hxxp://cdn[.]retii[.]dev/MuchaCHEATZ%20Setup%201[.]0[.]0[.]exe

Analysis

user interaction
yes
max time kernel
19s
max time network
81s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/10/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cdn.retii.dev/MuchaCHEATZ%20Setup%201.0.0.exe
Sample261001-tskzaagb89

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	5408	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
4128	MuchaCHEATZ Setup 1.0.0.exe

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
94	discord.com
284	discord.com
347	discord.com
59	discord.com
60	discord.com
101	discord.com
283	discord.com
308	discord.com
309	discord.com
331	discord.com

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5864	powershell.exe
2148	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2196	powershell.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MuchaCHEATZ Setup 1.0.0.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MuchaCHEATZ Setup 1.0.0.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5408	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1570888168-524493533-3242721904-1000\{A4BF86E1-9507-4A0C-8B1A-CC42AE925562}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MuchaCHEATZ Setup 1.0.0.exe:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 3896	2080	msedge.exe	82
PID 2080 wrote to memory of 5408	2080	msedge.exe	83
PID 2080 wrote to memory of 4168	2080	msedge.exe	84
PID 2080 wrote to memory of 4168	2080	msedge.exe	84
PID 2080 wrote to memory of 4168	2080	msedge.exe	84
PID 2080 wrote to memory of 5316	2080	msedge.exe	86
PID 2080 wrote to memory of 5316	2080	msedge.exe	86
PID 2080 wrote to memory of 4020	2080	msedge.exe	87
PID 2080 wrote to memory of 4020	2080	msedge.exe	87
PID 2080 wrote to memory of 4020	2080	msedge.exe	87
PID 2080 wrote to memory of 5724	2080	msedge.exe	88
PID 2080 wrote to memory of 5724	2080	msedge.exe	88
PID 2080 wrote to memory of 5724	2080	msedge.exe	88
PID 2080 wrote to memory of 3488	2080	msedge.exe	90
PID 2080 wrote to memory of 3488	2080	msedge.exe	90
PID 2080 wrote to memory of 3504	2080	msedge.exe	91
PID 2080 wrote to memory of 3504	2080	msedge.exe	91
PID 2080 wrote to memory of 996	2080	msedge.exe	93
PID 2080 wrote to memory of 996	2080	msedge.exe	93
PID 2080 wrote to memory of 996	2080	msedge.exe	93
PID 2080 wrote to memory of 5128	2080	msedge.exe	92
PID 2080 wrote to memory of 5128	2080	msedge.exe	92
PID 2080 wrote to memory of 1284	2080	msedge.exe	94
PID 2080 wrote to memory of 2288	2080	msedge.exe	97
PID 1284 wrote to memory of 3484	1284	msedge.exe	98
PID 2080 wrote to memory of 4972	2080	msedge.exe	101
PID 2080 wrote to memory of 2936	2080	msedge.exe	102
PID 2080 wrote to memory of 2936	2080	msedge.exe	102
PID 2080 wrote to memory of 2936	2080	msedge.exe	102
PID 2080 wrote to memory of 4128	2080	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cdn.retii.dev/MuchaCHEATZ%20Setup%201.0.0.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffa6bc6c188,0x7ffa6bc6c194,0x7ffa6bc6c1a0
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,18132221269573589936,1813496514957207921,524288 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,2921006372323435592,14736282989812334542,262144 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,15844219129728669221,15716732427046073253,524288 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:13
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,16869642595467903374,12581925512758795642,2097152 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,15867331883601488837,7442902390414986904,2097152 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,8811661425278113740,1589315594759815139,524288 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,5780320524931748737,16100933551741472362,524288 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,4076239742814169488,10111335333502303413,524288 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5556,i,18444125172116575554,12580999505013976205,2097152 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,16435604318354237240,926117024217050553,524288 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,3160002335648500419,17775080891092755378,524288 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,3160002335648500419,17775080891092755378,524288 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,9253524506965904160,8513553959528425283,524288 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5732,i,14389139887755809923,17467373450479151845,2097152 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:2936
- C:\Users\Admin\Downloads\MuchaCHEATZ Setup 1.0.0.exe
  "C:\Users\Admin\Downloads\MuchaCHEATZ Setup 1.0.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4128
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:2196
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5864
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\MuchaEXE', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,7684658827929276645,16523726313248674264,524288 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,6707408248666994705,14423931685524541704,524288 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,7815684438871339530,7672222811668389154,524288 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,16168126452093842673,12845595863534876513,524288 --field-trial-handle=2024,i,15434921157199105871,5136429561342797753,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:14
  2⤵
  PID:1160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5144

C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
"C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe"
1⤵
PID:5776
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1740,i,934766259572519591,9812744107547054734,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,13279964350257781837,11076099907244056233,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  PID:480
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --field-trial-handle=1740,i,934766259572519591,9812744107547054734,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,13279964350257781837,11076099907244056233,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1928 /prefetch:11
  2⤵
  PID:5828
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1740,i,934766259572519591,9812744107547054734,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,13279964350257781837,11076099907244056233,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2420 /prefetch:1
  2⤵
  PID:5156
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --field-trial-handle=1740,i,934766259572519591,9812744107547054734,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,13279964350257781837,11076099907244056233,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4000 /prefetch:12
  2⤵
  PID:3992
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --field-trial-handle=1740,i,934766259572519591,9812744107547054734,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,13279964350257781837,11076099907244056233,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4552 /prefetch:14
  2⤵
  PID:6024
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1740,i,934766259572519591,9812744107547054734,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,13279964350257781837,11076099907244056233,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:5672
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1740,i,934766259572519591,9812744107547054734,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,13279964350257781837,11076099907244056233,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:3668
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1740,i,934766259572519591,9812744107547054734,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,13279964350257781837,11076099907244056233,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:2016
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1740,i,934766259572519591,9812744107547054734,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,13279964350257781837,11076099907244056233,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:2640
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1740,i,934766259572519591,9812744107547054734,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,13279964350257781837,11076099907244056233,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4716
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1740,i,934766259572519591,9812744107547054734,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,13279964350257781837,11076099907244056233,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2192
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1740,i,934766259572519591,9812744107547054734,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,13279964350257781837,11076099907244056233,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=7676 /prefetch:1
  2⤵
  PID:1292

C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
"C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe"
1⤵
PID:3364
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=2008,i,7342207336131791381,5818026682656356160,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2012,i,3649504437379346927,793874777288881241,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:4136
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --field-trial-handle=2008,i,7342207336131791381,5818026682656356160,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2012,i,3649504437379346927,793874777288881241,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2040 /prefetch:11
  2⤵
  PID:692
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=561661591 --field-trial-handle=2008,i,7342207336131791381,5818026682656356160,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2012,i,3649504437379346927,793874777288881241,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2592 /prefetch:1
  2⤵
  PID:1356
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --field-trial-handle=2008,i,7342207336131791381,5818026682656356160,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2012,i,3649504437379346927,793874777288881241,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3612 /prefetch:12
  2⤵
  PID:2428
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --field-trial-handle=2008,i,7342207336131791381,5818026682656356160,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2012,i,3649504437379346927,793874777288881241,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4592 /prefetch:14
  2⤵
  PID:1908
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --launch-time-ticks=582930386 --field-trial-handle=2008,i,7342207336131791381,5818026682656356160,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2012,i,3649504437379346927,793874777288881241,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:5812
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --launch-time-ticks=582931025 --field-trial-handle=2008,i,7342207336131791381,5818026682656356160,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2012,i,3649504437379346927,793874777288881241,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:1832
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --launch-time-ticks=582942405 --field-trial-handle=2008,i,7342207336131791381,5818026682656356160,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2012,i,3649504437379346927,793874777288881241,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:1436
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --launch-time-ticks=582942684 --field-trial-handle=2008,i,7342207336131791381,5818026682656356160,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2012,i,3649504437379346927,793874777288881241,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:944
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --launch-time-ticks=582942902 --field-trial-handle=2008,i,7342207336131791381,5818026682656356160,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2012,i,3649504437379346927,793874777288881241,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:5296
- C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe
  "C:\Users\Admin\AppData\Local\Programs\MuchaEXE\MuchaCHEATZ.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuchaEXE" --app-user-model-id=electron.app.MuchaCHEATZ --app-path="C:\Users\Admin\AppData\Local\Programs\MuchaEXE\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --launch-time-ticks=582943123 --field-trial-handle=2008,i,7342207336131791381,5818026682656356160,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2012,i,3649504437379346927,793874777288881241,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:5172

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004E4
1⤵
PID:3612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 56b3adbf18e46f82c8075f712785ea8e59e3125a90ce26b8b0d20687401340d6
MD5 9957e974f5f56a44037770c8a45dfb1e
SHA1 799090afbb1a0f8ce52605687d1013278a68516d
SHA512 3967c71752cebb57254c981d715077ebd988ca8b9cab6d81aa3207770139958cbd95991d2aa0c690a7aa5908f37cba8053f388896014bbe4e47b42436cc915a6
TLSH
T1A64149303221B5D84D436F1205286AC9A2EF478AAFAC9F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c9a92cbd849eecadff108aa705c8bffeefa88b48debb99ebb0a61da60d1ea55d
MD5 3eab7477df5ca8aedeabf1695c6ec99e
SHA1 47e45efb75000cd4d9e036210864e45f420f2323
SHA512 0465738c688cb93e5238241731fb0a05395e81c567aa2fffc33a9f478454ed7814c50cbc62e962000f8c572df3a8f4d2780caaf1956dec8d990b4097d0125ee8
TLSH
T11ED02B1FBAAD12A0E12331390637420030C4E540480310188450032228C268100E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb58490731045c4d4ef8ae90fd5b5394608566e0de59eb2fcf0ecafd0e27c1e4
MD5 a1449147626cc89b1f49004bd7e5d7ce
SHA1 e848ee4aaefc37442c33cbecb41170227e80799f
SHA512 09a97d82a24abaaf732d89be9ab3b4434bd39ecb04c04633d236c4752119bff4b381aa75666a5cca804d38dfd7487cee9fe3800fd60f91ad3cfffc59a6e0ec34
TLSH
T1B5D02B1BBEAD02A0E11331390637420031C4E140480310188490033228C268104E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 c438177dbaf58703376138d54b5703338c09a6af9070d089467d06761c3c54eb
MD5 b9ec9369fd74821d930195cb857cf5a3
SHA1 0263fb3678767e560de97047cf46bcea6044a8a7
SHA512 ddf443579696589f9df2ce4c9fe31298ab034dbcbbd4b79e3d27552c841e198b0fd5a9d365d2dfc6c73a64570c2c3b0d30862ebf5ec0fa6f925e7660f08894b5
TLSH
T1AEF028B9C921FC270DFC4B1D70A4478AE751636B2A81885F3A3C920D8FB563B469AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 19535d662907da0520ebe2442f05309677dbac61c970f6754ba9b6462f30e24b
MD5 ae130d84ef912011080a3e7523883b65
SHA1 2b15a2aa9828cf6fa8cb32cf3ec0b6fbea1c694f
SHA512 e9e35b487ef982ff5d6c27034abfc0a31bf3da8a9c3398b30457379f7d2728ec64a73ad47794fdd4766b121c1caf0b1764ac3083dfbef91ae52563b5d3006362
SSDEEP 192:sxZ6RkoE/fRsWqNzodpW/W6+WNGY0Yx3cwIgjSJ:sxZ6xE/fRsWPW/bG5Ejju
TLSH
T13D32C755AE28A93B8CC7E219FB15BF53D6F9503390911E48E6FC8A1C15EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c1fbf4f0ad2db2bb8a1c64728f5d92e95b6de3c47ae04f9a2d71a3a72e41f501
MD5 c954e0e10d65131e525d0175af07141d
SHA1 2591f9d486a78ab105992bb644b45de8619eef8b
SHA512 5f42043aa37dfc04a0d3b09ce1fe80c397b745cf2f36a32588b855d175e1a47342998ccf8faa5c2417d44040046b85c750a61dfa7e4ac3bedb3f7e103f35e1ac
SSDEEP 192:sxZ6RkHE/fRspqNzodpW/W6+WNGY0Yx3VwIg5hSJ:sxZ6aE/fRspPW/bG5E63u
TLSH
T1ED32D755AE28A97B8CC7E219FB19BF53D6F9503390911E48E6FC8A1C05EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bfc75055232ea6eab2a75840c9b559c53b1ed421e303b26ed933b904eef5ce4b
MD5 b28d5fd2cc175e2735d5724c0f067419
SHA1 464d500e2a0ef9f617fe9377ab1c8d6bfca1a362
SHA512 7a503b9c7acd1f7e5b127b645c15a7f6584a18fdcba4d29a82ff00b71a7dd89588562545246984af56c5e5b611dad9d99b7c8df0e811cd0c00601bfd5d27ef51
SSDEEP 192:sxZ6RkHE/fRsyqNzodpW/W6+WNGY0YxWVwIg5hSJ:sxZ6aE/fRsyPW/bG5Ed3u
TLSH
T12642D855AE28A93B8CC7E219FB59BF53D7F9503290911E48E6FC8A1C05EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 7e5c0efbe62817fc26e7111fa924548ed0c54e74db7ffb89f5210c999d5de653
MD5 741caa4e5283e663de2f3e3453954f46
SHA1 3b6324cfed1d6ce1c5d6ac02126b58c0901742fd
SHA512 ac00c1db14fb285d5f4f4c3e11378b36cdcc5d34b4526b93e60f071dd1fe86400d4d6051a59d9c5674b0ee3bc06730c08c986f9e67854a3eed2a96cde8ecc0ca
SSDEEP 768:SPcas8Tw23fWRmLJQt18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3VOLl/hf0+7Yroq/:SPcas8Tw23fWRmLJQt1u1jaKVOLph8+s
TLSH
T107D2093F640CCB7E4FC01A99DC16AF976EA802C7A6688D4447FE994C02C77EB51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 37cc1a63727c0954b32947ec84b9e25723e39e8076cd902287b326b69c553405
MD5 c8f645b83a387fac870ed1faac3b3e82
SHA1 5c2e9e84d808dce015da960374901e7a863bdc20
SHA512 98ee0d24f1d42a2bed2f819b37bd0f5c74c9b4ebc4d74a86b8977d14258bfefa5a80b786953f252802cf819ae0c7d030d28af27369b12399f307e6c37c58b53c
SSDEEP 96:K8cAKF62iU4K5CeWgKXqfCusKjKUUgK9a+2vOKY4nwAKtSWGVCKGQ9XKKwcO21WD:ir/+SvIrlfrljh9DdgslV9rnC1pVTF5g
TLSH
T128C2765571BA12453CBE290881B5976F129235B33019EA2B7FFD44A28E6BE085DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 44fceccd4795ea26007ed72997c5d6926abae92b9d8d8cdcb03aef12a35dac47
MD5 d485e96eb28a14204f0223dcb9134176
SHA1 d53ae8a16e29b65c0f3944ffc148e5e62a17e49b
SHA512 ea121f6211580144849ff0c3c37e6250cbc09f569ec2078097521422a882fa5a830326cc5b8dc05c9d43197b3cdb8e1fa7c2edcd7afc844b74df4cde748c60b4
SSDEEP 384:nAiFzZcIo8Nu8TUNTUlIRowqYRTbzWfg9oanIpYlg7zS7VZh6DKhHU/OgL/7Izch:bFro1wg7Pbx97IpAwS7fYGH8h
TLSH
T10DC25B32EC68CAB7ECEA8ED9E7497A07DEF04153959C9AC4D5C85D1D009B19E130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 09be5d2e874472029deffb939d1a799447410125611eb57eaa88a5e4a7f6e726
MD5 db02fc7f4934236670634223c23adb92
SHA1 424abd73d26feaa15a70ade593542d9ac9b51b32
SHA512 4431d61c3e83160d1a5b374cc48f0ec6e0d8fd427d33e9ff800b47efffecf10b924775a503d87fd794f624e87e95dc66778cbbdfe5f73b603408d72548efc094
SSDEEP 384:nBiFiZcIR38Nu8TUNTUlIR+wqCRTbzWfg9oanIpYlg7zP7U8gL/7IzGob:oFQR31wgRZbx97IpAwP784
TLSH
T14EC23A36EC64C9BBECEB8ED9A7497A03DDF04153999C9AC4D9D85D1D009B1AE030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 55c30a3dea194cb4acfcf9a86d494fae9917707c76588975d9c134f907f21cc8
MD5 e28d7ff9de92c4697a47d3c72115cf86
SHA1 0c5bcb9c7940d4e78cc74d1dd6591670876476e8
SHA512 cbed60c2b25b07279fe6f84e618e0238abcbb9da3f24d7443fb4eb0fe21227f7eef5c48185ac47c32e893740cc6a34cb6033008079abde186c62d56e0fd83271
SSDEEP 384:nQiFzZcIN8Nu8TUNTUlIRowqYRTbzWfg9oanIpYlg7zV7VZh6DKhHU/OgL/7Izch:rFrN1wg7Pbx97IpAwV7fYGH8h
TLSH
T1BFC25B32EC68CAB7ECEA8ED9E7497A07DEF04153959C9AC4D5C86D1D009B19E130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ee3acf784722143f2cbdef47d55371aaff0e94000771a7b5cc87085901d18fb0
MD5 c6c0c0f5706efed788148bba8a48895b
SHA1 1064f4fd12f3f1666da5da27fbd575ceac5580fe
SHA512 047335509ce16cc3e40b97cfe6ebd845bd32347c1a0001f56b55acfa2c5b9ea6ee4e6c97d0bcbba84a1f4e19a855cb596223bf6b55f14aecefc07a18ee076b18
SSDEEP 384:nXiFiZcI638Nq8TUNTUlIxBwqBHzgbzWfg9oanIpYlrMv4EW1XoU1e/gL/7IzsGQ:SFQ63dwgwwzEx97IpArMIoUuQ
TLSH
T147C25C36EC69C9BBE8FA8FD9A74A7A03DEE0416385AC9AC4D9D45D1D00971DD030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 2e468fc46de3a77e61a79e60d8154db523d86eb685f18122ee5b1ac1667ab2eb
MD5 a9e2a1d43f0370bf4af2b4f8210dc61f
SHA1 7560f86daf1aa60c989bd47c73e1cc454b8b3800
SHA512 c040b8e84b7087858d71bba219e0ea5cf3c9943e22a4dde6cf144b0151b9f44bdca99a96f29125fd3a944e968da7973801d33bfc4b4e38a0cdf951a3c31730ad
SSDEEP 384:0L3H9qiS1nBzHARMAlGHnnN/js2CCq99BljsjrdtmNx:akiSF1HARPlWN/j7CCU9Bljsfdtmf
TLSH
T14572B4AE610F26C3C8D52378D10A054FE4F2DECD431A13C9B72A9E3B8E9CA5A557C598
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 8a9bfdd5aa1085ea3188ec74d619e5a066062b77e9dc5311b6734755ac1e0edc
MD5 e8895b48be9d4105489f0edc95d67291
SHA1 8311c612a231b8dc14899e4713ba4bd04e0cf82b
SHA512 0e907c5d710fe574eab85abc406c46a6726531e3e4e4a442449af2f4502839819f5e6ec2d3ff255b59bd641081d69ba32896028ffd709b1b8121ad7b475b7325
SSDEEP 384:KL3H6R2SpczPeC9HaFk7eH4czdjsauCMrHvYZSIoDjydyN:U22S+Te7F5T5jONHdVjydyN
TLSH
T1CD720AAD325F1257D5A223B8D007075FF9F1CECEC348A2DE67109D3A099FA2541A81F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\MuchaEXE\chrome_100_percent.pak
Size 702KB
SHA256 ab7c4b7b6cb8832a31d44b95ec50ce52294f49422a3bdde4e21968eca2930cbe
MD5 8bd180ba5ae087e7348c8e5d3fc747b9
SHA1 032e54936f0a96b9e008a77666e8739f6ff56341
SHA512 8f52ca1c25bbfacefdeb869ba8b2725a12269f5df40ae50744bcb7f4f68df6cf8ab6a6a63116969d07a9ca80caaadcd6b3542f056cf1317e55e7c1bfe8c2b28b
SSDEEP 12288:QI3HWfJwNjzgsz5B0GDJQrnKs8SNP+QSsEHeilSTe+gnzzmg/YJblIt6kjKQCrC:H32Bw7zEEmPLVbTe+gnzzmgwbc6kGQt
TLSH
T159E412E77370AC7DEEAB1677426614B0FC375A280B51060A17DAF8796923B48D8D93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Programs\MuchaEXE\dxcompiler.dll
Size 24.2MB
SHA256 cf895524b8c7f032591fa7e1fcbc4ece71fe75ed67587e6467bd324a734f9bfd
MD5 164b6e48c261cc19301cb265eef15a16
SHA1 6d07675a5198c0f3500b57d7c452237d9996bccc
SHA512 6df1dbb87a62d91edb465f3dc694e31ca3311a667ca9ca1d0b4c4fa6d3f6003fb7b37a872eb2bf00af64427506c0e8db67172d657b014afc91bf938365482bcf
SSDEEP 393216:b/fXIxm4PkG4kPyaD/oOG2UfRkZXbdqd8hAd:bCmaAO12RgrdqOAd
TLSH
T1A84719122646D49CC099C879C7678B268A2C30E73FA7B9DBC0F461252B79DFC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_rev4f50l.ee3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rev4f50l.ee3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\LICENSES.chromium.html
Size 19.5MB
SHA256 7b328b8c7463ac9bfc7dc648c751533517c8441a0b5b21047d6c0b2620e60d70
MD5 142cea93256b2b7824b854c62af026e6
SHA1 265c66c606344122b35f20c68086890017a75505
SHA512 82c7f1c6f17ba0af42ad552062db614bca8cbb6c317a456d15c6199f11b031decf2c0816770b0004326830899264a5640796d1333c524979f9dfcf64d7b57fee
SSDEEP 49152:ZehWCrdOOoVo5TYp2xnuCQpc3txsJM+QAFId+wi4WMEAccr:y
TLSH
T16E27B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\chrome_200_percent.pak
Size 1.2MB
SHA256 30fa4a6e27c9ff2fb0f939f01158477e621a67d86e9ecb84cf11b3947db8eb9d
MD5 62dc1994f062c83fce3944c829165007
SHA1 1ab2de2406114a4c4e32ca3dc4d6f8515cb4d6cd
SHA512 1d4b7acedaa54d376764ea1709750cb102b326fa4a993bad7b8ef4c4961950c52541dd79a8789709bfaa5aebbed0c6fe5a781866512c56da660ea7ed2c55befd
SSDEEP 24576:73WBS9n2zLmmibkFR8+mZiqr8BWhQumesXRvQtgIQwuSXAkpbaUGQ74:73P23mNbkFRJmQ+8khQRn1Q68uSXAk78
TLSH
T1754522D7D770AC3EDD520B77939B20E0FD7600271A61190F0B26BD7929276C8DA96B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\dxcompiler.dll
Size 24.6MB
SHA256 0c7a5fab6466c211fe39d90d845b7d6a64ac73e8c809d4fa0c09907bb45c1f3d
MD5 b0548e61db479d85539e6735aa43ee18
SHA1 4c7f933b9c1c771ce3431e3fec6f920ac9050dad
SHA512 69c2d5a35896dc7ef54ccbd96481700a0d71c087a56953fea9a73ee30b4b29a2ec168cdcd30412f2fd78ce49743a2afdaf066aa966e9b016b6f01f02a73acbd3
SSDEEP 393216:b/fXIxm4PkG4kPyaD/oOG2UfRkZXbdqd8hA6U:bCmaAO12RgrdqOAd
TLSH
T14B4729122646D49CC099C879C7678B268A2C30E73FA7B9DFC0F461252B79DBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\ffmpeg.dll
Size 3.0MB
SHA256 7728490eb079c19b17baeff2b6590c976f6a928b3c17923aeb4fcf1f1f31d299
MD5 6ea5d026d320e2ea52c4e9e5cdb883fb
SHA1 83f080026a25745e0161443c8bf80d8052bf1415
SHA512 4a232d6078325090de16800bbbf521029ca108187f9e49c02e4a6c97a74ea69835fb2f1012ec40eb3f84518e04b047c46f15b64b4e173ce8b99a9db3ee6c2d57
SSDEEP 49152:pagye0i1JBlvS0ZU3oAQULMsvpTwDowaY9/Gz/YaLuPkuf0E6OOlz2u1:pJ1lS0ZcoAs9HaLu8he
TLSH
T103E5AE02F6D251EDD019C03497AF9213F271780A8F205AEF17A05A253F66FE86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\icudtl.dat
Size 10.4MB
SHA256 9f48c7f9c7c94d516a14870707e910ab94d75ae640ff6842c4af53276cd26ebe
MD5 c9d17441b2314fe514cd8cb951577c1c
SHA1 15cae4dee805f3e04171e00781da13fe40036439
SHA512 836d4f4fa591ee059dbfb943c2f13ded58a0f5048b5505214ec7105d0963106e0078aa262090d0dac9cca80995c7961a900ffa7a2af8ff315aabad1313bd37a4
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89j:1/cBhORok2HiXUxO/RJk3IWhlYntjdOj
TLSH
T1A9B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\af.pak
Size 621KB
SHA256 3017b141bd16e24190d810f0748612f0fd4352ca8553002b9a63a7f77f7154f8
MD5 cd886deabac5d290bcfe505aec6d2936
SHA1 33b05211957f11d5d5bb563258b585c30ecd8870
SHA512 b1c79724837e2b52e5015dcb9c0b93472dca52e1c392c5b6bec3f554d3b77f74b1a0d118ea18ddf6abc8dfa175b8717a1a6c7344d479c7246bb1783e5cb9ae96
SSDEEP 12288:M1MEn7kwUPQ6tRGtAX9F17ZrzgNslCFW+pyGpgvi4H2Jyn4NsmUAAL/5THozvbjx:Mr7APftRGtAX9F5ZrzgNslCFW+pyTviB
TLSH
T103D41B0AEBC1273D09A07696FA0845F7BB5D626CC770F2BADDA982310966DFC10BD1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\am.pak
Size 1005KB
SHA256 67b938d162bc75db067120bb8366b5bafd9a75fa99a0ca9ad4f46b47d1d37634
MD5 6d22dcd650f3157f3b500d609c630b76
SHA1 fb063a5bfae0bdc3649e772e9fd86c285b26f954
SHA512 c27e6ab4b09c527ad462b968b02d1bf85205a62f16a63bf0b97a26d1f979c69113799cf8794ff2ddf3f1a3d360d267811fc4990d1932a788b9b6e653399bd091
SSDEEP 24576:O8VvT31VYRThTCKHyWVt10RTjHgvvevzFI6XdOdvwilgB1VewHZtPoIp:ZVZBF
TLSH
T1DC25AB547EF9F7570F8E8A1994320E4F9594AE4652802C38C35AE3FC2B2DF1B4DDA219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\ar.pak
Size 1.1MB
SHA256 4c47004abd0969cb1174d06eb7429c024872207960986afbf3cae37e339a8d01
MD5 c46ac6ec24a17487c65e6c841d16735b
SHA1 e8c2ff9b78fa8e4ba463f3bf9d2a9e741ef1c1cc
SHA512 21a67968bf005fc7c36ea109c2328c8333af757c977aaeaedf18423a3702d5630eea6607c4e834e400598f3c8bbc185921dc14746415cc6ea27f3735bbe0feec
SSDEEP 12288:rlzJhtfsBHApLxC14Gei8wj3ri2XYrvZU4pMk26ISeQN7+E6W0ZYJ66:7bkEj
TLSH
T126357BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\bg.pak
Size 1.1MB
SHA256 2eb9c74c67e4b13b45a73061fa978738e335bc245da71bab0ea9b205fe91074e
MD5 651366d5dc136aee8364ec625a917f9e
SHA1 9bfa9240d8e675a00c77608668775d9036c9a0a5
SHA512 90b84232f84cd67e88ea99af7f274629286ae02c292dd610ef4efeaa7ed4154ba7048e415f62a5c98fb785c8e4377deabead87aba2cefc1fed7a3d3429d52019
SSDEEP 24576:uuI9WglWLYxgCzQkEC1U1Vb6lNs7e373ZGm+X4KxUfVDIohD74uOVnaNmu8BtTJ1:ux9WglWLYxmEU1Vb6lNs7e373ZGm0dU4
TLSH
T1D24524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\bn.pak
Size 1.4MB
SHA256 415621a5c0b1546e6e447d43b76414425a8703cc7681d637ec1f283ad0c787e7
MD5 668f9188aa073a9a1c706fb67bd1de92
SHA1 9e0b1912544d3c722d41ebbce8abcec30d606c69
SHA512 60071949463a9029c15b5f85aee8c2be008fa97bae2e07d11bda922ad92066cf92dfce0d25115c12f785c94fe1d5aed390fd29cc47fdac6620a6f16bf401a5da
SSDEEP 3072:cCpCO+qbfG/1xsOktuHrcKqt2DOUzhUygJfGCARuItWNAypbjBbLR3QXQcjC8wkz:cCpfFfGr7ktuHlIAypbjBbmwOqM
TLSH
T16865EE209C6E81B6A8C5CDC9434C6370C123AE9B9B65F74DDC17A25538ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\ca.pak
Size 700KB
SHA256 6f28297c1ccb628f534d65dade167ae559f83eace359acf47e48ff890b9409d5
MD5 ddf227a00ab2b50a8de153edd0309499
SHA1 aad2e096c7b13afaaafd01261602fee51723eff7
SHA512 f10992e172cf225450dd4c90496201b19f30a57247c87a63313addb829551e1d07028f53a22cc6a94f4413963da6517aafff2f54480ad25ad327da95d8967010
SSDEEP 12288:2ztZe+rqQR7IO4yCiX7rmipFa8i5PsFzN3Mw2juwwPR9zejm0t3ltuFTjK85nCRC:stZeYqQuI59L8wWqTM0zrcC77JEw
TLSH
T1C5E4F8239BC93B7744D3331EFB46C253B48CA9847A06D254F4AE0B1622CCA9CD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\cs.pak
Size 725KB
SHA256 799a789ce531991cb975425730db310f9a8fe74091eee568f3e65fcc7ef0cd57
MD5 3a0e295c5386eb3ad6e45a38fa8e47f4
SHA1 f5b447f009a49210af0d53358be73b737df8390c
SHA512 6abd677d06ef1297beb437a8e76907d3ca69d005b3616280e2761e690a5a2a390059786e59427685796a80d75219dcb0276d861f93e0e57e775c9ac89a33f81e
SSDEEP 6144:1ozOsvAJKTtn9093lBlu+sV5ApvDEAdzBzB4DVw8OCJSBs78QXss:m6SAJ2aWJV5ApLHzBeVw8OCJSu
TLSH
T1EBF4391EEEA36425584002487FBE4228BD5E83540B6EF5BB7CCF9C912575B7A8EF0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\da.pak
Size 650KB
SHA256 530fd95daee21d793b99492ca7d0bf9979daffe42944e24414d4b08a3d23b9fe
MD5 219ada088672f4b07979e55874a39f22
SHA1 4d0320979ae2b08e26566b30d3e0adfe28b0dab7
SHA512 60c8ca3a812a9536023723db56c90393f33b687621d05e87d9bb15fc29f15d7b208b7bc8b25852d780c65e73ae6310adaad379246239e94b9495c0791a78a9de
SSDEEP 6144:KTi9dfDPHy+o3zVmf6J/Ql5znDXyefnbI6E/92IY/wlUYJw3zbFNVSpPzv2TLqG5:oGdfLHy+o4dIKav2XDsaJH
TLSH
T198E45B4BDD9C732FD9A90729F3108DA7EF6D543CC684664F64D8943A09CBC6092BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\de.pak
Size 701KB
SHA256 58165025c4252ba8b2ce8203b59362b9968938cb0fef9d7da04941be22f41bb3
MD5 cb2063512f2ba57556e8035b4a0928aa
SHA1 be7f052610b846ee4cbceb8e5587ed5b91386c64
SHA512 0e91bb75c23a295c626752c1ae7433a29f3a67d82cc132cf0140aa569b485e7d402c7e6332262fc7ec592be380462156adb92c05b523ca5e68d986553df6803f
SSDEEP 12288:IZb+kALwEHW3K7UpkZ+gyOqi9l0VX5bQUeecCtO:mb+kuTW3K7UpkZ+gy9i9OLoCtO
TLSH
T15FE41803ADDB625ED78673617705CDB77B19E36FD342312A88EDC02B650B5B283AC522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\el.pak
Size 1.2MB
SHA256 37d2e1ef69fea9bdb1e0902cbc61a458baa9009fc3761029bd1c1882a7a0c9b2
MD5 6b335073ea816b2193fda87420a8666c
SHA1 008e233d6450160f6de6527ab577312eb2708e3a
SHA512 c2f9f9070a605611863d52c42320b08a6dd6f36a148042f969dfe461f68707591575b9625b8f47301e2e9c6183cf67662271fbb613058333026faff2370d789d
SSDEEP 24576:BD9dSFbrxq539bk2tHZucYAJXDsSj8msAcByz2HSegLC0LqvMIvNAHx+4BWyjsHW:BD9dSFbrxq539bk2tHZucYAJXDsSj8mh
TLSH
T1D355BFEFB4582DED8046950785D8B07C2BC66D6CE749CBD8622DCB60BDF80719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\en-GB.pak
Size 566KB
SHA256 01d9200a5daee1770f7147b166d25baa6a8dd72c138c3c526421e656dec789f5
MD5 3382cf191387958d2dd901f22f35ee12
SHA1 8820631a23d2cc48465a619f42b4a50863c20b51
SHA512 062f6141f1f1c2a2f6900f54acff263c36313a579ebf13856b4861ee7ce8fab551fde398639283c3535db49e4f3ae26368f981ac02c1a095ec6137498a25d44e
SSDEEP 6144:q/Jlh7uqK6aG9NZxjTixh+4EYDNSPzELMxNiMP9Uh4bifaY1x+VKpDgBc7RK6:qhlxEk7Zexh+kNvM+h4bUhDj
TLSH
T161C44C1FF784122A05935162BB0AA562FF23D07CB36112667CBD811C33B6766C27B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\en-US.pak
Size 572KB
SHA256 23b271e8009bfa14783700cd0712b4ecaa5b8f2ea28a4d81ae1d7e05bc0c96b1
MD5 3d66180f21df40a9eb941814676972eb
SHA1 b74b6ceba72cd5ca9e662acca19285037995c362
SHA512 4ef14702236e389409bd875dfc0b3f467f8b15c9e97c13dacedfc751642445141de31d6ccc574c8aa4dd788c2e756a16ded3262eb0c577b2b0e82ff526638efc
SSDEEP 6144:pUTO8xSUd/7b7/wg7HfwKOF7Nt3/p9XhMP96hgREfaY+43Um8tjmngcs/wEwj:mqL8f7/weHfwpNbMUhgR2uj1wj
TLSH
T12AC44D1FF784122A05935262BF099572FF32D06CA36112663CBD812C3376B66D2B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\es-419.pak
Size 691KB
SHA256 2766fd52da83ff679346313e66440f013a7d478b9be946df4ab197505912450b
MD5 dfc99773a058140358d805801d8a6fe7
SHA1 71fbebcc25158410dd43a6e443a0c0aff9437a62
SHA512 0c4843734ae3eab3122c3df3e643d76f5936e365b466d3d19ee15c9b1c3db4c0ce7eb3782684b2a0fb456e72785e3bc661effdf0e47abc8c38096d23f1538116
SSDEEP 6144:7VfkPEZvGVqH+pbrqM7zvsYTHoZ2zgrOJJ85A26+ZTGm/X:JkcAVS+VNr/2OJIAoBX
TLSH
T189E4E722BAC81F5314E3A388B343D753E8D89545B408D25BE8EE876522CCF8CD967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\es.pak
Size 687KB
SHA256 fe6fff51ef19db1f4fe0fc602e0bd4bd7fabcfb1ca5d6896d1ce0efcf37e49c4
MD5 df73874d59567caf66e3f3957793423a
SHA1 83480824df3551496c84dd50038f0ddde8a1fd4f
SHA512 304211ec83c3e5d02fa46f2d6beb85885d4927c9ddcdc88ce3df8afe3b18c0cde776616b24f330adc4e63b098551bafca71a2215ccb7e398b4f4c59391c39f8b
SSDEEP 6144:EgSn5BhPVjudhF1GFhiUgdNo+TU3cWFkBZ8jAOwhJ8aW8tWf6k8+6PZCud:EgSbhZudeiBaMWFEZ8jfCJfW/fb4
TLSH
T1BEE4F726AACC1F6310A39349B743D753E8D89549B408D25BE8EF876621CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\et.pak
Size 627KB
SHA256 dd1205eae606f12510e24ce39f301439c98b3293d766ca5839dc292a14d7973c
MD5 1b82280edac606f3d7c318bec8a86f7e
SHA1 3304de615ec541211608f24c22b55dd96bd92322
SHA512 eea35f302b6e61865c4981ada63209f52dd78f33b95fe1673340df9bff191ed27a40b6522d730fdce5c07b236e2e3759c26fe01efafa8fa5dd2efc6948e53b02
SSDEEP 6144:yGJvIIlg3SnkZu4VcBzVOL+vNnnyW0inFaXSOJ44LsxfBPOCXy1gX8ZV1aBYvNpy:yATgioVVcG4NnfnFaXSyd1aqvNxqnzP
TLSH
T1CFD45C42A27D771B242412F9E737A937DC9FD7D8B4000D9668974A0970EEF8C38B6B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\fa.pak
Size 1.0MB
SHA256 ba33624ccad6d0e4a4339589c56be557b28968bf9422bd12a8f26e2a3d581577
MD5 2b77f59ade1e4c7d40cdbfe038616a03
SHA1 3931f8975a06621422ab71fc8e50f8ba2401f5b0
SHA512 8e65aab4a6264e25850fffa129e35a006e437f82cc097dcb2e459878a663a75d17e6de73f19ff46e441f9f97e7bb12912eab3f32da931210f1df15a26a01806f
SSDEEP 24576:3658u313uyqoz+sw2LrRmXnloThXtCfGk62Yha826JfigXnMX44OqlULakI02CYN:Z
TLSH
T1E235B1956AAC9AB25747CA0341D33834C773EF12D349FE40ACB1076609A5B139B5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\fi.pak
Size 639KB
SHA256 1f3123d7fb5c22a95b5250ea17450b665c3c6cd6a6dfd28bbdde15e1bf684a0e
MD5 26071a88b56d045fcafb610c6af8f9d8
SHA1 553bbd02c6e97cc47aab8c3f03c45c55ad168983
SHA512 8ece18be3e368a03b95092c65e3a27b2030286144ec9815cb011264249d938ec651f4f8901d9bea2a1552607cfe60dda85156ae3d1fc10330aaedabf6f89f7f5
SSDEEP 12288:J21mh0Ki36193qYvS3aAYNpv6IGp3Wa9q7Hg/:JVh05RRaQI2
TLSH
T1F7D46D915215C22137C4C29EBDB0903EF5E5E39CCC288D96E843CBD949EA9887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\fil.pak
Size 724KB
SHA256 02e2c70d3d85b0deb677a9ae576ae3cf89e80774532cb3315c14f1e8ce64b310
MD5 bc775353314653b56a92b19e25089e2e
SHA1 deca4713ed0d95a96b6bb857c683d9b7d8149181
SHA512 a59e0fcbae921c3f33bd2b9de052fb4958d1ba8e73285b2ac2948433dd13c7d95bf8f1fa5d257372375ac522dbc7b94ebbe68fd3958207556013a23ee5a1049d
SSDEEP 6144:sq4QFQ/1nfokC3ZQoM6qFYNFDQIG8xVz7A0gp2ua5vwg6MoZHA1JgiW:shQ6/xwkCJthNvI
TLSH
T11CF4D715B3402748DBC352E56264682F6AE560B83F81786E4FFF269B3BE7CD5D270182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\fr.pak
Size 745KB
SHA256 8bad7fd88072ac66649dd9307da9163962f8ab00313e627bf1c5ca4450a48b4a
MD5 e72107838fc5ed419d9fe6c515d8afa4
SHA1 4773f93e95e604c5827eeea8cc9dd53921645169
SHA512 7922202c6a800e4218ed71b39fe9ac92b289c9e8eda04e0b7d0a8b18f90e4698083320ea928474238a640d970ffc56dc51ebcffe7728705ec63451eb1d768810
SSDEEP 12288:jrzrRByD21UfcAZLF0W14PGbVAZgjgiu/WAMnS16Qua6gVA8DvjH48Kh0MVSiYnC:nRY2LFXV6lSC6o
TLSH
T154F4E66FB9D432CB19C60277FB16D663DD348248F215E300D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\gu.pak
Size 1.4MB
SHA256 e86e8c240d4b6283abb03c49df9e8899607ef9def6d4933c7a541d63b5835271
MD5 d951d00d45269c6850524c5ebe07de7d
SHA1 bfb100d437d2d94095b99111af48e41b6bbb3e31
SHA512 1d12fb98bc3f99f3781c8f6ea9b8686ff46195b515597362c980455d0c4078b8a708bfa8814831420452aae32aba4292e6fc68d3e23fcff8c58d5e40342c9bc8
SSDEEP 3072:3l1X+w3eMGwqlcdzHnfWGtduO5uNCPv0QaPjAwREJKVMjNiT7llj63rA8lDcSi53:3zuEXljWGm6YVsAU+hCR1Us1C
TLSH
T1BE6518D0D7B9F07019DA9F7E819E512086699343D57E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\he.pak
Size 906KB
SHA256 ddc1f304ab1f4489d19ae2b31e7f8e3ffb47dae439520159e8975422c65e4115
MD5 d4b804bf7dc9e7118cd3d38f128cd7f8
SHA1 7a95738e91da1499c3c551fb3f27218798aa2c7c
SHA512 2a1eeeb23c4c18e06592f4af4cdab369463919f359e81a5ab23c3e20bc74895a217603b8d826a125e67a13764ded1583e0af7f083f26f0dfedef79c033ae0007
SSDEEP 12288:PWPwMLpWzu3h/aP4n6nZT4SCVu/rcW0rVWvIxLdN3Za+uiJAEVXRQeQCaj4MlB6t:PWwpf6t
TLSH
T1CB1588C4B2E492255131AAC39FA5FA285FF3CAB53CA27512CB14526CAC774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\hi.pak
Size 1.5MB
SHA256 015b3856dc05e8635a48e749e6970fe43f5d620b8dbd04e5abff586178213f6e
MD5 1be4fa16db685e94007a0a30702b656a
SHA1 ad9208400427a3c649ec4b834093e45fab852977
SHA512 86d481794a185e783ec53936f8f63091e6816e8b4b23de6598e324abbac00a20dfafb5b73176eb23e24dee6acf8a603c18610e15ebd0d212ed46952492257886
SSDEEP 3072:3WhTplLLsvMLgWH3npvDBq7u7VSeTNY44V/B90ZV1dhuBlOvXoCDtDWejYX55nFO:m+vwpvY7u7VhY49II8iidSm4
TLSH
T19F75F40CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\hr.pak
Size 698KB
SHA256 d46c64ae8af3562e37eb80438aa2bee228fafda251d58ba4d0991291f1c72aab
MD5 8f8a2f1da61e896c7c2cf641726c081e
SHA1 867aa42a911833025ebb4cc30c14614732815be8
SHA512 90e299305b136736934dae850abbce858c5910995259a94468cf47316880fc00274e6f53fe5c6615c8f98c0185955b908f4f08dc144721dcfbfb76bda32c5716
SSDEEP 6144:Rb+L1GEcwOCRAHRG28sirAIu51KrX7K2wVO/ujQ52u:RsUEXOCRAHQ2VVggOmju
TLSH
T189E42A7DBEF2570A0897B24AEFAA43447DFD08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\hu.pak
Size 747KB
SHA256 0a46fc8d50f74effd1cfe1979e677df3de6fc47e6b551267303d93d57bd83f50
MD5 d6cfdd7c401a644dfbcd8e66c9702192
SHA1 2a1a0b58795ea033e5f8b28cb4046180db188800
SHA512 e0cd08e23dea8065656832f696a8e0aabb6c29874ee5140c1db4a211828dd45580b4a82e07518066c099b9aaf0afa70d88d720d4d336015cd48ec201ffdb80ec
SSDEEP 6144:q8auaOrooql8FACP/XDGBrT6Nn4HIuxiXlH27lm7FW3gAezpruS85S85Z49Ka0Yn:q8WOklmxP7zXAi85S83y/7LY1k
TLSH
T162F45BB79376944ABC6C179778643F15582E481BAB2B31FB2887886D34A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\id.pak
Size 620KB
SHA256 f567569c42a25bb2dfc5c33e13aac558c0e2a1d5d4b969592bbd0841b36438db
MD5 3fc5ddd09ea15b88504ae0671979f58d
SHA1 a7f2450660f45e1a860fe036a892a7f5648ef1a0
SHA512 2985a83b41ef90095b49214ac4261b873bce9b16f5eb2b7c974281afcb130650e6c176923ad6d0ad5dbf42541a866ae5663902ae6505e2ed6143814a68c1d7a5
SSDEEP 6144:6/0X4JMvgCGCBUZD1z70mQVqpffhTFjlFlLmBhpvh3xE65jXhBVbm2iTvxePHsE:6cIAGCBuzaozTFjlF9mj265bvz
TLSH
T185D4E8632ECD310C194442D9B2CEA91E7CCE233BAF05B76E8E348F7055A67686716BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\it.pak
Size 677KB
SHA256 aeb1d99a2a09476d9ee0fd133df2d4d987c731b9f91a248ac4e60377ddda1ca5
MD5 8a81829cd391a8bec7266a8c07c50d9d
SHA1 9cc480176bad2ead89032e27c22f1e7300512249
SHA512 f04d6c8b273540c353fb7431d08cecf85b8fbb55e52ce0cba41a647f9d46608e86780ebe56d13c155fd32c0199e0445f2a93101e7046815ba5ae50f0e2d07ff7
SSDEEP 6144:1MJJq6cv2jj3UArxtwaiXBRB73N+5aIwSbmCfEs61ltC5jhOfB+QcrMppzSj9f33:1M+2H/LLo8yW5uPHfIYH5lRpW
TLSH
T133E41B3AA5DA212519976359E611B185FBBAFCCCFE41721CC99B031C22CEE40F1ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\ja.pak
Size 822KB
SHA256 f6e0d8eda3bc8f1112494bda96b230f3c44f054c47cced50c94c5ee9199f04c6
MD5 30669ae9b3fa98995f9e622512ede11c
SHA1 64bb1837b2101d912b5e964822162e720c20bf86
SHA512 342d7570e6907167440c095cddb696261b667a75cf3322ac7b753e0422f0a2dc3a4a86409aff70a4d83d31ed918edc180075086fe3622cab05ee2e5baf62a404
SSDEEP 6144:iECY7nTTQoA4GmeuL2QHciIp7ZEQ23O6fr0bdJaHczchoVa:iFY7nX9GmfLrHcB7ZEQ23OSr6kHczcb
TLSH
T10105407CE3C569369D6153A22C4E36E17506AC9BFCA23A3A443DC074BD70BCEE415AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\kn.pak
Size 1.6MB
SHA256 af5fed2130102ecc0c878059c88faed9d6db2e8b147fb5ae9e15e3fe69706c8a
MD5 254a621dfdcda79b0e130eea6b295e4f
SHA1 0a619e7167c51f8130e815573fd9d6b35b339dec
SHA512 62b112893735452519ae2e10a4dda74bfa42bdbd67ca41f7006f5eaa8e0599e686e2c2f05e09b60f8953decab47590d9ad36230da777ca00c076c8418429fbe6
SSDEEP 12288:Uo788nG/ywDkewDScrOagfNuLBCj+7l7nmsMh4iVW9Tmv:hlnGf6Mb
TLSH
T12E85CD18ADBA7D311BD5006B24EC643ECFF16BE29CA947C2F4DDD7802C66C6A90825DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\ko.pak
Size 701KB
SHA256 55a3a8db9c84b1fe9e50b56d68fb069ad7546117cf1f6cb89f36f49cc044ad5e
MD5 ab32cf7394080109ce350eef80afb637
SHA1 0cff949298b61f84dec00e6779b57d5a134b4394
SHA512 a9a7c7ea2203d9450f5c38e8eac9d33520dfe7758f4b7c8f644a429f303088e459c410da96287b47981f39a42a7c3ebd3dcb8a7ea39c8ba48f9a7c2dcddb2801
SSDEEP 12288:J3ychDgWqcZ4kzM1WNiPszcbifYj4ZGRyrD7zIFPgssDXCFGIE/xESJGGLhwVX0D:J3ycHJIRP2w3+6WZ0y
TLSH
T10EE4B6F238DF63C91193CD82AEF4FA198382D976F75302A4ED44CE449E145D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\lt.pak
Size 759KB
SHA256 af969f4407c190dd01a426fa1244cb1ec7cdf2909d1c3ba5b87ff662ba567303
MD5 d67db6a28c8f559d1273a460e93a5876
SHA1 d26c98cc980c9817d9e2b53be6d848036374059d
SHA512 7f9dd0b418089e214fa4f16c994d7c1bc9a4fdd816e0ef2fb9a93877c4fac7b72401804ac2eb4fc43ba81d9d4778b7f3da6c3b8cdd1e88287a9713b71f5eccf8
SSDEEP 12288:0Yl5uPBw3krMNeep3Utdpy2L71aQYj98wN6j6SFH:0Yl5+O3uMgqSwNOa6f
TLSH
T177F41C0069E3AEFB9A5467C981A8CA74DEFD50009727BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\lv.pak
Size 756KB
SHA256 4455ab7c06172c2c80796a99558e41f452cc3b33be76654d70440cf4ac7a2d34
MD5 9c83376228a21c11f5edafc719424d27
SHA1 a59e8782855560fba290e0631d8d176f06abc4ed
SHA512 f4e806f54a19280dd343172bd4709406e1fdd0b6ce97223bc3b4da2a2244fb82dc4815a56731b17e7cea068f305441c519c27ffe3f5ee1100e4173d3a6add651
SSDEEP 12288:AWDthJkmQkiXWSlZ70XMICPPrJ0mn8cBTtStX+Gi:RDtakiXWSlZ70XMICPDJ0mn8cituGi
TLSH
T107F42B959EC68FA94D904DCB732AD122A8CCD740FE07F112ED798B3A560F52432B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\ml.pak
Size 1.7MB
SHA256 b5606265910e45098a88e989202a550531f6d00333c6b112ed4c5cbc07b2ff6a
MD5 9c29191c67c3d9539df9c936d31ca2aa
SHA1 7554192d90ed72687ae5920e464f94210177825d
SHA512 ce792fcbf46b0aabf6099904ddb9284d641f1dcf8b5ae75fdad04147affa78e0c3f109e5e31e3e884bb4f89c57c1d38c558c00e945fc54c3059c94e205a25f73
SSDEEP 24576:WiF/U/oZAuuxyYl+9y9XBkx/etEWaKfijHeBAzXT4+v2kiNk3Ma/W0b37:91
TLSH
T1DE85AD57A036CD3B0FD102167B4E2FABCD5B9FA140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\mr.pak
Size 1.4MB
SHA256 8465d4077ed5414cbcb7d9bdb00d85e515a1a069703cdc1d4d67c9d6e5623fb0
MD5 00192057578bcf97c8fdf81963e473aa
SHA1 d3441e0dd2dc3e840dca38400710ce017855d53e
SHA512 c623512e7ae3ca0acf7a65e757715449892c5241822d9f473866f742ca52fa5e041e4e5fb0d9a590870d27198e3a72fec86bb59a1831f0c9f5cb0ea1473ec4e9
SSDEEP 6144:WUASC3+M3K2rwb2XtiWUEFBhAaYRbIl9Bk5mty/DK:WUASCuMaWwCh34bIl9Bk5mA/DK
TLSH
T1B765D24DF77AF3685DACBC8E36540D3BD8FD31B1C3E9925648E1B3A74884CB401996A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\ms.pak
Size 652KB
SHA256 af7021a00befa586aa067ae3ccb339079e6f13ee0cab1621836f6abb608b6f2a
MD5 4d315df981e03002091c3320cc9caaf1
SHA1 4d3869a0c4d59d808918687436c3b56d6763c6e2
SHA512 969345b9b60fa3b9344e07a14cccb48df24ca09e3d1872546d897c64833fe7cd81ecee03dc7871f87002ce2ae5a4001603ce9116192b418a4dfc686d87d920f7
SSDEEP 6144:8O3AorsPjhhrF/t3pAHglSobUHuqwjroR+DhyWSzAbaR+Ulw7QCy9h2zR:jwfrBt6gMHuqwjTwrlwP
TLSH
T13EE4C6579EDE3118085843D9E2DDAA1B3CDD3332B705AB2B4DB08FB0166E7A53315B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\nb.pak
Size 623KB
SHA256 d97a2b0cbe6adc99add2ed3ce0d15d0bb124b778086c466c126634d60ea72608
MD5 820ea44fba453034b2a8ee9bd7e76611
SHA1 bdc2faf8211ab4ce0f175b6f380ba1d252661d8e
SHA512 a3fb0a5e05d597840aea11a3105fd3c6f6cbdf15440df3733447c1359b0669ae4be3a94d669dd3e27f2da93e58249956af2dc3babad45e9a4259a03ae75c2f44
SSDEEP 12288:fGkyTyHOJDAlQSoU/Op7fDYjG7PGcu5lBoU42wW3:OkyTyHK8ofZ7PGcAlBrN
TLSH
T116D40883EE86B72EF69442A8F518865B9B7D943CCE98199B54CCC52E0CC7EF052BD1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\nl.pak
Size 649KB
SHA256 b642c8ab5ce11438e9a8fd4639244fa8f1d55cfd70269565490bc55ee907b048
MD5 f23d20dac8528a02a179d6956f0e4fda
SHA1 c8dd7a94ff2ed337071a7ba1c729121d85fbb354
SHA512 3a4a7cfb2734c334f8c32b62c1d53dc2c16442c591fcb7f75a8833f190b59006b76a634945e2001e0c7c52514a5f763c709478ee18736caa870facda79434410
SSDEEP 12288:HwEuhAPlbJWQuslUeAKg3MHkTFBy7K9qHhG1J:Hluh0lbJWQuslUBMHkTTy76qHhGX
TLSH
T1C5E4F907AC8E253E59C0A349FA084BBBBF2ED22CC26CE67DD4EDD5341443F6851AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\pl.pak
Size 724KB
SHA256 8a0969fc743d3e2f5111387d53c0d79e8c1d9f68256ad6553b87fca2bcaa7e6e
MD5 bfb7498aaa8f4252f8fb5e521a3e61b8
SHA1 c89c6944d186987a9cb5be348d01bd52c7287bde
SHA512 9d73a56e374df5b135f85cf3fba9f2d99fbaf89110563db007d85d6e3e14c840c35905c20b3f5015bd79499f5b17de18d21614c4611b020c980ad87da5fb5e12
SSDEEP 12288:felyrOtK+N2tfQfuzSJQbZ4brnPjCUdye3m2UawMAmo1QhalNRPvLoolyOXd:GIgNrjwMQ1QhQVt
TLSH
T1E2F44B0E56E59A4E8CA008E6F6EB1B7CACDCC808F108D35FE45F452A619B19FC9BD5C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\pt-BR.pak
Size 680KB
SHA256 5546559a56f9ac3191062c3fd42defd190a68e78ac988eb57fa5a6fd2dc5f874
MD5 c88cc0606099c8505da3166430cd3b9f
SHA1 4bffde9a7a6ff078eced94be1faa6f58ecf6473b
SHA512 c734ed0e52d71c29fbc6fa93bea9d69d26c328d1c18c871faf1a507c57c93697271baf4f2c5759b4f65dc3ce3c640609b1f01b18b4203bacd16bf16596a2611c
SSDEEP 6144:2L09OIj7chWyuPDyGWJE1M9NBXBL5CcHaNyza5E3Vzu0LsRyU1y4:2wIc7+WygDqHEE8asRh1P
TLSH
T19EE42B2E6ECA136615225350775EEB03E5C80645FE0ADA87DCEF4B06A3CDE40D933BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\pt-PT.pak
Size 684KB
SHA256 bdfa7264dddf70f936f1785737969559a577b51d1952c820a468c611d18b17ca
MD5 161594d74a17bb74189e1fab6a3a99a1
SHA1 41332934f91785e616fe675317adad4a74f275e2
SHA512 81c22b6a5f2c3217d56f323cb63596ca7361a9636a314e192674c38e4807b6258c2127a603ea8b827c703abec0bb6f2675e149b0d3aaf522ab5e1d35452be40a
SSDEEP 6144:GSp8Fahf2pW8kuvFieJVJJxh/SUxNwyf8mBn9ITNKSRLc:G3ah+pW83LBn9AKSRA
TLSH
T1F7E429286EDA136605235351770ADB03FAC86655F809CA87C9EF0B4272CDF84D6B7F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\ro.pak
Size 711KB
SHA256 1e6b5b0dac63a9e951daf523de310f6bd9e5c53e281f37706d41bd35d2a08bb5
MD5 42b62d8b4ae6c44d00e8324038884bce
SHA1 4227b5185310d602cf78b9b181afee118b7b739c
SHA512 279b167f4ee8902259095e6feef515848926be23fbf566dff20520a664f1bc048444f119e8f12084c53ca6c633ff261b694e28fcc6786282303500153490e992
SSDEEP 12288:mtj+AUFtka335aKPBJ4RJBDepv5m0tsr/+Y:mN+AUb5m0sH
TLSH
T1ECF43B23A1C82A972D5152B2B73935D3EC8D105DF640E28DA4EEC97910CDDDB852EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\ru.pak
Size 1.1MB
SHA256 a9e76536472c45b39e7ae2af5f3ae1bc0e50a11646efdb6fb3ca373b5f2e2c70
MD5 b39c9f236b40c7a5be478df8684713eb
SHA1 7fa692f4ba15edd2dcf12c8d1f7ac5b73f392386
SHA512 8d25dc8b8b2df588cf7bb156a25db01f18ff92d4a27b08eeb5861a8100932da045d8a12de80d59ca11134730d9c9ee48df69cd144d153859fd583d4edddc4644
SSDEEP 12288:vrYo1AfQeRo4YeeMObzJ9sF8aTjBL1gJqSvYsqCQKki6NR3Fo8N5K4ZM+MYHenO2:DYoG72o3A
TLSH
T103458760669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35219A42D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\sk.pak
Size 737KB
SHA256 3cdc8bca8696c90a572fb15c865caa5c286df45344c72194c3eea97201cc816a
MD5 c38778f6b6aece2c2574fd319a51eb8a
SHA1 3348b29f9b9de8d47308622fc8806d199337c293
SHA512 985b77a4c24ec6cc4b31d03e3fa97f855dbd0b2e272879c584e456a4ae79268a90abbb9f7c82b4f9e81442519f08f298abeec954a097c96225f9c950d15d1030
SSDEEP 12288:MT1NIuFuNQL7DF562AexuBYinyteLKo1nsyYkxz+mpTjsxt9we:M8uL156NByOYkQdtae
TLSH
T1B9F45D3FDBE7181E8E8D0144FFEA7110FDAE86508A4EB0A5944F364714E26EDCAB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\sl.pak
Size 705KB
SHA256 e1371c8df577b979e3a515af34b0aaa3d07153c7a5c55d39a9b49a7ffe62d3d2
MD5 acb3ab2a8c329fc279c544dfbaa0de24
SHA1 3db50d028705d92eb70890afb3870be04a15bcc0
SHA512 67842b58b8d7e2bcb189eccec9a3fc69d1ece7bafc69366582fe79b89cad0989858720db15c5ffd56ecc099a26164ae4428635ea4bd2df2659f4acc4a5cabb05
SSDEEP 12288:kOCIF0cB2t2TraflWH1ToJ/i/fzbanql/aA:kOfFv3af8H1Tqi/fzbaE
TLSH
T102E42C397AA75E0F0C9AB2CEFEA606007FDC044CE251E6A1FC4F336A5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\sr.pak
Size 1.1MB
SHA256 c42a674e3f43aa70cef005931915c8b7ceb34b29566fba3309f8da931dc7861f
MD5 dc46abb0351f9f6dff99464090e12453
SHA1 342db31df56aaf55eff4b8eb51d31ec4cc1225ab
SHA512 0f5ad3101e4cda8a3d72dc6d48c48ebc0340e7e601c5ef65ce652a19b6e963e1e7413a37664b157d8d8afcca9809e1f9f4d54c61dfd46cda6eac931ebf06690c
SSDEEP 12288:eVgvEHg1Hc1LcIMy3S1dRBCm3i4xsJmExKVVhHPChxV1T37Vbu9D/k/E:0gvECzZChO
TLSH
T1AE3556A19B9E64DB0901F41BD808BE493DAF41FE3FAB975211601DBD34E10B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\sv.pak
Size 631KB
SHA256 7b0399a206bfbebe77d1a4fc598c8a6636a1bd940d3ab56519cf4af0134b6edb
MD5 d39fef87ff37175c1c8535deff59ab4a
SHA1 c6f5986a54d655149dced800f67a19d32f6aa15b
SHA512 1c8bd081a2aaecd866a1262277174a621f2ab24436df2141440efa79df3c973f02f6b74198a1baf7efbf59b58925a2a676803df6f05b4130a0daa3c5cbda169d
SSDEEP 6144:uCPEq+/Il//1VCfjdInisqkqQCJYxqxEFUlTOe+9kRRFczd5RtGmNS3210hiMSOW:T8q+/INNgy5xzLixM
TLSH
T13AD41B438A60F526FA72530DB608115F0AEDE25CE3F2954EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\sw.pak
Size 669KB
SHA256 bd41ea707a0d90d683ec8d5d0f0c79f3e925747bc4ea1982562dfb75080199b9
MD5 cc80a2829e04f124c210052045eed62a
SHA1 d51e048229b517e3f018df6a1e160ae9d1e1c4b1
SHA512 ec07236462896a7ba59d5cb49f212068f5ecdede5869a15501fc6635e399ad19c3cdb58391a286004fe2afcea60cbdeb6ac06966da4562bd6c0b12432f283b2f
SSDEEP 12288:khHZuBsIh7sKOuexGF2qjOWd9pGIbJ/BEB5WmedqU6jRdkgbyddYDhibWShgnJFA:khHZ0/SzFCiYBr
TLSH
T1ADE4D6629871E1191233618903DCFF732BDCED5C692B2D935A46BF0F218F58C56ABE48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\ta.pak
Size 1.7MB
SHA256 91fb1460711df108d8d435a378c8be1d1e80b0886c0158d8c6ae92f35812681b
MD5 7afd6d96cfe0cfca886da43d0ac33b84
SHA1 7b4f97d8a8775d1ac5ba56654c2bb075cbcea5f2
SHA512 58e944b4e889d3d7ee9f0a6c2ad636f2e2ba7d90ff0e16067db3826f26ab3f53210a94d90740bb525b5f0a397327111711e655af9fb1d65d34a41bf92bcf69bb
SSDEEP 6144:fqE4cGuBERDmPH6kHJgGPjkqwtRoKtm1vYpiMyZ:auYDmPHzgG4qetm1vYpiMyZ
TLSH
T1A0850CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\te.pak
Size 1.6MB
SHA256 fc8c2706c5dfd36e7af8e380a240e0f697cc5fe969b512092a2185896512c4af
MD5 2341fc51095d918c2c32d95d9f4fd20e
SHA1 1f0e537d5e4f0751df65bb7757b9014b544ac6be
SHA512 44db2301b1686fc878249a93d76ba7d68bf936db1f1468d253add22c6c6dc51b68d5ae0f0338e73b7588a84f06aa7be72278b968aba362924ce36cf380f7d964
SSDEEP 12288:/qSLrojq7MZKNby4cJPISF602ZLHgKmoQRT51bDC52CMzRWnB6Ic3p1Fqih7Rsrr:/qSLEuIhEced
TLSH
T1237593023A6AD310DBE60273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\th.pak
Size 1.3MB
SHA256 c1f4235c31bc05153230b0e55b7aabc9020d7460d5b0a025c386885e1e4bda3c
MD5 17455a1ecd74aba39c2244730346c97d
SHA1 f5b737951c6f2dda2299e6440650661d67cbeba1
SHA512 259dd57dc99bc055c604032c44009ee58b50f43656cedf4daf4b7d3358b63c3fc12a7789b3ab9f204eb0aac9812b43629d075ceeaefc7d2deb7de8f017749a62
SSDEEP 12288:JVdax6N9LyZYAbzALaSBs6ojhCQskJUsXw+sO5eXwpbDF1uRHKHlPijR5eysD5UC:fdvsn
TLSH
T1CA554DB37247DDD479481B5B262A7789672DAE653F73F8E000C9215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\tr.pak
Size 681KB
SHA256 d5648d7eaf1826211fb244fcf8419dabdc16c228d92139bc8b0b73c7a6b7e700
MD5 533b063f2a8157ea012a07cf40c0548d
SHA1 d86e4d4370f523a0cb613a0c423c2cb052fd7020
SHA512 d2a5e6a067015a4a64c19102a0151fdf1cde7777098296575aca3cd98f8b0df9ed8c8b8723e2b1160de7ad1423097b64ce024b5d137db97b119d16c21db8dc8f
SSDEEP 12288:26/UsDRvT6EMSufIHl6sgwhqlyfFfgdjbeRrc4V:2hhEMn7be64V
TLSH
T1CFE4D88178EF281C8FB9278FD6E91666F89F0666B331F4469B1A8636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\uk.pak
Size 1.2MB
SHA256 ec5d0b426e289c064e8f2d63636ae2a544ff30fc1e99dde04fe1920971e4d060
MD5 aa30f21e772b4a28c564b08b21c426c7
SHA1 a7683f5c6585b050d0fc78300d2d32cd427dc8a6
SHA512 3538fec1115f9d530078824c24eb6c6b928a24337b9ac80367915c39bf21d6d4009fd339e5314b3519a242a009773b66fb32bbab0e230156f4cbe561e131ef81
SSDEEP 12288:URMFZOHsZdpk2ub+QKjbzI9wkfWd8SihGx2sSr+amnMtBps7Q1Bq3gKINnsoA6QQ:/7OMZd3xp8Dqux
TLSH
T10D45A9A19BAD54DF0105F05BE94C7A0D7DA740FE7FA6871625A43DBF28F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\ur.pak
Size 1023KB
SHA256 c218e21744df2ff0669a87d497d65d76333073577360d4c662c592de146bf82a
MD5 37e3f75291ad8763ab34dd68aa05ba05
SHA1 e0c952ecfcf67cddf9b39eac7dff3bc7a6bb4508
SHA512 38b0eee7af8e0b6e4d2f92417a1ce84ba056fd5257f907aa8f4dcb2755023e8b46ae89257b6074ea14dd234aa85afdb8c0eb18667491bff294a1d5aeb9e95144
SSDEEP 12288:9QKK9e0uiT58PPPK8VSzqtdQSSidbyKFil2iOETcE88GYOa9NQYrjEYjwadcJKwN:9hg9G3b
TLSH
T13E2500D2A6BC96B35A21D92780D33C34CB735F13D34AF285E92246C54E9A0135F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\vi.pak
Size 810KB
SHA256 76a32f8ad5d08a6f9899e12e4aa9b3d9a9023931e2ca0f73e5ced541c922dcfb
MD5 e1b99087bc0e28d07ba01899e53a771b
SHA1 1d901109f79c85e9377d868f106a75c401780776
SHA512 f794f902d6948f802cf0aabc19553f4800d58ce48ba1da494ff70626ecc05e859a14b1477375cd199d8764cb629236d10394581ac9571b70ee17fe62fb3ed281
SSDEEP 24576:BGc4ZK/+cBAV2vKMKTxwEwke8lJ4NiOG2oq1ljV6:IiNiST1ljE
TLSH
T13405951216E1702680AC553EC6CD540D6FCEE42FF7C0CFE56FE429746A221A46F25BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\zh-CN.pak
Size 578KB
SHA256 7887bd3d01e12306e32a11d9a20566ca0e93688a0375e6ff59da04cf782b1681
MD5 1cd924bf80894ac1560a69d3cbaafca5
SHA1 7b6f50d16fef497fdfa14e83cb693bf06ef2cba2
SHA512 f73a42941e24ee4f24a11a6c69c8cd0d168b94cea1d351040498fea070d9264f1fb92814b6a6b4813489e513e15caf4538340346737e9f7ccfaf871cd24680c3
SSDEEP 12288:cnPAHd0HMaOIOUzQiXlUfO26wYeDMEbjT:0AHd0HMaOIOUz1XlyO26wYeDMEvT
TLSH
T194C47CE914F9BDEC004A90A03729A13D7C40764BF627EF266ED248ED2A91F9D0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\locales\zh-TW.pak
Size 570KB
SHA256 7cb5f76e54a548d4e52aa8cdf226a4339bdadc304897abca690f407e95e42f4d
MD5 3800f05dab9242f008f045c82fdd0878
SHA1 18bc880be614a3e7e143298999d0e5486c454151
SHA512 2073e0a011f51b554871d1362635d02eb49fb559257feb1e74c9a65fd4b36d1c5ca121014c2af12a75b8ac0e4ac7bce5f64d22054e7d50d0812c6b84be78fa14
SSDEEP 6144:rb52VUDAkA6tSi+lAPElPJxgaB22IuLpu51zOLHHDWqYi4C9aUmm1OPSTs:rbQVe1LSiU5gYjpu5dOLH/18
TLSH
T18FC46CBA0DFBDBEE0901F484B7C9923EBC8B386DDD337636FC851C942D69A5809A1145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\resources.pak
Size 11.9MB
SHA256 ee5707e9409e76742e1dacdae0ebbb3c567b8772ce5bbcb9785aa215f5784c22
MD5 94689dda7f94ce851257fb6772c7d3bf
SHA1 74826e6061075c0cd93ad68b6a7a55d0a9157610
SHA512 f43a5186f0afb9b58ca01a77b7bc0218397822c1ef5ee2670c1fafcccf79b6f035637f33747439cc3a09e1a42b3b932aa3afb148a26b29d23b2da39aa8b945a1
SSDEEP 196608:RRR3ZeqsPzZOgYimq8oR/5e7sbajeu5CeVX2uDK/cfOJsj5OkrFAceC/Zh2tX3fT:RLZelLgg9mno8sb4b5C68gOkrFJeCD2N
TLSH
T13AC633943364286FDE1123F3822D1237DA68DD0B15A590E30EAC705CEEB7A6C9FDA535
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\resources\app.asar
Size 1KB
SHA256 06a812ca137f83bc9a0225974cecf284eec6df263c7c762cc42ea40d387a520c
MD5 e63185b3daaa629a5e7c6b9befccf546
SHA1 d4b0582070844a23bdf1368f46b29ace39f315f9
SHA512 a8d731b688cef5532a54392e266428734774818c780a9d98610d1e7b9a78f46c96f1b68e1e0323c4de7654d36c041ae261fdb17876f1a0aee19ebfab6c0b7ca1
TLSH
T1CF31331A92B523748132E76D0F939919E632503711C18354BE5ED708AFB1A5AF115FCD
MD5 SHA1 SHA512 TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\snapshot_blob.bin
Size 360KB
SHA256 0b18f38d50c8f96c9fa2b8205c66c25b3ae45c985e8f2e7b6ecfab9f4d4d19d0
MD5 400c6740c922cf0d6f5564f90a6ff98b
SHA1 a67b8b17c054993f59166366f1ba994ad149b8ad
SHA512 409ee09ac44f3c142a9dd79e475142099a86a82ffa2c2a7816107b6a3dcdb97e3b0f450abd89d771b4cc8e78a025ee8fd4e22b0b25743525aabb600690a28f15
SSDEEP 3072:5lOt+xbRt251Ril0f2dvTbiWV6j1NXwxjmkiCkmW4k4DMwjZ99sey5UYxDQJb7w2:Gt+Hw2vTbYuqkqrIxsey5r835
TLSH
T1BA74FC46F15AC625CCE212384EEDCED83AB4F5CDDE4AC21B324047BDB4B96609F9258D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\v8_context_snapshot.bin
Size 724KB
SHA256 6d747f11d721655b780a47f6010eeef8428266e7521280e1e094d27c6f34311d
MD5 cea6e6039d5a818f95f8e0f17585457b
SHA1 083ec611fb0f9f8b05e25dbf188c0c85bebc9475
SHA512 1d69e338b85ff969fe3b96ec8deb7f9adacbc1d0bc6981bb4d68770ff58d99ff819d9c93577c31e984ee46f2c2d20e7b71b62600807548a71ca5b1d893354c49
SSDEEP 6144:Bt+Hwj15/HKW1Yqz2W6tgrYVLrgV2wXrIr2ff/sey5r838EV6vTB52WeVvV6AO1j:l3PKUYqz2W6tPsNXa/2jlPU5
TLSH
T1D1F4B3B6F50B8B31CA951B3D8EEB8E4B3A74F19DEE87C10B3151577C65B96A08E4240C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 3d8555de997bca1e58a72c6a8bc13a8267dca2c882ee0a783803470b289d1d23
MD5 f46154ed293b5ed031312c3fef27138e
SHA1 6d3d5e61e08aef1d9a3658e8471cdc233e1b81cb
SHA512 8908df2f50d3d707ef09bf881c94f9ed375379e404098bbf269095f645ffdd4010e16fdfed72553db09fadc62e16824dc4eae0d0ae6aa68e574857eded1c6f5c
SSDEEP 49152:o8bFjaGwMVhX4X6t+LsctbWjRIWHyQ1TKhwI+A3O/rrlfelrVeMsnNBnyoxmohPY:o8bFTwQWUUKG7V
TLSH
T1D3464903F69681D9C06DE6798B5FA623F631F8800B2276DF56A00F192E66FE0673D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\7z-out\vulkan-1.dll
Size 917KB
SHA256 5549afe706236d5c7ad5df4607c51639c790dfd118770eb27af8f2c5c076c3c7
MD5 99c5850794a0006d80306d01e8f64060
SHA1 3fcaf46c6dd67942e6b20e31d2fb97fd8a9b0e33
SHA512 e489d01cd2cf9eef1cfeecd2f3a04c4c1120f87713b40137cb3af547b04e6d0278c758e62b028e914324f00899718b1463e2e5da631233d2f28d46e235a4a837
SSDEEP 24576:BHzMfR00pJ8YRlEcqX0GoJyKqPHrKNlC1E+Dkw7+DQ6g3v0TAE7yoeHYV:1zMfRbX8aluo8KqTKNlC1E+Dkw7+DQ6N
TLSH
T15D156D6396948AB9D6768034DDD28A0389F174811322BACF03B41714BF5EFF46B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpiderBanner.dll

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\SpiderBanner.dll
Size 9KB
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
TLSH
T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nse9BBF.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Roaming\MuchaEXE\Cache\Cache_Data\f_000002
Size 1024KB
SHA256 f620fb56330823b792726e41f2ab36ef7c1111946c8cb3f6acdde571c2a9317e
MD5 6c8eb0451a505a773a6a49de65ded058
SHA1 c977f7e271efeabcd50c0f979f2af5b4e7934c58
SHA512 577a553f728cc4754d8235564cf72e22ed305f827ee253ef2e1cf4bbffe341d2761fbfc4a33e7130f9aca0e6d3c5740c74c4655fb498fbb050c37597e6605ba8
SSDEEP 24576:YsdwiF8K+cElJcz/PNg1+mi5UdNYU1MjQLK+9qc03:Ysdw+H8JczdR5+YU6o9q
TLSH
T1A62533DB13591C1AD9544EB00161FAA284538F3F1AA04BED5C69F9F9633F8E50393A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\MuchaEXE\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 33cdf8bcb4e9289241ad45e181466b8484c262e73bab75fa78a5f73d89f33ba2
MD5 2c591326ffc4676ddde8ae821e4919fb
SHA1 29862c120f995cc483934268c43720f0162eff67
SHA512 050ff980fd594176a1bd476ab56497581088cfe51b84b061909914159992687abbed23a3aabe8efd2e83c87fe2689ba30f962b314c4741507be98063c168e845
TLSH
T11DC08C2B249623E5DF1B823790DE450832A82802720A16E3FDE5665EFC34AA597B00C1
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\MuchaEXE\DawnGraphiteCache\index
Size 256KB
SHA256 3bed28bd55d458d466b99c16b4922feaf056a0cd9a6a3367d6574a207c33d733
MD5 3a8f15288c0efabd7fe364da85f4f079
SHA1 30c6a985011a83f497035725f9d9811d50a073b0
SHA512 17c6324e1d9d27a7e790beed1a90461afff41141a3e1cc0169cd0456f949fa4e2db745ba0df9a009cab1a4afa400af2b0588000407d3a5c1c674ba934d47099c
SSDEEP 3:LsOllllklkXliCFe+ll:LsUlPiGP/
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\MuchaEXE\DawnGraphiteCache\index
Size 256KB
SHA256 d27a5b0e7d07b0e818cf28b9eac3d98916b9bf82e829e1e9505dc2bc07440e16
MD5 ddbff6938701406f539f566a3dc1428b
SHA1 d67ed1596e580c7442c37a08d9ad149941e9c6a5
SHA512 d0971082766d0e71f7c17b296c94f05167aa49b59e99de7250ad1a3f326cd5aa662988d754c76bbad7491faeb9b0412328ddf2a2d3d637e5fa4e363a90ef60c2
SSDEEP 3:LstlNllkll/lqCFe+ll:LsX3lEtqGP/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\MuchaEXE\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\MuchaEXE\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\MuchaEXE\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\MuchaEXE\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\MuchaEXE\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\MuchaEXE\Local State
Size 490B
SHA256 5f81bd8e164644d4cccf0391436dcba529c26f1afedc9876f217c1c5c34eb911
MD5 81c241f0e616b75a159a0cd34f5f7bf3
SHA1 34d42f1e116aeb8f542afc776df3a09cff3d0148
SHA512 d13f55147df57f7ba10bbc16c56edc8869ca815bc1c57fccea6bbd10cb4d026819f79fa9cd329de6b2bb2b06a2f0605ffdee6191de45ae6bc797a93fa95dab86
TLSH
T12FF00E766CD0DEF8BF028340444FD2024F6895EF589207092C4A02234BF7C68AB06931
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\MuchaEXE\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent Stated43da1f8-91fe-4a92-93cd-73b9df67716c.tmp

Path C:\Users\Admin\AppData\Roaming\MuchaEXE\Network\Network Persistent Stated43da1f8-91fe-4a92-93cd-73b9df67716c.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\MuchaEXE\Preferences
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\MuchaEXE\Preferences
Size 132B
SHA256 47ad95afaa16b5f4e0706535f48ffdd01eb3654c69ebccb08d9130930261ff3f
MD5 932e7acea8040a4e06ebe3bca9442c47
SHA1 8e6320f0ce2e40412876c6a887683c61d4524724
SHA512 1519b38b28ddce4354da7082f9571735de21b97dcaa9024b51d971d309e57f8c8230045a9c4181fc47a2faf75e67566844c2a9e80af019435e9af501cd8b7d53
TLSH
T19DC02B21100030364E2F9D03C043788D48F10614490F086144C03042481711D0C8702B
MD5 SHA1 SHA512 TLSH

Submit Download

MuchaCHEATZ Setup 1.0.0.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\MuchaCHEATZ Setup 1.0.0.exe:Zone.Identifier
Size 89B
SHA256 c76b251abe19c60536905b468be5b4bf343144dccbeddb7984fc050a86047e6a
MD5 25b8447dfc62bcef02dd8a439ce7e8f9
SHA1 911b41e558e7a6d191c21bcd50f68bfa7e1022d9
SHA512 0cc92de993581277569f7aeda4b7de7e89e545a1ae2f0181fe45b3b9791945a8a4c0de46d32ffe5704ca490bdd836d0cabc79b6d542b8edb41c24c470d4d076c
TLSH
T175B0125F440104001375718827CF5415E41F251088048240D84040D2D44D08883A9405
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2148-297-0x00000000705A0000-0x00000000705EC000-memory.dmp

Download

memory/2148-304-0x00000000707D0000-0x0000000070B27000-memory.dmp

Download

memory/2196-246-0x0000000007560000-0x0000000007594000-memory.dmp

Download

memory/2196-256-0x0000000007FD0000-0x000000000864A000-memory.dmp

Download

memory/2196-258-0x0000000007A10000-0x0000000007A1A000-memory.dmp

Download

memory/2196-260-0x0000000007BD0000-0x0000000007BF4000-memory.dmp

Download

memory/2196-216-0x0000000003110000-0x0000000003146000-memory.dmp

Download

memory/2196-259-0x0000000007BA0000-0x0000000007BCA000-memory.dmp

Download

memory/2196-217-0x0000000005940000-0x0000000005F6A000-memory.dmp

Download

memory/2196-218-0x0000000005700000-0x0000000005722000-memory.dmp

Download

memory/2196-219-0x0000000005FE0000-0x0000000006046000-memory.dmp

Download

memory/2196-220-0x0000000006050000-0x00000000060B6000-memory.dmp

Download

memory/2196-227-0x0000000006100000-0x0000000006457000-memory.dmp

Download

memory/2196-228-0x00000000065A0000-0x00000000065BE000-memory.dmp

Download

memory/2196-229-0x00000000065D0000-0x000000000661C000-memory.dmp

Download

memory/2196-261-0x0000000070700000-0x0000000070A57000-memory.dmp

Download

memory/2196-255-0x0000000007640000-0x00000000076E4000-memory.dmp

Download

memory/2196-257-0x0000000007990000-0x00000000079AA000-memory.dmp

Download

memory/2196-247-0x00000000705A0000-0x00000000705EC000-memory.dmp

Download

memory/2196-254-0x00000000075A0000-0x00000000075BE000-memory.dmp

Download

memory/2288-197-0x000001F8D32E0000-0x000001F8D42E0000-memory.dmp

Download

memory/5156-927-0x00007FFA7AA80000-0x00007FFA7AA81000-memory.dmp

Download

memory/5156-928-0x00007FFA7A3D0000-0x00007FFA7A3D1000-memory.dmp

Download

memory/5864-277-0x00000000705A0000-0x00000000705EC000-memory.dmp

Download

memory/5864-274-0x0000000005D90000-0x00000000060E7000-memory.dmp

Download

memory/5864-285-0x00000000078C0000-0x00000000078D1000-memory.dmp

Download

memory/5864-284-0x0000000007950000-0x00000000079E6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads