f97ccddf340e03f8f8ea4702e96370c3c7847744d2b3b7b6163e6fa16130b5cf

Analysis

user interaction
yes
max time kernel
447s
max time network
448s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/09/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Снимок экрана 2026-08-23 213114.png
Size 72KB
Sample260919-tmlzdsha92
SHA256 f97ccddf340e03f8f8ea4702e96370c3c7847744d2b3b7b6163e6fa16130b5cf
MD5 e06c87468cd75839aaf781c27ab65a82
SHA1 be219d6035ac59307e838b06d28dc7110a8d9680
SHA512 51a3d87e3a7eefaee9a33cc27ce3a570b21e3a962a3dd69272679259ecee9bbe7d4e55d5fe1f0a27a65cbeeac502d8e105359861e90f348a7a2ce1f36ddd1f61
SSDEEP 1536:5051b+P8j8523TSJuRZAz3qqY5rKksNBMvsx82AarZ3QnhhZ7M4aq:50o5FJiy3qBLkJMoCnBP
TLSH
T19A7302D526C3B290C4D4D66BB4BDAF68F7AC540DBDA93DE42601E12323409CF5AB2257
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
497	5084	firefox.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Control Panel\International\Geo\Nation	Xeno-v1.3.60.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Control Panel\International\Geo\Nation	Xeno-v1.3.60.exe

Executes dropped EXE 11 IoCs

pid	Process
4276	Xeno-v1.3.60.exe
7060	Xeno-v1.3.60.exe
3488	Xeno-v1.3.60.exe
3200	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
1216	Xeno-v1.3.60.exe
6980	Xeno-v1.3.60.exe
6956	Xeno-v1.3.60.exe
6424	Xeno-v1.3.60.exe
2780	Xeno-v1.3.60.exe
8892	Xeno-v1.3.60.exe

Loads dropped DLL 49 IoCs

pid	Process
4276	Xeno-v1.3.60.exe
4276	Xeno-v1.3.60.exe
4276	Xeno-v1.3.60.exe
7060	Xeno-v1.3.60.exe
7060	Xeno-v1.3.60.exe
3488	Xeno-v1.3.60.exe
7060	Xeno-v1.3.60.exe
7060	Xeno-v1.3.60.exe
7060	Xeno-v1.3.60.exe
7060	Xeno-v1.3.60.exe
7060	Xeno-v1.3.60.exe
7060	Xeno-v1.3.60.exe
7060	Xeno-v1.3.60.exe
3488	Xeno-v1.3.60.exe
3488	Xeno-v1.3.60.exe
3488	Xeno-v1.3.60.exe
3488	Xeno-v1.3.60.exe
3488	Xeno-v1.3.60.exe
3200	Xeno-v1.3.60.exe
3200	Xeno-v1.3.60.exe
3200	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
1216	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
1216	Xeno-v1.3.60.exe
6980	Xeno-v1.3.60.exe
6956	Xeno-v1.3.60.exe
6424	Xeno-v1.3.60.exe
6424	Xeno-v1.3.60.exe
6424	Xeno-v1.3.60.exe
6424	Xeno-v1.3.60.exe
6424	Xeno-v1.3.60.exe
6424	Xeno-v1.3.60.exe
2780	Xeno-v1.3.60.exe
8892	Xeno-v1.3.60.exe
8892	Xeno-v1.3.60.exe
8892	Xeno-v1.3.60.exe
8892	Xeno-v1.3.60.exe
8892	Xeno-v1.3.60.exe
8892	Xeno-v1.3.60.exe

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
236	discord.com
598	discord.com
606	discord.com
619	discord.com
622	discord.com
237	discord.com
238	discord.com
599	discord.com
640	discord.com
235	discord.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6484_2101571394\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6484_1634886101\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6484_1634886101\protocols.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Xeno-v1.3.60.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
8056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xeno-v1.3.60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xeno-v1.3.60.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6444	msedge.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
6348	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343082088923998"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Xeno-v1.3.60.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2814447569-4053889695-374664695-1000\{EA1B5B33-923A-4CF8-8120-695900BDB96F}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Xeno-v1.3.60.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Xeno-v1.3.60.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Xeno-v1.3.60.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e8005398e082303024b98265d99428e115f0000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Xeno-v1.3.60.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Xeno-v1.3.60.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Xeno-v1.3.60.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Xeno-v1.3.60.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2814447569-4053889695-374664695-1000\{D7AA91AC-101F-45EF-944E-0CE2D720AD9A}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Xeno-v1.3.60.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Xeno-v1.3.60.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Xeno-v1.3.60.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	Xeno-v1.3.60.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Xeno-v1.3.60.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Xeno-v1.3.60.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4336	mspaint.exe
4336	mspaint.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3296	firefox.exe
2648	firefox.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6484	msedge.exe
6484	msedge.exe
6484	msedge.exe
6484	msedge.exe
6484	msedge.exe
6484	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	firefox.exe
Token: SeDebugPrivilege	5084	firefox.exe
Token: SeDebugPrivilege	5084	firefox.exe
Token: SeDebugPrivilege	5084	firefox.exe
Token: SeDebugPrivilege	5084	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	3296	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeSecurityPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe
Token: SeDebugPrivilege	4276	Xeno-v1.3.60.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
4336	mspaint.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
6484	msedge.exe
6484	msedge.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
5084	firefox.exe
5084	firefox.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe
4368	Xeno-v1.3.60.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
4336	mspaint.exe
4336	mspaint.exe
4336	mspaint.exe
4336	mspaint.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
3296	firefox.exe
2648	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
4368	Xeno-v1.3.60.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 5084	3728	firefox.exe	98
PID 3728 wrote to memory of 5084	3728	firefox.exe	98
PID 5084 wrote to memory of 4252	5084	firefox.exe	99
PID 5084 wrote to memory of 4252	5084	firefox.exe	99
PID 5084 wrote to memory of 4252	5084	firefox.exe	99
PID 5084 wrote to memory of 1056	5084	firefox.exe	100
PID 5084 wrote to memory of 1056	5084	firefox.exe	100
PID 5084 wrote to memory of 1056	5084	firefox.exe	100
PID 5084 wrote to memory of 1056	5084	firefox.exe	100
PID 5084 wrote to memory of 1268	5084	firefox.exe	101
PID 5084 wrote to memory of 1268	5084	firefox.exe	101
PID 5084 wrote to memory of 1268	5084	firefox.exe	101
PID 5084 wrote to memory of 1268	5084	firefox.exe	101
PID 5084 wrote to memory of 3988	5084	firefox.exe	102
PID 5084 wrote to memory of 3988	5084	firefox.exe	102
PID 5084 wrote to memory of 3988	5084	firefox.exe	102
PID 5084 wrote to memory of 2136	5084	firefox.exe	103
PID 5084 wrote to memory of 2136	5084	firefox.exe	103
PID 5084 wrote to memory of 2136	5084	firefox.exe	103
PID 5084 wrote to memory of 2136	5084	firefox.exe	103
PID 5084 wrote to memory of 5652	5084	firefox.exe	104
PID 5084 wrote to memory of 5652	5084	firefox.exe	104
PID 5084 wrote to memory of 5652	5084	firefox.exe	104
PID 5084 wrote to memory of 5652	5084	firefox.exe	104
PID 5084 wrote to memory of 5692	5084	firefox.exe	105
PID 5084 wrote to memory of 5692	5084	firefox.exe	105
PID 5084 wrote to memory of 5692	5084	firefox.exe	105
PID 5084 wrote to memory of 5692	5084	firefox.exe	105
PID 5084 wrote to memory of 5700	5084	firefox.exe	106
PID 5084 wrote to memory of 5700	5084	firefox.exe	106
PID 5084 wrote to memory of 5700	5084	firefox.exe	106
PID 5084 wrote to memory of 5700	5084	firefox.exe	106
PID 5084 wrote to memory of 5712	5084	firefox.exe	107
PID 5084 wrote to memory of 5712	5084	firefox.exe	107
PID 5084 wrote to memory of 5712	5084	firefox.exe	107
PID 5084 wrote to memory of 5712	5084	firefox.exe	107
PID 5084 wrote to memory of 4888	5084	firefox.exe	108
PID 5084 wrote to memory of 4888	5084	firefox.exe	108
PID 5084 wrote to memory of 4888	5084	firefox.exe	108
PID 5084 wrote to memory of 4888	5084	firefox.exe	108
PID 5084 wrote to memory of 5664	5084	firefox.exe	109
PID 5084 wrote to memory of 5664	5084	firefox.exe	109
PID 5084 wrote to memory of 5664	5084	firefox.exe	109
PID 5084 wrote to memory of 5664	5084	firefox.exe	109
PID 5084 wrote to memory of 5276	5084	firefox.exe	110
PID 5084 wrote to memory of 5276	5084	firefox.exe	110
PID 5084 wrote to memory of 5276	5084	firefox.exe	110
PID 5084 wrote to memory of 5276	5084	firefox.exe	110
PID 5084 wrote to memory of 5284	5084	firefox.exe	111
PID 5084 wrote to memory of 5284	5084	firefox.exe	111
PID 5084 wrote to memory of 5284	5084	firefox.exe	111
PID 5084 wrote to memory of 5284	5084	firefox.exe	111
PID 5084 wrote to memory of 5544	5084	firefox.exe	112
PID 5084 wrote to memory of 5544	5084	firefox.exe	112
PID 5084 wrote to memory of 5544	5084	firefox.exe	112
PID 5084 wrote to memory of 5544	5084	firefox.exe	112
PID 5084 wrote to memory of 2804	5084	firefox.exe	113
PID 5084 wrote to memory of 2804	5084	firefox.exe	113
PID 5084 wrote to memory of 2804	5084	firefox.exe	113
PID 5084 wrote to memory of 2804	5084	firefox.exe	113
PID 5084 wrote to memory of 5632	5084	firefox.exe	114
PID 5084 wrote to memory of 5632	5084	firefox.exe	114
PID 5084 wrote to memory of 5632	5084	firefox.exe	114
PID 5084 wrote to memory of 5632	5084	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Снимок экрана 2026-08-23 213114.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3412

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Drops desktop.ini file(s)
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27100 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {d67c749b-9a45-4b28-9f28-5396f00ac08d} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27136 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {12631b61-c898-4703-b0c8-0bb77e28c214} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 27277 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {6f38cfbc-8211-4990-815e-899af5fef450} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3932 -prefsLen 27277 -prefMapHandle 3936 -prefMapSize 270279 -ipcHandle 1656 -initialChannelId {0df0e774-3e2c-47ed-9a50-6e20bc036d97} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4396 -prefsLen 34776 -prefMapHandle 4400 -prefMapSize 270279 -jsInitHandle 4404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4412 -initialChannelId {9fac7b20-fc20-4685-a875-666177bc6e00} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4964 -prefsLen 35013 -prefMapHandle 4968 -prefMapSize 270279 -ipcHandle 4976 -initialChannelId {57475f79-d1dc-4560-ab1c-d9b5d9f1184c} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5204 -prefsLen 32952 -prefMapHandle 5208 -prefMapSize 270279 -jsInitHandle 5212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5220 -initialChannelId {1c7bb9e7-da3f-41e9-979d-98d8c775c545} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32952 -prefMapHandle 5268 -prefMapSize 270279 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {73e6fd17-2531-4fa7-a59e-7ad50a89d34a} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5580 -prefsLen 32952 -prefMapHandle 5584 -prefMapSize 270279 -jsInitHandle 5588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {1bb009a7-ca66-454f-abbb-25f99944c24a} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4644 -prefsLen 33071 -prefMapHandle 3800 -prefMapSize 270279 -jsInitHandle 6084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3124 -initialChannelId {9da87746-0b38-4555-8246-630f6f8765f9} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6464 -prefsLen 33071 -prefMapHandle 6468 -prefMapSize 270279 -jsInitHandle 6472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6480 -initialChannelId {1dbcca99-f150-4a68-bfc8-63bfab1c13a0} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 33071 -prefMapHandle 6520 -prefMapSize 270279 -jsInitHandle 5748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5612 -initialChannelId {e6a87668-8126-473b-b4f7-755ed0530a01} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5440 -prefsLen 33071 -prefMapHandle 5424 -prefMapSize 270279 -jsInitHandle 5428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5240 -initialChannelId {c9ac66ac-a623-4aca-a401-bcc1c0559291} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6076 -prefsLen 35201 -prefMapHandle 6056 -prefMapSize 270279 -ipcHandle 6696 -initialChannelId {2931e577-a1dc-4843-af92-80f2d59259c2} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    - Checks processor information in registry
    PID:5544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6368 -prefsLen 35050 -prefMapHandle 6108 -prefMapSize 270279 -jsInitHandle 6520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6240 -initialChannelId {d09d3669-b87e-49df-9e3b-6cf9f85185af} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5440 -prefsLen 35498 -prefMapHandle 3800 -prefMapSize 270279 -jsInitHandle 6916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7136 -initialChannelId {f0e23cca-35ed-4cbc-be17-86e99f040105} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:5632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5220 -prefsLen 35498 -prefMapHandle 6916 -prefMapSize 270279 -jsInitHandle 7136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7076 -initialChannelId {5bd7b0b9-d53f-4201-a6ba-e706dd3539ec} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:5692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7892 -prefsLen 35548 -prefMapHandle 7788 -prefMapSize 270279 -jsInitHandle 7900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7908 -initialChannelId {55fa6382-7ca3-44ce-9d86-36a8045a7e50} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:4552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8128 -prefsLen 35548 -prefMapHandle 8132 -prefMapSize 270279 -jsInitHandle 8136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7944 -initialChannelId {8fb6d4dc-873b-4a40-86f8-9ff37ff2a789} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:1788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8336 -prefsLen 35548 -prefMapHandle 8340 -prefMapSize 270279 -jsInitHandle 8344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8356 -initialChannelId {de886e48-230f-4299-bde3-f3f248b807c3} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:2824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8760 -prefsLen 36935 -prefMapHandle 8764 -prefMapSize 270279 -jsInitHandle 8768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8736 -initialChannelId {5baf698d-d958-4be4-ba56-832edef9f83d} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:4224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8928 -prefsLen 36935 -prefMapHandle 8920 -prefMapSize 270279 -jsInitHandle 6436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8792 -initialChannelId {5f99f771-4ee0-4428-a9b5-085d8e56881d} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9172 -prefsLen 36935 -prefMapHandle 9176 -prefMapSize 270279 -jsInitHandle 9180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9188 -initialChannelId {d21d660d-d5c9-4849-b1cf-303698c8015b} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:4324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9236 -prefsLen 36935 -prefMapHandle 9232 -prefMapSize 270279 -jsInitHandle 9228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9284 -initialChannelId {ed976536-03de-4228-9ce2-7e7ee8db7409} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:4980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8188 -prefsLen 36975 -prefMapHandle 7788 -prefMapSize 270279 -jsInitHandle 8176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9676 -initialChannelId {6e718d37-53ab-47a1-a7ce-43eeaa9aa1cd} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    - Checks processor information in registry
    PID:1460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 10072 -prefsLen 40115 -prefMapHandle 10076 -prefMapSize 270279 -ipcHandle 10084 -initialChannelId {aa8f9e2a-e92a-4260-a430-a4f48ad71f17} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 utility
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10168 -prefsLen 36975 -prefMapHandle 10172 -prefMapSize 270279 -jsInitHandle 10176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10184 -initialChannelId {2d83044d-b406-4c9a-b2f5-b3c8be85de2d} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    - Checks processor information in registry
    PID:5744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10324 -prefsLen 36975 -prefMapHandle 10320 -prefMapSize 270279 -jsInitHandle 10316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10308 -initialChannelId {dcccbede-d748-41b6-9e0c-1609a4d9a597} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
    3⤵
    - Checks processor information in registry
    PID:5044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9632 -prefsLen 36975 -prefMapHandle 9624 -prefMapSize 270279 -jsInitHandle 9108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6964 -initialChannelId {c970d446-4516-4dfd-b5ba-e520c6a9b426} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
    3⤵
    - Checks processor information in registry
    PID:4940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9852 -prefsLen 36975 -prefMapHandle 9844 -prefMapSize 270279 -jsInitHandle 9836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8348 -initialChannelId {93a83af1-f4ee-4682-a47e-746a8e6f0181} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
    3⤵
    - Checks processor information in registry
    PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 9776 -prefsLen 40115 -prefMapHandle 9788 -prefMapSize 270279 -ipcHandle 9828 -initialChannelId {ccd5dea5-0431-4cf7-9892-fd54c0d7ea2a} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 utility
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2648
- - C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
    "C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe
      C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1728,i,4020931443100808502,3754991897764346515,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3488

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6916

C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
"C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3200
- C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe
  C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4368
- - C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe
    "C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1668 --field-trial-handle=1692,i,2259527177736405920,18391875915584821484,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe
    "C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2296 --field-trial-handle=1692,i,2259527177736405920,18391875915584821484,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6980
- - C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe
    "C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --app-user-model-id=Xeno --app-path="C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2428 --field-trial-handle=1692,i,2259527177736405920,18391875915584821484,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:6484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x310,0x7ff8920ac188,0x7ff8920ac194,0x7ff8920ac1a0
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,4148279251691555472,7967745782086237664,262144 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,5057725075132211952,17367993626076816645,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
      4⤵
      System Time Discovery
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,7466074572832300470,4061185838152123444,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,9218937471352225375,13922725777139301247,2097152 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,927602654317140885,11870844035539575298,2097152 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,14157829611638763847,9198616313030904138,2097152 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
      4⤵
      PID:6356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,11031113319492249446,12444299894010780777,2097152 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
      4⤵
      PID:6652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,15474722479777722023,13601675686631060052,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
      4⤵
      PID:7420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,11575268673007879710,16671894912878213824,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      PID:7544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3640,i,16763527866099800897,7074694276100105291,2097152 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
      4⤵
      PID:7712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,9558189593463708072,11396180652652758974,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:8
      4⤵
      PID:7888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,7157763302553732488,18157896253072948018,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
      4⤵
      PID:7880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,14271280177238595792,3398823791460732550,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
      4⤵
      Modifies registry class
      PID:7352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,12164269723476502987,9504525765038633149,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
      4⤵
      PID:7364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,3302514389960724295,9812541490471661502,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
      4⤵
      PID:7752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,3302514389960724295,9812541490471661502,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
      4⤵
      PID:7844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,8460258282435471502,15290326836789936944,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
      4⤵
      PID:7604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,14815965758746120083,12072816841393855515,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
      4⤵
      PID:7700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,3623722362135605774,1673440957441744481,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
      4⤵
      PID:9028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,9908632685016991678,15218478210739230583,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
      4⤵
      PID:9036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,8569860909025292842,14199573606093325959,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
      4⤵
      PID:7212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,10375546547947339952,2411518277410323225,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
      4⤵
      PID:8544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,9581857995456119246,17548567486530934696,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
      4⤵
      PID:8536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,15978690112026144771,10619679556684845037,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
      4⤵
      PID:8824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3368,i,8328426547043087503,11315084307359810508,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
      4⤵
      PID:7592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,4892805304622585366,17118452223744300379,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
      4⤵
      PID:8012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=884,i,6451934564375532234,14153966152794425638,524288 --field-trial-handle=2204,i,11964157939419354592,9064104931298765212,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
      4⤵
      PID:9108
- - C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe
    "C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2800 --field-trial-handle=1692,i,2259527177736405920,18391875915584821484,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6424
- - C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe
    "C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=3760 --field-trial-handle=1692,i,2259527177736405920,18391875915584821484,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe
    "C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2504 --field-trial-handle=1692,i,2259527177736405920,18391875915584821484,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:8892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM RobloxPlayerBeta.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:8056
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM RobloxPlayerBeta.exe /T
      4⤵
      Kills process with taskkill
      PID:6348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:5480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:8312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e4448ca9f236ba1a9ae2db196c350ecf936119c03ed3f44cd388bcc39067923c
MD5 776c65a8e9a4a380f4ab611ae67034f2
SHA1 e0a0e3529ca7ff56d512fe9d1e8b5d641a98cb8b
SHA512 f993c36b5853a211dcc327f59ca5730b9f33f5a2b1a50da31c487c31312af98b94e088c5f5a6c10bb62e986c998370d68f0733d2636c281a30b294afeda24a6c
TLSH
T157D02228A2330800FA2AA2F300A88FF02300EC0C23C08A03F0320838BC02B0022CFEC0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db27f10a02296b23f1c84ce23d8bd8face68517c43a553f82c316ac46f0db8be
MD5 5e2dbed42857899535d91c5c2d5ce3b7
SHA1 346277f7fc97e9d3fccb644bd0f8441cc58fe138
SHA512 c2727e81c41b8d7091092a7155568f311413896f34a9c04de8487c45d130f247f5b0a4e1768712c6e2292be65a81999cf7349086692e9f731dc1ca0fab66b144
TLSH
T1D3D02228E2330000F22AA2F300AA8FF02300EC0C23C00802F0320838BC00B0022CFEC0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 70aaf279877edf9dd0070bc9dd535a6380bf2bc781449a91424b59d29ea145e9
MD5 f41ace2095e5e085b8575f089e02e09d
SHA1 ccc965e8c49d9225b74ee9ea855ffb9ef260cecc
SHA512 5112f899df46be4e050ed826469f014b2ddfceb6e19854864bac089c86670cdb7912396b7e76c85e49c4fa388fafd0baa54cb2102af7f2bccf22e1aa05be7c25
SSDEEP 192:F2c8hOQSZc4unnG6ydswKMHimreJSptQNMyBawBBsbLD:wbhOQIc4c0gkim4SzQxswUHD
TLSH
T16322B8A413794E46FB643E3850F8194639B0572E9E87EF5E124FF8BC176B77D2202898
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5e411e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5e411e.TMP
Size 3KB
SHA256 7a920231009641698007613d934a89c87d5282eae0029a77d23d6658c843808f
MD5 d190c053b9617c41dc0f661d8c6dbc10
SHA1 99c8cb2a826c96f8c44eb854ea9d13c72ace1dd9
SHA512 06afb962e4af990c36e538603f35e7129882f88b1ded70a1244506bf4e617809ab589f4e0c15324c6ba9ea1e64f2fe6a178c333ced09fc8e63f540b9f0a82dae
TLSH
T1176171C503924C53CFB4223891CC11873E35AB8BA1C7FE6D0198F8789B5E361328789C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 14998827406189fae67eee7c656862565e0bcde99b500e4de55f83fcdd1b363b
MD5 b5c5297416d379f54f62c1c50cb07403
SHA1 3b61659c36ffdff88c13f8d9d64cbf4f4f09aa9e
SHA512 3cdbf549a7a2d129c5f84ed227b060de15c20894f44edaae4719e4ef287b15af731af5682e2fb8fda6b4aea3074c705cca1d96bed2dea2fce40bd4d6d44140ce
TLSH
T1DB51ABF3C7E8866DC90156F4AB187E2BCE2D0954432C3C6AC8E4AF1B93E2471E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c46e841e23bcffe4d63fde8ca80c0db3862d83d76b981a33abedfd56b1fbb5ab
MD5 d753526657eae42b0ce294cd74048599
SHA1 b139640271f22c144a4e8cf09553375dff01ee83
SHA512 2caf7fb1cbc78c84be3542b18e492af11175aabbb196384a88ea94ec7fca26ffed1d022586a133b64e3c2e82bb778ad45ea720f1a3f9b34f2d44a069d60951b5
SSDEEP 192:sxZAR7Z4/fbsbyYNkHEIdpEXHW6+WNzk6/eB2h0bpIg4J:sxZAP4/fbsbJYqHbN/efc
TLSH
T1A022D756BE28697B8CCBE20DBA15BF13D6F9103251D51E58FAFC862C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a5282476a11146fc47210e84faf9e5dee83b3f2728738d0d5ba223994475c9aa
MD5 a6f64432e683d1fecf1847939b535820
SHA1 9d25505f99f05028e763380d0af4f9b698ab47a6
SHA512 51203ab924bef879594d7de93ef5c0b3ba9682045eec3bf78e3437f2cbff3f901de853b9e07996cee157dbe36c97daeb57bf56eff81e95d20d82370a501835a7
SSDEEP 192:sxZAR7Z4/fbsYyYNkHEIdpEXHW6+WNzk6/eB2h0bpIg5wJ:sxZAP4/fbsYJYqHbN/efW
TLSH
T10932D656BE28697B8CCBD20DBB15BF13D6F9103291D51E58AAFC862C05E66CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 cca005ddb18feb96cd3820e0fa40cfe503ec6e5893231ce7ea3e7b3f1335ad85
MD5 62c72c5afab7dba476281c932ff3afcc
SHA1 7bb8c449fafe20cc853daff2e8a70fb6a3994296
SHA512 ddc28edc5111ac0a554a8981116f1a8f55ca53e0fb84dfab4bc56bec9e9411a2fefdd7fcf04ac71e413f1447dce89784b4282163d9edd6e7ef59b8b8138adb77
SSDEEP 192:sxZAR7Z4/fbsXyYNkHEIdpEXHW6+WNzk6/eB2hGbpIg5WJ:sxZAP4/fbsXJYqHbN/eDg
TLSH
T1A032D756BE28697B8CCBE20DBB15BF13D6F9503251D51E58AAFC872C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 a85c7b366cf4490116fa550523b26fd624e9775c864f6d1e681cb104bb4869f3
MD5 b68a223429702c7ef7cf175c5e016f63
SHA1 85cba3b2a2506e19af0f88fe956a3d844616e03a
SHA512 b71f35ca1992315c527e49f49af6fef167ebb279bc6d6b52e842254bce4a479d95dbcc7e4f85671d538632b2d43f1a9553f4f6bb930e9efbb6e594a2833e2a19
SSDEEP 768:QJyI5kN7pLuLbjTWvvd5x8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU9XyLlYmHforo/:QJyI5k7EbjTWvvd5xu1jaF9XyLGgfT/
TLSH
T1FFE2F97B780CCA7E4FC00A9CDD5A7F9B6DA8028BA698CD4047FE945C03C66EE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 55b4c64f201e5e005a589a50aa6ef469b08f2bc98d578e74bb8a49b6aa015c93
MD5 28218b03ea2e38cb455f55cfc26325ab
SHA1 73ab40a8d218e5a08ec14e062bffd05248fef880
SHA512 4cde44505fa904f91c0a29d7ae378cb0a2ef77b825a88b91ddec51a40103d3cfa602c5da4b48d72c076f79ce105cec0068c51a5f5c706564be8c695b87c5e2fd
TLSH
T15ED0A75BA1645690EFFE8B861732526D862038CC60C9D08CA81304659459E52B693FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 1e1441d78efe1158cf55dbbd7d103e7343bd53ebfd1bf584824a53dff133e21a
MD5 c9461deb0116c6c1eb62c7cbf150bf3e
SHA1 688796827be3345c103a231fe0f73cd2b25d6390
SHA512 5c198e1352473bc639b789757d0ae6852690eeff147ff407dc0f1514f5a08b78a6e033985c2a63451a04b0613a46f283042d8e628c22072559ade172bfa2b782
TLSH
T13BD0A757A1651590EFBA4A871732629D46603CCC54C9D08CA8132469A479E52B6A2FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5dcca9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5dcca9.TMP
Size 138B
SHA256 f0b9256ae4a38567df7c9c6ecf123e7d086c4517bb5e8ee0dc860028249113e8
MD5 4ea857099c918cb0332adbcc5801aef3
SHA1 995273306bf29f81d7ed0432cb509f651ba76d2a
SHA512 a2fbe2d193d89374ad63a7bf28af61b865fcdf1de66a5d8ecd5356c90d15fcd1b6516d5e17e1a011ad59d931a05b9e28a415f0e605362423e1edad56e5d5f4a3
TLSH
T17EC09BB7A4840565DB3D46D61332625D47153CCC58C6C48DA41335643075E137553FE2
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ea9f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ea9f9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 213519447d06f8c590f37a1db1ff23a61c5a9eb4b7cb4a4899119e246cf89946
MD5 ac694f72be4113468c73eb62c291292c
SHA1 b776e19bf36b0598ce3876dac22c0b966dcf02bb
SHA512 88b2b11c9d2d3849967e74977f0317676852e7c6eb9140ad498e96b629e72b16d51b3d9d8dfad6e66f8326d870ceb3d55b31c5ba1f3a26ad4a7c8ef8dc8cdf87
SSDEEP 192:uuAm+xasuheOwQxMlsNqkZQ6Q+gIf+REQmiU1JJu44X40+FWHKdxaVx0hg/J5ID:njZcIisNqkZk+Xmepx4X0WHKjKGeID
TLSH
T1DD625B316C79AC3799EFB101B48B26138FF8607799C45F90E6E89B1E01866BD131BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 99982f41a7896dd6f2b0f3145bf46d0922c36ba7e1aac4edccccfb432ac7279d
MD5 aea5b509c9025d8b7e6eff25e21f66d9
SHA1 936cf8d62890e6e7748f4071b50765a4efe5ee77
SHA512 4ca37f7cf642a4cc6c9329728cafeea71295fd24d754893b8adc1e2824affa0f90d799949980cd285e82067143acfb7be4d28f505b7fb85969e1ab2caef76c51
SSDEEP 192:FONo6owQmiUymUpvX40+FWHKdxKrnw8U/u:FONo6V6pvX0WHKjChU/u
TLSH
T10702D635AC787C6B8EE7A945B98B26135FE4116BA9D46F80DAE82F1D00D765C2307C32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 8efccf151f76a7cad5fbc8aed9386486b83fee3a25cbba20598c3f28e220a30d
MD5 a7e9b22a604c89090b48550deffba30e
SHA1 8b892051a6a7eb84736859d5a148f3a82cef36b3
SHA512 fdd4e25bcdc91c926383b6ec50baa8caebfb154f72499b3c7743bc97dfa30b2362f8183b77f5ce87ce73f89c1c069d63e30724dec4404e51ec2750ab8688931f
SSDEEP 192:FON76oxQmiUyKUDvX40+FWHKdxaVGPMg/J5U/u:FON76WEDvX0WHKjKxeU/u
TLSH
T1D212E731A8A9BC6B5DEBB041F4CB25435FE461779D85AF80EAE45F1D00C666C230BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c80d07faaf8b7747ba63306c1ec3cf2f20921b3e1523572661ae87530e211a9e
MD5 df5f20e2703b9af40ffde7e215f62d58
SHA1 46470304efff197281068bf91a0873c1a72ebc13
SHA512 0ce6920ea18b609d76f85fbe639d735869575edfe1d560c17f06b07e727dea3e7d2b2cd0eb159ec7fa620c55dc3c2d0fd132c63dae7288aca90e55f99987f59b
SSDEEP 384:nCiFiZcIMksNy8TUNTUlIlkIk+XmedxODfYJX0WHKjK9meID:JFQfDwg9XNHh0YKj+meID
TLSH
T1DFC272F598D7993BE8AE5383A77E2D428EBCD063B5885980F7945E0DCC821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 4c27554dc5e59372fafa171c81536dec0592bc8f820610137591fa1b2620220e
MD5 7c734638de62e32a1a6a925332e03eff
SHA1 18e1b4bb59b86cdfaaa2338bef742d189afe4269
SHA512 5e9629cbb1f6d54fa9436e911ef59c57561621cf149d46caa25cfde2068e85b3012569824cd1e45716bf8f6d34e131a12ead9a1f93dc68d0db3b0e4f510f624e
SSDEEP 192:uu4m+xasuheOwQxMlsNqkIQ6Q+gIf+REQmiU1JJu44X40+FWHKdxaVx0hg/J5ID:nLZcIisNqkIk+Xmepx4X0WHKjKGeID
TLSH
T1D5725B716C79AC3799EFB001B48B26138FF8607799C45F90E6E89F1E01C66AD2317C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

49b67f39-b485-44a0-9814-76ef2dfe9601.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\49b67f39-b485-44a0-9814-76ef2dfe9601.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 27c49bba229c24a196a5f683ec9b8b2b75917d7b4d4b07e24dc8cabdea02ddcd
MD5 6130fb46d82d786cb506de79834f4118
SHA1 1c7216a4e8823cefd44e691b9d19cca11d80e68a
SHA512 d63f5404b0adc006d5c9da72c5cdb6ac1243f84ae17a666909b5b633ce2a83bf2a50757bfa89533b863b35a3709fa9c902dc6e848aa0c37ecc55f9e3de6dd26d
TLSH
T1B6412798A6F91148B3B77F1A9BF6A86E587FB8772E06D45E10010E4F4962B00CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6zufhr8y.default-release\activity-stream.contile.json
Size 5KB
SHA256 3d281afbb1bfb93d3ec62d3b2f682ee56b6b75d5006dba54cb68c8d668a9369b
MD5 82519ac255e6eb91760825ffcf28ad4e
SHA1 238838180bc04db7bc426694e675814db87d57b3
SHA512 a6fa7afa3a3f78ab6005bde850336597798708c2c39e3804e02791883338ac6c059eafc4391d27f24503714c9ef58028a1f04f431715b0306f6511b475701319
SSDEEP 96:TjOLAZUdZCLAYjptssbpALAnlYRT+mRINb:uAZUdIAOtssbGAnl/mRINb
TLSH
T1D8B119AFF950491367739BD42D56271CF243B24AD4D8EFACA3D6AC1111AC36D42ED8C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24743

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6zufhr8y.default-release\cache2\doomed\24743
Size 22KB
SHA256 c4229051289e3a471c6afb330028f8708f590e9b5d1465c543d3a841162766f4
MD5 8012e30415f9c43af31cacc010851c73
SHA1 6b829803be08b2f42a11818cd911ded9d13e0e75
SHA512 76cd516aec6e9059f2afc28961afcdf801463b2d8a3bd2a2ce44a54651d8aa8577898102454fa34848e12e12eea82b15e7dd61da3f4f82d77be216544362ec07
SSDEEP 384:7YRw4Jpy+spVsyiSdQpQb+drJcqu/blUM62U5yTrKqedYxCEm3wX09ClPEqnAJl:0RYRHKI+drJjCb+/29Tr9eixCX3wX04A
TLSH
T1F4A2C0B71E0434858B2AC5C14D1D6F6F2D189B6BD5C4D09567C02F05AAC4FB3C9ED0AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03D74D5ED346B6A425AA45C38A54C3F6BCFF5085

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6zufhr8y.default-release\cache2\entries\03D74D5ED346B6A425AA45C38A54C3F6BCFF5085
Size 47KB
SHA256 0e633c52d637862338b72ea97bb4633f6a88bee3724f188ab65807ebad748e1a
MD5 4f5c8290ab99e977d6152a2ef1176e38
SHA1 38e9004d9c8952d4357bb512cc885cd4d0a1b8f6
SHA512 b47f756803aa21b839fcfd227cc09b6e2f85a07ecd10ae0192accda9847fc1126e62d9cebc10611844b2b872ad30fcc50c2f3a07fccd0dbe681ce8cdbe4dc9dc
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uTLSN1:eUEEoBVQDjeQaLnP2pfZTqgSEgwQuoR0
TLSH
T15C23F137284A3D90C381E2A0949FF9097C43B5A2DFE199ADD0683BC741093995FF65EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1BE83AFAF5BCF0805FCCBCEABCEC088D066292F8

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6zufhr8y.default-release\cache2\entries\1BE83AFAF5BCF0805FCCBCEABCEC088D066292F8
Size 21KB
SHA256 8ab7172110957d56cd5342daeac04303f294854133175b5859cbfe7eff0e1a89
MD5 62389ddaa7611f2374d98aff34949938
SHA1 fb84253bcdc20b46b81a10525750ecb0d64d0a13
SHA512 a8fae52a9ef18dba9c94e5bd04cb0e82d6fefeacb4ebfb9ee3cd420a3547170809d1051a0f49955d4ada4f801a2a1796663ef8a2a61dac0219edb6f6bb80b938
SSDEEP 384:+t5BQlOd7oWf+t3QZWfnNtLIWVjwzIvi6qppvu1Bsg:wsl+oWJYnLIWFgIKRpvuHsg
TLSH
T11FA2D03F0E21190661D255E98E36A7683F14BF12F9D9DEEB5D4E3D0160C67EB841314C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3D24A59C40BC55543305891C1143AA824DDAFD7D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6zufhr8y.default-release\cache2\entries\3D24A59C40BC55543305891C1143AA824DDAFD7D
Size 15KB
SHA256 439cec7bdd3ddaf94314ed96da8c9a1f580e215d6c1c8da9af7aa64c15dac6af
MD5 e2d0f865ba23991279121a3f62a652dc
SHA1 18e2dd598fd13754afd1c59d9eebee329efc451d
SHA512 3e3921f27bcb4f0b66c8108cbc3a857dc2c85aa0aac69524f2da99ec9f735fb2f97320524e54a0d4b3ac733832b903a996b0ca8adf194760ad06c4f546524abe
SSDEEP 384:6980/AEIEtavHJkVSpTKA1Hc/uj72SbmzPsBy:g80/jXGoS/euj72SbOsBy
TLSH
T14362BFB94F92432B7E8203F1C61F896A0EE99D63A8E5D67D2908300C4C85AB99D87108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7320E8D7B4F1807C903A9FE86293F9895E274E71

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6zufhr8y.default-release\cache2\entries\7320E8D7B4F1807C903A9FE86293F9895E274E71
Size 13KB
SHA256 10c611e5117990401ce4e6a65703a88f4564a8b518830ce484f6702fc2f8fb51
MD5 4c57887a705dc9b273eed8c294b8c5c7
SHA1 659ace69be24b3de8bf916ec7705e2ff0e70483a
SHA512 b3d9bb89faf06f53bc0f5b906cdde86bce3c69d8d00545eb1fcb4b8e65389253a0ab1dec992abe6cd8fb400ec619bd909bc65641e17835ba318277085dfcaaa0
SSDEEP 384:7yMBmpFiG/06veO5np9ltc2UcJHKKaPOGnAOQ:7zBIeO5VTxHNaZ+
TLSH
T1B752A0770F11751943E344D3D7875ACD7E6129B3DEE6D0E4A8093A00B9D8779CF8688A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7D5090DA7B302D5BC47A8CB2313078E883F18CCC

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6zufhr8y.default-release\cache2\entries\7D5090DA7B302D5BC47A8CB2313078E883F18CCC
Size 30KB
SHA256 e6eec75cca1d6ee8faf3ae5dd972a53d1ef17049591bd4ac2123aeb077959ada
MD5 9830ff9e829639b45855bac347927ee4
SHA1 7f3a2f955c050213b14c63e0149ae2fa050e4496
SHA512 2acf6a529f7700b0e4a1e868a18d6bfba57bc17379d96990c3fa42f7c60a27a7ca619964c2687b2f4f55833f8eab71c34feaa96258ee7fe3d5a1b0549b986a9c
SSDEEP 768:oamOTZE0hAdJfoxmiJ9zdC9SpCwJoF/YuCsXvsc:omZnOnfoXH3foNYJU
TLSH
T1B0D2E0772C0065542AF723534CFA1B58FF61BAA3F971E25D48640929C0D03FE5B662BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6zufhr8y.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 6c7585850a45eacb1ec76249ed35069ac0c7dccdad0b3532857752db814a7b01
MD5 2566ff8aef3e6cdee40d24dd936a42dc
SHA1 9da13a2c376e8e98bbe803c5e9892b6cbc61dced
SHA512 813b6137c7a45e5a4702fb2126a8ab21ddb547241a8eb7d297c1164ccdb5e956418539bf0880641c497ad41be99da2349233fb00654094ac6731e58ccb988a17
SSDEEP 384:HalwSiO024YODL84KKDL849B7SOEAd9KVRaAcP+AWRMAyL+nS+b:6l8ZYODL8lKDL8CB7S/AmVAf+hRMzLE7
TLSH
T127728E3D4F403CAC1597D0E8C4B982AA8D18B7A7DFE680BD21583D0DC794A69B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E5AE6F6AF1E3C1048B381EC930DDEB339B86D9D6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6zufhr8y.default-release\cache2\entries\E5AE6F6AF1E3C1048B381EC930DDEB339B86D9D6
Size 2.6MB
SHA256 5ee7fbc9d3d19433d87ed58dab9006cf18141f169fdf6f920953b211a7887a15
MD5 0e2eed64687b2f4e3f8baaa5507e3140
SHA1 3bd5417cdec4a313a32f4cb9cb26af26ab854576
SHA512 8267f9aed99c807eeeeb15398c7495b074d70277f626058f17e8095f28c4e6c38e9e75c1cad39ded1ae4101d3caf2027589b74df69a02d455c0b293ad1184d30
SSDEEP 24576:MdNBgTS81WABENglKn71okjq5mMCvmqcBH08V2URGUF1GhkBc6LO/6XgxjaOiyjz:MXBMS81WABENg8n71okjq5mMCvmqcBHq
TLSH
T189C5182AEE515F17C81403F184AB17343B34D0455BEAE32B7ACFB126BC673691E961AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E5E64E52DFEC73AAA46B59FA1856DF0913CAC1B9

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6zufhr8y.default-release\cache2\entries\E5E64E52DFEC73AAA46B59FA1856DF0913CAC1B9
Size 2.1MB
SHA256 5aeecd7aa5d93772662c13986e05ae341c8e0bae2e3b50062bf2bafb8e43488f
MD5 689141fcb5233ae2434f7ebbbcd13310
SHA1 d37d758a725bbff1495e553ee05fade3a5527a17
SHA512 9e2e101fdf883ba8a522cd5815b17f5ecb572a91021f5dd696461a578eb36acd1d894be6ac9b6b81256f88e99ea6165a741be825af282d9634df78641cefcaa9
SSDEEP 24576:aZlGzXI796yV4T32CKvolcgoMaNvCwzwNQJA5F9ZzczsJAp9ZziwQBVQdZzFwQBR:aCzXI79232CKvolI1vpp
TLSH
T1C3A5E85AFF82AF62D961127040B723313B75E44117E6E32B3E9E75257F1A3680E6236C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0feeae7a-1d29-4694-a1c8-91bf21751067.tmp

Path C:\Users\Admin\AppData\Local\Temp\0feeae7a-1d29-4694-a1c8-91bf21751067.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Xeno.dll

Path C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\resources\public\Xeno.dll
Size 2.3MB
SHA256 c015896a88b7dd391c1fcfb612d18ec2585ed74162d197f09c2f22bc9aa5545d
MD5 0605723ab6eb4c0fe718c0cc33e31424
SHA1 fba34d0a82515c91e5f36413330c3296407e6138
SHA512 a76266f8f844f94f3dea766c84fa17b2398de5d54f9cdfd896e8b2315b279971173c42833fae957b674e4ea41e997ea5f9b454f7cc978b6ba5e970c23b556290
SSDEEP 49152:5+jqPOu2DM1P8daBpcU5TgySscBxFkUXDBIhm1/:Je8/WbTFhDDd
TLSH
T1E5B58E67A59900ECD076D1F8CA1B5513E7B27C4903306AEB02E0B9652F27AF58F3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\resources\public\libcrypto-3-x64.dll
Size 7.1MB
SHA256 16e85806333aa3b3a4fe8c31c9402b78ee01a4a143e9031db165c48386dd6289
MD5 b47c9988a203a596803837c128853517
SHA1 2f669bf535dde5727989da919ffa5c36cf9d78e2
SHA512 24874b5902785cea67d3781e59471e6b8fb8c9d9e6e33e8c894745eb4324bfa1ab123ff2809269e1a7b2eb604343efe556183479c0e0d30214dec252c31fb69b
SSDEEP 196608:uHhm399Xki0GiR/8yGX26ui1CPwDvt3uFOxC:uHhm399XkifiR/8rGfi1CPwDvt3uFoC
TLSH
T164767BADA67C0109E8AA81BDC2979327D771B91957F013CF186196F80F23FD92B7A740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\resources\public\libcurl.dll
Size 637KB
SHA256 8645f1b6bec48f061e54941ec1d9c5e4b8096ce1a80d8ea0a0353e4cb557f8f5
MD5 8c14feded4b94c4b72af1f710f236778
SHA1 62dd8f17cff9916faa792a8188f8e82ed6edf9c8
SHA512 c0222d788aef2be7eb205f923302a79b59ec6018210944cf6d807b073fcd2c08182f42e4a1766b7e42e190ac4ebb090f6afe026a52e5bb11f585db180bbe0fc8
SSDEEP 12288:EzbJ84IyhxblduSGHhphyfiuEkatR5YI80OdnmqKENG:EzbJ84pjbWSGHz1uEkatR5YI80Odnmqt
TLSH
T13CD46C56B3F414A9D1A7C17CC6538227E3B2B0542361A7DB12B4CBBA6F13BE2573A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\resources\public\libssl-3-x64.dll
Size 1.4MB
SHA256 bfc059e16951fa90cc14489a8263f35c6703e762f2f5413682b4f7935bbced57
MD5 754fff93ed112eb26bd4a6b0e8300deb
SHA1 de9edf5c9ac80b1f26dcc91d89791065097a7d23
SHA512 05d215d1e0cd65a98cf55a2a5e123992e5719006eb346261c0c03a629cfe2cde910765a1a87a3f5a93d2371ea9c15d677277b903d55c24731bcc7c7eed87a71a
SSDEEP 24576:CV6b+rLptrBSFH+tK8olR+WmXWdEVB36eVE:CV6bedt9UlIzWdEVB3a
TLSH
T1F1656CAAA7B8019CD5B6C17CC2934B23D2B6F4162370A7DF0A658A781F63BD5173D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\LICENSES.chromium.html
Size 7.9MB
SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
MD5 0e3e4362f785aff0b9e1852b1064c0f1
SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
TLSH
T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\chrome_100_percent.pak
Size 132KB
SHA256 99ca6947d97df212e45782bbd5d97bfb42112872e1c42bab4209ceedf66dc760
MD5 443c58245eeb233d319abf7150b99c31
SHA1 f889ce6302bd8cfbb68ee9a6d8252e58b63e492d
SHA512 081f3ee4a5e40fdc8bb6f16f2cfd47edde2bd8f3b5349775526092a770b090c05308d4289ecdda3d541cf7f0579ac64b529930fd128edad9b0991dfa00b0e9bc
SSDEEP 3072:bKzwJCcIe4woKmWVlBL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:bKzwjIe41KmWVlNK18Gb0OV8ld0GecQu
TLSH
T136D3D0E3B3F4EE7DCAA715B7A61500B1ECF3462917A1434A074BD8753A26788D8C8793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\chrome_200_percent.pak
Size 191KB
SHA256 cb4fd141a5c4d188a3ecb203e9d41a3afca648724160e212289adcac666fbff4
MD5 81b5b74fe16c7c81870f539d5c263397
SHA1 27526cc2b68a6d2b539bd75317a20c9c5e43c889
SHA512 b2670e2dfa495ccc7874c21d0413cfbebfd4a2f14fc0217e823ec6a16ac1181f8e06bfe7c2d32543167bc3a2e929c7f0af1a5f90182e95913ba2292fa7cadb80
SSDEEP 3072:A4DQYaE/N6gbrvy/+JPnKmWVlBafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+Hxf:A4DQYaSN6gnvyWnKmWVlSgx5GMRejnbA
TLSH
T12214E1D7A3B8DD7DC9770AB3662501F1ECF215395AB6520B13DF9C353A56B8888C8283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
TLSH
T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\ffmpeg.dll
Size 2.7MB
SHA256 e1ab367644f72ebcdc8eb3fcfe829ff51719559ac2a43a1600e712b16871ad65
MD5 d5e1f1e9d0ccfe7f21b5c3750b202b4d
SHA1 74144ac93c0c58a9b9288bce5d06814c9a1b1dc2
SHA512 dcf70d43f1a83c424be99c38e33e520c72115c3d30945980e5e394d460462251bde309e543213b2b08dcbe9769d11d46792e1cc99aa42777fcc34d6f3361a3d2
SSDEEP 49152:EZ2KxYmwFfgQQs0ShPrF0/zO6R0gRhPj3hTUctrRhuwSnKxqgI5IN8N3lzl3hqzb:Aofp1Pyi54wnKxqg4INhhd
TLSH
T10DD5AE07F6D640D9D029C174869FA233F63134468B24A7EF1A909A252F7BFD46E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\icudtl.dat
Size 10.1MB
SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
MD5 2134e5dbc46fb1c46eac0fe1af710ec3
SHA1 dbecf2d193ae575aba4217194d4136bd9291d4db
SHA512 b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb
SSDEEP 98304:GKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8j:GKPBhORjOhCliXUxiG9Ha93Whla6ZGr4
TLSH
T1C4B63803A2FB4EC2F9FB6F31D8F452679567BD496E32805A01042F3B5C336908665BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\libEGL.dll
Size 469KB
SHA256 e142752e073c0051a0beb963981af70263ed673959515545521a7941d3230838
MD5 dd78b86b3c92d61c37b44ef5b157cfe0
SHA1 4dcf9ebc3ff5ca552c0e83469b921153b29aea1f
SHA512 9d071568dc56db2ab93d034d07a11a477aab8ac50d9ea3c4db3ac4866fcd3c2f3002ba7a3f2c55589a9d68463181fc7a03327dc164310d7e80e30cc6f6bf2423
SSDEEP 6144:s4itlpEJVqKqK5Z5UibKsBHI0Sfnx+lXGpeOQHA93GT3sm:s4itlpAqKqK5Z5U+jBolfnjIyG
TLSH
T120A48D15779544A9D06AC434CA534612EE76B8920F35FADF02A4E23D2F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\libGLESv2.dll
Size 7.1MB
SHA256 b0ff1bad8e2f34b12dfcc4b5387bdc042f9bc2f963e11dea1758397ca0e907ea
MD5 af3792b63af63408a40604184ea6ef7f
SHA1 b4d577e1c7ca0d4d3a34e2edb919cf58e6b62952
SHA512 d413c52f7c82dd17f06002f3ca6bc3efcf4e11e88379d989d982b2f9f47b71643971c4988abee2dc1212027b2cea148a8849bcb442dd4dbcd8e26ea892dd7a58
SSDEEP 49152:x2b3imtb1uWsvZRUCXQNMBbGUa/XFfOpvQnDwX+xjA7LAIgRg37QiI+id3pFJs7w:x7RWft4NV+sduHox6gWE5lHaFX
TLSH
T168767C07F2A541D9E05DD2B9CB4B9232FA30B899473072DF6A9817213F67BE06B79710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\af.pak
Size 381KB
SHA256 7bb75adef02d28819f1bd3b42fa46ed56d6dfbeae072341997b09b8c1f52d8dc
MD5 b293cc5ea7db02649bd7d386b8fa0624
SHA1 32169b9d009b7a0fb7ecdaf650c989e956291772
SHA512 496bc72e7b798d02e453eb96d20566b91405bab774521527ef882c1fcb58f25e2d0718013ddc0d23f7fad883f4cde93b57c6caaeba8cd18a09665c9f6245f557
SSDEEP 6144:qu8SyRtgbfbjR985DhdxQ+ICGSBsjA636Zi2Jynq4UtUKnpgmhqxox7sfxSC2C8l:Ry0zbjREda+ICTsjA636Zi2Jynq4UtBz
TLSH
T1EC841B0AD784273D09B07696BA0545FBBB9CA26CD770B2B6DD9D823305A2EFC017D1D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\am.pak
Size 619KB
SHA256 685ecdff01d4ae92be1d900ef00fd8632616bc41f18a56e682528f312d4a5167
MD5 4cb4b30911e9fbfe6c1de688cca821ab
SHA1 58cc2d8e954b5c74a902f13c522d1f6836769623
SHA512 6629af841c52463c46dbeb03e3b4b1cad550c2db790c75365d63512e039b3369cdd9f18316e9c50dcf3aa77aa4d2becb6a87570f3b538b456af3041d60393434
SSDEEP 12288:ihHb86uYwT8xiT1XF/gpwozFQd529+lV5ru4yPpx30jH8+A:MbIT8xCXFopwozFQd529+lV5nyPN
TLSH
T12CD4BA547EF9F7170F8E8A19A4310E4E9594AD4652913C38C35AE3FC2B2EF1B4DDA218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\ar.pak
Size 680KB
SHA256 acc1b352ea206c25afe88a614346b468f4f78bf23f886883a38dae905d121dc0
MD5 7294148ba219909a4909613381ea45ac
SHA1 a8a70e589760b5eaeae1a95fe51723cce48fca87
SHA512 cabf320e827067ef8efb7c021ff098430054d125fb50540c06d12167c7d1c6d08449e6a1b33fa4a092ce6c81a600415711005e100b1b756a199e05ca18dbf3b7
SSDEEP 12288:DpJ+LHvZtD9JAO08vYU3X1Y9kbMf5MNi/+det13zMgSENR5:tMqta45F+K
TLSH
T166E4ACE21B2984720B96DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\bg.pak
Size 706KB
SHA256 3fd27d562e32f1a052e924b6c468486acf0b2af42dd1ad2270e83d115d4b3f65
MD5 080cffa1d4032b7d4bfa217aa00c4f47
SHA1 525cf2baf62ec4c90e3a1d89cce37c9f433c61e1
SHA512 9470ea433a7c08331ff26df00170c81309e72145e6f32c16e7c2c1e53c54b3974b991ea128e636138f8212e276a2fdf94c344d9ab7fcee35ec231543e08196b0
SSDEEP 12288:L83VytDqWwQkDmLlYMdAs1aQUtjtaVVnFH2mFxadnra35rKN3yoSiVD1BbCeSKnd:LoytDq/DIlYMdAs1aQUVGCa35rKsoSiF
TLSH
T1F2F423A15B9A689F0101F55F98087E093CEB84FE3FE7879241642DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\bn.pak
Size 911KB
SHA256 2bb70dc94361267e755169dde430ea31aa21b4daf31b5eed78901b27bc596a2e
MD5 bea57ab3921250ff4dadc9f42f8202d9
SHA1 ace7fc0579a946d32419e8c5ff9bc64d40e53364
SHA512 164f5c081bf23def7378450dfaf4db1ceb49595351de5d933375d9b1b409f7bc2dc96c4f228a7f024b7ac891a27603ec174ee8b3a7937bf678d61fdcd3e4c7a8
SSDEEP 3072:MtVVy6YHuQ4qxkVxCp2tUkbBb5OMDK5f0Xl+IP:GVVMH5ECAt5Bb5i5IlR
TLSH
T1B315EE209C6E91B2A8D5CDC9434C6370C1236E9B9B61F34DDC17A25938ADC3C8DADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\ca.pak
Size 430KB
SHA256 02d60b97f70c31f5c5003108321fc3ac3c79bf39a36392c3adaf7735b9cc1c1d
MD5 2cddd012546caf0aed6775cdf5cfdee9
SHA1 cacce951770feefd1bcf89de5be97bb39606e7ee
SHA512 b75d9b2946b11b9fc7430c5773835422aae6e716504d7841c1b08413ec18d454d9d6faa5ed63e19c59ab2e1ee919822283fd7e21a97f54482685d541e4dd2519
SSDEEP 12288:q86RFXgkI0h7nyRhIs3cSlFEYLCJBqB3nbhjJOtJuwlwSGMwFdLbpuQ16BtryBtE:r6wkj0RpTHpEMNJ82kLI25exte
TLSH
T1B3940A238BCD3B7744D2320AFB46C257F08CA9847B06D254F5AE1B1622CCADCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\cs.pak
Size 441KB
SHA256 c1020222b90558a6a8a07f24756b183594641ef77562d35e7899e1489d0ebd8e
MD5 6d43974c98037eecee8691520de4d63e
SHA1 e15672b3ab22a059b976d245ea3f59d35c3387d1
SHA512 64e76499d56c3e32cc013bd05e2d3eaf5618527b8035bd5a37f5018a1e6072cde4a06f7c66921b9b087e60ff686ed63b7321f0295a34451443797ffa8e5cea35
SSDEEP 6144:Ym4rbeY08bI70wXaNA2MXQC5t8VNDKNDZs1X8Qb:AraWbE0wqUXQC5t8VNGNDab
TLSH
T1A5A44B1EDBA36535494002487BBA5128AD2E83540B6FA5BB7CCFAC92217177ECFF4D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\da.pak
Size 400KB
SHA256 dab543bcc1a8abf057f720f9f448e45ca5cfd1c424826bce8933174bb2eccad7
MD5 ba54e3345d61d5cf431db6a0d649f792
SHA1 32b2edc19df7e14e6567e0faf671c038f78a65da
SHA512 5f858c4c876e1d15d4929464b7d9bc2cc497eea93d887c3cf0cc1c651a0f5a81d75f04f7a0b4277dc43bd9deb148d147d35fa1aa2dd218d404fa2c8c389ecb5d
SSDEEP 6144:+/1dB4b3HibjZWsnZwlFkuJwZjUEbUSovDHv50Sr+zOUPOd40TWwd:IBa3HibtW23UtR5DrJT1
TLSH
T1C8945B4BCC9D332FC5A94B65F2108DA7EB5D943CC680264F75D8A43A4ACBD6093BE1C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\de.pak
Size 427KB
SHA256 6283ec48cddd08c387a36ec71fff87c2ab0ef27449e8971eba2d76a6136b1708
MD5 46a45fb8e7880802e1624df86d254973
SHA1 13778b3bf0101c3894fcb228080c25ebd47dc046
SHA512 ffa8ebaebb3f057440176f123442b13b6f96842b9688efe6633c0014f0dcde982e667b0f2dc84a1f6450e310a8e05a13e35ddc24b1de8d25ba5a711d8b07d357
SSDEEP 6144:uozFfPighra5V8U/x6P3T7H2mAyRc5rRRNnOIyCLM:umagpaov7H295d9yCLM
TLSH
T11694F603A9DF625EC78273617301CDB77B19E26FC346316688EDE13B654B5B283AC426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\el.pak
Size 775KB
SHA256 87f0a26d73fea2ebb5017a95e937e08d7c347baecbe93514c1b866c1e28dea32
MD5 7f92f844b9d8bef68dadbdb85a084bd6
SHA1 96c508fc2b624fe9c2945e2d673a645fe39ad3f2
SHA512 d47eb475f9ca60bc1e7ec33fe2e2a395bb8ef3f109bc4b769fc2e03e2ddc04bb3391b10f1b382b7497555e36ef02fca31cd47f67c03de43d275bbddc3bd8e7ac
SSDEEP 24576:rolquNwPB02/grQWjs6dJoaEA3HsiEcBCJ7391Qf26tKMaBlSEf5xXbW1rk2Pcjb:rMquNgB02/grQWjs6dJoaEA3HsiEcBCF
TLSH
T1B6F4BFEFB4542DED8085950785D8F07C27C62D6CE749CBE86629CB60BDF90718A22E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\en-GB.pak
Size 348KB
SHA256 914b7bec10c1e8c2a9e461edaa498b2b344aadc130a30321d4116ce0c4c99ad3
MD5 a32f3f357725ff256be9026398a1cd06
SHA1 cf492e3e5c18e9e8c8cdd6b964e987541cc46505
SHA512 a96b2b00ad6883c205224770bc2cfcc93a5cf29b41bc8169117771f36264a8a89ad4e5bddc0c50f85c0979f3355188ba86c915f0b3b1013b3ecac9383fa8b192
SSDEEP 6144:ZYAo1l9QMP9eKZwdfaY0tQWj5izSiBHXV:i5QMTZwctV5USsV
TLSH
T12E743C1FF784126A06531262BB46A6A2FF26D07CA35112673CAC805C33B6B56C3777E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\en-US.pak
Size 351KB
SHA256 69c1a2e1b30d83612decf1a8dd7b124a04f58e9f2465876726f02f7f7d5eb54a
MD5 06d28839ea0b3aab4597ba8646a53a96
SHA1 9c6a74aae8c783546d613c6f38cbfc8f5e3736f1
SHA512 a432542dc98795ce0ea6fa4a6bbcbae8ba126f1fda025a9ad6ff3fa67eee85dcf7afc6678f5100bb1543c4d00ac75043ea92e64b65c9ef6bd946ce3dc4d5ae71
SSDEEP 6144:hVewV1XEsUrS0MP9eurM9faYkuiEB53bS3nwgfwi:BQo0MPrMsuD5LSjfwi
TLSH
T1D6744C1FE784226606631272BF0595B2BF36D06DA35112673CBC812C33B7B66C2776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\es-419.pak
Size 425KB
SHA256 5fcf21564ceec93eb64d2002de165a55c1875859975e0bf9035cbe96f258b50d
MD5 c753cb5296cc411ae72964735ce0de78
SHA1 4151545bc2cb9fe4330f3b238aeb28e9ff0dbd6c
SHA512 5688e1f406125f939840e8308d950a741a02ef24a006fd3619f3e943595630ce32010b51bb7a37768f1c595f4c77b104bb7483ca24ff599eb04434974d894c1d
SSDEEP 3072:gZ/k72wvCDFb9D8jzsHYrtdy58d8pdxkoHQ7o0wryQ1KOP/5+lBFy0GLFL5RRIHm:gZ/k7dCRb9DVYzkpx/rT5aqLFL512Rdq
TLSH
T1C4941B22AAC81F5300E2A389B783D757E4D49545F408C29BE9EB83A512DCF8CC977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\es.pak
Size 425KB
SHA256 468e0143c978a948c62d4a3dc743099a4147d39773a6112b303692d0e335810e
MD5 c9e0b58f2d9e087b2e8e92d31be2a3e6
SHA1 59a43b7021860db2d2a7fe8ced8fd1a4b0c8322c
SHA512 16160e6375fdde1ec2e17ba8622c9c953a46372143d0b09a33ee55852b2b9f037c1c16dd5bb6bd1f2454559dcb172c8317aa8b6c6b26d44e8da706eb16ec5f07
SSDEEP 6144:XJi0HwWCjWU7xXF6++uTtgcRzpJ2xP3n/j35f6UrC7JKoWeM66PZqC:X0qwWCjWAQMn9pcxP3/j35HrfoW5GC
TLSH
T1CF941A22AACC1B6300E39385B783D753E4D89585B408C29BD9EFC76612D8F8CC967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\et.pak
Size 384KB
SHA256 41883af1e49cc180fb48e02659e75b0169d974d77373cf7bb2a4ea02dd654e26
MD5 ccd361017778964de23bf1d741cb888a
SHA1 5b0305538762987901b7a8332635f3d7996c09dd
SHA512 a9d7c99c07229d382e8ba7cc3199bc66fc39df5fd9b58e6a76e423b865f8c05f53398125a17a20c27462b2db595f3d778b4d94b1853121d8447b771f9284e5c5
SSDEEP 6144:5zlBfny9yawR8+qH2LxVu03ybwXfNYJYT/RyTKiYGT5Yjz43BvLCsPQ5bm:plBIy2HQllIT5YjtC
TLSH
T1AD843B42517E771B682012F9D233AD67DC9EE7D8B4000D937896491A71FEF8C38B6B68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\fa.pak
Size 629KB
SHA256 9068dc6c71fd8bbc1a4f3b2009689472d1fd2c096b7e8afb3e089a46b98d8b38
MD5 87a2305436bad7556fe7abb68767802a
SHA1 0edad3677b0872321a1f8f3d391c17ab373aba17
SHA512 6c32b1c83e03b553843faabb5a9c1b63c769b13de60841d2bc81f2c9514b30ebf16551acf33262ef8abaa4a5aa3955600a35a045b0fd446964109c58a2734969
SSDEEP 12288:YbNHatX0nuyabufwH0wNUWGOufStQ4vy1BeFtDmxJVIwjwMTAKzIxRAQiHedNu3v:YJbuyabufwUwNUWGOufStQ4vy1BeFtD6
TLSH
T143D4C3956AAC9AB16756CA0341D33834C773EF13D34DFE40ACA1076609A5B139B4FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\fi.pak
Size 392KB
SHA256 052a72c9d6f2bb55f02fb1c5c4c68525a32b8cc9120c270d07d7b813d604f7dc
MD5 f87a1ccbcf3db6988e95e94333bc5a4f
SHA1 e85f8446eb74d8bd4318354ec98135c17afe3248
SHA512 c4a7ee0552b343010fce8ceeef70620acf672c9ab56fc24ccfb88abdbad23aac4cee65c8b241c594b7ec92d0841087485aeda583d2e887cf4c823a10b2e7cd3c
SSDEEP 6144:MYecIeTKohFeI4OsOSFOEi3paUXJLY5gYuyHsEl18OWUcl0wwPKNbX1wAEb:1eT0Z15av5gY1HsEl18OWUkzEb
TLSH
T198845D914219C23137C4828E7CF0907EF5E9E39D8C288D96F847C6D949EA98C7D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\fil.pak
Size 442KB
SHA256 e8f03c2e9c88adb04648ef93f9ea3cff87641638ac97c9a6752b751e7f7a8a20
MD5 2e6a6728bd5a09339ac01a38bf686310
SHA1 619e27f30c99eff8f2df3ba2287c6f7fe0b5b063
SHA512 0452ac74eafcf971265de92041659c006b5e559919b895b41795bb1307ee7c302e873440b006485b7cffcdab0f6b908a119683fab40a664d5bf3591239427c00
SSDEEP 6144:IHFro0m4qhQiy6DQejOQ5V/xe8zGUZ3Lms5IXmJlLATyiH:IHhrm4q5/5T8s5Imq
TLSH
T186A4A516A3402744DBC356E613A0682F66E530BC3F826C6E4FBF26977BA7CD5D270186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\fr.pak
Size 459KB
SHA256 cd21cae54eb6cb115771d1afe14d17822e13332759f8710d6386a6e4277c11c8
MD5 8e21cec6cb5732fd2baa28f3e572ef7d
SHA1 778228dee97f5475b9982375740d6f90e8e5fe0c
SHA512 07726afa312f6104e3d92c6be13fc4b0e728a4a21f643c9552a961784063d3c8a9c52e5649ffaa9fd6a083dc5de37316e0d2cc10cd1a6fbeb83789c385ae990b
SSDEEP 12288:DVJxu/lk6QuamV1ilzaWO8ZQMYnYMFQaBIWKe5Xxkq20wCszvZL2vULN1oThXn5r:rxUjVrszc5jn
TLSH
T145A4F75FA9D432C715C212B3FB12D663DD348248F216E340D8DF4696229A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\gu.pak
Size 886KB
SHA256 0f0fee8a2f22f80a0c4a758e7f4fd90d40be4048dcab0d824135caa5e92efd5d
MD5 0c33e2a35eaaed3572f31e7b24d4493b
SHA1 278498568109ea7d6cb34c634316f95b04155b64
SHA512 4eebf9be5a8c317d2d2e8e9b1e607774f5c7c35af7d8bd6c80326fe3c6e2e05089f04485eedde8be8c7b71a7b49e407289f361361d86802c0463c5b6b296f2a4
SSDEEP 3072:+Np5emhl6KNyUrBh8PITmKMaW4eeenbssMhmksd4t+0+z20QmuOAl5dUjvawWnhG:+NpXl7gHJxt8sW5cZhcxl+
TLSH
T16E152AD0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\he.pak
Size 549KB
SHA256 ad20b3d634130c247f4ff954f1a5c56687523e5610f2ec6085e257126c4513a4
MD5 8b3957dda3c9fd903d2c4b8a5f686475
SHA1 36e45b4d30fd1e59ecafe095f405e0722a814a17
SHA512 1dd54ce0a1f30ba087a9d09b9aa2928dec3070788d7db3dc2bbd27fa6126f70fa1e05106a1503602b203fa76be914210a38d5dc9c6bb56c56857ef08c528c4f2
SSDEEP 12288:NiYE4ErOOFmTj2/1cH47n60/AfOX4neQCapHT5fJmodGMIv55lmi2DnwmIQgQ:Nci5EoF
TLSH
T1ABC4A9C4B2D452255231AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\hi.pak
Size 928KB
SHA256 71830814b8c7028a114a53a4e715ffa8da12f01d920455242a0cbc35fef48e6b
MD5 4eb5c501aecb647fa81fb4b65b0cb6d6
SHA1 5154741cceb272352f0814850e75b517f7f8a023
SHA512 2bf32962d4f018959281f6f09d149aadd901c21131ef25aa1199ecd73dc16e2377eeeb67352e030198aa280ac1fd5962eb226fc6481c654d8d332751a20329d8
SSDEEP 3072:SIYvII2+N6GbSJWbkXSvc4QAEm5dmGhsYK/GR3J+P8N06bxdYnLsuSQdnPtg83cf:SIKII9kGmJzl5d58Jy2
TLSH
T17915060CEBBEF3B55DEC3C8A32890D37D5AD3674A3E5521348D5B3DB9844CB4146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\hr.pak
Size 428KB
SHA256 08fc2b1e6b9652d809a7550f1343b3ee54ebcbad0fe74b009aab6ef926c0279b
MD5 23fdde99818ba28131a6ba81decf2c1b
SHA1 c1a87661f80c7dde9a08a360d2f5b72f58042076
SHA512 0f53b131d142c7b88081afa59f10e17be489c342f2e328d0e7bcaa18b5dcfa599b37ca09317aa9ae564e52a3cea06d79021eac6ab5ab38a9c0ec99bdce797e9e
SSDEEP 3072:AVgFY01/7xHaZURnmgHqbKPOS+7Wr/5cIG0uPXQ1lF6Wk6DkYAiKbeM/MQbngt3a:AVYB1/7YKAOa5/58178pjcO
TLSH
T1D4941A7CB9F267090996A346EFA6434479BE08CCE56597BB3C4F632F0003F4D6AB8159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\hu.pak
Size 460KB
SHA256 ca4b4c7c7be45ea0871abf7d5668ab948f712a02facdc1d6bbc189b1b3522446
MD5 2fef83993a62f73f8e4b40a6e28a085c
SHA1 8bae181f3eed8d5ea8fb0f912c679e608ee7c008
SHA512 6eed29acd38b662f62381a5c00ebfb254915a57de6fde8e6da77f60dffd13d4846b26b1897d710ef852bcec5728a4460becaed2367f1a06a066da77521701324
SSDEEP 6144:xaFSpYjWPSoLaIAetky1+n5QgsZfGRtgY6mHHPSim7WwQGeDCd5gRRVJtGNvw2nZ:UxiPLAZn5QgZrH+7UdCd5v1Z
TLSH
T1BBA45B7793B6944AB8AC17D378603F15592E581B9F2B25F728C788AD30A17CD0D83C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\id.pak
Size 377KB
SHA256 bd512e36a88f0d7e6fecc0b559adb2761589947fef9c253dc350cd8d6ea889f2
MD5 0dcb56f6b196199f7ed802c06b774037
SHA1 f62edd5e814d05cc4aeb5574fc63acfdeffb6010
SHA512 e03474255bce20004788475ee1f546ee7830e9b9960023b15210d88347032b5376848aeadef3e953ec654d3905baee37279bfaa287af7669ca66e382a4b1344c
SSDEEP 6144:Cul7Z20J6S8lZMGqv00FU/XfjDVnjHFTRmPbUK1E5+shlvtmZSVsEaQm:jyI6SmMq0iXVnjHFNmDUsE5+shPm
TLSH
T14D84E8632ECD310C494803D5A2C9A91E7CCD233BAF05B76F8E748FB055B67682766B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\it.pak
Size 417KB
SHA256 95bbf94625cf0476124763cebedcf5ee46148bb6b5c006f86540a02e8d8c883c
MD5 47c89f9ba4993e7cb6640c23f444e9cd
SHA1 0e3755d2835742b7aa4e1d5245454f7cf22a2d47
SHA512 948e4da235cf7d0272fd7a99e7238596e5d50913886fc73fe35f9af17d1087f550a3cc3251ee6595f9872ef0b88e75725405382e6aea4850088e068d5b80922d
SSDEEP 6144:7G169R9ACcto0SgqRrhsO1F+RT9TeexAGT95ELRqbKYT9fLwdQ2Yoi4Z8Hr21GWg:7A69RCi7eZh48CfilwLq58zoP
TLSH
T1CF943B3695D621151A976369E211B085FBAEF8CCFE41721C999B031C23CFE84E2EDB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\ja.pak
Size 510KB
SHA256 88383ddccacb53f3ce5918cd80b5dafb16b3cf1fab295e230cc15490600615e4
MD5 afd423713e28b3980392443f31dbda7b
SHA1 926560b21af422f22e1cca1a4a2948ff988bc6d9
SHA512 1544f7a91b4b63bb80f651833a931204e44745bb0bccfb5564ee9af3149218f140b6adfb6d4ebb5ce5e82f5c345c098cae8a0637b274c42f6711aa53877b0bd4
SSDEEP 6144:I5Q+c9x+7+YqFkl+cDWSJ7sZDs29v3rbP5BgLTxVx:I5Q5yqCl/JsZDs29v3f5BgLN
TLSH
T19CB44F7CE3C569369D6153A22C0E36E17606AC5FFCA2363A042DC075BDB0BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\kn.pak
Size 1023KB
SHA256 0c8e0b6a8398d7b9ab9cac634e4a7ce4453540358e79ac6e9c5633efb4182fe9
MD5 74f0e9c7c670a981d3651e0d189dfc47
SHA1 a2fd3037311f36aaa348805d57172f9e9b0680c6
SHA512 2c555439f7de3902b2b1a940cd43977558c4d9239c449105fc24777952af8de592ba86a7476567d190719c66d38f7a7982c9b94278c0594de1b427dc546f2d89
SSDEEP 6144:3jIXOpf5AEb7XtwKG20PSjNlB2DPVX1EB/lthEVGkcVw27zidmaZXH0r2AxiYRpv:3cHS7XxRPaEjJ2j7q5DPUc+vB+13d
TLSH
T10325CD185DBA7D302BD5006B24EC603EDFF16BD29CAA07D2F4DDD7802C66C6A90869DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\ko.pak
Size 429KB
SHA256 56100d20a59fe6cb333f57ffdef90157324ae1b90194e852478daa8c46d29de9
MD5 c90a42bb27bcbf1bd345dc998f9e410e
SHA1 66f8bb72db6b38e2d288959bcee3c43caefdc59a
SHA512 b5912c895a6a3b391555efc10b15d45fe9a84473c8687327b7d2fa033711e437e2f160345daefd554374357e0afbaeda4a25f4f69ca74e498d7081062f299b46
SSDEEP 12288:4ysgl3zGY/cUXcfyC8OhOJhmHCqq5A72eEd8MtKq7hUoXAj:l32WJ75z8AAj
TLSH
T15394E9F238DB23CD11939D82AEF4FA1983C1E976F7430294ED44CE559E245C74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\lt.pak
Size 463KB
SHA256 ecb4ecbd96575f6f984f60e85ab1ebb0067e73174ff9912941ee1aaa28516d93
MD5 06d8db8aab68c565af14bfe408ae4daf
SHA1 0898fd0ee4d7380b93b8fb3d4a1816eb810ea9a7
SHA512 1ebc04cca7e3bf005f9befad5a81736fc572383a636c7237e4206e75b05befe49f967427f912c97758aa392f9cc2dcbdf07c471562cb4ccc90f7d8e951c3ab9f
SSDEEP 6144:mGUgXQKlF4q4RmoBkzMbI0COOeQ0AI7U5FJzvnhJalV9Jx62cJ2I96Sut:maQK4NnbhCOOe495PzvnUJx6nP6Sut
TLSH
T1C3A43B006AD3AFFB9A4063CA81E4DA74DABE50009727AC61EC69C79BC43BF452574F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\lv.pak
Size 461KB
SHA256 dfb9b5ee446977dc0435cff4d66402d3a9426edb106effdbb7d86379527c5956
MD5 f8a5403bd91f231db58e77c9d4514e2f
SHA1 7d29e2d8459af6fc3082cec0d9638daf5275bf3d
SHA512 f491cffdc5cc588f7ec70f87be84615aaf5b39e9c990cd9c835e65beb27f26334517abac1af7419f2b7b18f94c369037c8df4c1c8e26a5fed4288d477dc0874e
SSDEEP 6144:k6nCZt8n4UUaNHkt9NLtVFHrP47H4zRa9Y2b3L5fRZanVhE19AYFs4FjEA5FGlsW:FQMlVEzM74zWYOL5CE9DjYs18
TLSH
T137A42B958AC68F964E905DCB7336D133A9CCD740EE07E122ED7D4B3A610F52422B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\ml.pak
Size 1.0MB
SHA256 a7afb3ebfa8f4d2e35dfdd5554ff2702182e73dad0fd82f8b4207a61563ed134
MD5 fb1a6e31dfb4f4c78a50b4dbece0e1c1
SHA1 367c506478380f8bab411747a906f8f8c60df30a
SHA512 18afb816e974c9f0d669af7cb6a5d8761e1c5af69317e6ea293559876549692baf1567657b356ba9d52ecdf4d117b7ee7fe003d1820286470d43af89321e3f6d
SSDEEP 12288:CnO59wW3g+Z/47/ZmQkg3sKMmWDcZubSAI51jy03eGhd5R/7d9gf3co:COXZdKg03eI5R/7Mf31
TLSH
T1E0359C1BA036CD3B0FD102257B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\mr.pak
Size 870KB
SHA256 436efbdbce605c23f855644a9ff1b04d9a3eca37de3b18de8c3e589930d54096
MD5 1675668911fd3063e092fe34579c210c
SHA1 d1d09041778599002d07a89848ddd79cf5f4f4db
SHA512 61c7aabb00700773bb55522e7ae9482d1d97ace936c9bbfeaef3215a976c411a51f41a2d5aa05f2b286b0d112b5616215b9fa3632eaee38b1ec090dfb29391b1
SSDEEP 3072:ryyL/Ti/fQDFJEm1VhkrXspg2GLXFEMUAG3GRa3RQR3Kz/YYxi4noc4AmHwpVuQ4:pTi/fSLIje5DDcJ01V55ipWLYb
TLSH
T1CD15C14CF77AF3685DACBC9E36580D3BD8FD31B1C3E9825648E1B3A74884CB405596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\ms.pak
Size 395KB
SHA256 163eb7ba5f0c61acb6443709c24e38ca6370a33f89a12e13d0a57c258a87ca16
MD5 2c4056d84b980267faadd69d52c17086
SHA1 3b3c5fcf182d86a170c8f35c041bf3869a82b362
SHA512 47285ab42b46cf7d6556eac2a8f7afb9a9c9abe8cb026fe847b2504e4dbddd481a98c1ea959c74e31f195ecdbb618a3d93df8f20b797411a8bf2b3856fc9b963
SSDEEP 6144:D0DH30N8CXsxdu2kulaBGY/H3IUv5sf3UwMM3KbI:DGjfxdflasKHL5UUDML
TLSH
T1E484B6068EDD3118496843D9D2DA691B7CDD3333B705AF2B8DA08FB112AE7A53316F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\nb.pak
Size 386KB
SHA256 29f38d3720c948fd261a2aea7d195e861a73a1313071bd2cbf1ebcbba77c63e6
MD5 23ecce10db7753622fd7cd956aa55212
SHA1 52affc68e91448d8aecf2396f02ede77d4ea664f
SHA512 553543bef496052995e33e2f3e8bd66ac845351cd292623479a303261900c393cec35af3e0ecd57db84197e6f7653ffa4eeaf4950647ae2d5304f961890deba1
SSDEEP 6144:0t4+Y0qilKh+7Op7fCFegnmKQ7PpWS6j25OB4Y6GOQzMh:u4+Y0FKh+7Op7fCFkP8Vi5OB4NQzMh
TLSH
T128842983EE46B72AF2A447A4F419855B9B7D942CCD88099B64CCC63B1DC7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\nl.pak
Size 398KB
SHA256 3c682e37df71cc036c2b5e91064407fed8091c0306a856121e28c19e7110e1e4
MD5 54817be286dbfd9de461f42304eb72cc
SHA1 79386881a11e6c7d49f2d117822c29d7631f3830
SHA512 d8f922b028b03c6379911308cf240d104b40a9c46f67a6ddbbfcd20110c287e8106376cd6e8295915d054e05b2a8a045b3ab8d98932c1be97b1f258525db1a68
SSDEEP 6144:IZobt+gAv/5SfHepaMs3B+qnCv+659tuxMGpe/hWUP6C:QLgAv/5SJTb659tuxMGpe/hbP6C
TLSH
T139941B17A88E253E19C0B749FA044FBBBF2ED22CC26CE67D94DDD1351453FA841AD889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\pl.pak
Size 444KB
SHA256 d52358b8fd70f1f18b3f8ecc4aa9c791591dbb698ef8d8670312e50f024db451
MD5 41cb68de75d011281c7936194ef8457f
SHA1 6bd3efbf5142769c6fbe8478185edf89f471716a
SHA512 ceb90fa9f723c3d8d522a401cb46545c72a2ddd1d04f091e9d7ca5212cedcc641c54cb8fe19595e9c823b2ed374757e5ba7d1813cd763bbd8d726b1e2ebe0407
SSDEEP 12288:XEmjSoGU/h+XgvqiWHbdvP/CUd9e3maUXl0hmhF1Qhwkd54Mz4c6W/:0Zl+I1QhX5qa
TLSH
T1DDA46D0E46E59A4E4DB008E6F1E31B7CBCDCC848E109C35FE46F452A616719ECABE5D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\pt-BR.pak
Size 419KB
SHA256 b4e0a6064dcfe876c819ec4b00f9857b84ff52cd3e845bd0c48e31ad43a23db9
MD5 4f3f65f6639ae1905fa37b9b6ee2e4d4
SHA1 07553f41c4f8f3d105eb92b65497c4976449a6b4
SHA512 85cfcaed8fa2026c13735e7d4b6852bf794dd4a8ac078889d5ef46ec2ff7173ae443addcb0b0c711f6a31f80469fc1df5af1a78da6397d9df5e33cabb354fba2
SSDEEP 6144:Zj1SlkigJpsehea53NBXBLm+9nnI1iys55nfJkW++sRgltp:Zjj9pseAaLnN5fJLnsRcD
TLSH
T1AD943C2A5DCA136604225350B74AEB43E5885746FE0ACAC7DCFF4B46A3D8E40DE33B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\pt-PT.pak
Size 420KB
SHA256 342381f89058bedd809991a0b416f48642df3c71aea10bb13e13bc15eaaf46c8
MD5 7074036013be3839e218ec7b15d49215
SHA1 7711ae4e96efd4f4676a3c0281a92af56329deee
SHA512 8a1e9cefb8a64b3664d9496e2d2f76e2281b3c427fe24ecb70ee74f78778d94def66787a7e35ccde6037ec061e29a6ac7fd8b4010f77b13945780e1316bb16e0
SSDEEP 6144:WPh4tRdLtMRieJVJJxhzOhxcNR8f5W75BKbSR8u:ih4tRdxU/ND75BKbSRl
TLSH
T18B941A295EDA1366052253917706EB03FAC86645F80ACAC7D9EF0B4272CDF84C7B6F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\ro.pak
Size 434KB
SHA256 b7b56396806412ac1721d2648fa98a89a069d1f58d359d8e90dd1c6b8473b9a2
MD5 e66343d1af0b8f483116ad7689e7faba
SHA1 a245b6aa9309a7c10aca8502cbd10d9dcbd5d8de
SHA512 9f6517aae57f3d8a65d4f9b354b7ed9923c1bab8a414b78347f4dc375707907d16d458d9d458d8fbd28f065e268e092770fbc198833315ce14e6eecfc0d3f0aa
SSDEEP 6144:wvnUEfoHLgfnNaLF33GKoZQoA02M5Hg2obs20/qulUy:wsEaLgfnoF33GKoZQod2M5HLoA/Iy
TLSH
T1AB943D2391C86AD72D5112B2B76634D3E88E105DFA41D28D60EEC97D10C99DBC62EECF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\ru.pak
Size 711KB
SHA256 c5264fa2b485326e91d4df7a6e39122554ed632c0c17fa1f130205ed50e2d6b9
MD5 6092ff0430736682e24595b37b3c018d
SHA1 9d2b9822556ab1f33861c45b2f7f4236b3ea5f05
SHA512 fdd960f3295c280cc57915f7cabd7ffde0c0cdf4cf6b671748a6f5b8b39376141f2a552afce3e2a428ba18057fb9890da9b95fc6b8367dbda5430e1b205a08cf
SSDEEP 12288:FKYfeXN2hnO3j/HkwzvM/sWAhwxxe8P/XvFGGJbM3cFaPuLzUFCpWNFHWajfr69R:FtVy56687
TLSH
T1F1F47760669E64DE1201F41BDC08BE0D7CEB45FE3FABA36219642D7E35F2024C67D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\sk.pak
Size 448KB
SHA256 04b179b5c3a5468f495a0620a2dbc6e312ebd76ba32b98d8cc7daafb46edc21e
MD5 b88ec1f7bbdcf1b6690f2698b3dff738
SHA1 c5975de1d66827087bbf8cf0f4b3bda816a723e1
SHA512 ef30ac14b17b71f5659f33778d8c4b017127c3c5bfb593dca919a80320a66dcf5e0a3f228dcf62b05df5d4d6929eb5401ba9c369affe89cf541633bb743553f0
SSDEEP 6144:WhktQ05fPaV1kP1OOygitJeKqsf2d/5hK7LtHEMEGLxGg:WGSW41+NygiqKqsf2B5hK7LtHJJL/
TLSH
T1BAA45E3FDBE6181E8E990148EFE67110F9BE46508A4EB4A5984F328724F36EDCE74D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\sl.pak
Size 433KB
SHA256 b36e1fe2405cc4b9f34587e30da2feadaa6f03124769b02f79333adacaddb49b
MD5 1b02b0834b8bbd12a77f7fff09e1d81a
SHA1 1898cfedde55aae307f7578b88cb0bcaf61e1d52
SHA512 b1006053ace6f8842e9436c94934b2e7d1b502e3df9ecd1fe59ab39ae35e69e8f0dcff8728aee2c35a3a1eb7a27f0146d6113b4de0632dbab20eb0a37942bc4c
SSDEEP 6144:4O8DqTPKIM7B2zi2i+ennbANjdnPMAm4ocyxPbPDTmAu1pHHGfXjQLO25QlhDc/6:H4qy7B2kZSSl25ytc/1rg/J1i/fzUZqk
TLSH
T142941D75ABA79E0E0DA7B2CBFDA112007FDC044CD692E6A1FC4F336A5011A3817BD599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\sr.pak
Size 666KB
SHA256 b75a222db70c3f5734a75042718da599881d5e84cc52b332e9162f78b32f4819
MD5 4d1ee9487f4ddfdc4471366d3965293f
SHA1 4e53084fe0d4bf4f46ea980f7423787084152ff2
SHA512 a44a448203cc9388d8df4c39be9db5436546fa17add0975c18ce01ea0a5cba142692660ce6efbf00699793ca98af8e392e41a07dcd9c183fe03414574389609c
SSDEEP 12288:EmiMMe1Knu/SyI4cH1ANLVsewp6035sp1xAx7oC+37ZJSk/k/o:EnMMeqk9k35WxAG
TLSH
T193E457A19B9E64DB0501F41BD808BE493DAF41FE3FAB975211601DBD34E20B887B935E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\sv.pak
Size 389KB
SHA256 110112c2f7ff5d3c8599036669d156e96ec19e70515fbba3bbcb2043ab994680
MD5 094d69544816535e4d040ef0ce923100
SHA1 5891cdc73bc4c112855d099ee112da0c3e9cea81
SHA512 023037077a3482a3bf2ac076b5c00922d7039bfc2098797275465138142fea0f97c1e003f77de71b9ab88f786b7401182618603610c51f634ad17a123faf5bd4
SSDEEP 6144:lWebObjmSPLUfHxd8cAkxbMUK4NLXmXQMLSOzDE/xWcqpvPb5BN5Bngbd:lWebo2Aa25P5Be
TLSH
T107840B438620F526FB72170DB908115F0AEDE25CE6E2958EB8D9C83EAD8BD5405FE347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\sw.pak
Size 408KB
SHA256 7a5d056fd317b7b60a4fbf0df39dfdd21829f2245393a21e1ddccf1a4e3b61fe
MD5 bc771a0e8398e14653d9a4373a73496a
SHA1 6e844c7daa666640ac3093d5e51276886a0f5a66
SHA512 79b916c737bc44051e6b4c0a9afdfba26928536034c5a5149586594454855b7074f6f8fdaeb98f0b7bde5c3da36d66988f683de8961e13c9c82301676f942998
SSDEEP 12288:dmnKF5TzfMUxbQufAaRO8VUZgNArc5m3HZ+bAoe4Fahk:dmsB5mw
TLSH
T16294E7628871E0185233558603D9FF7317DCEC9C2D2729A36A46BF4F218F98C57ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\ta.pak
Size 1.0MB
SHA256 9cd624a97493282afed3b9b1e848b12639234fa54c04b22128169924f9c92777
MD5 abf95e05d798043abf4f2f514c0517a9
SHA1 b8c6c1cdcbfea03fb106c7a44385a3a8e6806aa6
SHA512 aacd7439df84ec76a3d0c69c39341b51031b66b24be53c87f3ffbced989b38fee416b19db2c3b36904eaf88f98b24e1e26f070bcc8dfb4ecc99dc7bb6f6b911f
SSDEEP 3072:/IFTT2M16QygBwVWhphfT5hB7zNtRaKcA2/:/cf2GDwVWhphfT5zzNtRBcA2/
TLSH
T1CF350CCE923EEE890F93288F0319536912986155C47BE3A67C756E1298ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\te.pak
Size 973KB
SHA256 11df9eaa9216b091fab01f66fd77bcb17c0bea0db3ea7a803bdf5dc6c6e18322
MD5 51356402af92c1912f185b6bc9aa9026
SHA1 60ccd65d7ef35e5219f2bd1eced66e1ba984a8cb
SHA512 8ddc7946a9445a832b4b3b254d24e12d66c42af8cf7dc13add4cd3a9ae50b83e5178830300c0b08aa145d55d79b868efa9d95a116623044d7df8eac1a6556632
SSDEEP 12288:4hk/xBJ3p1F96/iTlw2cTgTNFOpnr/p54JqQJgwgtaJCb8+58XfX0DDq9OyJoTA1:45kz5sMBD
TLSH
T10C2592023A6AD310DAE70273752CF66C49681B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\th.pak
Size 817KB
SHA256 610a440605110f1aa18b1134d116c66cd2050da53e0360924a3171d0850c27fc
MD5 2376dc182234c3f1188dc0d6e1840453
SHA1 2dd35d89e79512e37b721fa697cb2e9e07a1d1cf
SHA512 7c81fe0c2172ff49b6ad9236762fe81e0a786991ca6c6e3549bd66f9cba3c14d96f8560e01bf3681355d6155a0b1b9cb5fa0177137f71ba3d8a1fb6fded29e38
SSDEEP 12288:XeYsml39by4s3/5UidrLRflssB/j86qGv0loIG2EeuLADq7Kle9dAv7y3KH409X9:XJuI5j5N
TLSH
T1E8055BB37247D9D479441B5B262A7789673DAE693F73F8E00089215A73F071A8422EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\tr.pak
Size 415KB
SHA256 26fd3317bedd4080038d7a0003d73923fc0edd40283ef11b5ba80bb27f946c13
MD5 418dc1cdd7ccc10679523665e1626280
SHA1 d4407ba9bc55153963150e6e30f23cc5b2304e30
SHA512 4a907bf14dc9cd8ecb2f17152ff5ea0a6dc37034c95ed31a445395bcb9ad6fc23d4117e81f94ac82d767869b0b828738eacd33b810df87dd41cc3ec2d5b92e94
SSDEEP 6144:Vb44kEWcgMZ4ll7rSmilqnkdShlbh+krge5545/d+2i1TTvdzAQwiBXVx+:Vb4pMKlJe81lh+A545/T
TLSH
T10E940A8178EF381CCB792B8FD2E50626F89F07A6F331E4469A169636735675703E260C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\uk.pak
Size 711KB
SHA256 0523b68c3320674d1565dedaf0436ec821a7175a34ac673338d6447aab20fd7a
MD5 0ed34d4a274d21d3376ca37df97b3017
SHA1 3db12dcc6d1e85d4a497e4cb1cc8103f4a9565be
SHA512 6a5f4c02a23cabc79ec69738778a6c62685cdbe0d8cbeccd830cd75911e00caac4e1d0a1a2165f4cec070e7c417d0ad13e03fe5d7e89c3352e6f2d25cb6e2f06
SSDEEP 12288:XdGPBo+VgnayTBVsFQifnSo75uB3Ij5A9mERrEusLNiXElqBkyC:tGFV6cr5/E+
TLSH
T162F489A1AA9D58DF0105F05BE84C7A0D7DA741FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\ur.pak
Size 622KB
SHA256 578aef61fc8b5c2e0f3765b1487f8af9f72f6506050d501fec9edcbf93c7a3e4
MD5 8d6fa97205a1d2b371a54144aea453ca
SHA1 11a77318f571d15daf7ad047b06e1ec8a51c8f8c
SHA512 9c8dbf1126b97bca195c801b81afdbd8f68e8f44ebd57c563d63f6c1a3f7fa08b1abc76e25a28d1eb2cd8bc47c9438f23b72063f081f0bce6b8f48bd90a56433
SSDEEP 12288:9lhG4V8PzqSMeyeSD7J/5TZPEHbWC8cQYrUu7co/9NjjFpv/j:9Lz4a5mW2
TLSH
T10ED40ED2E6BC96B25A21D92780D33C34CB635F13D34BF286E52146C54E9A0139F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\vi.pak
Size 492KB
SHA256 326e44c27579796e4b55cc281c3e4c9bf5ad7aa87156530709cd6296350758af
MD5 7b2cbb79992021e2fa2714ae9cdf0728
SHA1 a543c9b6d4dabd48c6b5d995cfa3c915a2b76433
SHA512 5c77c2dd9e5ee9d381a2524c733d3ffb55146160393bf919ed8855781d1e8ed0c4d707bd71554d7868ff53bc546344a415e846dc15f68f0e7630d49a94f14049
SSDEEP 12288:fo4e5En2DYpgsHB30XBfwSPSoC39XPSw508ELDg4iW+U9Hzi8Bhf:w4e5ipgsHd0X9wS9e9b508wDHiW+U9TP
TLSH
T1F1B4851116D0702680AC553EC5CE540E6FCAE42FF7C18FE56FF429797A221A46F21BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\zh-CN.pak
Size 357KB
SHA256 b33b23552f8f76aa43671556676298c0af54641e9f1de27a8208750148e737ca
MD5 d15fa5c75a835983af2663466b5a8494
SHA1 6580f7c91e31491a296a039f681c93810281717c
SHA512 39a63db44e1e2b67b1937af803336b221bbe94d3bb31b2117530886fb9e66131efd0eb3969c251d2ee264a7c07bdaecac330c97b1cbe74b3988cac6ff86f3be5
SSDEEP 6144:Iq8Dy2yBz8a8s7H+vlKVClmk3955CuKNP++DfIlX:Iq8WfqaV+vlKVCld55JKNP++a
TLSH
T1AC747EE910ECBDEC044644902725617E7C40B20BF66BDF766ED248ED2BA2F9D0757A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\locales\zh-TW.pak
Size 353KB
SHA256 69d888be9d5affc6086e901cf52936477101374abd8186f8e8f6cc38af826691
MD5 c1c8f601f2d0bb06b49d870c80904907
SHA1 6237df5d4580afccaa6a07f35729f9e2737c82a8
SHA512 2d68f116cbfc77a17b9fb550addbde95ca09f10ce1745d5aacbb9e76dd4d041d6de8e423844266711c64fc6733bb805311a5c8838f576d049340f32d4e0eccb2
SSDEEP 6144:guDHX49O+9vE+J8RCV2qLulexKuhz050wzqCBxBZ/9yGTm:g6Ih9OchxKuhz050wzJd/q
TLSH
T135746BA608FFDAEE0901F984B7C9462F7C8B746DED3B7637FC4818D52E36A540A52106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources.pak
Size 5.0MB
SHA256 0c967cb604d5066f1ab609e81895c1271475a2e1b4b3d5930eea720fc218781b
MD5 043dbe3eaf0bde424185a3843e321f83
SHA1 580ac5fde14e6d177d6f45d2e40d435cc7edc8d0
SHA512 44814aaec681922594528d0ed1a4d2e935045220d09e065647b53455931eaeb3b737c87032b611d7ead621379ae653a9c5d6d87c828c1961c54129124234ebc3
SSDEEP 98304:qg1zetaMcKWPxgWMp1W/ywNAWsh11fHcMtyrwr+oxPf0yO1WODHxSkLyz7ai6y:qgVetWxWF1pkshH8M4krFPf0FIG27sy
TLSH
T1C5363300A765583ED1D8A2F8C49A1133AB3491831AA53C5DF0CEA21D9F7C76B85B47BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

binding.gyp

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\binding.gyp
Size 452B
SHA256 ad2dff6b2afb1e5d9c243b0fa4208e0f90efaa41541c5cb9d65a329a26619cf0
MD5 1907d853a5cd0568834e38c669c856dc
SHA1 0449edcd3e1bf635c5678f1a76d5b90b082bd472
SHA512 2f798520e014420bf9ec5c03ace8c4998fdbe3c5de3b83523270ec75ea971d68ca80dfcc5dea3ce3a0b65532a2288743f01b34623438c97cba910bff1559c549
TLSH
T137F02B16D72F0A2702F927FC8D374642E6D9A6935742550BB8BC608D8F700558043D7D
MD5 SHA1 SHA512 TLSH

Submit Download

addon.obj

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\obj\xeno\src\addon.obj
Size 1.7MB
SHA256 f045506ec3bc29a020c5f75d41d1bffe9c3daafa34bbf128cdbd8b5f9dfa08e6
MD5 d080acd21d421dae56b4621b41bb088d
SHA1 9b76f7eb50f1f35562a1a14f65126ffb20975676
SHA512 ebfa969e0911ad246a68bab55fd78fad609bb59c2239e5ab97c789204f17b5f72f1fda11b228b44e8b190eba4b1035ba9608c94b63d8a0af1605e7b91fd75c07
SSDEEP 49152:oX0JnmPJ6P5ESr7qJ1eGhczNBaY7DrgElBEFzqCPrObytX2fvyXpKvsXzA00LKRA:JOhczNBaY7DrgElBEFzqCPrObytX2fvb
TLSH
T14F853C1689B4C6C3D95D9E71E01F032E391081A99A69E6C3C1AFC53E4CED3CD46BB963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcpkg.applocal.log

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\obj\xeno\vcpkg.applocal.log
Size 5B
SHA256 f01a374e9c81e3db89b3a42940c4d6a5447684986a1296e42bf13f196eed6295
MD5 3bab25a3e651a9e4a00473d2257b99f9
SHA1 1419458f2696be8daeade77ddad380cd0c871fdb
SHA512 ae8dc1129b7a81ba70c9512a94a3e9ccd8c159f1817e309198c2babaf5bcb3f7e97f43b54ea4937cbea468bb5a62328fc0c01982aa1b883d8fd6d2e2c58090ff
MD5 SHA1 SHA512

Submit Download

win_delay_load_hook.obj

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\obj\xeno\win_delay_load_hook.obj
Size 117KB
SHA256 233242629a4941654150060864d802f4b1b5db5c43f655760a76af9b5cdbe50b
MD5 231cd9ad2f7d74c20cc0e129ed6fd962
SHA1 1e01ec6618ac6e00c6d2801ca0cc75449a7f7a48
SHA512 c63173646f2343fc841772936f14708cb8b92fbd67abdbb8349716c6b1eae1823fce63b4c444e799679531f50966506efc3853b9c9a52d43554281fb101ce648
SSDEEP 1536:KJzTvmCrKWg4EAbn+1u+zR4Q76mLhARWybXvc6vXGzxhKNECvtIt:KJXv64Eun+1uo97PAQ6vXQZCU
TLSH
T18EC3E85580B4C7D7DF095DB5E02F031E1D90C1ABC998939292FBC97F88DC3E906AA1B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xeno.node.recipe

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\obj\xeno\xeno.node.recipe
Size 337B
SHA256 884d42313504c353a630c97419dff2b5ceecf921763609e101ddf0e9135bdb9f
MD5 ec2a2f1f199556e4c8509c9a104e6249
SHA1 d094929b3f68df307b85a3173e9deb3e75d763bb
SHA512 0d53cca54729835b2fc470ed718e9916c43a39fdd1baa91d36f8c2f750bf98cd1543a726ac391522aae623c3c28f5bc759936015322e70937c56a0b0656729be
TLSH
T1D2E0866648C4F042A7B06199E27D8F6AFA5B6AD305294C6034D0CE6F0E9344919534AB
MD5 SHA1 SHA512 TLSH

Submit Download

CL.command.1.tlog

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\obj\xeno\xeno.tlog\CL.command.1.tlog
Size 6KB
SHA256 1f1471f9b1ebd70eecbb671c0253b53427d00daef548c828cd198532ae633991
MD5 a33122174d4c0a745478ce9655259250
SHA1 01f64b511ad836569e5d9c60fe1381697f7dc411
SHA512 0c8d685ecc3a2536c4cb0cf42489e3ff7ca781aaf5a6e1f7c50b34e809ec21966b79cc7d4a46ea464799593d4b5bd6c8f81ffbc9908a09fe1e2ef1b99600cbec
SSDEEP 192:t/S0ysZn6NO/FNy6Eq9q50cS0ysZn6NO/FNy6rq9q0X:S+aYB+VmX
TLSH
T124E1AD2870EC606EA31376DA8FCED59FC665F3F986B706AF40B1660B0621C1A5F11B74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CL.read.1.tlog

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\obj\xeno\xeno.tlog\CL.read.1.tlog
Size 61KB
SHA256 172bf5af718dfb2483488833cb9aefe96805574b7c832e2f0fb272e40f0b1635
MD5 dadb09a0182aafa17f03138bf2ae00a7
SHA1 25c8e8889997780ff52a50c1b57a87e2954d6b8a
SHA512 3e3180e6c71e4a308fc85043de29fc4358cbf61ebcb6028451df674a1e56a95d56ce9d9f09b9339e091af6277f4c39cc2deaec16aed090ef6125a659170e3a04
SSDEEP 192:t/CsNDH+jSQ1wQZg3SnivrDRD/ovgKXFarw40GCxNtrDRD/ovgKXFarP:9CZjpivrDRDgvLGCxNtrDRDgv+
TLSH
T10D53291C70EA22496313F2C69BCBA55BD322F2A8D63B576F51D403031390A176E96FBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CL.write.1.tlog

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\obj\xeno\xeno.tlog\CL.write.1.tlog
Size 838B
SHA256 7e9ec4dc3d2f9eeed41582f33b557e44d0d5e0d565b01793c1da154a438cf1ab
MD5 aa73b43878b769f644952ad21193fe2b
SHA1 a229f566202c59ad2076bffaea3dcdf6d28b7117
SHA512 b0d40ced426bee988392625bdd698857bdfa636789ddd67c8ee8e1284ac7c0ae04419474c31d2e36d36f81d36eac592d6de8be5705543792a4312423fc1f0f0a
TLSH
T1A401963874DDA08ED38730D25FDEE56DDA62BBA58C5B0A3F1094964B0362C0E5B089F5
MD5 SHA1 SHA512 TLSH

Submit Download

Cl.items.tlog

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\obj\xeno\xeno.tlog\Cl.items.tlog
Size 414B
SHA256 62fcbe7a4b5b81effb181a4bb2d7c32163975cb312b50729af3f2f63e92ea82a
MD5 6a50eeb370f0e503d87dcba03299d7ee
SHA1 9f11ce7a5a4c3f911d7eb7b396c5ed3d14d7ef56
SHA512 54a5a55708bdb6cbc4ee929d90ed94f48fe7a9fc0a019b00569d8a02bc9ea72ab604a55aac6382a32ff1c49e394d397765dd0534a948f0e1bfdce0fc87f83feb
TLSH
T1A5E065EB059CC5038592B1DBB3BD8B5638C402C3444DE268EBE095149C8B89B1EF349F
MD5 SHA1 SHA512 TLSH

Submit Download

link.command.1.tlog

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\obj\xeno\xeno.tlog\link.command.1.tlog
Size 2KB
SHA256 4fe1822430418ae457c4fa7ec4db85e3f44b1bfc2809d68a3a85ab9480e66305
MD5 aca7204f08fcd77d9ef25b9028ffa8c2
SHA1 9d641a09e80fd60244802a28bc1da448b807613f
SHA512 92286a9c7701fa042f4373fe42951eb6519b70017ad921e51061ce1acaed0a880034f46a42f9c0efda668bd64d621d2ac81c30eff67c2ea48f65f2e16073cf00
TLSH
T1B941A13874EC715DC74770A60FEAD07EC7257BA4C96B0A3F04D0554F4326C4AAB01AB0
MD5 SHA1 SHA512 TLSH

Submit Download

link.read.1.tlog

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\obj\xeno\xeno.tlog\link.read.1.tlog
Size 5KB
SHA256 1a3bb9c84e0f94f9801acf69b3299d53d3a3ab24f63775fda67ca0c450beb514
MD5 d9bbd9790af7406fff3e44c8d6c79d87
SHA1 7c034eb2bebb8f953550ac40d27bb3d3834f49b3
SHA512 dbd7fb1bd6645ba9a9d79d6847b52f22767582bf3c7c27a476591585e7e19cb5af758751d9092599f48483097d364ff2f188b2028da8196934e2305dc9331596
SSDEEP 96:tmUIeRtmUIe/JwtAZl9tY1dtPWMmUIe/pmUIeQ7Rrm1EWMCPKlsPrTCD:tltDq1DpMGNSD
TLSH
T13BC1613870EA324A5746F1C24BDBA16BD712F765DA2F173F80D40347039291BA643EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

link.secondary.1.tlog

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\obj\xeno\xeno.tlog\link.secondary.1.tlog
Size 420B
SHA256 2b746dda6002045a22157cd3dbc008feb49f680d1068151b71d7e020ef8a37ec
MD5 75077ab86d8cd14c01139eed6b8f1320
SHA1 db9023db4c0ae17d372cdfec449f39fb3af51847
SHA512 55ec1ce01623246e56cd3b255de7867c97c1a4ee9b9bc556c3f64ccc15c397132fac0ed45ec7b1ece2705d800035f7d652f6eee20b4188ef769c1d540be5be1f
TLSH
T1C9E0A05E098841175E92FB8EA17EC3C979E50682660D9B0C97F1C5081EC798B5AD704B
MD5 SHA1 SHA512 TLSH

Submit Download

link.write.1.tlog

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\obj\xeno\xeno.tlog\link.write.1.tlog
Size 840B
SHA256 53cd60c48e16f63d6ca11c5d95383606539deb9205fb1934b33d92b14d74dbf9
MD5 d164d661e75deb81aa10072238cdeb47
SHA1 60b7cbd07bc0728f6f8bb1fccfa4a471c5e72b05
SHA512 284280eb6a841eaffcf9095f6b2acb886a9cf6ce238b14a64f983335b6bef1747160bf95c09936928dfee629d1dac7404c70b38a8d7b310c2e4ca3e1b3ad113e
TLSH
T13601803978DDA08EC3C730926FEEE06DDA227BA5884B0A3F10C49A4B5322C0D57089F1
MD5 SHA1 SHA512 TLSH

Submit Download

xeno.lastbuildstate

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\obj\xeno\xeno.tlog\xeno.lastbuildstate
Size 233B
SHA256 85cd74c614fc5e19fac516b41bf4c2d5293aabbde8661cf876ed71639f664a82
MD5 fa19eb333b70c54521dc769c8d7a1063
SHA1 05e67116de155e31e69f017605365020d3c679bd
SHA512 b0a71eb3715a0842b0e1f98b994cdd7a71cf96e5a500ef69822396acd02a67ca44c85218a5d2afd7da803c365f1c4ec394b6d505f6e92c7a2b4a0f30ba9a16fa
TLSH
T19BD097000398C0A2A822B9CA60EC01CD33E422A2482AE24C9ED0030C1E8740F00B323F
MD5 SHA1 SHA512 TLSH

Submit Download

xeno.iobj

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\xeno.iobj
Size 602KB
SHA256 b77ebc23e755bd4eb2cb3cbcd609495e6925fabb64dbed22ab5fb3135fa4a875
MD5 058aa92a856d8f4989f32a03b8ec0d17
SHA1 285e0b0f271d883037cf94fbdb5ecbc909ce331e
SHA512 2600b521545ba970ce3dcb2845c0eb5443a5da1ae3cc8934ebf89e61cf3bd5911523dcfbb607e450c51905b8078b8b46ece8082f3f20f0d370628fe8a6fadba8
SSDEEP 12288:VjH7Qc13n6AGU5/j+Qnhax77UajANwk9QjOnNLERiyKQLCoBDQhIQS3YA2swHxP:mc13n6AGU5/jDnhax77Ua/k9QjOnNLEq
TLSH
T161D42B05A6A8CB72EE368272D1D3053DB374F642BF8B5B47234BD1B16C83385BA1B456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xeno.ipdb

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\xeno.ipdb
Size 203KB
SHA256 c199d85230eda0fac99346ec1879113c378efa1334f2e2e6e38a98ac52c4295f
MD5 095ab27bedce326cc726e2b49e53ce8f
SHA1 7318850f47872b9fb5f16e0b7584e823fb1bfaa4
SHA512 145c91d2b63487b786637cda70d7925b2d41efcea92f93374ce5d542a46909e4ec806974487ff1bf16ced9c06bf78b5ddc7da1196f084993a627c60a38e88ea0
SSDEEP 768:uJ+JhqE3+JjOiYFJc9+I7pe2SH+kZP8fUpwCbezFyi8/6lWquVuzepHhV2/XWchi:q+JhpOIcG2SKf/CeZyyxuyIDDt
TLSH
T1CF141D457B428A71C41903334CE79F963B75FA421F6B0B8732FA9A3D6DA27A17E421C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xeno.node

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\Release\xeno.node
Size 152KB
SHA256 b29fe50685d3e61eef0123123c64276d5ee7816de0e695d132e6884314c78f9e
MD5 4b2c873f81f12b04966451a4cb52b6dc
SHA1 174df7d5b2fe482970ce1b48840947faad637bf9
SHA512 b73ef1fe628cda3e3a6c01ed7bbb4bce360bd8c168e9c9ffcbb8605e352cd0901926fdab04b72834d6e9a6b0a6383a7c2bdb5abcedfac19ea33a6122ab7f3932
SSDEEP 3072:e/oBISptd/e6Iayfev5XcIaOlpcg8S4vP:e/6JDdG6IEXog0P
TLSH
T121E34C17A6A9507BD267C535C8834A01EB72BC564790AADF47500FBA1E237E0DF3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.gypi

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\config.gypi
Size 15KB
SHA256 3e24dd241f5dde1feb8ab522d511d50dea7888f16c618065632e763f926f3e84
MD5 a206fad70faead9ed15fbc3510dc4723
SHA1 20986e19f4bae3f1aa159a51d0fb210d09e203b4
SHA512 43dbaa1f66149e58b37c6f716e46c3515c8becd49ebae638f5a445b4a80aa3d136d2295f04f0aa10ad59d50279e6cea90b203d5e2b53fdac8eb56e1e8f2d5ab4
SSDEEP 192:F4IbegwSDaExV8BZCt2IMAxdMxfpJ81bkJoYjlFHh1bq4DqxFAfTf8hHziMgrVRi:eZSDaExdYj/HhMegFAfTf8jgDWvJ
TLSH
T1A7628B36C42E4E8676C47E546CD4624199804993CDA2B508736C8B5C6FEF0AFDAFB23D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xeno.vcxproj

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\xeno.vcxproj
Size 12KB
SHA256 4dc7aaab179950cdecae36bc883a95461edebaded39498b3491a14ec33bb90e8
MD5 cb82991ead04b99fab793977416855e7
SHA1 5bff52aab9ea4f994e4d3cf9870b2a9bbb6f3cf6
SHA512 4eaa7d4fad0e075b625f2bf486e26e92334da50de94da95a18d378d12c5ef6a94cc7f9e4d222c3048d9c49f9bb2715ab793de30419d9099713742bab57ab6425
SSDEEP 384:4iAvXvFe4ps4rvXvFe4fvXvFe4iN4rvXvFe4yj:4iAvXvFe4vvXvFe4fvXvFe4xvXvFe4e
TLSH
T1E0429402F4BC8BE65587213782E556692DF0D2872D9AA054FA8DD1DC6F9F00EA253F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xeno.vcxproj.filters

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\xeno.vcxproj.filters
Size 2KB
SHA256 13fc77f175d5302d663d10ddc715e916556186cfc123c6092b8ab21d319d9ac6
MD5 1240f5cfe76ff5345c18c4724b1eda29
SHA1 40786e7e41e2dfabadbc5fa4649e2a465fad7345
SHA512 6001d959521cfc8e3071c377cca3c02eb690c2bff0592c852212c9b1742be43af2e8028e505f522908f4a3a3c2084562454c15da162460c328765837818e89d9
TLSH
T16B418665C9FD5ACA21222CBBF288C6077EEA52F330C8520476DE864A5F5670B56F731C
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\package.json
Size 322B
SHA256 efdb56d33792bf254696235274b24ddf40674e3d1b3b0a5187029d67cfa72bd4
MD5 64fd1ac57fceca11cb4e5e2bdf083f17
SHA1 fb12d8bc2ba1ae36950ff7c4bf78dec9a04d1719
SHA512 d8ff01a7c8e90dcac8ecaac092bf439e27d7d7590b8db86045772d9bb885886cccf5b5923211b089c3c6f4b5936ba716dceb74773393534c4d34cbbc2efd72cd
TLSH
T131E086538A1091331DF506D2DD72435675315B1E4269DC1E3CF31314962675710E9F59
MD5 SHA1 SHA512 TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Failed.png

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\Failed.png
Size 20KB
SHA256 2be181dd1f3f0049db3997f4b5b69b94b903443f7f8bdbff3051aac633444fc3
MD5 487dbdaaa1d37ff7ecf8e2ac582709fe
SHA1 db8981ccc3d8d22f6e72ed1afa03fcba3719c1c4
SHA512 a8c765ee2dbbf23eb9da13fb4f6b6cfcbb2bb7c31744a1675311b663f4473b64e2e73bb11e0eb427ff3da4251f2161c3fa56d60c81884237f4bad1b7e59f32dd
SSDEEP 384:Z1Ih7jQ/sHAxxRQn72u98DvK8uv/50JkaovKoG8kxnKh:ohNkxI7CvK8e/Yekwh
TLSH
T12792D0838A3494F632E807FC164B26BFFDD6B99D890506C37988642326F0DE1D1AE51C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xeno.ico

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\Xeno.ico
Size 271KB
SHA256 47d3235a172d30f8937d9552c1f00da66deb7032c44e292ddf5b57c52b8e84b9
MD5 9fc67142fd756e3d1df6551bf91bdbcc
SHA1 3453c28d120ecedcd40ee14ccededd3b8cebfa26
SHA512 05c3baa2bf1e76649010597bd574da15e2490c97998611dabaf9d5fd368b815596297ebccfbee9c537e08c96712d618115922e8b3fac5b047a3fecefac0b15f0
SSDEEP 192:7xtSRvfoOnnnnnnn2+0+0+0+0+0+0+0+QHHHHHHHvnnnnnnn:7GYVnnnnnnnrnnnnnnn
TLSH
T14F44F0E3394459C9E9B65E79D17099F0103B7EBA3A9F38047E34BF1E0C32193189A43A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 94b6e91b93c2202dabd659bff294bee87c22897a30a6b4930b49051c2fb502dc
MD5 c8dbf0ca88facfe87899168a7f7db52c
SHA1 e2cf163ad067b5d3b19908a71ed393711f66cd09
SHA512 e85c738f5d5a0ae6c3ef75a082712cb3cf2feae4560d316cb110e4eaf3a97d6058d5374da2a5edde39c3114f9aff8a027cbdff8cf49be2425943bac09c39e70b
SSDEEP 192:w89M0wd8dc9cy1WphWWD1S8f4DBQABJt9o0Z5uE7Mqnajcno:wt0wd8xy1WphWWD1IDBRJtO0zuOMlAo
TLSH
T1A762A49366E43F15EA9F277221FEDBD72A391B81255043B8C607E54C3882782BD97C0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\api-ms-win-crt-environment-l1-1-0.dll
Size 18KB
SHA256 f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1
MD5 c712515d052a385991d30b9c6afc767f
SHA1 9a4818897251cacb7fe1c6fe1be3e854985186ad
SHA512 b7d1e22a169c3869aa7c7c749925a031e8bdd94c2531c6ffe9dae3b3cd9a2ee1409ca26824c4e720be859de3d4b2af637dd60308c023b4774d47afe13284dcd2
SSDEEP 192:sfW1hWiQcvHCjdks/nGfe4pBjSY6Na3sAW5RKTt3E2sVWQ4GWIjcyqnaj/6g6dqd:sfW1hWPQim0GftpBjzim3StltFpn
TLSH
T1F2822BC69ABC9543F9C3AE7052B8EA877D3DDBC31D20812605A9F5982CC73D1EB1092D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 51541ec6684b43157a85ea46a42ebed4555be06bed0d0d07ff3ea6377301318d
MD5 42a2a95f1bb940d01f55eb1674a81fe2
SHA1 f982f3bbb4dc3aaaba8df098d1b395846f7cba08
SHA512 de9a7a1a6a45e2f76105eaeafcc3c29adbff142dcf2586e147417045b897a9dcddec5e1b97acfc5d3fc9c8e3a508dbc3f607bf3df20a7435e74436f94cb056b6
SSDEEP 192:zt/PGnWlC0i5C9WphWAeD1S8f4DBQABJJ2yy2D8KN3qnajV2MVorr:VunWm5C9WphWbD1IDBRJJkt2lxnorr
TLSH
T18852F78347E47E02EAA72B3112FDDBDB3F3D5781185247668006A52839E73C1BF1659D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 80139e4caa379d87b1d1dafc23ace71d2b330368115f6314140d4ae59c2a78e8
MD5 98da186fd7d7873c164a51c5d7b77f1a
SHA1 725a8b8fdfbe6a1e85674f4b2a7c0dd08411e00b
SHA512 587b49a24cc59d4dcb62b59f379d1c9010196a6551cfc99ffdd931eeb0172618f020863191e530d65ad198e57063c57ba6f70bcf80591304243268ea5513f806
SSDEEP 192:DaY17aFBRQWphWp+QD1S8f4DBQABJtAa46ArNc4qnajr7PQW:7VWphWFD1IDBRJtAa54lrPQW
TLSH
T1BB421CC387B85903E7637F7026A9D68B3D3E67C66D6085668057F2A52C833C5EF0162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 7bb8644e565ad4bcfd890f9044bccb4d99953a740e9a500b1f820b2fdc3fc240
MD5 ff48b107b2449a647c64baabd49408a1
SHA1 efb868ba125d9ff08474f02b9483d74c36a13cee
SHA512 4da2e4b727e7f31f8bffd680453c451b444bdf217c15cb36e353f8bb5ecb6c6481caa7d848558c7d94cfc2d1bc3551ace11e85ffc8ec7a7b570a59c294ea0216
SSDEEP 192:JWphWzDD1S8f4DBQABJtySO5M8xOSqnaj3yAY9:JWphWHD1IDBRJtyICTluAY9
TLSH
T141422B868BB82803E6927F7006A9D6877D3E63C31811856A5087F6983C433DDEF01B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\api-ms-win-crt-math-l1-1-0.dll
Size 20KB
SHA256 8a7bff1c918539a75c25568db25933d653c003e016fd7791a37186b42bbb7c20
MD5 e10e077bb06209aedd0d0d378c758f73
SHA1 97a9053a311280678f8ef65dc4e25975c41bd4ee
SHA512 571c1fc4192320bd967b603e6cda917a62f4720eb4dcd557ec2913d2558c0cfe68f936198f5809934aaa3a1d6049e8e918eb0e638a7244df5c71ef0c78843191
SSDEEP 384:rJI2M4Oe59Ckb1hgmLZWphW1D1IDBRJJo95DKlxT1xpN:ri2Mq59Bb1jEkI1PU5Dmv
TLSH
T1F592B68749DCFF67D28F17B701F08BCE6A381AA254E1B6B4C81B918934927C47E4394D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\api-ms-win-crt-runtime-l1-1-0.dll
Size 16KB
SHA256 07382c0d91dad2bb6ba8bd06ea02f12c57abf7c4e5a70672e9f2954d09a4ffd4
MD5 f91e1ff896b5616919ac97c7095c513e
SHA1 4ec6eed0bac5a8801db10238c7b3a5d35a87be67
SHA512 6448d6cdfde11e1805b6d381111ea062f681807c9dc54ae890305f287b13b6fb57ef3f4d3b909e56b81c99830c086b5702b46ba0f93e695fce2b87b32fa4b26a
SSDEEP 192:uaajPrpJhhf4AN5/KipWphWAzD1S8f4DBQABJJLQ67T0q11qnajVtPx5g:ulbr7fWphWiD1IDBRJJL7Tplxb5g
TLSH
T1F272E7834AE87F27E68B3B7316F9D7D72A36638629104179C857E1D938C3781BD0721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 2a466648affd3d51b944f563bb65046a3da91006a0d90fb2c0b123487a1fc1b3
MD5 429c26ed27a026442f89c95ff16ce8c2
SHA1 69ed09faae00a980c296546c9b5e6a8d5f978439
SHA512 04641164d9e1eb3183db0c406583626011dfe2b2574551c0ac466ebf44165afcd7d8faf356b8268b4fc9a54db20de010a4e4293594ad2e605950aea65636f4e5
SSDEEP 192:BpPLNPjFuWYFxEpah7WphWRD1S8f4DBQABJ+SiLuEbNEdiqnajVCpEbOg4:B19OFVh7WphWRD1IDBRJ5iLbnlxkEf
TLSH
T16082C58385EC3F46D28797331AFAEBEB5635538328147278C407E9943ACA389BE0755D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\api-ms-win-crt-string-l1-1-0.dll
Size 18KB
SHA256 bf4ea10be1b64c442ac0ccf4bdf69f6703467176a27e9e14a488d26448a6e179
MD5 0f593e50be4715aa8e1f6eb39434edd5
SHA1 1117709f577278717c34365ce879bcd7c956069b
SHA512 487dcbf7b7f18d62606cb2f05c8feff07e6ecda42e643f5919c6edda66cdb3b8cc393b0d260374f06c10cf54082410fc9f02bd87cc50866bc0c28b0bcec3e658
SSDEEP 384:fFvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl3WphW+D1IDBRJ5YBMOnlxkEx:p5yguNvZ5VQgx3SbwA71IkFxVI1PKJ
TLSH
T11982B58346F83F45CA8F57B319FAC7C72A384B4625411375C467A58C3882B96BE6BA0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\api-ms-win-crt-utility-l1-1-0.dll
Size 18KB
SHA256 984306a3547be2f48483d68d0466b21dda9db4be304bedc9ffdb953c26cac5a1
MD5 54f27114eb0fda1588362bb6b5567979
SHA1 eaa07829d012206ac55fb1af5cc6a35f341d22be
SHA512 18d2bdce558655f2088918241efdf9297dfe4a14a5d8d9c5be539334ae26a933b35543c9071cedada5a1bb7c2b20238e9d012e64eb5bbf24d0f6b0b726c0329d
SSDEEP 384:RfVW1hWfFm0GftpBjaDRm3SY6vlgCohaQ:RfsQViklwHj
TLSH
T1E58219868EBCA583EAC36E7053E8DBC77D3D97C35D20856140AAF1982C877E1AF1461D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\concrt140.dll
Size 316KB
SHA256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376
MD5 5fe9a647921ded8a2fad92deb9ec4ab2
SHA1 1ce87fac4c22aae82a81ddb26952c074b744e78d
SHA512 11fe4c0519cb1df73695ce38b5fdea2a563de565116a47ff0032d5a68b8c51fe732ad66738a7167e56d79193c60af9204a7ee0beae8ff8bb75abd0b484c2d764
SSDEEP 6144:jfjSd54rw5k9cZW1Cbfpri5/ww8VRj7nWzg/p8Wcz:DOP4rwK9c0ILqzocz
TLSH
T16C64398A76140CE6F96BE039C553851BE6F2BC416352D3CB0264839E6F637D1E93A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\index.html
Size 383B
SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
MD5 e582b9106fb430459c697d4c5a519c25
SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
TLSH
T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
MD5 SHA1 SHA512 TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\msvcp140_1.dll
Size 35KB
SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
MD5 2a214cb2f0f9473e7765ee3b8db8651e
SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
TLSH
T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcrt.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\msvcrt.dll
Size 683KB
SHA256 84425efa675012d33433c4c1c43836811d74be8b3e53a04947566f19356803d3
MD5 3c16dc3a8bca4e7b1e9cd1413301bb54
SHA1 64953c05cbb41f5297808069b9c45d6ba33f633b
SHA512 6b7514a07231604d49ece1cc532fec748902705e026926059bcb6bba6c9eaf60cd3cf3f1d3fafe62a468cd3b3f53d574f25dea1b15f666226849afb2b87735c5
SSDEEP 12288:USJWl7OB9MB+kuYHWsnx53yozyg2GqJj7GyopCoAQRmVyIZN/eo:xW8QHldnjz+G+7GyopCumVyIZ1X
TLSH
T16BE49D6573A90AF5D87BE13EC9825226F672B819137483DB02A14A685F33BF5563F303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification.mp3

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\notification.mp3
Size 15KB
SHA256 053a2fe627916e048af1ce04b356988f3844754f370ea169f16bdf8f72eb0d07
MD5 386725dd55412a7d59cb97d5a5cae711
SHA1 5550aa8a9ca6a8a5e51845d7508fe678d47d12e8
SHA512 dc2f2da50046b8f54723363cb87d4aed66f5beb686d3afcd034473287423ba8b3c8e4235834e05a4220fad82119d0ee9865176852b114b4b2cec060e48c8e8a2
SSDEEP 384:8znRznWlUhkjC3p9gPF3WBWhVVQWDtqIbQX:8dKuGO3p9KF3WMhvQWDt5bQX
TLSH
T19F72D0B310D088CDFB48D076A32791A3552E964867E6B0D14A037E731AA9BE3E0557EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\ucrtbase.dll
Size 1011KB
SHA256 6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232
MD5 849959a003fa63c5a42ae87929fcd18b
SHA1 d1b80b3265e31a2b5d8d7da6183146bbd5fb791b
SHA512 64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09
SSDEEP 24576:EsKxVJ/pRRK0Y/9fCrl4NbpjONcncXEomxvSZX0yp49C:lKxDPHQCrlQBXxw
TLSH
T10D25AF64FA5D0EA9D57BE13DC51B560FD572380207608ACF03E64BB96E2BBD91637320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\resources\public\zlib1.dll
Size 88KB
SHA256 f6b58fdde3bfef2c25c7254fadfed12d86d81c4a5c962262715868c48063fc76
MD5 68cf6f98cb8b227814a59ff3f909a0af
SHA1 0383a4d7a74417d3ec90526e61b7637256e0bb57
SHA512 b59f9eeededd1f76f048b57ae753f79227aead32006fc649532a9bae3f441515bab85338d25b26e5002c54c65d661c0c3048f5c3c1ded6274638ee950afb4744
SSDEEP 1536:QvkS6XmTzqbKxfXOTBpp/foyUaDmjGI23aIOcIOZhhkxBJNJ5:PdXozwBppnqG3oSZfkxBJNJ5
TLSH
T1C5936B4AAAB412A5D6F78178D8D207ADC331701407A44BDF9648A7691F23BE41F363FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\snapshot_blob.bin
Size 253KB
SHA256 c1c9145735032bff20b2fff50a4b92ae9cf47290f433e3f3b32e3b232d610c59
MD5 3a4095538e021b84396b3ce25affafc3
SHA1 cfc20771227b3c1f3197ff6a91cee68555afb247
SHA512 7b71083180f237f5f37cbe7a9755f6606708b959986562f9c5880cccea17b80a5187649fc0cb6965a8b40526bcb2cb6d980d364be528465290658b4d9084348e
SSDEEP 1536:N8eVec2PhNMqkPhmpILx3FtscrrDKrVTT9gXA4SuoveydoBaDEtu/wMHOdxpMKrF:76N6PkpILxHscrXeQZb0G0mvY6T
TLSH
T1CE446284FA40EB1BF923AA70CCDA84D93325F7449F438ADB7684473D3471B76AA05789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\v8_context_snapshot.bin
Size 564KB
SHA256 5b1f69f39f3d5865dce13ee3bdbc1af2938f5cc4c056dc9f9e213e9af346ad4b
MD5 5db8a5bb87c7999343f30128979057a1
SHA1 c4177c2fe973a495db59b6228ac26264eec46a4d
SHA512 da2d516251376952729a33de2cd23764290d400fafc49642f2ccd799e3f989cce4d5561a76d380a950b77b53b50148dec9089c30de6c3dc38666237e196e569b
SSDEEP 6144:alKQ1+Ku6X5O8QgZbNg8zvEjbwTBH32jezyjPX:aV1oeLvs4mCG
TLSH
T12DC48485BB01EB17ED116EB08DF6D4C533B0BA449F03498BB2A85B3E3276B625D193D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\vk_swiftshader.dll
Size 5.0MB
SHA256 2df870c1719ab057ea37aa15e3e379360c1dd8eaea2eaa56cb7b026f5ee4f19f
MD5 b06a97b925991eac3832437d7db078cd
SHA1 ca32356ba0938ada1233e13795860690712fbc14
SHA512 e1e61c28a28dfcf15d69e9ccc8e289dfe606b926e21756bbc0f21e15df18d27b1926277ffc2bd6549cdfb17f11d71c2a9353392e58c33557209b781ec32cef9e
SSDEEP 49152:Ab03fn3GIdr1DO1N8jvfWSrvOuyEE0+w7rz77gpxbhk0H4t38mvttDpSHUoeygs4:d3v3xDvRTGVgt38mvt1pSH0adU
TLSH
T1DD364903B2958199F05ED179475BA632F632F8801B72B6DF46A40F192E37FE02B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\7z-out\vulkan-1.dll
Size 910KB
SHA256 5789ca1822f3a5a67cd2c24e6ff0307e688b76a2e99831050bdcf8b8d155956d
MD5 d562628f9df56ae61770ffdef79c8d05
SHA1 2423105a960fe0ceb038ca36d6a37638ebd32b6f
SHA512 739f9f41d8e3e48dbd20bfecfc5679f38e59b3fc8cb406a77c384fd5146f19efafa1e4f23f15071dbeaa1d0dc71e125966e19fb757fc39e6abe953159669c096
SSDEEP 24576:FoHDVVdrfQ09CPKuy0O0Q6Z5W0DYsHA6g3P0zAk7s+:FuVdrI0GKuy066Z5W0DYsHA6g3P0zAkz
TLSH
T111155D27AA98496AD576C034D9828607C9B174911B25B5CF03684B09BFAFFF4373CB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqEF3B.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6484_1881152103\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6484_545999606\CRX_INSTALL\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XENO_CACHE.bin

Path C:\Users\Admin\AppData\Local\Xeno\XENO_CACHE.bin
Size 36B
SHA256 3bab55816f9c1c63b26bee8027a74983736938cfa748d9c91230391d4bacfb88
MD5 03b4e88d732421deccbdd05cb90b0513
SHA1 1ba9d3bd3af60ecc041e93251633b5a0fbac4d9b
SHA512 40e01403608fc8d8c0bc7bc6e1367a472778dea5d4dde4d242b37b0860d098075ac71cf24abd85c6b9ee67bf6adf80adaaf279a969f4477555807003276a2c75
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 23KB
SHA256 a419dea0f46643c73117e6fb77a2bd2516fcae72045a87763aa77d915a34a34c
MD5 b485cd3f5b0eeb1463bd4d75b8c151e8
SHA1 20d237b76e3ec9bc62944e26ae623e87a2233c85
SHA512 2d1f16db98b2de2d74fe84db393f17c6884ec5c0a988500decc1d271ab28175c0ff23b5c291fd7f8097140bed3df446741c5ad96effe1df61907656c422c4963
SSDEEP 384:FsEsXsj0sQsIswzskzsZEsUo/l95baOsoFfRPbY:y7WT95bjfJM
TLSH
T10FB222011BFB1599F6F35B307BB2ABA29A73F9215B1A656D429102050B33E10CD6EF73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 19KB
SHA256 4ee6e0cc80f307a487b33a80692ea3e9438e69a9c986588ba7a97dec2e3d086a
MD5 855e2b7bf28534679daa1dcf2196502d
SHA1 f04c9e5ff77a1edc6b3aa324ec32d39d9f9e4766
SHA512 12432686cf327feff3efef425bb864f0c2b0dadf30f7b736cee5b212cbe451a7f59b55873523155320a7f70ec3823da26363fbd40b44cb6a68af13e78a86191d
SSDEEP 192:VbsXvwbsYv0bs/gvs3bsbVvz2mbsPWSzv25bsNvObs5Wv0bs6+lvM+bs6UhvM+bG:dsosfsjLsZ7sOTsksHsDs5s9
TLSH
T19C9211010BF70A92F6F35A30BA716742EBB3B9115B06561E839202590E33F50DDBAB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 19KB
SHA256 65dccfd3490e34ecfeab35ac9eb0229576f3a8b87efba649be9500105ff109ed
MD5 a8b03a730d03ce4c1eb4ec69e1e7a25b
SHA1 1d1b7ef2a2bd64d15ed3cd05851d634a93c7d6d7
SHA512 c507e1aca6026e1f2f5bfde758debe6e598831ba12200e0e069d0aa629f5ac75c815332a88b6eac1e559a5fc5e6b024bd2851d14801bfd0c54fdc98d6d5e51a8
SSDEEP 192:DbsXvebsYvubs/gvsxbsbVvz2obsPWSzv2TbsNvQbs5Wvebs6+lvMYbs6UhvMYbG:nsysFsjZsZpsOhsKsdsBs3s9
TLSH
T1079210010BF70A92F6F39934BA716742EBB3B9115B07565E829202590E33F50CDBAB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\AlternateServices.bin
Size 46KB
SHA256 5721a801f01ee7570b790376857fe8479e5784f1ad3196bab1497aeb1038cbd1
MD5 b1c950ffada5780ebc1a44ab50ee68b1
SHA1 ec216a6c0f8b5411cbdc768332a4f515397a64ca
SHA512 2a528e58210415659d6bd151a245fbec37e4488d9d53f5d5d78a653582643125b83a2f3841714cb2b1751cd61d99427f0e3f347f03ae221a559c4be6d6f45231
SSDEEP 96:E9jaSqI56PiRgiDBsidNTeeVM/pSb7PbhZZljByx2VtyuZViy8t/ibDVe6JJ4EPR:EpVQKB22vZZYFtSIglosSAkPY
TLSH
T1EA230AF76FB5E462F4A39FB04099748CCC3307299869A588D609D0F71292BA5D07FF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\AlternateServices.bin
Size 52KB
SHA256 2fd6495321e89c3ce61c179e6178843200968697e37e6548836df678503c6c67
MD5 b57a08c6dd43bf40591728e627f5a8d6
SHA1 115fa1be67f34c3b4066ffac4e6dbe38744ba807
SHA512 4e570c1e52f18de9466f1a63fab2b3c76a63a6d500ce56466e83808930299134391a2a18f86d7cb70d92c1ec6fbcc2be25136381e57de7da48d053b41fafa34e
SSDEEP 96:E1M/p8lhZBnTPXDyx2vPyuZvsy8t8Dz9e6JpkEPbEbEvNLPQsvNbhI6yM1840IBN:E1Q022nZZEFtQIgFosyvFkzPY
TLSH
T17333E9F76FB5A852F4A35FB0409DB48CC83306299859E9C8DA08A0F703967A5D17FF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\AlternateServices.bin
Size 11KB
SHA256 6b53d000ee16d7816cb19b2d7dc8712183f1edf5ae28e9fba981b332d300889b
MD5 3a1f746ca61c8d5f8ac6849f2454afbd
SHA1 582d593983acc551f3bc159a9598bfdb791bbfed
SHA512 7ad27c92f27952f317a5dc38a6158aaeae382de4d55ee380dd494434e40aa8e899d38de19785ed70a3b0051b50e981a1d6ac8d680a803f64867fc385b76c09d9
SSDEEP 24:CuhMZC91BKH29xabO5q9F55A5GTJ9BBTL9VvXTH9lfTs9BbQgyWN9VxWAS:BiHsYgI56GTrrTpBXTdNTe9QgyM/pS
TLSH
T1873262E32F766462F4A38FB04059B58C9C331725946D9184CA4590F712C6FA9D07FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\AlternateServices.bin
Size 33KB
SHA256 5dd9adc60b3852ac1a311926f61e432598b3e76c5fe444adcb906b682f984a74
MD5 3948b09fcbf6ddd55076b048ba92efb4
SHA1 c11ce895caea59e9409b0898be4265830acf465d
SHA512 a032282e2349df8b5f2315781115b8213e0b35730fb70c902dc2f7ee66ae3f6775ff813638c741483fc327910c45a94214d98da8ceae45fbc8b82697cc7ad795
SSDEEP 96:EWiMYgI56GTrrTpBXTdNTeeVM/pSb7PbhZZljByx2VtyuZViy8t/ibDVe6JJ4EPz:EBDnzVQKB22vZZYFtSIglosS
TLSH
T197F2B5F72FB1A452F4A38FF04499749CCC330625986995C8C605D0F71296BA5E17FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\datareporting\glean\db\data.safe.tmp
Size 137KB
SHA256 140fe92636d339e0572e7fda5286fea8cf73064700a9b62c85c5f448ede0d23e
MD5 6acd7b17bebd98a368e716028d56520b
SHA1 3df9bd530abbc2fef1bca9296066e3aa9850458c
SHA512 204ff4efb445be2549ad94aa33de11779bbc9768f3c08b0fd4e7e5dbb4350039e7e96636c8a0d05480e0e4448c645b2ddb0c9b50deff39f9e67580ceda16d052
SSDEEP 3072:GAroctQ/qyB97JdPTvR6QLt6sRM83q48t/6NJlfyA+yvUxRd:GAcctQiyB97JdPT56QLt6sRM83q48t/X
TLSH
T167D39F94CB17407BFC1485BFB495673C2635F4214A599B0B2AAC04762DCB3FF2D0AB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\datareporting\glean\db\data.safe.tmp
Size 156KB
SHA256 2459721e66a76f8a23424574fdd267444eaeacbafc83cefd6522a598e303772a
MD5 d312a31bba8153ed58ec74927d25054c
SHA1 048b661e452f3547c0620250b8f25f07dc6f246b
SHA512 26898a4806fb59baccccaf4af0cdde75c83ea8eef96bbb5e0cd5e99bfbcb0c79cd385652650c8c20d0342d1f008bffef511543a384601f43ae8a72cb99b2d468
SSDEEP 3072:y3vEcAS+Gnh0TvnksXuZXQ7Z/LmqTgez/9W66WJUOvDdvvPxZk:y3McAS+GnSTvksXuZXQ7Z/LmqTgez/9E
TLSH
T180F3BF84CF16407BEC2485BFB495673C3735F4654A59970B2AAC04722DCB3BF2D4AB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1305835b0704e7d006b62f471c43bf29e1a4bb6ef6129ea6da3c4fd9beecfe93
MD5 54105c175163b172eb67285057446215
SHA1 50f5f4d8ca889268ef5ed917ab2c6e5678d8a479
SHA512 a89d7ed62791ca5f3d55aea16bc3ad832ace407bc0bbe978b71c43f89211fb04a25bd81541d7194e5e89b57408116946dd32c5a395bd3da0428853aed2f387fb
SSDEEP 192:zu1d66Joz1zgCl6mc0dXOv5zboXbk5yjKcN:zId66Joz1zgC1jGboXbk5yj9
TLSH
T13FD1FD64FA28863FD448427BDCB61F410F7A389B984E3F1935AD64092C5B2DD3A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 bb41d5737500ff7f634fa369c302b100087dc874564a17fa6b9cba9dc8098feb
MD5 203b53c870882d6ddfaf852d298038f8
SHA1 95db3a4f0e603f644746d6f81c7be736b734dbce
SHA512 d8d01e0d12b096c213b0ddf4f3cd588b3ffc923ee459c2193a09b6dc4ac5569d52bf1769afdac8a6d41495295a07302335bd007b6dc142d32bddad1a3d4f6293
SSDEEP 192:su1d66Joz1zgCl6mc0d6Ov5zboAPZk5yjKcN:sId66Joz1zgC1jHboaZk5yj9
TLSH
T1EDE11D64FA28863FC408437BDCB61F410F3A389A984E3F1935AD64082C572CD3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 1c42beb4520d3c49dd11b41514d2eec44f406843fba4d0f0213c58501ec1ce54
MD5 aba5c2a1249d28396ef003930eeca68e
SHA1 144997485d20fca87c56e6efdebd25b2057ee9d8
SHA512 9a9e91cfb3609bfb922b5f08c4724a8b364b158fe876eecfb45867e6fe09622f759714cb7b62cd33461c9381f9f0b894973e147a53256efc45e69b68577f9ee2
TLSH
T1E361AB9CF628463FE048813ADCA61B451F34349698AF7F2A399C604D1E572CD768D17E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\datareporting\glean\events\events
Size 1KB
SHA256 4a80c51ff41c5f2b53b334b249053a68edb991af80c96a75544a1b24c324bdd2
MD5 95691f769c0d0801f575ce062347acf0
SHA1 b53ccc6925ee324eed904d2e85fcbd55d95ca0d5
SHA512 e811eda156abc1d4d797d6029a533b3c09aa100cfd99005a95a613387a60639fa6ae493f220a7f67a4987d7d0c370e9832de505a3ac6e8bd2f014fe8ab2df187
TLSH
T141214C5C3EB84EAA5DC7E2ACB451128E53958E07148B1C43CD52EE9DCEC16D9326B43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\datareporting\glean\events\events
Size 5KB
SHA256 08cc761acc8add1b955ccb64d9510019bf4f44a6c9aa3b3389d8aceb7f1f9a39
MD5 45ce3b340c9ae155bf01fd23a71b5727
SHA1 8835785445e75c0d261883e6a4b118c0d4c18bde
SHA512 b4e6b66be0214fbec9eeee625eb4fb1a8fc3e8615fd259eb14baed6c04b112d02da40e0ff822946cb57e6efdf183ef07ccffd014d6abc561450b952319dd6a2e
SSDEEP 96:kQXVD43Gt8m24ioDcdCdj050Tbjf4A8YD90+BAG8/y:Rlx26WkjWol5Ab/y
TLSH
T11EC1342D39B40CBF69D7D3ADB481439E479D8F02C08B1C47CC97EFA9CD85A99325A468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

105b4b86-adcf-49f9-90b9-0022af3162d4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\datareporting\glean\pending_pings\105b4b86-adcf-49f9-90b9-0022af3162d4
Size 235B
SHA256 e0c3ecd81039b7688935fd47d9643ca5c1961c5ab5e0abec93cfbe38e4db9bba
MD5 f844e36f06aad7c5138e79669aff19cf
SHA1 47781ae48d51f78ac8be171d33cbadeb5afed18e
SHA512 8e9a4a427f1ea3620116482203df8b389b940fc1f3c54f83d5cda9ebb4d114a11d947315484efec3af15e8a3aa09bc7aaa05995be1469e0d4832fd75b932180f
TLSH
T1D2D0978024E8332C48140F0AF0E028CA30444C3324F4AC20D5A245B8AABCDC892EAC07
MD5 SHA1 SHA512 TLSH

Submit Download

28faa0ed-e4c8-490f-8066-834534e0a06c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\datareporting\glean\pending_pings\28faa0ed-e4c8-490f-8066-834534e0a06c
Size 235B
SHA256 8ab537423b2c1dbeb489392896694fe5afcf96120b32dee7438c9de298e22304
MD5 fa4afd0ee4ca6218245dafc18e7d8bcc
SHA1 25c53aadd8516dad64894d75e1532f3f78a56f25
SHA512 8f4048cb596b2a9860ce5d84e8f7bf48accd67a552f634457e253a168ed8a1e44bac04f7614b77e3c3438d69fb823a508993134fbeea17cd8cab9093ac109d67
TLSH
T1AFD097D454C8672C0C140F0AF0B03EC230488C3314B49810C7B20078AAB8ECA415580A
MD5 SHA1 SHA512 TLSH

Submit Download

5376e42e-c43b-4faa-9f99-ae0006b33791

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\datareporting\glean\pending_pings\5376e42e-c43b-4faa-9f99-ae0006b33791
Size 2KB
SHA256 0fb89b18357c907dd363b4a341a2379b170802b0d368f11fddc938679a3dca03
MD5 9e4cb52143792508cc5c62ee44419dfb
SHA1 268e20aeb0f40df4a5b6ebd4218aad1006dbe467
SHA512 894e050a96947f55f1f6a6d81a376ba6a6e3e94c62d86e3d6810350270824d96e8177d1573ad85c18ce186c51b32e259ec58e292311832f0212867739c403ab6
TLSH
T1CB41A45CB5B85D779CDBF29D9092234F53A44E0304822C876E52EE0CCDA229D336A127
MD5 SHA1 SHA512 TLSH

Submit Download

6d9dee93-4534-42ef-9984-8bb3ca88660c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\datareporting\glean\pending_pings\6d9dee93-4534-42ef-9984-8bb3ca88660c
Size 883B
SHA256 df163995d7b9db2af1f6eee26587bfeaa916b62f80d2b5d1d8b9d41bd7be43b6
MD5 283b4bb2129074577805d65001897824
SHA1 d0493514f5fc1dfae064cf83fdc6574034b490e2
SHA512 087b20b386c85d0283a0d8d612c9dcb0172a6f589444bf4f48ed8c4254e64ae8f344b2ef8daa8745919bb544ff253a465787fa30516a8b4a6e946435266ca5bf
TLSH
T1F0112380B670B9F2DC6CD34BC9B637074BF8792380C685043EB519184CBE51E43A2307
MD5 SHA1 SHA512 TLSH

Submit Download

9fa9c521-9920-4704-96be-7a2e84a9e897

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\datareporting\glean\pending_pings\9fa9c521-9920-4704-96be-7a2e84a9e897
Size 886B
SHA256 fa4e8d8e184760e7a7d30efcc3a9f1f391ccb286aad96f1e1c473e03ddb4a600
MD5 ab47c109961e7c53fdb9d609c034336b
SHA1 c0c550860fefd99f5cfe7fe4e17e77862f56c20f
SHA512 3ed740e5523962c137233038bd7bf64145ef9ce4dd5f9d754990e58f84c6c424838198cf2d8f651a8aeea90d72f5794b91979fa625974c82d50769495e71506a
TLSH
T176116380EA7076B2DC6CD387D5F23B0347E5345380C64904BEA42A284CFF00D53A630B
MD5 SHA1 SHA512 TLSH

Submit Download

da17eda6-527f-4606-94a4-da2f1c323ad9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\datareporting\glean\pending_pings\da17eda6-527f-4606-94a4-da2f1c323ad9
Size 16KB
SHA256 66147ed1e8a0745a11f7bda3f3c56181f16b2fe52f8c77e40f7327e9b4407867
MD5 9c9734fd732a16562ca9ae2553d4d765
SHA1 61c571e44a794bb503406ddf835d7cebc4b924d8
SHA512 5265fd5fd4c5e61971d0dc7bdc80db440bc812ac1535efa6db867d7ced955c429b06f86a2439fecc7ddca664a694ce1ac9dc265d16db393c9fc2faddb6ef5825
SSDEEP 192:LWcZ2Sz4KR95m7VvHaLei9yhn9gzywBmo21pRBAYttmhcnoHNMt75+AE3dlf0e6q:yC2SkKR/m7Vi/9yh9gzywBCR7UU5QOO
TLSH
T15672D856686045BB8291E3A8D4FC7FC3E6F528CF4C418FCA9BE47D086DDA0AD102794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\extensions.json
Size 16KB
SHA256 8d9254367bf62363966fe5facb732a8cf3e07a4e872c24c6aa164b707858d35b
MD5 3ed82f19a651e41f75d415de5c10275a
SHA1 9860ca4aab0760bad4eeab9263823ed98d25fa82
SHA512 f2df20379f9581566083f7418e20e419ff069e7246e24bb3133da947b3d2caf8a03c4b14ca46b011961b2e245e8147f58ec2fe91566229e351d4f6d1dc6534b7
SSDEEP 384:UkI4vDUmldvF8dhWe94zH96oaL4HNL4PhL4H6L4H9L4Hy74hC:7I4bRfWX34B6f4t4B4o494U4s
TLSH
T16072631545048EB8298FA79AAA367E01C37D473B60845C38F4DD8FC842FB5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\prefs-1.js
Size 8KB
SHA256 c4a19fb9ffe0c661b03fbf87335bea6a71b8e994773e9e91f0ebf27c92fb182d
MD5 b945ffd1c1cd0f5e9f4e1ca50a0fd2e2
SHA1 24e8ac3933b3158373a51311e0b89c10114d2127
SHA512 f3657895decfe35e323de21db33d27cd7ae14f427fc634bc0b24aed96093b27477e9a8e34b6650c73077a2622b4d9558f93e4528b7c2ec642587fe37cc1b524c
SSDEEP 96:xHoMRTUlvqGqwQf0v7NbzSwOSSlkdv9jbcyn/WRC4oABw88bRN8L4cneM8GS:+MVRVf0v7VOSS37RNNBw88z
TLSH
T13F021E385504CF7F74B676BCBC6488315AA2063BBABF68C750B94495050CF7841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\prefs-1.js
Size 12KB
SHA256 882bbfc1ed97fc12063f8c0a9079755bbcf4265de22a171de6632f13a70bfec8
MD5 7d994389975198150c909dfe815be7f9
SHA1 888feb4a678a1b832cb8356d4d88f07c4d058925
SHA512 452c3267ef28ef1ae45175f80ab6f1167e2d28588e1cd544cfb183774358712530ef3f3ee522cae02f926ad3f7986cad27815f00ef94c0ab9b0cafb7abb11b42
SSDEEP 192:+MFCRVf0v76OSS3qLRNsOBw88mOOCTI/N:ANRVwngF
TLSH
T10642CB385500CB7F20F6327DAC2189B019A15627BABFBCD345F884A2455CF6845F7AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\prefs-1.js
Size 12KB
SHA256 37b258fdd2cc7b70d15e7ab9c29c89366f9b7e577e4bdb79f9b4e9e7df616442
MD5 f1f9febc76ab955985d0e86c1b9542cd
SHA1 1d546f81a429e8e14fbde117018b3d07aec857f4
SHA512 56e18f732cd17ff0df69a1868435fd0b8de10a4389d28d2c698cb4de6fb5023ec2f5e6ca9010dce0d6c52d4dc22543f8293ae25b180639dfd61c85198d701339
SSDEEP 192:+MFCRVf0v7VOSS3qLRNsOBw88mOOCTI/N:AURVwngF
TLSH
T14242BB385500CB7F20F6327DAC2189B019A15627BABFBCD345F884A2455CF6845F7AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\prefs-1.js
Size 6KB
SHA256 340f3518ae956775866c497d9d1adfe29506472ea7b12f55b706769d5a54c5ef
MD5 05532883cc46e63dcc42850c8ce96770
SHA1 172aba3f85958316543853ea3de5e60ab985381a
SHA512 ba2e6f82c647b1cc1bc1cbbe121627f088bd58d00456267fb7062f732376521683f00b222ecf66184cf9f26a90dfd7e4fa7f83f8438639080bdddef35185da06
SSDEEP 96:xHoMUTUlvqGqwQfvv71zSwOSSlkdv9jbcyn/HcPBw88P8L4cneMh:+MIRVfvv7JOSS3ucPBw88k
TLSH
T132E1FF7895088B7F74B6777CAC6888715AB2013BBBBF68C750B55484051CF3881F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\prefs.js
Size 6KB
SHA256 4cbffa6942c5bb4d5fd2360fd2ea7893f19e3741cd65d801d2545188ecb0e3fb
MD5 3ab89b4a4861edfc3ec5c7a38a863286
SHA1 20ee20c88b629028d55d2bd9da80055d4baa1039
SHA512 1dc31f0c562c2b8f9f52aaf24fdf80e2e83fc5fb7ef41c715843bdf621747e5c77b58ad94811ab792f31dd0689e5a90768724e1bdcb749bd8c4c5e0ab76f2381
SSDEEP 96:xHoMUTUlvqGqwQfvJBtN1zScSSlkdv9j3yOn/HcPBw88P8L4cneMh:+MIRVfvJBtNxSSyyycPBw88k
TLSH
T10FE11E3894488B7F74B6776CAC6888719AB2013BBBBF68C750B55484050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\prefs.js
Size 12KB
SHA256 93c6fe034f16c0ea2b7411a6d533d98a2c9f7246423c0a4c346a9d79a5557a00
MD5 a240302781e3f34d16547a848f8d5f39
SHA1 41262067f546b2e0cb0f064e630be3adc855fcf0
SHA512 85f448a040f8a14b43cd3e3d9aff94301ee1c944b8d640aef431887623573bdfdd6590e5bdd2c80e39af971a7896b801c87accfc3fd0f65df0869e2158599a26
SSDEEP 192:+MFCRYf0v76MSS3qLRNsOBw88mOOCTI/N:lnRVwngF
TLSH
T14D42BB385500CB7F20F2327DAC2589B019A15627BABFBCD345F884A2455CF6845F7AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\sessionstore-backups\recovery.baklz4
Size 45KB
SHA256 30e4cb37fd12ff9fecca22ca71bb29d8823052adcc69f56f81bc330536661acb
MD5 bb1d6eb7e80de2856198d569f0f15dea
SHA1 5fe39c6cbe1a43359a2cad3408f75b4c44cbd033
SHA512 b08fe2842d31b87361a42ae2e3eaba488c277885d99e7f64586044f526ab76ac2f3249ceedf185cf43b097b801b90b024b7ca0d93f1edf14307dbcfa9c417190
SSDEEP 768:ibJKe3eXhymrGHwGX8jz6YRB8AOLutd1cdFG2ItrVbkX/0ahZw4tl7t:AKqeRrr9mYRB8AOynudsP1Osqw47t
TLSH
T1E023E169CA14ED539B943DEC60AB2D48D7B00CC792790DA1B6047FB718F7B01C59DE86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\sessionstore-backups\recovery.baklz4
Size 81KB
SHA256 3f874924965f6ebec4345ba30d83238ad9e3ac35f920da9b76f82c1cfb3ca4ee
MD5 255ae7308fff05b1913c46ebc4e3681f
SHA1 0121dcfafd6ead1afc17d36480caa5d9bc67b695
SHA512 db870f7d664caa8e784bb0653dd61fead06e7497565dd4642c9912667ee7f716fe031d7d4e58a71e43d627d444df1ad81f630da6591a75bcefc68f66f7356866
SSDEEP 1536:kKqeRrr9mYRB8AOynudsP1OsqwvzHlwFr9mYRB8AOynudsP1OsqwTU:kKqeRZm2qunuyP1bq4rlwFZm2qunuyPc
TLSH
T15383F158C958ED63AAA82DFC20772C44E6B00CCB92790CA17644BEB718F7B05C4DDE4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\sessionstore-backups\recovery.baklz4
Size 82KB
SHA256 d4fe87a3366304d40e56a6a7d67a9266933f9ee59b21484e13eb64ca8370c123
MD5 1c9704de9c323d6efde0167d4fddd8db
SHA1 0a7ba96de217be65015defb1fc54fcd03aa7a0b0
SHA512 b56e8053fdeac1ec3296359f16160c86f87abcb989124614aaac14f651f9c4cea5bf352c02b90749d070f709053b0ff44c1a160ec50fb58ba89e882dc2a1b3ea
SSDEEP 1536:SKqeRrr9mYRB8AOynudsP1OsqwvzHlwFr9mYRB8AOynudsP1Osqw68LkBn:SKqeRZm2qunuyP1bq4rlwFZm2qunuyPy
TLSH
T19183F168C618AD63AAA82DFC207B7C44E6B00CCB92790CB17644BEB608F7745D4DDE47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\sessionstore-backups\recovery.baklz4
Size 570KB
SHA256 f0260a8bc7e010a5685f12fa3bd401f344e69180ced2e9fa31267b7d7b4f2dda
MD5 280450136c94605a6f7f3cebdc08f11c
SHA1 00376a6dab6a3950193a709413fb0666cc0e0c27
SHA512 5062c24c2d5b5f875d83c8d5be0fc633e566f7b9d560f5c8e593efba77b42cbe2cc28e42a5e1f72cd5d33ef083917c1b2e6ab13bc97bc6cf1d4766570083e8c9
SSDEEP 12288:vMMdBuUmxDanqEN9tAjfUTl7epga0+PnXnP:vMMdBQDaqyfAjjpDz/P
TLSH
T115C4010587C45FB6CEA82F1C90FF1A1977A04DCF90266985FB23BE4B5EFBA40521B185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\sessionstore-backups\recovery.baklz4
Size 80KB
SHA256 ee216439e3048d9eeca400392d1f2ad7f52df2f0583b59a96323500977418df9
MD5 f3d5c7f5da264491eb70b95f1fb6aa8d
SHA1 016ea4bd80c9969f3df7398a7f76cfc0cb803b70
SHA512 1327ceb681f63005a6235b7363e53c9099fde585c35287b5c993ff690d4213250327ec2fa53c6bd7398ebaa7e0d5a3591533ba3c1b2712db4c029277f69451dc
SSDEEP 1536:8KqeRrr9mYRB8AOynudsP1OsqwpsyCxr9mYRB8AOynudsP1OsqwIa:8KqeRZm2qunuyP1bqfpZm2qunuyP1bqK
TLSH
T12683E159C658ED639AA42DFC60AB2D44E6B04CCB92790CA07604BFA718F7B05C4DDE46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 ea38e3fcb6f9031541f2c434896813964022cb3c20d2884f0774b851bedf74cb
MD5 5424c5ef66dbd2da79aad415320d84f9
SHA1 518887fc2832dedfe14c6582e4ad571c612ee2fb
SHA512 177e010f7b31660ad73fde3f16184842dd3d7c6e39d9f269a34525555b10f25fe68bba87609325818e417ee340dd7baae5edcd61a01332c013aee50599513c8d
TLSH
T1F4518DBB1C272CFB3928C11AAC5F0FC1C693102014B9B05DB96DD92305FC2066585E0F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 56a969be64372efb96cdd121f79016cb712723a02ad0ace182082524c0e7c3fe
MD5 ca609c097229248deda60cec0b7ff4cd
SHA1 8af06ad8cb6286001be119a0ea9259f11fed85db
SHA512 74da920f0424abd0839392df99f5169f1ac4975b0245064279fe33ce853180dc38d53bdc5a0f261742b844b308c39cceef68a6d8804d64f87164825e7e98ecb2
SSDEEP 192:w4hR9wZAKfaOtCcCvYqyWnhROa66ZMOGfi0v/47bs65:vROqKmRRF7M5pg/sy
TLSH
T1B112BFA7CD00ADC95AE6D7C0685C4F4EC3C20AD0C5FA1124AE54E92301EEF66A778ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\sessionstore-backups\recovery.baklz4
Size 82KB
SHA256 f51fa70ccf014fc5fe0f7c3cab3a0925352752702f86588b4ffb3329f7721a42
MD5 2f8b0e4d053d6985a06f45cec784fe77
SHA1 b8aece0d42aa7c5957a1e2a96ac90afa1a3ab148
SHA512 643fc1bba21a84864fd09021b6a8efe8253a99db686ab3099b4dc15f1bce94a159e028d8f0d8f6feb5bf82a998f7bb79bb93d8650c1845182b61f3d177c61a1e
SSDEEP 1536:JKqeRrr9mYRB8AOynudsP1OsqwvzHlwFr9mYRB8AOynudsP1Osqw68Zk3L:JKqeRZm2qunuyP1bq4rlwFZm2qunuyPY
TLSH
T15083F168C958AD63AAA83DFC607B2C44E6B00CCB91794CB17644BEB608F7B05D4DDD4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\sessionstore-backups\recovery.baklz4
Size 39KB
SHA256 31cafd3a500ff522efb094e7329c9bcdcf34f2d974d498362b9af9ce4aa03b1b
MD5 b91da486a27c8583dd4eaaf75cc94fa8
SHA1 6814dcee36e5f0f5ab2d99608932b9b5a888e41a
SHA512 32c430ff25bb9c02ac99bd22ef92145cf53fc4c7a2d8e3ab5cadf5c5816b609474e739d96ed91f9ab4a369fc5a3fd4791e203816bcbea726bfd99ce434360556
SSDEEP 768:3YK652HwGX8jz6YRB8XOLutd1chFG2ItrVbkX/0ahZw47r:3YK65b9mYRB8XOynuhsP1OsqwCr
TLSH
T1B503F159C958ED63AEE17FFC60672D08E3A00CC792B90874B645BE6704F7A0694DCD46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\sessionstore-backups\recovery.baklz4
Size 571KB
SHA256 eac71fbfd75c019f79ba87ffa7bfb023c26d044c7f6fb4cdcdb694128f46bc5b
MD5 2b2992f0a84f5ddf384145da6206cbb8
SHA1 537c5ed3776e3182a33dffddafabe31d67d922ec
SHA512 49cebf305fd42a3493acf0f90d8f36c3a0a5f7b562907f621cf1c5d735d89fce6c3bd33a20e9be0b2e8004407871850a6c5ce2027bae511afaeb5c1c058593fd
SSDEEP 12288:2MMcBuUmxDanqEN9tAjfUTl7epga0+PnXnT:2MMcBQDaqyfAjjpDz/T
TLSH
T147C4010587C45FB6CFA82E1C90FF1A1977A04DCF90266985FB23BE4B5EFBA40521B185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\sessionstore-backups\recovery.jsonlz4
Size 571KB
SHA256 6ce619c701fac68445f848cc408010d7fca54f3c4e2501487eae946654ffd22f
MD5 2151f0315ffe38bc804bebe42150ac35
SHA1 9d8dc9cf8010d6c2ae04157ce83efa19e5931326
SHA512 da2201204928561b485397f257bcc990dd529a091f37031dad23c91c31bf822856050bbf7a0f5608fe1866434299e9ecd969043e28272633df0a2f74011de0db
SSDEEP 12288:JMMsBuUmxDanqEN9tAjfUTl7epga0+PnXn8:JMMsBQDaqyfAjjpDz/8
TLSH
T1D5C4010587C45FB6CFA82E1C90FF1A1977A04DCF90266985FB23BE4B5EFBA40521B185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6e064cc5-a7a3-4110-970b-8421dccbbaf3}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\storage\default\https+++www.virustotal.com\cache\morgue\243\{6e064cc5-a7a3-4110-970b-8421dccbbaf3}.final
Size 72KB
SHA256 5fe02e64b6c72ea3ea61e8c44ee5553e73fcc6ea1225d1e58b78b008b8158e58
MD5 61566a7782cbe723e61df55a0023e6f2
SHA1 b76d71c1e7b647546df3030d8bb0e43449325623
SHA512 e7ca09e67a659de09f18f4c1afd6431988d12035ccff1fc143d3ee2f766548bef633f51bf800f82b6d909399d1dfa5ac20804012cec0d0c07269ae84c83a890f
SSDEEP 1536:0qn0viwlXGZyT4+zeSRVK6E6kf/6hWS1tSdEeHWQbfJgv84L:0qnoiupzeyY6bkHS1tQ2QbBI84L
TLSH
T16B73F0756B10DA9F323752F7E941B8DC53BC7B82FACBE14492A1BA9230D05D5EF0A508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2232182701SeesravbiacteaWDosrgk.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\idb\2232182701SeesravbiacteaWDosrgk.sqlite
Size 48KB
SHA256 fe1121c677128812848303925f95f00912256b06918b5f1ca50412f594517f1b
MD5 447ad0f07de14fd657a0b6bcb47c4520
SHA1 6a5b46b0b225deb66968cddc5cf7c7097124b24d
SHA512 c371d318b9bfd23efce9a963ab45d0c305135d5338c4b4b38fcdcb1cf8d929b2ad7d4608df2715005c63f00b357eb1d8683619b4717b26148ed51f2697fc7f76
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyErBN:Oa16S6CKnqlizbxV+2xVeU7X2B0rB
TLSH
T1E023708E3F07F511C536F0B178A48D51BC5E321D07222AD56990DAE4C8F215AFD1F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.4MB
SHA256 e2cd8b3b08fbae8944ec920681fcec7cde67088c75a2b5053d9370298470bc50
MD5 29673ab3a6077ffc315d3a2c5f82ffed
SHA1 712ddb024de1fc68c0d9b637801844b418597386
SHA512 a48a526465e3fac743ddc4687edb9eb8711ab937626ec2a9e90000ba3a938125365528b0e404acdb20b41c21961d74a61b94b7180fce29a59681cebedfa4da1a
SSDEEP 49152:ED2D3/Y4Oak4k7QpVwEGMnIl3/drqK+h8rnMnYpcdY6bY3D9tikGmlA9RLtpwVxi:zCZtilISRLtpwV4
TLSH
T180765BE420E19253F38640B3719993FB21EFC01C6036CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6zufhr8y.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.4MB
SHA256 18cbca8dfb00daa170b276c1e3da63625eb14b9d5cf9949610f6899be6920805
MD5 f3cb628729c442a80bf7a8ee7349adea
SHA1 1be65f69c544537149638d8c291fe4b73a81b908
SHA512 7a0de33f374397c5de9ded1f7f8e8421a6b1b68816b5012ab387ff8886e15609ef77ca8523982ab6d9bf72aad5eb8c02a2b72a896ee2fa4f5d3f377400a3d608
SSDEEP 49152:A9yWkwn/X1XeTy2D3/YsUOak4l0pVwEGMEIl3/drqQ+h8rnMnYpVeH6XY+kGtiki:2S9ti6ISRLtpwhF
TLSH
T146765BE420E19253F38640B3719993FB21EFC01C6036CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Xeno\DawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Xeno\DawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Xeno\DawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Xeno\DawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Xeno\Network\Network Persistent State
Size 967B
SHA256 39f10b7b373539feefe202afe690f95b19a5036286df935219bd6dde499d2fab
MD5 c9f8571a3c6da008f266c99a27131adc
SHA1 13d5b63975e7b4faf3b377bbdbf967f2dcee3a7f
SHA512 ce7761e0b77a99e94f5eb7d78da5aa494b953bf90f6039db06d3437c7ee992dcafd04746d3fa0a68e1a49c758db8f33150c16c91aa0c8dac8b377c67c86ebad7
TLSH
T14F1176DAC7D84E7E856212F92B363923C0BE0A1C52293D02D9D8EB8E53E1839561254F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ec90b.TMP

Path C:\Users\Admin\AppData\Roaming\Xeno\Network\Network Persistent State~RFe5ec90b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Xeno\Network\TransportSecurity
Size 355B
SHA256 ab0a43e5fbb50c7db8e877aca106968e5d0450c5f9b00722351c4e8001e8fe1d
MD5 cf30978b56ff05c728de30a49688c15f
SHA1 df498118b5e272295ad15731b17321e31a2c7bba
SHA512 9f12397fd2f379eb7fc579c679926922e14b256b0ab06d840b407e15eab515337f08f4cac6d5a7de0434e2f8c3747c98a5a5800e8a5e7d063bc71c569ac930e7
TLSH
T148E0266249FAF47B206C4A660F687C427E7BB5350583ACF8965A423C60705F35623453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Xeno\Network\TransportSecurity
Size 690B
SHA256 bfc75922a5d3025816ee13cd14c5a8d0395f06b8ed616af84f6d2861891115cb
MD5 2e0bcd00cb631b10c70acde1e280cb48
SHA1 dd50dba2bc5118b8c33bb27c50c92fd5cf69bae8
SHA512 1dcc4c01b516799569dd9607b77fa6a88ba522beec790c72e1427895579fe843dc1e0057a414b2cbc58f7e47b252c52fb1c19405aac7aceacaa79cb024aff670
TLSH
T1B2019EA2C6BAE47B617D0D730A44BC4569FBF8B504426CF8DA52423C70A45F34913823
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5e2096.TMP

Path C:\Users\Admin\AppData\Roaming\Xeno\Network\TransportSecurity~RFe5e2096.TMP
Size 188B
SHA256 7ade43390388167e180fd3e5bac5e8b4ff4907dfa807ca15152c65fa4064b8f7
MD5 2b2bc2b4c2079c93f66dfd46b5b5a46e
SHA1 d82caa99681905af37e7a118808afe2f4428414b
SHA512 a3df5a77ce969caef865fe1f5bac906d0d2f8f3f2dd6714984ef66f9be86bc405ace46cb548511450a988a2b3a3720c4d5dd4f4f7fb9d6efb6e35b249cc4d996
TLSH
T176C0C0A107FDE4F3203889310B8CBD005F3EF03442425CF88242023C51103B6C213013
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1216-3709-0x000002A4343E0000-0x000002A434898000-memory.dmp

Download

memory/2780-3802-0x00007FF8B4DF0000-0x00007FF8B4DF1000-memory.dmp

Download

memory/2780-4907-0x0000015E69650000-0x0000015E696BB000-memory.dmp

Download

memory/4368-4022-0x0000027C41CC0000-0x0000027C41F4C000-memory.dmp

Download

memory/6424-4385-0x000001FF77600000-0x000001FF77AB8000-memory.dmp

Download

memory/6956-3737-0x00007FF8B3D00000-0x00007FF8B3D01000-memory.dmp

Download

memory/6956-3736-0x00007FF8B52C0000-0x00007FF8B52C1000-memory.dmp

Download

memory/7060-2919-0x00000246B5FA0000-0x00000246B6044000-memory.dmp

Download