448f52adccdec89917785c5cbfdf2164268
SHA512 7e38f06f7bfb6825342261069e8bd5b66c16590b915b48c5198ca6ffe855f4d0f4267a159b844b4b0fd5a65372be4e24808fb917ad39ecd9299a04c8e0b329a5
MD5 SHA1 SHA512

Submit Download

mmc-pack.json

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\mmc-pack.json
Size 1KB
SHA256 d939d1d6387f09a7a09e16fe40c12e5ccac9b36889d7a0e8b3e893c3e359b1e4
MD5 2fe10f67a13356dc3340ee9228f43109
SHA1 572ae0de29d632791d221764e5bea3f84d0695cd
SHA512 ff0d22e0fc3207cd9baa9e85cd8cb4daa17e3afbd415623879dc12f7a97311803f6408ebae6c8c93b76d8c7f193bdb22b261d7ed59ff08b0f98ee3ead4f0965c
TLSH
T15A112030CBB11CA21595E3B0083D5067D5B444576F743E9C721C414C5FAD6FF11613AD
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST.MF

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\instances\1.12.2\natives\META-INF\MANIFEST.MF
Size 107B
SHA256 9ed6f74e29c4397e63e5b5477e9a75c1a07ae124c5bfbd6b92deaada959db5c9
MD5 993d982806e559301981fda56c52bafb
SHA1 310df5381bcd2f24b192ea65679aa96f22356284
SHA512 88df8ca0725648b860b479a5ef347ca79490967c77c2167facdfb3f38d30958d91246928e86d7bcf31e330215c79c5dfb36e1a28210f459958a8c21c587be035
TLSH
T1BBB01228071D4CE569A257F224EC910711D712413673202C2707DBDCDBD44C6017D42D
MD5 SHA1 SHA512 TLSH

Submit Download

java.dll

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\bin\java.dll
Size 154KB
SHA256 3e060e1aafa2fe99f06c34db84a49d3a2f994c1a0dbef40f37dbafd45cd69533
MD5 31401e170ddd8437635c4c8571a80341
SHA1 b79de1ce1b96ad0c3d00c8a32e55043eaeb1bad7
SHA512 fc5e52e5398563a39dd5d8204ffe52a8668c19e1f1bb9706cf408c6c7ed81f8be667d87233bcdfd8739ac022792c36b9147249e5eedb51b21493100ffbf1e5c9
SSDEEP 3072:9UiwiCAYX+v/hqHQ525w25r87Wh8AH6MPVbH5ED853:9tYYAw5W5uMJOi
TLSH
T1F0F33A0A935640A2F89771B8B0255003F3BA7858023C937B57E58B4E9FBFB61BD57781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\bin\javaw.exe
Size 202KB
SHA256 32546ecf1236769d2d777331f90282fb97589bec75da11c8e727d61d3d4c988a
MD5 7b23b0aab68e65b93bb6477f05999574
SHA1 920752e4c22e1165e6df27f69599483187edfbb3
SHA512 e3395303e53edce3dfa8fe11b7338c77795595a17dac17818e4bc8b77feee4900d541201d6762aa8f46565730e24a5423684049d40bbd074186ef7223c96b604
SSDEEP 6144:DKTNOY/WrlzkTa0OtC8QZKHkZjTB0bgvex:DKTNFIlGOCjTubgvex
TLSH
T13E14AE92739020F1E9979275C5969912E7B27C9F03B0830F13A877761F733A1781EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\bin\msvcr100.dll
Size 809KB
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
TLSH
T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\bin\server\jvm.dll
Size 8.3MB
SHA256 04d85639dacb86c6efca146051681608727f0376ca5293b9f83b232fc4db6a54
MD5 2894ece7b8de355b13978d6b8ec6e68c
SHA1 cec5cd8450498ee6f81eae2f10e56726b6125be2
SHA512 634e1cedf63d384c072bbd32dbca35982f7b2a7a77ab6d11130f2d45fd164d17ad080206a650854473370e824ec1153c61821c318a2af7954d2031a38d37bfd4
SSDEEP 196608:9kUYI8+So/zQYbmWpNOXN5HZ0jM/i/MpwR:fYI8+So/zQYbrCN5HyM/i/MKR
TLSH
T1D3965C6A617030E8E67BC2BC8A199507C7F338A4073597CBD6B153911B43BE969FAF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\bin\verify.dll
Size 48KB
SHA256 238f96dc1effcb719a9efe8472c34aa880e2cff4af94e26b8a48b5c00695d688
MD5 5f317dc17d83fd8d80df4eee1a6f1024
SHA1 256a67812cf7e6f6d41884d290e995e144c41c6e
SHA512 5f0e62e0c314d9aed7d61bb79d77c3389855afbfc3765262ec61ab8c4b1648c1d1b7cd7b23f54319d4139ab2132a2471c115790ec25ac4a03d340abde0fe0e75
SSDEEP 768:4kAC+MiPYBO1/aJsjSZymc0U9lsb+TjRxRv8RLv+TguulQR3PvNOC7V:8JO9c0+YkJyr+T8O3PvNvV
TLSH
T179235C73A3E578B3F9C38C34C5A4A29BDAF1B8901354C74FE5E64A0A5F43F512668E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\bin\zip.dll
Size 75KB
SHA256 d62088f0dc6aff56b2bc71185a88b225d61700bca55fcc721c9e9d5b02459790
MD5 d027f8fd7d74aff3bf8cbddba3aa04e4
SHA1 f6b97d03bfc4870f33414ec235160f77581452ec
SHA512 eab8cfc41482bbcdfba5d0e77397b15d65227d98ed764cde0c56cffe75a314ed4aca9d3a12414ab6718e01064d6939a2b75f2c845f91742bd02aae5bcaa05b59
SSDEEP 1536:oLW6LkTgB9Fc4mENkn+IOQIOpVnToIfisBrTwFk:oLjYMFGsGp9TBfisBrTwFk
TLSH
T194739D569AF46222FAF65470C4E6CA2FC7B2305052D4979F929C97811F433A23F983ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\lib\amd64\jvm.cfg
Size 634B
SHA256 80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb
MD5 499f2a4e0a25a41c1ff80df2d073e4fd
SHA1 e2469cbe07e92d817637be4e889ebb74c3c46253
SHA512 7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d
TLSH
T152F00CAB8009672653A221E77680385CEB52D13CE22BBCFA1148AE883D03CBCA017856
MD5 SHA1 SHA512 TLSH

Submit Download

meta-index

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\lib\ext\meta-index
Size 1KB
SHA256 f0bce718f8d2b38247ce0ac814a1470c826602f4251d86369c2359ff60676bd8
MD5 005faac2118450bfcd46ae414da5f0e5
SHA1 9f5c887e0505e1bb06bd1fc7975a3219709d061d
SHA512 8b618c74b359ab3c9d3c8a4864f8e48fe4054514a396352a829a84c9b843a2028c6c31eb53e857e03c803294e05f69c5bf586e261312264e7607b2efd14f78a9
TLSH
T114316B1B458BA16EBE2E0ECABF37EB81665CC23B041951BC04C90C85A50DD0E2F38D75
MD5 SHA1 SHA512 TLSH

Submit Download

meta-index

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\lib\meta-index
Size 2KB
SHA256 4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4
MD5 91aa6ea7320140f30379f758d626e59d
SHA1 3be2febe28723b1033ccdaa110eaf59bbd6d1f96
SHA512 03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb
TLSH
T10741566F0287842F9E980DCBB577DB964BA8843618D8A3FC43E41C4576CDC4B0734A74
MD5 SHA1 SHA512 TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\lib\tzdb.dat
Size 98KB
SHA256 79f315b59efa1c8eb1c43b8a56cf4b2efbfa7a0d8cd1f49ea3ff3c67ad095945
MD5 15587f96261d342f4195b7b5308e415a
SHA1 61ef3adae0d6565e80fdc5cb9e33791c211dbfb2
SHA512 746d464f40b6199500882af39b8ed2c36f41949afdffdfb55dd29e4cb6246e5ae799b00ca306d8ed812e810aaa8f35c9b117d5cd8dfe3fb746f2825470877e2d
SSDEEP 1536:UovmEMaoVdLe4mG5CV4+5a/////wn+7TaK69rUMt7qdI1oLqoXo:UqMy4/mFSGKkrjt7qdIqLbXo
TLSH
T1DBA3D5783B6190B7B2CB4222162B9B93197DAD816FC3080279F17D5E4A76AD7613334F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\java\jre-legacy\lib\tzmappings
Size 8KB
SHA256 d936ee24810b747c54192b4b5a279f21179fe3ceb42d113d025a368ebb7cb5a7
MD5 7d4abbcfb06d083f349e27d7e6972f3c
SHA1 eb91253590526f7be7415839ccbf702683639c8c
SHA512 e5c2fbbc07cd53baf14f3cc239b56b42b73de47f9b7904aabf7d97695d2ab8866d0c8179235cbf022245949b9b8e419985e328aa5ed333b14b8b4de2c82b225e
SSDEEP 192:qwfOC9OYOxUmHomjgDwlZ+TFXsq2H+aUHCHQj4mEo:qqgniTyq0iV
TLSH
T13102FF007260A7CAD5B3AC4B374A7397F416B2D81CC19E6C2A6BC7AF5D059B611E1A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icu4j-core-mojang-51.2.jar

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\libraries\com\ibm\icu\icu4j-core-mojang\51.2\icu4j-core-mojang-51.2.jar
Size 1.6MB
SHA256 147592c5eb8e11fc8394125954f877acf25918bae13aa210c2825aefc3030ed8
MD5 aec124acf7b3c1c6ed41a6270a4452b8
SHA1 63d216a9311cca6be337c1e458e587f99d382b84
SHA512 ca585221ac4b06ed7b12891b43882e1c219d4656bab0f291a25fb9bd971d09371f1c8e35181a9ae5dafd9a429367ade86ec3f06eb0dc887e8a790c671132cac1
SSDEEP 24576:RMl7QhGL9gcpfLXQfrq0FKhpcRXArrbyWgggaaDtktf1aUQJf0C36c1Nh:2FfgPHoim/uhDyl1EfFFF
TLSH
T1FA75E0A7E6CF20B9D93F02F396495223B52EADE8D42F95361C643DC26927E4D6B0530C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patchy-1.3.9.jar

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\libraries\com\mojang\patchy\1.3.9\patchy-1.3.9.jar
Size 23KB
SHA256 79f5a9d8c788489d3375cb77cc826a905e261e50d23f31b94c2d5f2b92ad3dc6
MD5 4ade1d942adf9f69fc5ec0cd5e8e5693
SHA1 eb8bb7b66fa0e2152b1b40b3856e82f7619439ee
SHA512 8ed153c01d5bc3add24fab30bf5aa385a62d9c3fc748b5ddcb2bb32461644db7f1606b16f6be5ee0d24822cdd14090617a02ec2ef4fd1ea4821ee6a23435c7c1
SSDEEP 384:HSjmemdjq9O8GajQGr1MFKQl3y62i33EaxjBUqFhFGEJu/WcrauLqtYe:smzTJTKQl2ralaEuoYe
TLSH
T1F7B28D71D38A44E5E6690778718609B7743F0688D2CFDE6E0E993FB1DD392A52EE3201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

codecjorbis-20101023.jar

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\libraries\com\paulscode\codecjorbis\20101023\codecjorbis-20101023.jar
Size 101KB
SHA256 6c4b4e50e608763564afa1bde2d25ece9dd715e7c9129540faa1faded4896506
MD5 0d622e2ac4368b5a33d540a9e4819e0c
SHA1 c73b5636faf089d9f00e8732a829577de25237ee
SHA512 304b55520c48d574cb046efa45687000b640937ea86119b81c152bfb192aded3de61b993bb83275e21efa4cf0f50efd3025d030b18dc1a0f53fed1dcdcb151f9
SSDEEP 1536:WD3fa3ic1NIqIZ8CYAEsNMFpdui0VH3Bq61a4D3r1j/mOQu6+5Gy+gvocWbRtaM5:OcsqLCvmLuvNRq61aal/mPuV5VxvAWF8
TLSH
T11EA3E073C58F6029CE16CBF760FD8562795E19B4A3031711386AEEE57A8CF84DB1814E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

codecwav-20101023.jar

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\libraries\com\paulscode\codecwav\20101023\codecwav-20101023.jar
Size 5KB
SHA256 bb7d17b340afe6abdfbfdaa03683bce4aef39a64887dbab0636eaff3cf2d59ba
MD5 f6a93b7eb8083e4ced92e7e253657057
SHA1 12f031cfe88fef5c1dd36c563c0a3a69bd7261da
SHA512 994af7ab19036542162d75a94dad4c7645f60626879f715d308966b8a018c84474cfcac28e2555f4a6e7a925bc919c54da276e2ee45bad2eb512ca1abeb7a2ed
SSDEEP 96:u266mpym+KSA1ET69IjWVVWSa0OQDBrDkO2l/7FOn1fQL2MGyZ+7VoRXQn5bfyp:u266mTCjavWPbQDBrUDFOn1frcZ+xoRn
TLSH
T1FFC10832A3D3B575E24D12F243C3AE767E5F0481E71E6A007B503368BA1E8543E20A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libraryjavasound-20101123.jar

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\libraries\com\paulscode\libraryjavasound\20101123\libraryjavasound-20101123.jar
Size 21KB
SHA256 333bbefeff5eb1722dc9b8d2e26c38bc69c1efa07d0ca870480f29d8858aa336
MD5 247b45f9d2f0071ad543c14d0ff31d5c
SHA1 5c5e304366f75f9eaa2e8cca546a1fb6109348b3
SHA512 eac73f86f1f85c94f5df309c4a27b02ce33e63635ef731e088f4dbeae2679d837c0a82efd96d853bc0a193edf5636d949a91b41e2b43de8bfbe376d2e717984c
SSDEEP 384:W2VUwbXPC75ni2FgZY1KUS90tkUDp1cdUVD7DkbMNG:W8U+KVjFgZwCgkUDp1cGvQbYG
TLSH
T1DCA2CF3283D2309CE6E87AB282C71303679E15867F07DC41375367D9B31EB0979020AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

librarylwjglopenal-20100824.jar

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\libraries\com\paulscode\librarylwjglopenal\20100824\librarylwjglopenal-20100824.jar
Size 18KB
SHA256 107d11509f6af59b8c2ba23df828bc5d3c4e067b58f3d858c7deb90ca5308f84
MD5 93730cef2e75762c5a1431c6d7a0c78e
SHA1 73e80d0794c39665aec3f62eee88ca91676674ef
SHA512 0e0956a0c16943c3bbeee89b17a556b2f4a57e7d87db1bca2449a77517c46559f4b2dcb541695f89693fedb533e627671466915758dd0f0299477bf374a58dc8
SSDEEP 384:O2/pcGf9gGBkuFKfPfznT+CMpKfPMc77Jh4HDOobTYR3IWO/t2WEfF+/jgWlfuUW:O8pcGFgYkuFieCM+H4HCR3IWgt2B9+/o
TLSH
T13182BF7B9392B06BE645A5B243636F3D150D2244FA8779C07B64726E3B0AD4A9C012B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna-4.4.0.jar

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\libraries\net\java\dev\jna\jna\4.4.0\jna-4.4.0.jar
Size 1.0MB
SHA256 c4dadeeecaa90c8847902082aee5eb107fcf59c5d0e63a17fcaf273c0e2d2bd1
MD5 34d3537524a6c8c134e840e7be601569
SHA1 cb208278274bf12ebdb56c61bd7407e6f774d65a
SHA512 d38d124f5d2c227da57b0473bb37709a4d9f6fbcf5b6da3a6e15e2a90e5c2980d9dc649cdaeecb08b376dead73267128c1972d9e25ecc243424b8f6e6f4e67b3
SSDEEP 24576:n4URralwgzl2KYrdk8d1+NV08ctI6wCY+CnErouvUlsYyB:n4G3gz1YrdP78V0buAxpU6v
TLSH
T11D352367E08B7639CC3243B2C1F322F3741B1AE8E55BD6B942E51EDB5121C5F0B6492A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platform-3.4.0.jar

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\libraries\net\java\dev\jna\platform\3.4.0\platform-3.4.0.jar
Size 892KB
SHA256 ea89d5090c8303ba4e9a0056e6d8a20429f3e021411e950bfd9eba3b6e6cf15c
MD5 c5057d6dc3a531708e4a91249fadda3f
SHA1 e3f70017be8100d3d6923f50b3d2ee17714e9c13
SHA512 a89db5e82b44181d1b76ab9a7c1a0156f0511374a0d2c374ed815d4941f8566da0864e14492c85041938286dc2b27b8b0ed32188fa30e2e6286bc6f15339f7d3
SSDEEP 12288:2UMV3DMX3/U64NzK2gclfUA6f5h+XZTtZ5dTn:2hhptK2pdj
TLSH
T1D8156123E663CA63DEB44AF7A2D303451737A915190B9B7E07A46C81DFA15076FA0BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinput-2.0.5.jar

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\libraries\net\java\jinput\jinput\2.0.5\jinput-2.0.5.jar
Size 203KB
SHA256 79b5a4f5829e1a49a415711f7fb8eb5b9ad22defa72929fda2da96ec30d3f018
MD5 cc07d371f79dc4ed2239e1101ae06313
SHA1 39c7796b469a600f72380316f6b1f11db6c2c7c4
SHA512 d75e3e35844ce41515fd25f34f9cc2228c5b94e479894dc832e07c78f70cb0d83819c7d574d01bbd0363e9387c9ac15f43a1171a8bd75b783aa5c856b492d24c
SSDEEP 3072:SybelxUxryf1416x8ZlX4Gg1PJBVVZYMyKUVVtYH4E2eqq7tOzuy+LDzRDDL81:SoGfgljX4dzVvXI7s1Qzuy+LDJL81
TLSH
T1B114CF23D87A0412F773D3305AC0329B782D56A49C0B268E34B5D0EABC69D4667E7F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jutils-1.0.0.jar

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\libraries\net\java\jutils\jutils\1.0.0\jutils-1.0.0.jar
Size 7KB
SHA256 c3334ff39cf0ab3b54925619101054c90098b7c733b1e7834c7b75e4c41e84a5
MD5 f60976b19661c849c5c87433045a9885
SHA1 e12fe1fda814bd348c1579329c86943d2cd3c6a6
SHA512 39cdb29204df770b84ecd5d0041d8cf662c25bd16ef1e7d8257704a1ed3355cc3bb554b99d1fa2e8f0b5d99973201d344ab6cef04cacf98cd041f93a66e36bec
SSDEEP 192:n6Qgg4Ls8/fN7aoa0TqVmG1uM6BWNRXEnHCw:nsg4A8HdtqVP1uMBLUniw
TLSH
T1DCF12A778247AC78D77DE1B242182002BCED98E0061C439975B3A0E7FEE6F48DA93947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jopt-simple-5.0.3.jar

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\libraries\net\sf\jopt-simple\jopt-simple\5.0.3\jopt-simple-5.0.3.jar
Size 76KB
SHA256 6f45c00908265947c39221035250024f2caec9a15c1c8cf553ebeecee289f342
MD5 0a5ec84e23df9d7cfb4063bc55f2744c
SHA1 cdd846cfc4e0f7eefafc02c0f5dce32b9303aa2a
SHA512 c69c688a723a7f46dc3142156977d00ca82bc25e3f6e32c66851720db9107dccd1b0e17751272ed1a0c874449d122e040f890214b0e60828239c57639579f996
SSDEEP 1536:FIxHnxkGG2ZiU9PuVLbXANSWJl6r8/UBFrFrQcqNxFFdS4kM/DdjN1/83HMLmvgS:FwHxb1uVLbXATJl5IrFrQvJLkM/JJx6D
TLSH
T1E373CF1A7FC0C475D30BA33E005681235E744BC9A405F15F676405B669AEC8EAB1BFBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl-2.9.4-nightly-20150209.jar

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\libraries\org\lwjgl\lwjgl\lwjgl\2.9.4-nightly-20150209\lwjgl-2.9.4-nightly-20150209.jar
Size 1022KB
SHA256 833e721817f70d1445eec13d8ce5a86e12af70efac5014356302e2bbc68b3fe2
MD5 6e55ddca0cb6375facfecf1c769b7d77
SHA1 697517568c68e78ae0b4544145af031c81082dfe
SHA512 fbedcb5868c3182c4f8a559d375d51b948bc7146d83990e19ef48a042a5d6399a74372e672651a4be7369579201a50591c5a8673082bc70bef0757e9be7266b9
SSDEEP 24576:ChM0YL3qw8NvDXbDkrl5QAPBMOb6MDGDxsLJIMLQd:C6qw85krlyaBVbKxs9IJ
TLSH
T17525E123DCE3902AFD27413944531B3E741D27ECD88699901BAA1BC2B5778A5FB2B734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl_util-2.9.4-nightly-20150209.jar

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\libraries\org\lwjgl\lwjgl\lwjgl_util\2.9.4-nightly-20150209\lwjgl_util-2.9.4-nightly-20150209.jar
Size 169KB
SHA256 034456b132a336b72757325bb7aaf99e075681ee5650d2bea21717bd485de42f
MD5 b5c4665943f749a0bba6a6da53a45674
SHA1 d51a7c040a721d13efdfbd34f8b257b2df882ad0
SHA512 e6d96084f1702d396e7048a95c0f0d2fddefa7692219d89979c21928f6c624e60ea439fee8e5e218df6f7257b8e4261d3c893cb7d9a17d0d36e67265efe7c506
SSDEEP 3072:qlpPjgPAh0dppn0SLyq3AauC0ogOoG2xxL2ZXip+QPFVHmz6lxcfmt:qlpLBED05C0O2x12rIFVH9Dcfmt
TLSH
T12E04C050FCBBFE3EF66F417940971345342E87A4AD9A69F45194CBC2CAA0CE68B43364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oshi-core-1.1.jar

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\libraries\oshi-project\oshi-core\1.1\oshi-core-1.1.jar
Size 30KB
SHA256 27901e5d4d60d3502571d5e6358fc89e3fcf874138b69d495d139bcc3e169404
MD5 4f992d3ac0aa70a8647460494c95e261
SHA1 9ddf7b048a8d701be231c0f4f95fd986198fd2d8
SHA512 5b7af823687116dfdd92584a215cb661dcace19bfe4f2f3930a809407a0a9327538eb16d3b1d7b616c73e6cb927a5100e6d871781dc2035b8bd02ba75e2c167d
SSDEEP 384:vbo59GGiuJBMgy/w67kfGtr9blL1kq93Xur9cIkiRmIduCN9nRCc8ol1ciQPfOO2:+Mgb67L/lL1kOHur9csRmItF1ciiqzyE
TLSH
T1A6D29E28B142B66DF8094732D1C5F42B303BC6CDAE5B629530C5B1E3DF1A82A6F2561F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrismLauncher-0.log

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\logs\PrismLauncher-0.log
Size 17KB
SHA256 1c18fea5b5695ed3b80f5030d216c2b0fe84e5247770d2ef21637c966c82d4e5
MD5 5afa40bfab7bc3eab5e5a562ba749577
SHA1 6fe6949b8e276d514adbccdedc2b2ea2353dbc80
SHA512 ac2d01138498fa072c619d876372f421c386bc5e28607f604f7ec63bbec7eedfcb72ad4ef458578ef8b52fa4699c1effe865a655af92bf346dfd502da7acea66
SSDEEP 192:g7D78MJVFA9hGNJITg1cYuCMlCpH9LexpAviS34CpRnltujx4POTPMH:y7NduTg1kCgaH9LezAvD34CHnUS40H
TLSH
T107826B4BBA111776977BC2005A4B13FAC114FE3A96B01B6BF50D03E67F7A00532F9966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.json

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\meta\net.minecraft\index.json
Size 428KB
SHA256 e34a34557c4958442f9e258fe3e31f0d069582c89a4ade7e1773a090542a1006
MD5 3c8c40f7705835da6d5f1a489428a484
SHA1 2fa3bbedd60fe93c6298d885084fa7dd0a764092
SHA512 209704d35016d845a87894d5cc286ddef8bbc95e270df15b6c0565e80c937e2e0d1a2c49a48a5aab021a2742b25135f2f82a90efc920499d60578f339e6ff6f1
SSDEEP 1536:xONE3XW5oDzJeUTrUcMc9/TzwkdGrETGrSS2YvZnURFzU4v:wKHasNrt9/Tz3dGocZnUXv
TLSH
T166948F90C8B9AE6B245571BD4D1D82878530C96B4CA87E0E77CC008C5FAE97D27F636E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metacache

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\metacache
Size 426B
SHA256 0795a80b42f4beab5860097926a9ce9beaa27224cf76b9ba9caabf0ac59cecbe
MD5 56770cbba034741e9bf6ac5cfd17abe4
SHA1 ef22685be6c7f0801fecde9be5caeccc457dd728
SHA512 89a76e902ef4d40003867a293835f28a6092681a715b4f625a2a2c78dbafaeb785abeb0f3e7a31fe356f6100808c1de53d6290552bb926f5ccf326a9643f6594
TLSH
T16BE02635C02C0E631147626C26A9998323B9439B5D663C0A378C994C8F2C41F26F91A9
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 2KB
SHA256 43f206664aa4cc2efabb6055d3f702d87fc8d285158986d3375fe899641f1466
MD5 d86ce565d6156e147fb4312a26fd72b8
SHA1 44add05116114111ec9c39ca2c32b14e031ea8e6
SHA512 da23a78729ef5af276825f5d1992996c0fe172cfd6bba23e0890854e9c7266bdebec7f829e43cdc12aaf246b9a090d386bab26f50de35210bea833e5da29a831
TLSH
T15941C5726F58A43D41B929514C72FE2B0D563E17058F6094F12C3C8FF25B9526F4A8A7
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 1KB
SHA256 7360ea1139c5cbd6f6064c596e412651584501788c52a5df2f09fec637ec7505
MD5 2dcced185a15cdb4e4ba2aefce596f7c
SHA1 aec3dd567fa79638f1121b99c4a8dfdbc583794a
SHA512 d02f7701c1f3c96c6b328276cf81ed497de1b7842d93662efbcd511e58687076cea10a34bd89bc061b5d5519bb8041ae3ce9d49da0779dab8f3d59c36cbd5ffe
TLSH
T1203167429F98B03D503245228DA7F61B09973D12548F21D8F2283C8FF227D556766567
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 3KB
SHA256 7e2afc1ac6ca233e36422a47e3b64e20a673f68403163d2baf1b4f00f0eef6af
MD5 f30439fe1580baf2797368c1d4005e00
SHA1 4b837de525b19870a0d3ef16b0c18f816054bcee
SHA512 471cf767e04ac301ebb852c12a252644302555da2a46a7f3db6efcda865f532d5dab1cb427c0f2adf5a6c8253749eaafb758beadc55ee2a449e370010173ecb9
TLSH
T1DC61B6725654683E807454695EAABF3B0E693E3320CF3888F15C260FF1F7923791255B
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 3KB
SHA256 d0c0772f0af19fbc78eb3f085ad91d28acc4b39d1cd5eaf4a427059509d267fb
MD5 4c47d63b5d3929aeaf968dc49836250f
SHA1 fd2cccf45810057a60d9099052d5137d6f7a2ed1
SHA512 1b0d82297425c56d41c72ba391a7684031fd57215776e15d27a43e304d5eb7f52d463dbeafe7b2147de263b627c51808a548ab893cc7bbe247c405b78d2b612f
TLSH
T16C71A4731550A83F847044695D6ABF3A0E693E33258F3888F15C220FF1B7923791255B
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 30B
SHA256 e7bb8d933ad3397d35cf1706f0364ebab6b7c73b6b6846cdb0383db420c2cb25
MD5 412c51abbdcc110394940f8bfdee3d3f
SHA1 17df4e8360e0b635622dd12a6a36088cbb47b2ad
SHA512 77b3d41680d77ed7a29b3d0e1d07583bd1a29d0c3939f0eebb17639cf2e92447fc5eb784635d0b44ae0b58a5212b4d9ca6505a02d0d2c9a521089a8b33437440
MD5 SHA1 SHA512

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 2KB
SHA256 7dcd2b3aeb9b7a99781cd78c551505600ce82268aef6d954a6b1005d543cd492
MD5 5bf97e14a7af2fca8e2339c901b41fe8
SHA1 3c9322a007ba2659b894613792f7989a41cedef2
SHA512 61fbc9027d9925e43b606279f7b661432ce3ccb139de6335d883c7bede52fea57b0a051f5031cc6c875aa6e1d1c1e511d88c5354d3cc001e355fbb38e59d1367
TLSH
T18341E7326F54B83C41B928514CB2FE2B0D533E67458F6094F12C3C8FF21A9526F099A7
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 3KB
SHA256 06bd9698a37f848262471901f3b570e1f86a6ed461701b77ff3de47ba6ee73a5
MD5 a04ebfba76a5281bd65598e9226c7b95
SHA1 81d689b57149380f433771e8f39e58c848854a38
SHA512 9d983bad79289a55a1cc0244482741fbf717b7204ac9740042c6f7dbcd2faefe425b18d05d17b336b8c60cc615acf9c1b42f7723ee327db912585dcaf4783888
TLSH
T15561B4725550A83F846054695EAABF3B0EA93E33258F3888F25C260FF0F7923791255B
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 2KB
SHA256 b1aa82670bfef3110afb8ef409c91ab87a34f10e4954b9e6efa6afd8d63c41fd
MD5 8cb3ea0b233d4279934a03f354614b76
SHA1 67dcf982aeac285bb22c91036c7371098daa1105
SHA512 ed4c5d27bcf7d5659ddbbcdd6d207f936b2e8f93fafe4529170a9a2e5cce7e30ea9ec72f0242b360e8f6681d8bb7478f996c942449083a361da0d20867488748
TLSH
T17F41E7726F58B43C01BA14618C72FE2E0D673D67049F6094F22C3C8FF1169522F5A957
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 2KB
SHA256 7e48b6f9a277f029ce8cc6bcfa98d46810f04ba2148ef39354f011aef1193bfb
MD5 f24165c35de86d012d43ac0c2f6782dc
SHA1 7b4652e3454e5b28997c7c17e234a7dca2e12717
SHA512 5ac6bc37e67fabf1a12cbfb0189e55c1a93022061035c9adfe90863a1dd295a6450810918615c9ca3bdfe412616be788b6ec7dc7a485405557c500abcd18df87
TLSH
T1F951E7326F98A43E40B454658D72FE3B0E677E23158F3488F12C384FF2AB9126B0655B
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 3KB
SHA256 e34379ae6aa5532d1492f4ce90bd1674a726d9a96a0c0100c4975c3c0aff4851
MD5 9909151563c4c8b4ca91557ab8843bdb
SHA1 29510f3fb6b9cd24166d68156894dee79bbd2556
SHA512 05b55862df8953f6bb37b1edf363c50958d8ff77013261223095ad1ae7c5cc9a641687d06cbd455a16d743ef5af5fe593059895413bf95975e735de02b19516c
TLSH
T10E7193731550A83E847444695DAABF3A0E693E33258F3888F15C220EF1B7923791259B
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 3KB
SHA256 d93fb1d19c03f84047ac85fc9337243e9ea971614ea0d77600d4d4199bb77d27
MD5 ca2e1871782853b322283ac5f24f4d8e
SHA1 2c2ea1878799e50e0c8ca2e3df2f96db9b2a94ea
SHA512 215ebe8a3c3e9fe3b1f9bd91f9d477021cbebdb281f2f0a31255b0ade577ddf538f32aeb7882d36c0a0a4ae67dc7f6272b7ef3eb2c06305836b4ebaaf84dc17c
TLSH
T1FB71A5731590A83F847044695D6ABF3A0E693E33258F388CF15C220EF1F79237912A9B
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 2KB
SHA256 fc0cbc77da2f103d984355049999486d22bbec178643d8b8df99435e154e9c83
MD5 0b925dfb9b32793836303439395741f3
SHA1 0be058edcab48130a3a294b39cf52603963e833c
SHA512 db9fb2f2af7332e7cc7aa811af779cfa788c4e70dad281307d66126d7c96eb916661ad6d5028df3a46ee8a5d659d26e1fe0283f8c2a5b3ff4f11f4541b070f08
TLSH
T1EC41E7726F48A43C01B914618C72FE2A0D673D17049F6094F22C3C8FF1169522F19957
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 2KB
SHA256 114253fbcc29abac1668b58b47be441ab36ea1c2220aa7ab640a244a4fc7fcf8
MD5 832ae2418893355ec44121812080fcd1
SHA1 4d0a9d520445f0b622d46a293fca48665e722a45
SHA512 2fb89d474b884f9d5b27ed0150b6caa8800b773f955ec1d0276053ac29ee459f9abe6d9689072c731e09978472a7793f4b555a3629e1601400abb68a726e20f9
TLSH
T19941D6726F58B43C01B924614CB2FE6B0DA33E17448F6094F12C3C8FF25A9526F19967
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 3KB
SHA256 7d7fb4a363802d7d1e2712b1197c67d179d9fad670fddfb772d6ad8fd75a6e52
MD5 681860a57f00aa3e2c4e64943ae7f38d
SHA1 6709c62a35f2fd0ea9c0c324b36a107c85b96c5b
SHA512 4d638bb044da0f55f475857d5d12fc2ee659e462601a3f569cbe8c5229e1e6e1b0c1a46b452ea7d0c68e276d1dd4e021d632738e738eb22e0502b05b16e4b333
TLSH
T19B7194731550A83E847455699DAABF3A0E693E33258F388CF15C220EF1F7923791269B
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg
Size 3KB
SHA256 2af1fbf70095bf5b649a88809ad51b713c6ae5bed6b27dfacac253ea812c80b3
MD5 fdaee2b52beef42e26ddaa482ef0fc24
SHA1 21646ed77e558ee41615f2687c58f75a6c53323d
SHA512 2476a5a18f390d654e8f97852d174d27b4110c0e82e3db974a45018991818b8f9e61f44942f9e8c7814cff3f2f06ce4c232217284998ad203b315798865d9079
TLSH
T1E071B6731590A83F846448A95D6ABF3A0E693E73248F3888F15C220EF1F7923791599B
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg.lock

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg.lock
Size 66B
SHA256 e4587bef4c3eb3320f26b7e332ed868052d4e5ad86821c4a76dbc86cfca6019f
MD5 ea072f9deea6062af7088c7240f793a2
SHA1 c530acbae2a40d459b3f35e62d171bf0fd849398
SHA512 9ccd4a8d9279eebbe8815439c3fa46bcf5116dc1aaa95d7f58d9d5318dc8b4aae6c382bdf7e5010073cf9ac17e3df6719094d636b070ff16335d436eee516c3e
TLSH
T1FDA022000F030E03B08000B0C308232200C300200803A038EE00C0ACA23A02CB030800
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg.lock

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher.cfg.lock
Size 66B
SHA256 b13310a23de3b554b046293ff3bd47675a6296eaa4e731787888311c099dfed6
MD5 554afa5a9c821d15775914bb865ada78
SHA1 138ee0da5863bd0a9199cb456689c98f53723f37
SHA512 6f7644060375fe5cf1e9a40bebc7436c599513be1a45bd4c009519418acc727323aa072e30d67e070dd723d77d4d19dc0cda793e0f8ee1034559811c6ddadc51
TLSH
T1A4A022000F030E03B28000F2C308232208C300200803803AEE00C02CA23A00CB030C00
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher_update.cfg

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\prismlauncher_update.cfg
Size 83B
SHA256 4c7c14f9e04f4d16ad2e15483a363452d85b9627232a4d8a757fc766129c9bc6
MD5 e04f216b4f0303ab4deb74611e0c134e
SHA1 06dbc9f75de9ecf35d1ade6a6a21482e6df8dd35
SHA512 8fff61b5d94d32e3154146dfbcd24e5512f35a740ecc627cbbdd8da0d309a338de01a84c0ef720683a93f7da291b15b72ed2360dde11d3a2261e9c8074215cd4
TLSH
T133A012496F11541C2060254400484B41508131561FF1C810138944450141F32CC4BC0C
MD5 SHA1 SHA512 TLSH

Submit Download

index_v2.json

Path C:\Users\Admin\Desktop\PrismLauncher-Windows-MinGW-w64-Portable-11.0.3\translations\index_v2.json
Size 27KB
SHA256 b8fd08f1a2691202fdf66958f15835d325a0db12fd03dbb81c3870db8847e4e4
MD5 385c491f8c71630ee8330ff78fb04b63
SHA1 820c5d5d893c5b19e1bbe533918aa6b3c61c30d1
SHA512 7d2120d328b5495ea7cace9b669ddb1cde58987ea79da15fb6725b4ef3750ce1a405020b9af8abadd97fd34fcaafaf3ba4c8ce5dddc0dfef7ca48a1986b29e5c
SSDEEP 192:aVfCXyeZChOA1EY4UkWh1k176ksy2S1SOul1JyztdbX2mn7fGLeMU6CL:aVafZOEY4rwy2Qul1Jyztd7fGLeM+
TLSH
T16DD26979C4342D092016D2AF56861643241FEF5B4D267D14BF6C8A8E0F2F26E26FE63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SoleHack ALPHA.jar

Path C:\Users\Admin\Desktop\SoleHack ALPHA.jar
Size 2.0MB
SHA256 82e106f2c3f12655ef75b5838b74c0381566740d1454ccd3d5424af153d0394b
MD5 b9a11a3a0ef2843ddace68d0427299cc
SHA1 7710aa9d5c21690cdd075c85a01bac56f1a1e3f1
SHA512 cb5a6a4113109e209077aceb8cdf3962b8b0ef5c5ef9080271f3f76fa8c2b6dee70688957fa05e67c3670c72fe4da171e278d6ec4250a212463e00f0b4d2f1fe
SSDEEP 49152:lUdg8y+n3ZmmNsf5XY1aONofHbZCjKReztJmKKGJ0heOdqEs:lyl33hNa21C1CjPztJY+/Es
TLSH
T1F9A5330A81DD8C32D82B0977BAC1C555BA4CE2BC9306A63DA95C6FDD20BDA401356FDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-3151-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/1760-4673-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4418-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4384-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4437-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4458-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4467-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4486-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4571-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4569-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4568-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4630-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4635-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4644-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4654-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4776-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4775-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4668-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4693-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4773-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4771-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4772-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4769-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4770-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4759-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4721-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4723-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4724-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4725-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4720-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4717-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1760-4700-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/3444-42-0x00007FF979870000-0x00007FF979F00000-memory.dmp

Download

memory/3444-41-0x00007FF979280000-0x00007FF979869000-memory.dmp

Download

memory/3444-40-0x00007FF978710000-0x00007FF9789DE000-memory.dmp

Download

memory/3444-39-0x00007FF97A190000-0x00007FF97A35E000-memory.dmp

Download

memory/3444-43-0x00007FF975050000-0x00007FF97506E000-memory.dmp

Download

memory/3448-55-0x00007FF97A190000-0x00007FF97A35E000-memory.dmp

Download

memory/3448-59-0x00007FF97AC30000-0x00007FF97AE4C000-memory.dmp

Download

memory/3448-58-0x00007FF979870000-0x00007FF979F00000-memory.dmp

Download

memory/3448-57-0x00007FF979280000-0x00007FF979869000-memory.dmp

Download

memory/3448-56-0x00007FF978710000-0x00007FF9789DE000-memory.dmp

Download

memory/4444-7-0x00007FF978710000-0x00007FF9789DE000-memory.dmp

Download

memory/4444-6-0x00007FF97A190000-0x00007FF97A35E000-memory.dmp

Download

memory/4444-10-0x00007FF97AC30000-0x00007FF97AE4C000-memory.dmp

Download

memory/4444-5-0x00007FF6C3E90000-0x00007FF6C5019000-memory.dmp

Download

memory/4444-8-0x00007FF979280000-0x00007FF979869000-memory.dmp

Download

memory/4444-4-0x00007FF979870000-0x00007FF979F00000-memory.dmp

Download

memory/4444-9-0x00007FF979870000-0x00007FF979F00000-memory.dmp

Download

memory/4488-3440-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4488-3289-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4488-3302-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4488-3347-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4488-3366-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4488-3269-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4488-3490-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4488-3477-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4852-174-0x00007FF9799C0000-0x00007FF97A050000-memory.dmp

Download

memory/4852-170-0x00007FF6C3E90000-0x00007FF6C5019000-memory.dmp

Download

memory/4852-171-0x00007FF978690000-0x00007FF97885E000-memory.dmp

Download

memory/4852-173-0x00007FF9793D0000-0x00007FF9799B9000-memory.dmp

Download

memory/4852-172-0x00007FF978860000-0x00007FF978B2E000-memory.dmp

Download

memory/4852-169-0x00007FF9799C0000-0x00007FF97A050000-memory.dmp

Download

memory/4852-175-0x00007FF97AC30000-0x00007FF97AE4C000-memory.dmp

Download