hxxps://launcher[.]pokemonotherside[.]fr/downloads/OthersideLauncherSetup[.]exe

Analysis

user interaction
yes
max time kernel
233s
max time network
236s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://launcher.pokemonotherside.fr/downloads/OthersideLauncherSetup.exe
Sample261003-2dtxmszvgv

Score

8^/10

defense_evasion discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
18	2100	msedge.exe

Executes dropped EXE 10 IoCs

pid	Process
2740	OthersideLauncherSetup.exe
1800	Otherside Launcher.exe
3196	Otherside Launcher.exe
2320	Otherside Launcher.exe
5640	Otherside Launcher.exe
1352	Otherside Launcher.exe
4696	Otherside Launcher.exe
5272	Otherside Launcher.exe
2076	Otherside Launcher.exe
5196	Otherside Launcher.exe

Loads dropped DLL 27 IoCs

pid	Process
2740	OthersideLauncherSetup.exe
2740	OthersideLauncherSetup.exe
2740	OthersideLauncherSetup.exe
2740	OthersideLauncherSetup.exe
2740	OthersideLauncherSetup.exe
2740	OthersideLauncherSetup.exe
2740	OthersideLauncherSetup.exe
2740	OthersideLauncherSetup.exe
2740	OthersideLauncherSetup.exe
2740	OthersideLauncherSetup.exe
2740	OthersideLauncherSetup.exe
2740	OthersideLauncherSetup.exe
2320	Otherside Launcher.exe
5640	Otherside Launcher.exe
2320	Otherside Launcher.exe
2320	Otherside Launcher.exe
2320	Otherside Launcher.exe
2320	Otherside Launcher.exe
5272	Otherside Launcher.exe
5272	Otherside Launcher.exe
5272	Otherside Launcher.exe
5272	Otherside Launcher.exe
5272	Otherside Launcher.exe
2076	Otherside Launcher.exe
5196	Otherside Launcher.exe
5196	Otherside Launcher.exe
5196	Otherside Launcher.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3952	powershell.exe
4952	powershell.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4968_59850163\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4968_1815617327\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4968_1815617327\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4968_224381907\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4968_224381907\nav_config.json	msedge.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5448	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Otherside Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Otherside Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Otherside Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Otherside Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Otherside Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Otherside Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Otherside Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Otherside Launcher.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OthersideLauncherSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2100	msedge.exe
4108	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Otherside Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Otherside Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Otherside Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Otherside Launcher.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OthersideLauncherSetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{975804AE-0BE4-42C1-9A36-164C93EC0288}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{431E406A-8827-4E81-A5A7-477CFEDF772C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
5448	powershell.exe
5448	powershell.exe
5448	powershell.exe
3952	powershell.exe
3952	powershell.exe
3952	powershell.exe
2740	OthersideLauncherSetup.exe
2740	OthersideLauncherSetup.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4968	msedge.exe
4968	msedge.exe
4164	msedge.exe
4164	msedge.exe
5196	Otherside Launcher.exe
5196	Otherside Launcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5448	powershell.exe
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeIncreaseQuotaPrivilege	4952	powershell.exe
Token: SeSecurityPrivilege	4952	powershell.exe
Token: SeTakeOwnershipPrivilege	4952	powershell.exe
Token: SeLoadDriverPrivilege	4952	powershell.exe
Token: SeSystemProfilePrivilege	4952	powershell.exe
Token: SeSystemtimePrivilege	4952	powershell.exe
Token: SeProfSingleProcessPrivilege	4952	powershell.exe
Token: SeIncBasePriorityPrivilege	4952	powershell.exe
Token: SeCreatePagefilePrivilege	4952	powershell.exe
Token: SeBackupPrivilege	4952	powershell.exe
Token: SeRestorePrivilege	4952	powershell.exe
Token: SeShutdownPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeSystemEnvironmentPrivilege	4952	powershell.exe
Token: SeRemoteShutdownPrivilege	4952	powershell.exe
Token: SeUndockPrivilege	4952	powershell.exe
Token: SeManageVolumePrivilege	4952	powershell.exe
Token: 33	4952	powershell.exe
Token: 34	4952	powershell.exe
Token: 35	4952	powershell.exe
Token: 36	4952	powershell.exe
Token: SeSecurityPrivilege	2740	OthersideLauncherSetup.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe
Token: SeCreatePagefilePrivilege	1800	Otherside Launcher.exe
Token: SeShutdownPrivilege	1800	Otherside Launcher.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5232 wrote to memory of 2396	5232	msedge.exe	90
PID 5232 wrote to memory of 2100	5232	msedge.exe	91
PID 5232 wrote to memory of 5712	5232	msedge.exe	92
PID 5232 wrote to memory of 5712	5232	msedge.exe	92
PID 5232 wrote to memory of 936	5232	msedge.exe	94
PID 5232 wrote to memory of 5192	5232	msedge.exe	95
PID 5232 wrote to memory of 936	5232	msedge.exe	94
PID 5232 wrote to memory of 936	5232	msedge.exe	94
PID 5232 wrote to memory of 5192	5232	msedge.exe	95
PID 5232 wrote to memory of 5192	5232	msedge.exe	95
PID 5232 wrote to memory of 5680	5232	msedge.exe	96
PID 5232 wrote to memory of 5680	5232	msedge.exe	96
PID 5232 wrote to memory of 5680	5232	msedge.exe	96
PID 5232 wrote to memory of 6028	5232	msedge.exe	97
PID 5232 wrote to memory of 5928	5232	msedge.exe	98
PID 5232 wrote to memory of 6028	5232	msedge.exe	97
PID 5232 wrote to memory of 6028	5232	msedge.exe	97
PID 5232 wrote to memory of 5928	5232	msedge.exe	98
PID 5232 wrote to memory of 5928	5232	msedge.exe	98
PID 5232 wrote to memory of 2020	5232	msedge.exe	99
PID 5232 wrote to memory of 2068	5232	msedge.exe	100
PID 5232 wrote to memory of 2020	5232	msedge.exe	99
PID 5232 wrote to memory of 2068	5232	msedge.exe	100
PID 5232 wrote to memory of 6032	5232	msedge.exe	101
PID 5232 wrote to memory of 6032	5232	msedge.exe	101
PID 5232 wrote to memory of 6032	5232	msedge.exe	101
PID 5232 wrote to memory of 2856	5232	msedge.exe	102
PID 5232 wrote to memory of 2856	5232	msedge.exe	102
PID 5232 wrote to memory of 4148	5232	msedge.exe	105
PID 5232 wrote to memory of 2596	5232	msedge.exe	108
PID 5232 wrote to memory of 2596	5232	msedge.exe	108
PID 5232 wrote to memory of 2596	5232	msedge.exe	108
PID 5232 wrote to memory of 2376	5232	msedge.exe	109
PID 5232 wrote to memory of 2740	5232	msedge.exe	110
PID 5232 wrote to memory of 5776	5232	msedge.exe	112
PID 5232 wrote to memory of 5996	5232	msedge.exe	113
PID 5232 wrote to memory of 4084	5232	msedge.exe	114
PID 2740 wrote to memory of 5448	2740	OthersideLauncherSetup.exe	115
PID 2740 wrote to memory of 3952	2740	OthersideLauncherSetup.exe	117
PID 2740 wrote to memory of 4952	2740	OthersideLauncherSetup.exe	119
PID 5232 wrote to memory of 3396	5232	msedge.exe	141
PID 5232 wrote to memory of 3396	5232	msedge.exe	141
PID 1800 wrote to memory of 2320	1800	Otherside Launcher.exe	126
PID 1800 wrote to memory of 3196	1800	Otherside Launcher.exe	127
PID 1800 wrote to memory of 5640	1800	Otherside Launcher.exe	128
PID 5232 wrote to memory of 4968	5232	msedge.exe	129
PID 4968 wrote to memory of 6092	4968	msedge.exe	130
PID 4968 wrote to memory of 4108	4968	msedge.exe	132
PID 4968 wrote to memory of 2976	4968	msedge.exe	133
PID 4968 wrote to memory of 2976	4968	msedge.exe	133
PID 4968 wrote to memory of 3040	4968	msedge.exe	134
PID 4968 wrote to memory of 2976	4968	msedge.exe	133
PID 4968 wrote to memory of 3040	4968	msedge.exe	134
PID 4968 wrote to memory of 6004	4968	msedge.exe	136
PID 4968 wrote to memory of 1628	4968	msedge.exe	137
PID 4968 wrote to memory of 1628	4968	msedge.exe	137
PID 4968 wrote to memory of 3068	4968	msedge.exe	138
PID 4968 wrote to memory of 3068	4968	msedge.exe	138
PID 4968 wrote to memory of 6072	4968	msedge.exe	139
PID 4968 wrote to memory of 6072	4968	msedge.exe	139
PID 4968 wrote to memory of 2920	4968	msedge.exe	140
PID 4968 wrote to memory of 2920	4968	msedge.exe	140
PID 4968 wrote to memory of 1696	4968	msedge.exe	142
PID 4968 wrote to memory of 1696	4968	msedge.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://launcher.pokemonotherside.fr/downloads/OthersideLauncherSetup.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffc8321c188,0x7ffc8321c194,0x7ffc8321c1a0
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,11606208767127113623,14379389613161993947,524288 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,8704117692436048080,14376213997500266707,524288 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:13
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,3238857764388834727,15271434206135080630,2097152 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,4539212391245703943,4180216888349681529,2097152 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,16036430619189350745,5374869619848417878,262144 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:2
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,3354894637046247578,7816017826286719671,2097152 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:9
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,16971051675177727793,7508756271699950545,2097152 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,1399974215965322641,2861406120661240995,524288 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,15760319453565442198,12764116975693500797,524288 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5888,i,9542451163708154010,8674229183781253633,2097152 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,10482378248697830662,13571862582093722110,524288 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,8239175069934711320,863775807646467609,524288 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,8239175069934711320,863775807646467609,524288 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4908,i,2914485308359401309,4142608962100387404,2097152 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,4821375486011385866,264522726571690250,524288 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  PID:2376
- C:\Users\Admin\Downloads\OthersideLauncherSetup.exe
  "C:\Users\Admin\Downloads\OthersideLauncherSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
    3⤵
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5448
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Otherside Launcher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,17767159326296678611,8461320687870599637,524288 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,11899825456123292033,16210854628369057656,524288 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,12720664884937101188,13842672664275900054,524288 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:14
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,7327553390125572996,4225059695455553826,524288 --field-trial-handle=2592,i,12255697760923494175,15246332910251577785,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc8321c188,0x7ffc8321c194,0x7ffc8321c1a0
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,9850114543042397550,7095793285285201343,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,16980518877607106007,16128292668874947310,262144 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:2
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,14638926619237238709,17416357475562030056,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:13
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,448300162640171881,16055531810152972391,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,448300162640171881,16055531810152972391,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,15522413737564234370,7917618024668704685,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,16783191155232167937,16950693466321716857,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,2841301185040102298,7028334009319860947,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,11136930902508521949,141690138494200530,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,3142431190422339028,2053934086135162281,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,17949603917707031202,5046680690626751502,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,12340905568609711469,300751395518445309,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,5341969722375328821,2450677473335346675,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,7017626391056628247,17430536132206396691,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,16388965256563491621,5865722115374524158,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,14780737248033111266,11799709463247643482,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,4488089038071224971,15296806801749166204,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:14
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4984,i,15272808864606404120,11289321547724023480,262144 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,15090285892237162922,4042357389633993781,524288 --field-trial-handle=2788,i,10224053826367934287,11652445802765462821,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:14
    3⤵
    PID:5152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4084

C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe
"C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Otherside Launcher" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1816,i,15939852107359935327,15766178220902504350,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1820,i,9877687902925293962,8602523798775762756,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2320
- C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Otherside Launcher" --field-trial-handle=1816,i,15939852107359935327,15766178220902504350,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1820,i,9877687902925293962,8602523798775762756,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1896 /prefetch:11
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:3196
- C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Otherside Launcher" --app-user-model-id="electron.app.Otherside Launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1816,i,15939852107359935327,15766178220902504350,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1820,i,9877687902925293962,8602523798775762756,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2348 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3396

C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe
"C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
PID:1352
- C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Otherside Launcher" --field-trial-handle=1624,i,12320268380169647567,10048585577498626012,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1628,i,5206920548377185644,9976969804441335713,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1728 /prefetch:11
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:4696
- C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Otherside Launcher" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1624,i,12320268380169647567,10048585577498626012,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1628,i,5206920548377185644,9976969804441335713,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1620 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5272
- C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Otherside Launcher" --app-user-model-id="electron.app.Otherside Launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1791065930437424 --launch-time-ticks=675366835 --field-trial-handle=1624,i,12320268380169647567,10048585577498626012,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1628,i,5206920548377185644,9976969804441335713,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2472 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2076
- C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Otherside Launcher\Otherside Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Otherside Launcher" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1624,i,12320268380169647567,10048585577498626012,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1628,i,5206920548377185644,9976969804441335713,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3424 /prefetch:10
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

03d6301a-6504-4a73-9a4f-aec7ce5f5948.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\03d6301a-6504-4a73-9a4f-aec7ce5f5948.tmp
Size 37KB
SHA256 5c5e26190133040bfa862daa553b6a6f32ce930297e4649d22fbd3bebfa02998
MD5 91074b59d1ed62528da411f89b734d22
SHA1 6620cdacc6206988ce16a9b71ee82d57435c6063
SHA512 07a87ada5110a68da032a0dfd2c0f825b501af2cd5978726b4bec4b94cce1462872acd5f818c2d66adce7f217b3c2817dcb571e1b08233e12e09a9b8b39f5c68
SSDEEP 768:uFM93IwgWQwlK3OdWf7D51h3Yogkl5akl8pbHW0AWI23DrgvP9C:D93Fo7D51h3Yog05akl4bHW0ASzrgdC
TLSH
T19403AF72AC64DEB79DEAC784B65A7203BFF4817399D99A84D6CCDA0D00532ED070BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06e406a6-1a1a-4573-913e-358d39921bbd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\06e406a6-1a1a-4573-913e-358d39921bbd.tmp
Size 34KB
SHA256 5c06b03e15c0f69a18a3d2e59c0bde1c16fa1c52e9fd81592965f8d8f20fbb04
MD5 fc4bc48d663bac2100af07a1f060005f
SHA1 96dac2dec8170a55850b8f62d6069bb398122461
SHA512 39231f4c0039f22a1c6968f8047698f3baa4255f4bde035e6a185ad5cc5e0e8a589379a03b709c53699c217f9a6300b621174d2edf1c32273b410db49d2d2833
SSDEEP 768:nU3sQhlK3OdWf7D51h3Yogkl5akl8pbHW0AWD13DrgvPfa:nU3sh7D51h3Yog05akl4bHW0AEzrg/a
TLSH
T15EF2BF71AC74AEB359EBC285B51A7207BFF8C127A7DD5B8484CD9B0D05976EE030B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

256dc445-6909-4e57-8aa2-4605645cc4b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\256dc445-6909-4e57-8aa2-4605645cc4b3.tmp
Size 37KB
SHA256 6c26c644dd794c08cd8f7f6d90faf1fa5f3a7799f03c63b1e4232ee0d0050941
MD5 343ec096de13661034561bdbd8b8aa6b
SHA1 38f4722bb889353d7b9d8ee8e554ccc065308e85
SHA512 034b16153aa573d8d474a040d622145469579ba95c511493bed9805732164ba9a8e79b4046c09cb831477db78192d3d190141e1c2655984068ba834120652304
SSDEEP 768:B/UxvxjgC+CZ3ljK3OdWA1h3Yogkl5akl8pbHW0AWTQSHvP0Vv:UZj3+I391h3Yog05akl4bHW0ABSCv
TLSH
T1CC03C035FC64AD778AF6A284760AA317FFF495636AC556A445DC9F0E02873BC030B853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ecba35d-2ae0-4b23-9895-464e3a3d82b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3ecba35d-2ae0-4b23-9895-464e3a3d82b0.tmp
Size 39KB
SHA256 04c3ab76e0b353a6f91682f418a654ee1045c8ff7419f3eca656ddf51f9066cd
MD5 d86f1127d1a434a1232c2e241080872b
SHA1 b2eea817bf29784e8e2f2db275134827c75b6550
SHA512 6493a9b667750d83726892de9110c06db2d1254c5fef11c0063772daa73438aeeb6ec7e47158191d128724d8593b8e82b50900cf9dd1edb4481c87a0f3b25bb4
SSDEEP 768:oFM93IwgWQw6hmj3OdW81h3Yogkl5akl8pbHW0AWIG5/2wd0DrgvP9C:N93FY1h3Yog05akl4bHW0Aal2AwrgdC
TLSH
T1E903AF3ADCA49E7F8DEEA784A60E2216AEF48133D6E95684D3CC9B0D40735ED130BC51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46aa230a-3418-4f48-8acd-a2e43a27e395.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\46aa230a-3418-4f48-8acd-a2e43a27e395.tmp
Size 34KB
SHA256 4a59ec6d6b65d1e0a021ac4baea2858adb7c8d7b4b31387a6b20872f0a6036ee
MD5 b5ab53d0d127442fa1e28e6f0c7105d3
SHA1 690c981aa57414f109a30028f964c279fb7ad9ae
SHA512 a4a1b83d331e8105135ad1225ce674f1c3507b1871c67a177a32e194abf69dfef7176f123010815c536789c4b8c13eb08f3b46a05e7fb5ceef312edff30edf6e
SSDEEP 768:Vn3hQhlK3OdWf7D51h3Yogkl5akl8pbHW0AWD13DrgvPfa:Vn3hh7D51h3Yog05akl4bHW0AEzrg/a
TLSH
T157F2BF71AC74AEB75AE6C285B51A7207BFF8C127A7DD5B8484CDAB0D01976FD030B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68103609-54e3-475c-89ce-3d8d32087d1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\68103609-54e3-475c-89ce-3d8d32087d1d.tmp
Size 36KB
SHA256 e921ad0ab3d0bb547ea37399a0c8d80418a3b441f56a3c078c7492fdde2f1d37
MD5 4178d901402e16c3ca4e8963cda94fce
SHA1 79d0914b4fcc5bab32c727fe82e1a29c91b1458b
SHA512 441e9063fdaef9e4b556271c798a8c6d7d454e4fd1a94cb168ee8e402473bf2dd9cb509c93153b32773445076e926ea706c0fb2aac6a76f10fa0a16cde30a3d5
SSDEEP 768:SFH13VwgWQHlK3OdWf7DB1h3Yogkl5akl8pbHW0AWD13DrgvPfa:u13Sp7DB1h3Yog05akl4bHW0AEzrg/a
TLSH
T15103BF729CA4DAB79EEBC784B61A3203BFF48163D6D99784C6CC9A0D01971ED030BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e1837ee53009f9b691f7aee3be45ffb945d4894bf04ccaf875b9947114bb5224
MD5 58ba31abb4a3fd3bbc9aadea4fc9ca13
SHA1 d79c4b2ccee6dadb45162ea34fb988911510f0b8
SHA512 0c096d7f5d364e0911d26f4bc2ea03e3d81b2026be5182b04fc17e7949640761db8056138b55b28aa9abe884d601d2cf6b1be9e992fd3565c35c69def459d32a
TLSH
T1F3D02B3579ACD772C18C503A405901112A95F001FD46C1801953B10848913400006295
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08126c54bd139460b048bed70881ec2eed246a5165d23d58802f8221a04e5af7
MD5 6792f56a8b16de71cdff46ee6b1cb134
SHA1 2b344e6bd240f256e8ced955a740db088b329901
SHA512 5d23317e53f46eddbd06ca669cb69d8bc0c7843ef8345fa5123da2678e3f073a1eef30b8cfd5c04c904daf3a7d089ea52b412f4df3b917047a639782da4db03b
TLSH
T1ECD0C00CF9AC8378D9082037923501163B88D100FE03500180D122A504B3310004C0B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 74115655b7cef8beeb6319503739a945a81e4bc723b21ca5310c7fc4651d5017
MD5 cef3877f267000ea83f889f1f4250a74
SHA1 450da6c1896141b40179049370d69450d1a754ad
SHA512 532981e5d1fe6e3c13c69c27a36822ca6ed714463802065264681aad7834702a754d0d0fc7b75e4d8f97dbc248eacb9699e2590d0f8f501997df4453a63d9560
TLSH
T14AD0804DF9AC977CD9592437963541663B89D511FE53501185D156A544B3311015C1E0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0a1e646beadfff70af6a1dc73b6baa41188262ddbb2b7781270d4e94c92c02be
MD5 893220bb58a1416480d52375128fa19a
SHA1 3a577208211e9133f3744d9ba695501b0481ca9b
SHA512 b3f0e3d85398f7aa7fcea74cd44fd2709c0265d9072771dccfe7508832bc1173f452a0f49028e8bd62ea434676abcdf4a111c8e31f121871fbdfa4acf207b131
TLSH
T1C2D02B3179BCD772C18C503E405A01112A85F001FD46C1801A53F10848913400005281
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03d00329319490e3d2ec6b61f9e8a12665158b83eb73666756d1d6792b979c87
MD5 f9bec72d29f1e0f2dd6e4006cc5b0d46
SHA1 c44504c4b51c6c746aacf532c10c5ebff657e836
SHA512 3ef3eafd3550a107bcc03bb01b841e062973d0f912dd8a2203b224f867da719d795f9e4eab5be22f3fb2b6bc67f0e278ae10878c59dcdc1c08148e8c5decdb62
TLSH
T1A4D080157DBCA7F4E12D203E5225010576CCE553FE435105D89165594CF33924095DF5
MD5 SHA1 SHA512 TLSH

Submit Download

010eaea5-6888-44d1-8939-4d61bfed3360.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\010eaea5-6888-44d1-8939-4d61bfed3360.tmp
Size 414B
SHA256 8bbcb97d3c2129ae09583e75923aa1ca5383bacf45583405ff7f5756dae97262
MD5 776c2915b36eb5196b1a4e02b4b998ea
SHA1 5b907fb4e4992ff801629cd9d4443f22b9fb82d2
SHA512 8f931f0648830ba0980b335611e50fb72519ee2e52b9efcead84f96043997db71a8ef3d990cf89c037547471ce6e4651060efc9c112549e15977cc74e0772fe4
TLSH
T1D6E02BE6D931EC3B19FD072851604B85E74153972651878F763C9108CFB073AD1D296C
MD5 SHA1 SHA512 TLSH

Submit Download

284d9a12-b7a0-46d7-88e1-7cecde49e14f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\284d9a12-b7a0-46d7-88e1-7cecde49e14f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66324c60-53f9-4e07-8d7a-90038fc42b5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66324c60-53f9-4e07-8d7a-90038fc42b5a.tmp
Size 12KB
SHA256 f09e71439c5cecbced52e581f0796776d2177e90964105128ae360ac3acc1fc5
MD5 22e4be7655d4cd2563107f2254b6bb03
SHA1 13fcab9fb92cc8a99960b6f466dfae70e8ba33a6
SHA512 e87f6f83f0c8b4cb3329b9ecad2770430ea1e70c119022ce47786278ef7caa1f9e2474611fc64ef2c6367069ba959312da6c58d0f7fa46c11027ab62db8bc4ac
SSDEEP 192:sxRqRmO0/fSs4WpVVUyZM4zoA8pw/g6+WNIYdMpgG+hIgDEJ:sxRqX0/fSs4WvqUMBw/5IrIE
TLSH
T1D942B756AD28A97B8CCBE21DFB557F53D2F95032A1D21F48A6FC861C14EB6DD120340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

707707c2-7167-4c64-a058-7685708a7ce6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\707707c2-7167-4c64-a058-7685708a7ce6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

87949841-aa83-4338-ae0e-d0d943043f9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87949841-aa83-4338-ae0e-d0d943043f9a.tmp
Size 11KB
SHA256 3be52e09b18670cc65c0344e95c62abb003d238c7346426d858d4e99e3f15510
MD5 8334d7d337849c54fa220603d404fac5
SHA1 6d0f19bcfca6b88e336171250d3fa43f18c67964
SHA512 917dad933477a568e556b4a3bcac9cc032009d7d4a431f07709f946a011983cfe39baa965b444a84f7045a91613926b16afd22b1697b5c51339eccbbf7523db8
SSDEEP 192:sxRqRaO0/fSseUqmBPzoA8pi/g6+WNIYdAqiG+hIgDVJ:sxRqT0/fSspHBmi/5I7Nz
TLSH
T1E132A656AD28A97B8CCBE20DBB657F53E2F9503261D51F08E6FC861C14EB6DE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f0bf429-884f-4b56-842a-084ae6970ae0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f0bf429-884f-4b56-842a-084ae6970ae0.tmp
Size 11KB
SHA256 6405f648a4ea8f19104d52ef882ded24dcf7c653366b28cbce293141e9c9533b
MD5 7b615c3e4271b5a2ba8a093e1a1b6dd4
SHA1 45fb3271ef815c7e1c8ca09658f36c5edaba0038
SHA512 7075e12e4d3bc8570d18e385288100a78a9c2e0928c220b001e0f5da8a956a23bcfd11963aeed9cb089a8de04bfe2e5d6c5457f1348e8f6a5db92e4895810f7f
SSDEEP 192:sxRBRaO0/fSsBUqmBPzoA8pi/g6+WNIYdgiG+hIgIJ:sxRBT0/fSs2HBmi/5I+s
TLSH
T14432A656AE28A93B8CCBE21DFB657F53D2F9503261D51B08EAFC865C04EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 fb1b44a4c6a7fb446c1549dfc4cdd34712a57059e008841282531fc99932c812
MD5 9c4798359727e7fd34846025e3c68981
SHA1 5bb374542a6e1bf1bf9005d04f2f29f6c28bd85c
SHA512 6dd6c7ca46be949f6eccebdc1c856039674477c6f9b97a67bb8855ec18aa63c9aeb700d70c9eb3f59f057fe93f159fdd185cd4bb5d5ff268ef50d33f84985f1f
TLSH
T16471A4A09270DE15EBA4307041EEC98E3D329A8CEFFB5F25F31691F6654A3A0C95706C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f47c01cd9ba85fa027a60f1c7768608eccf9f8432182098504935a373a916a45
MD5 d5afbe849bd5bfe512f75dfdb00fb0b9
SHA1 08153890d3d35378f74b341deb4b9596f860c6b3
SHA512 0cc5ce1b01163ab0de12e2efadb66d348cc03f5e330f1fefa641da977d8e0d50de9a6dbf1c0eace8535029f1c1095871234e109c812c3e8f17e48515d2aa9e74
TLSH
T14D71A5A09270DE15EBA4307041EEC98E3D319A8CEFFB5F25F31691F6654A3A0C9570AC
MD5 SHA1 SHA512 TLSH

Submit Download

ca5dcf76-024a-4a6e-88f7-75f9ed3d2b99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ca5dcf76-024a-4a6e-88f7-75f9ed3d2b99.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 fb7ff6e8082efd43bca5ae4c8f150377d9b4428583e8065cc8a09c0a38097086
MD5 f39e78643a4208a1cb599d99b41c6e0b
SHA1 1ab3cf225029e052a790cb46470d945e962f4d84
SHA512 2122c818f6e2bc8b9b2b14f593c930624ffaa5c1035a584756ef9c0dd1ff9f5a8382da8e30eea6cc1a32a28a56bd4dad880702c28a943ae57ea93547f7c06ec6
TLSH
T1B8E026A824C8C22DB05B6897136C870C8FD03513A2CC3E4A174CDD406242381E2C77E0
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 bd2a2d112aa6cfcd72fe9aced14606e005d209813f29a95887c86e2254dde9ca
MD5 8d7ad49e8ae518ace54c181d82de43d4
SHA1 355c688f258a62fb65a9a014c57cd1c7913a10be
SHA512 c1394a328c851e8b7a351166d22d5ba3fac362e75239eb0d32e6ace674c325e394f7440e98703c03305ac98b0be8d983914c4bd804903c466c5ffc732917c545
SSDEEP 3:MsEllllkEthXllkl2zE6B:/M/xT02zD
TLSH
T1C044041C7FC00505C500D43044D3C3501370D43707115F57345104177DC55710C11004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 91e417ca195d4ced61b4e2c032b9f4f53d1136f48114db8e43170aa2415fb161
MD5 2554a0893dec2453f47e56e7c2427568
SHA1 4258da1f5da7316da305a2d7e7103b061b0b3cbf
SHA512 ca8460c17fd5e78a2609414ab864c5d03edb15455d3c97e0a91054faab3461e9e8833d16e379a27415a54048fe87d1a8d888554c3207f46f54a3892c2055fcb4
SSDEEP 96:XxnP61tejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFq:XgyH+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T17C24114F5F342721CDBD917668EB45A35C7DF03F8B1266DA686114B4CEE2642A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e649002-5f54-4d35-864c-111a6e98b6fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5e649002-5f54-4d35-864c-111a6e98b6fa.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

6b1f47e5-f4f5-4ab6-9ea5-8ffff51a24b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6b1f47e5-f4f5-4ab6-9ea5-8ffff51a24b8.tmp
Size 2KB
SHA256 001411680f70105174704d26ddc491837c31edd157c745e2b42446e1a0afe4c4
MD5 d8abcd2482d0e554ebc27467155df147
SHA1 4a32799cc92dcd38a9e9d5eeee180126b9abc371
SHA512 16c4042e06a328b10da7af0b9086344149ce4ee2966773a609b3cf4f4023f8b9e963084537fda8fdee5e1b03446b0b599c52925bf95fdfb1452ef016e27e60c8
TLSH
T1AE419BF3C3E8867D890156F4AB186E1BCE1D0915832C3C5AC9E4AE2B93E34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

9fd18112-f74f-4517-b59c-78cddbbe18b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9fd18112-f74f-4517-b59c-78cddbbe18b3.tmp
Size 2KB
SHA256 2ac1f05733b6076bd732870a19f46ddcbc65552ffc795df02f42ffc8ab727f63
MD5 309107aaa8c1d57def145820bee5428f
SHA1 aa1ce59b205bb31d19a01f5e980722b04da1f16f
SHA512 163868a3a312e02fafdb71889d6b57f433c99abb73cd0096b8c6eb87700f3c0c1d8d1a08d0df198199a082f2a62e95bc190158316998abaa2150489b2bfeef9c
TLSH
T188419BF3C3E8867D890156F4AB186E1BCE1D0915832C3C5AC9E4AE2B93E34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

a2b5c319-6365-48b4-8ffc-7b9d37007da6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a2b5c319-6365-48b4-8ffc-7b9d37007da6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e7dc5cb4-783e-485b-85c9-2a6c47bcfbad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e7dc5cb4-783e-485b-85c9-2a6c47bcfbad.tmp
Size 2KB
SHA256 cd43f9ac9beee64f4505dc08fd7940a3b17e96969f45ac68534c93f1fe60fc2f
MD5 2799c31e9176f6328cc16f2a17ddde6f
SHA1 e974016b27cdb5a0a6339cd3447fbaec6ad186ee
SHA512 29246e23a7604c5defa562ceb334ca201a792c90106954af2a14585d212f9704a6ab54f60883e5ad8624437c2247864a14b7b3c92537206cc66203c8fd5c1217
TLSH
T1805190F7C6E8866DC90156F4AB186E2FCE2D0915832C3D5AC8E49F2B93E3471D18169F
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 4fdc4542698f9028edc376c2758c25f6bd2b6864fc934f3649488643e80b09a2
MD5 fa3c7014ad7e7ff02f551962e247f04c
SHA1 e58d257a397cce6f47d706e3331b6a6fb3468ca4
SHA512 f6290ab783f7fbd316da9d0a7f33925c1aff8000338a0e14fb9d9f0f1f613f322ef918edd076beb69f3c1149be5b8723e633a0872442e5efcbc29c4bd1060d39
TLSH
T1E9E026A425CAC27D701F20471328CB089FE87A27E2C83E462F80CA556A87584B2D35A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 bdfcd672378b27498244c492265fc7fd1101045bd0e8b4b0393b8fd9789400a4
MD5 364e9ae1bf6cbb2aa197a11c9443f318
SHA1 94f5fe4009c2db0203befd06b1dd1e43afc3be24
SHA512 633f7399aa81b4e26face7a1c5c1aa227f49e3301a1330734b78e288db92c9da388362671df1b9299e831060b5396f68c9f2efdffda702543773a204d137277b
TLSH
T1A0E0D8B475D9C32E754A2087232CE3088AF27613F6C4BE552B08F9456B4B18472839A0
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 ae41fd10b37892b4a5a2c562bc6135c5cc52aefb9e0f94616bb1ea026a038395
MD5 dff60db773fa2f87c8000614fe1a361f
SHA1 9acff18ec73c8a10e5e6e7b0b06cf8aa6e5c8703
SHA512 28241901741c04c910cd3afcf2fd4cd45e6450352a88a81a6fbb7b2885a10dddd139e6a0ba869307aa9612135972f3708b46111294346a9e549ad3a9aa60e576
TLSH
T123E026F465C9C73D600C64831369DB1DCFF47E1BABC23F8A570898C5AA42590B2E79A0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0e19ad6db2f73e1ef9ba5821c4a0fbfdeaedc42e5a7f3f6518d50c24f200e259
MD5 d8ef92c760ff3dbf5c51d0cae1838b0a
SHA1 6ad6cfc9f36192c54a567ab7fd9d8218225eb055
SHA512 3fb705ededdf02b2b198f0975b175d5266e958187b6cd6b7399c118fea80f39f004fac58bb578897ef987add4ea6e8bf2c722b3ab66c77c3f7b34e2a52ff8d3c
SSDEEP 48:BPIJKEgU7ydRIxKaEcbnIVK8U4nyzBetRPT:BPqKEg6GRaKaEYn+K8U64BetRPT
TLSH
T11991C00034BF828138BE6649145A84368DD5B2F7386DE9FF3A7891660E9BD018DFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c42cbf64-e7ae-461e-91b3-d5d613180af4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c42cbf64-e7ae-461e-91b3-d5d613180af4.tmp
Size 12KB
SHA256 683713d291c7e91fc586d92bb36944c6e282fa4676a9883ff0ad0b69397440c4
MD5 d92168e5bdc1f4850c7c6a09027a6fe4
SHA1 f335a7820f81434753f1b4d9b3751d5dc0a89385
SHA512 cd2bc0148b8a6ba2bac90cd58b88f8f38bea19e1fb1e40e775af5388f3196e19e76829495452fd8b4c7cdc0eeebe982ae6bf7d19989c2dd6088c95e1690807a6
SSDEEP 192:sxRqRmO0/fSsVWpVVUqmBPzoA8pw/g6+WNIYdMp7g+hIgDVJ:sxRqX0/fSsVWvqHBmw/5Ir5z
TLSH
T15F42C656AD28A97B8CCBE21DFB667F53D2F9503261D21F08A6FC861C14EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5cd7ab4-9ccf-4deb-b78c-232a7dddddc2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c5cd7ab4-9ccf-4deb-b78c-232a7dddddc2.tmp
Size 11KB
SHA256 a7e38445415a089d3a4f65df9f2886a70947954751ccbc4b47211d8723d13cce
MD5 1b4575e6d8a1fff41054e38071c8779c
SHA1 00b770a26e10c69e51010ac7886c055eea482420
SHA512 f107d8aade267454bcf213fef0f8f0818c9ba39d9a24c8cf84a23e7bed60123f3cce68b07549268b6f392072d139ed92ef5157593526ea11773eb92fa6804440
SSDEEP 192:sxRqRaO0/fSsGUqmBPzoA8pi/g6+WNIYdgiG+hIgDTJ:sxRqT0/fSshHBmi/5I+Z
TLSH
T199329556AE28A97B8CCBE20DFB557F53D2F9503261951F08EAFC865C04EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ede990c4-0523-478d-8db2-367dc0073181.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ede990c4-0523-478d-8db2-367dc0073181.tmp
Size 23KB
SHA256 2928907f8a73e295312020a25c5cb309152d623ecc0c8325ca8cf5403bcfb749
MD5 d7a839b763c50864f12de357c041b8c8
SHA1 51be25c5a679fd706a6180a3dcd48c2feeff7f3c
SHA512 c4d53ad809d544723823dde4ad17c59f55e6f78ac07d8469144079cdcb9fc1f65080898a99ed4f9f4f69509133e321ec765af4c7282c2ae111c85f9238bac537
SSDEEP 384:qYe+z1ifCtgUGFf8SKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV269GGRLwroKrA:qF+z1oWgU6f8S8F1+UoAYDCx9Tuqh0Vc
TLSH
T174B2FA2B604DCB7E4FC01A9D9C196FD76DA802CB96588D4047FED94C03C77EAA21A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 184620d14400bf873d172cb5cf1f3033d2e8f0e64cbe933279bbfff3d1df016c
MD5 ca2f917d14d478f03decd7205d9fc5a7
SHA1 662c03fe7bf244f32d12ca3978e9930ac845cd5e
SHA512 4ba9f61d66cc786ef96a4c6b4abaeb9b7f6d55af246143eac9903de76ea0443c10f18d5d0959d0e8ddca95f769364378fa7e6395680bf08a0c89f70ad805e21c
TLSH
T1A1E0D868B9C4C25F71963587036DC34C8BD13913EAC43F491F00D94456461C172875B1
MD5 SHA1 SHA512 TLSH

Submit Download

54a7f076-83f3-4bc1-b4a2-a71d3dcb59f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\54a7f076-83f3-4bc1-b4a2-a71d3dcb59f1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 0704cbd4ef055f21db87def81db8877cbdd946e44f6579e13c60b9b6e4abe14e
MD5 6d01822dc409dc749666a7c430aa8aa1
SHA1 836e3d5f8680f48eb7c7f60809a90899fc82ca8d
SHA512 4d3aac5b307683cee851fdc07945b35c76f2d3adfa47528e9263b1dc317d7295adf0b07e945b3312507968df8256e61db8200222096d82ad642467e5991e37d0
SSDEEP 3:MsEllllkEthXllkl2zEM:/M/xT02z
TLSH
T17B44045F7FC00505C50034304051C350D370D4134511575734D504137CD55750C00444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ad363c45-d34d-46a9-96ea-81a7b3acbe44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ad363c45-d34d-46a9-96ea-81a7b3acbe44.tmp
Size 41KB
SHA256 a4cb1fa8a547ca75319f60d7326107628ddb148ef18b69e40e3537849e0e0adf
MD5 75e0f1ba56f3bc70d915b909bfb04051
SHA1 fb3b2d364d97cdf0e2575bea44ee7501a6ab5bdb
SHA512 6711da05c90d6a8105e01294dd2894e07b8e149df43d054afc65e7fa20997cff8144b2c5b438ffa556267a0b133c4aa5a19ce4c7e2e9f07a48fd3d4e78244d86
SSDEEP 768:SFM93VwgWQOlK3OdWf7D61h3Yogkl5akl8pbHW0AWDbk9gN3DrgvPfa:v93S67D61h3Yog05akl4bHW0AMNNzrgi
TLSH
T1EB139D7D9C649A7F89EEB744660E2216AEF84177D9F59694C3C88B0CC0731ADB70BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b85c7303-b03c-4333-9258-6f13b6f2fbb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b85c7303-b03c-4333-9258-6f13b6f2fbb4.tmp
Size 38KB
SHA256 c1ad568159a992ffe30eaa46a3401fd3f93cd0012396161e9b6259a33fd470b4
MD5 53ced7d0c1927f2f6c738c9b3cab3db3
SHA1 88ef55fb14aae886aea2cf70d08fa26da642b722
SHA512 b9ffb8f73fa25e8379118db03ed0e808e7da6c3620acd21254ead041f00ebc90aeac036c52d2af9c90733e641e7cecf964c119200fbd920a47e02cec2bd5d7b1
SSDEEP 768:p/UxvxjgC+t3eQplK3OdWf7Db1h3Yogkl5akl8pbHW0AWD1M6:cZj3+t3ef7Db1h3Yog05akl4bHW0AEM6
TLSH
T10A03CF35BC68AE7389E6D284760A6317FFF48933A6C95BD845DC9F0D06872AD030B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24a345c7-8b56-4d7f-b07c-d9930583647c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\24a345c7-8b56-4d7f-b07c-d9930583647c.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

66408528-dec6-42e1-a621-d3031a02122d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\66408528-dec6-42e1-a621-d3031a02122d.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

be8fa176-39e4-45bf-a8dc-7636f2d87a8a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\be8fa176-39e4-45bf-a8dc-7636f2d87a8a.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

070af1f3-34ca-4fad-80b6-f3400b930272.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\070af1f3-34ca-4fad-80b6-f3400b930272.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 1007e8b11d806cfebb70039e593d5155c7fb02c335c6d5b48f274617826321a9
MD5 58cfacc31820c61124c89f26553d3453
SHA1 153ff5deea0c0c0e4e987700f4b427c193cdd0df
SHA512 0dd35941d71cd279f375fbd114289832e14e2ca6c770bd1a75bab5457aa93e71c3ff7a7f57b18e702e84f492dce99bbaf7bc01926f8b15a85e889f5d434fc0cb
SSDEEP 384:k1eBaGH1igGW14b4HNrxH+SsgR+5JYcjK/NIAsF41l48WQ+zd7eErbfkwY8hf9:wenVKWiUHNrxH+htW0uIAcCl4QmMIbft
TLSH
T1F8728869616F6DC7D8A122B010D601E7FBE4E48CDF7551D8FE2BCA2B5C90BB74EA0520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 6d530df1ae0ac9c3509455fd2cb8b30fc8be87bce62a1028c13442d2cefe70e4
MD5 d00c219e46ca6bbbea7385947550fd2e
SHA1 797be78d1389ab94951623bdce7a495f51fff32d
SHA512 542c7f5ce5a62d10c4565cd72482cef8652cc13ac5c25e9af95c16a67448287dd7cb87b4e24cffd9901ffc7aabda9298794baa8744e759bb8b2a0bf23b12c0f4
SSDEEP 384:y8mgnT1iBWFGlmLh2SMQ6fEqdAL0WWOEPiUDzdC0AIAC2giNAWXJdOEqBDKpN+I3:6SZ6WwlmL0S36LmgXN6UFC0AIAkiiWXl
TLSH
T17972F82C356B4D87ED6220F400910386FBE8E456EB9291DAFAD7CD2B5C45E799F600F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29da7920-233d-4822-9381-91d435310724.tmp.ico

Path C:\Users\Admin\AppData\Local\Temp\29da7920-233d-4822-9381-91d435310724.tmp.ico
Size 134KB
SHA256 7b243b9bd1bc53a0e80fe5b439111d13a535cb32b8863e1627da6acd298a0a8b
MD5 df74e2a59d6fb109d30076345c846cf7
SHA1 c93d93ee1ec40ec59a2b727afad00bd8f968c674
SHA512 b7f56591c8ee3bdc7e1f072f2ddeed402d3752bfa966c732a2d1ac1ae764a2e94f7b62c4708aa14d514bb16402ec265d8e6518524f8198d90aea2cc37cfbb7ce
SSDEEP 1536:0AW16l4ELs6vu2sGepISKPc752ruqyDtGFo56PAqYOP2zinEOKhNVR8b:0d16l/LFv5ZSt77aksuCqOP2vnNVRC
TLSH
T1E9D33A4AFA11E8DDE26C4835C2A4CD6843317E3DBC2915237CB776B976BBA473856C20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e8d119a-8157-4803-b61c-ad05b4981870.tmp

Path C:\Users\Admin\AppData\Local\Temp\8e8d119a-8157-4803-b61c-ad05b4981870.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91f1e8e7-fb27-455f-954b-bf5cb3999d1b.tmp

Path C:\Users\Admin\AppData\Local\Temp\91f1e8e7-fb27-455f-954b-bf5cb3999d1b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_kjxmpwtb.zac.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kjxmpwtb.zac.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\LICENSES.chromium.html
Size 19.4MB
SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
MD5 f18ed9a25df7c7951cb7f936ca9feeea
SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
TLSH
T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\chrome_100_percent.pak
Size 117KB
SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
MD5 750913d55e87def9108e55728ba67d00
SHA1 a5944bc170d1f6c3223195c043134566471dae1d
SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
TLSH
T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\chrome_200_percent.pak
Size 192KB
SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
MD5 d476c19d21b3c2861f08c1c82fffddcb
SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\dxcompiler.dll
Size 24.4MB
SHA256 42661c340fbe0c08c9b3ace01756775c80e28f372993cc6ffdc779273ccb7ffb
MD5 bf480d8a1ecd8b107f0a9e6c2923cbb7
SHA1 a5671e8b90b1a786ea084efc6807a9cecdd1ad49
SHA512 b7f48e0b461e501cf483d82d09de377d717c6f13ad77ef2ecb2d733bb748198e11fefec5b8ad42774bdc3a4b81f58f7b238222cb75baa12e2a200d334c8a90c6
SSDEEP 196608:WKkG+l2tvb3nmgD131GYN7aPtAH+R4gQiUiV1gFould/5YmO0r:W5G+lkvb3nV1GYIP+H1gQoV1Ioul3Yl
TLSH
T1B3473A122646D49CC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 9f287f1ce0944b0c8477dda83b6eaa6764ea0cd778f719275e51ada47110c8f4
MD5 96e27f3aa481b775d2f547bd72db1145
SHA1 b44cee66aa6daee40a60801f9cf4a9f9d494828c
SHA512 f8edf851534bf0cc07999ce9654f0a96046a19fd6d10046c9172a22a0e9ac58ddc2310b952c01492cae89f4e31cf024ee266af69dc01f4e1a93e272153710502
SSDEEP 49152:Uv3nwJt5w3heAaTPLO6lNU81IQbx6i1N2fgPvA7lPUaLu2JiaoosxpSS:Uy5yfa3O6l5PaLu2hoU
TLSH
T193E59E03F6D251EDD029C03497ABA213F271780A4F205AEF17A05A253F66FD86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\libEGL.dll
Size 467KB
SHA256 99fba8142975f4f3d27087f241dbf42baac94da038a1a479432b5b0a73363db9
MD5 fe3f9683b1551d8f8ff46e00973a7d4f
SHA1 789dea6593f42a5303e7544c95b20e18e6b590ea
SHA512 4b24f7cecd5977930f80b043759bd4ee7586b83ee144d139ae89da0fd2880eed3752a6165f52ff87f20324bd4f65fefddb130db2a88d42c7ee7ed153863c0231
SSDEEP 12288:96/vCrog5QZ9yJNe8DcQir3YB9ANZMBg:96/vCrovjLA94Mm
TLSH
T1E8A48D15B3E948A9E07BC1388A538643EB75B4520B61F6DF02A0D2793F77BE45A7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\libGLESv2.dll
Size 7.6MB
SHA256 b26958a9e2c4f94989dfcdd579ec59b79df8576569b5d5998558f3b82cb9bbbe
MD5 dc309e495de9ad8535c65e94b3ac1172
SHA1 df78bbabd7a7c18d00da63bea8e63e8bf6e0258b
SHA512 c9fb34d47751cc89a806ebb3611fc11d315ca368ffedf8ab0a64ff016b0100b56bf497342b5647a93df9ea2794e00417975bdbee97e91d1ce4ba6755a6416ab7
SSDEEP 49152:FZLjoLYM0JCVIM5OImUoJbmQO+76qJ6AJKibKnTaUueVYAO6a/wBWUx0IXvJ/k8R:HsLYR7J19mO6c8LSmkOSR6hLpsHis
TLSH
T12C867B03F69681D9C05DD2B88B57A223FA74B8450724B6CF2BA447152F6ABF0EB3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\af.pak
Size 605KB
SHA256 d990f4ced39e31a1149d2a1842ce2504706885e6ab05957ee2f338c77d94c16b
MD5 38fc876717fd2811593b8e1f5932685d
SHA1 3dcb3222e420713d6d731ff6bab7783dcd75c16d
SHA512 b98358fbb30f988b67edca4e7d608665ba10ba2b9c3230bee6adc9c040f974464b9e26eb72bf9a45b58d677419d8a2ed7f99d84cc1c22eefe496ec634bfa1c74
SSDEEP 12288:l+Ifrr9xi2tfxgtRGt+TkTnPxxNtEKY+53GmNAn4H2JyneNASgnALzcGfozvhpIX:ZvZtfutRGt+Tk7PxxNtEKY+53pAn4H2b
TLSH
T1EED41B0AEB91173D05B07696FB0945B7FB9CA26CC770B2BADDA982310566DFC10BD0D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\am.pak
Size 983KB
SHA256 8d3d5dfc64acfbb0c35036d74561d09ddf3b22058eeed0f8d26a2e9c0703248e
MD5 ca12f04a04bc27a3a5fe78789091ce51
SHA1 eefa0606bcf3aa65edc124978f731336c60811f9
SHA512 07fca45e2c99ab93eda0346550f083c0e0fc7abc50d9610869ed9f558cec399a0b88434b4d8cb5a838acdec7e8b3e7a2a6c9b1171050293647977b15fdbdf109
SSDEEP 24576:Ueb6TG1orqThTCKHyK6ax0hHfjnNWNT5zaAfX8j5xi8bVdwZtPBE:lI
TLSH
T18425AA547DF9F7570F8E8A1994320E4EA594AE4692803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\ar.pak
Size 1.1MB
SHA256 f629b5aa59869c537ab03c2df0affc5de5c7cc90827bd189bd5e7a40b6ebb338
MD5 2bfb20c3e7c58ba1093c5663e798e3b4
SHA1 cc82ea81852db782d18518055bad2658525398de
SHA512 8e3408a477a4c11d7c8bc4cd5b79e2ca41b96c93a0d7e172f3903c8f1667f0180bb2d11d1cfcacc922c0c5c17554e1a2043e93be49e01d7aa00d93d96c77681c
SSDEEP 12288:Xbjdz92BGop7mFo2GE5Hwjdfg7P3v4Uzbskb2QSVMNj1Eio7DAi:F9ZEv
TLSH
T124357BE21B2984720B56DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\bg.pak
Size 1.1MB
SHA256 2789212aac5f2133ed23c1f84623bc64eb4cfbd93aef7af751d1221e27a21daa
MD5 ea6519b0214acdfe80b9ceb590ea4dce
SHA1 49d14345b6baa6939055d7f50bf0984791481706
SHA512 28a1ddd55b55e792db5a114fd305ec3631579a3e8e5507a629144769bd25c4e2de6ef9e969ddb037f7945330be02e4951a5ba8a27881fc5e413c2a33c436b84f
SSDEEP 24576:0KWulJLYAgCzQkEC2U5Vb6IqSsl373ZWmKf3p2KuUfVDrzQE74uOVnQxRfkn4wxI:0KWulJLYAmFU5Vb6IqSsl373ZWmS3p0g
TLSH
T1863535A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\bn.pak
Size 1.4MB
SHA256 e72b72977b40fb10472fe1a3fcffcda8b434bf52e2bb2da2935faa80da224812
MD5 ae6da45169b7a3fd99da8218c92a1e2b
SHA1 2552cffa1f63012b2fa7ef6209869f3eeae207c7
SHA512 8328e598f9c30636d60547a1d31e909b46ab6f92b3c210274c95886294af7ef20552718a536ee55c0a58d7947d2932061fea8e3113b8b331b4ca084501f51c4b
SSDEEP 3072:Y2M24emMNfpp1pomjwuquXCg/V7hq2XOUU9qygEfK8tRs3F+IBEBbaUqQsjkwgw0:Y2q+Nfcm00yg/V7hJF+IBEBbjwg/H
TLSH
T10165EF209C6E81B6A8C5CDC9434C6370C523AE9B9B65F74DDC17A24538ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\ca.pak
Size 683KB
SHA256 bc72ff7dd7c4286c1abb52da11c4dfdc42c917cdb267004eb2a906201850bca6
MD5 9c41cd6ca7b5423e60b40226e5e7fae6
SHA1 1f070aaa95377fbab2d558d0b3ce47f1999b1b58
SHA512 c1ff06fc4fb156a1dd015552024ba20cabcdbed97fefd23046304daa3e758bf9af3efffaa7b6ad9ac0bf314d49bf83b957b1c836d514dddae8e97351de6d2a72
SSDEEP 12288:R4sPQE4viqMz7hjzlCiG78lpGa8D5PsF4N3Mw2juwwPR9zejm0t3l7C7ThALDq9w:R4sYoQf0LltOZIM0s5JZusQ
TLSH
T1F1E4F8239FC93B7704D2330EFB46C253A48CA9847A16D254F4AE1B1622CCADCD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\cs.pak
Size 709KB
SHA256 8386f70e830a565d0674014ae4ad385a61eb43d7e7b99d4d373d14388dfd32ce
MD5 fd8b34402d5e02dd82babb5a3ec5eb46
SHA1 c191efa261b84f6514227b6c41edceea7930b189
SHA512 2edfb6eb3d647a7f62d2a09cba95d6762691de9c4c73c1ad0817f9b262cee9bc20180745e64a3043a4d399cfa95fd212f2e0dd996ef3f5c212e7296989d0e26c
SSDEEP 6144:mzj1kQPV+WB/p5jDk8EmuVSG15ADF4+AP/uzBYcZ8OlJSBs98Qv:m2QNV/p5jADVz15AD+kzBYcZ8OlJS+
TLSH
T1C6F4391EEEA36425584002487FBE4128BD5EC3140B6EE5AB7CCF9D912579B7E8EF0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\da.pak
Size 637KB
SHA256 ff687bb6dc79bb638bca4f6a9226544a783209645922d323cf777b169690b25a
MD5 3402cf97870da2b1aec77fa74062f874
SHA1 758610d4624471ac55e9f4ac59abb07ad60fb309
SHA512 dc2bc7b982cde34e0678021a00ee92d4c21b7c91c64a33c0118f74d40eecaaf7ce5418c6986c78b4af88138cdd2949c006acf20ce7b2530a7d3747bb782d98bb
SSDEEP 6144:GXjE15yr09M10AETh/OQzVY2/QD5Qn+XgRVBaFLxE/ene2wlzqJwZBIEbPKaSpuG:GXI+rAMG+FXeRIAAmjfsPP
TLSH
T153D44A4BDC9CB32F89A94725F311CDA7DB6D443CC684264F65D8953A09CFCA092BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\de.pak
Size 684KB
SHA256 19d27a3d2e2f1f43e9a3f1d31e62239b413041fa6abecaa9d6d2c7aa874635fd
MD5 ef2b8eb257ab26f6eb9bdd2d96a73f38
SHA1 76ce40b27901d434ac7dc1ce2f0e77b9886099b5
SHA512 777dd91b1f857ee76e16df0e3fca41268cc7461802c6de44152a230a644321304f94c25b99f6017dba26684fd6e7ed857c46945af568bd88c096f39bcbca5494
SSDEEP 6144:hg5ggW1t4xJEe4oT3K7UpV0/b8g1aXCWQwa4edK+59/KjjeVDxe6+lAnf3UoZMRi:8281T3K7UpVdg1aP3s9/KVLePU6ApCgW
TLSH
T1CCE40803ADDB625EC786B3617705CDB77B19E36BC346322B84DDD02B654B5B283AC422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\el.pak
Size 1.2MB
SHA256 3ee2e46a5a569e411ccf9d77ee4f356e1833bfccbaefcc5e71b7c1517206ab5f
MD5 b5b01fbf52e566a2042c2bf019a6fa1c
SHA1 d6764bc102d1819f48724be1d14e1f6d547d2724
SHA512 35c4d5668f9f5a1ccb25df0f36cefa9c3f3b134a0af4b9b460af5b073eb1257b131a272505b0f2823d9b0a4c21cd8ce76128fa6ec088de539980499d941c9f95
SSDEEP 24576:NRzn7HWFbrlE5Yp9Ck2twZuwxJXDsSSEumUaR67ex2MSPgL00O5B/FCyjlHvAdQ/:bfHWFbrlE5Yp9Ck2twZuwxJXDsSSEumu
TLSH
T12245CFEFB4582DED8046950785D8B07C2BC66D6CE749CBD86229CB60BDFC0719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\en-GB.pak
Size 552KB
SHA256 aac3b4904d021d58d053bdea2d8056a219ecda1e341d87cb70070aea2cee418f
MD5 121461689d08e6e0d1e0ad4e6c695f7e
SHA1 113ec35be3b54ebf9e2b064181475bb82dda2670
SHA512 69b0d1d401aafd2fac6ed86f3c51de4889ebda123c6cfbe6267e83cd9271dccf7db2627cfaf31bf5713efad48845662763106ef26da09803a1580fa04c7416c5
SSDEEP 6144:D1Zf+l9GJBIvNBlxIxhb5E43FzcieMaMP9zQ49lfaYHEJjXCYDcBcnR7K:D1ZfqsJavNBPIxhbQvMNQ49UhDc
TLSH
T13AC43D1FF784126A05A311A2BB0AA5A2FF23D07CB35112667CBD811C33B676583777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\en-US.pak
Size 558KB
SHA256 bce3ec06227dba2273c4ff12482cba37b709cc8bf5fd29c4380f9a07b92bf821
MD5 6249e6f03590c631a2a873b3e79058d4
SHA1 b82396e2d4ddcb822254dc999c378642614e7f13
SHA512 3352f438f691067fcdd1cc331cac28130e464d0d9411971ecf7bf8c2d30d32e67cd9a65a71a48dc72f60eaee295dacc9055166dff0bef1f79e0ad4bbb2d0f3e2
SSDEEP 6144:JI1Ecs6drHfBLOFcGfIKUMP99Q8HUfaYQypqs5GjWngK8/uYwj:J2G6drHfBVZMTQ8HSkjZwj
TLSH
T157C44D1FF744112A06A352A2BF0995A2FF32D06DA35112563CBD812C3376B6683B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\es-419.pak
Size 674KB
SHA256 3beaef48bc776d3ebcfb867786fc47f78af2dfd6503f460094db5183666ce34e
MD5 2de214419bd7d75a54d7c4d53b2b5816
SHA1 24be574b50ff8c5fa55019f9ff3a2b9cd48b12af
SHA512 d51419c4deaafd9a948c4a8a0be82e154ef5da2e12bf19da9442a99ec825ed3b6a59ba93605cef6fd0fb3de8f5f9626d771328683cff61cc83e4f89144bc7878
SSDEEP 6144:by/lPx7jO15hgStbdXisoO5yMYMgsoZNcNTkJkH5A4UnNyz7:bOl69tBXXwBmkJMApU7
TLSH
T197E40826BAC81F6310E3A348B743D753E4D89545B408D29BE8EB876522CCF8CC967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\es.pak
Size 670KB
SHA256 669099cdff7ace75d40fa7b2fcb731b9fa3946d7939cae5dc6d751cdc88519e4
MD5 db71b60a3daebcda75035e4158618253
SHA1 146c97db3081e41cf8930c622aba97862ea5b090
SHA512 5719b9419018f93a6b783493c6e9d1e0eb2fe8cb7b9ab573796ddfc1582a4103a546f74aeed04332d41d3a3e865d64d87ec849fc081b6339bb9c80a5bc6cc161
SSDEEP 6144:Cy7XAQQj1VPRuogNBM+7p4naYwFd8jw9MOJRev+JETiZ6PZC+t:CAQXRu9HGaYEd8jqxJkveyitg
TLSH
T1ADE4E726AACC0F6350E39349F743D753E8D49549B408D29BE8EB866621CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\et.pak
Size 612KB
SHA256 ecc838878412cc9f28dda9efed2fc60b67315f5fdf64e912db33cee7571a5939
MD5 0485794b4810c277d1215c5fc9a69e3d
SHA1 c0e9b7feb062df79ec3a1c94115efa36bc14c72f
SHA512 c694c4d2badb1c22638e7ca652ba4d801b1cf1b9f63c3f492b651c2a41c03e5c6a2e41310d129f70dbf7278fc4b6b68227e5882b86ad9fab8c8cc31f5e21dd0f
SSDEEP 6144:STM5NSzkgUaqY93DL+cfFnyN0GnFajtRvfZdkUmPOTQyXgXmjVOlvuCCn1qyzXiu:STMOzVUN8jfF8nFajtXOl2CC1qwP
TLSH
T170D44C42A27D771B182412F9E737E923DC9ED3D8B4000D9668974A1971EEFCC38B6B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\fa.pak
Size 1013KB
SHA256 fc3aef3ee191597095362ef4d40253de1bee120779f4b4e088ab974f90cddabb
MD5 02590b8fee8516816cbf343865c6293b
SHA1 c2e33f11ef11ee6f6c47431ab00b24d96e16d481
SHA512 268b06256b6f12be958f8f3154b9605ad0835058348034dbd553712deeae8e7aeca44a97e4e8b8a36c7c5c511485fa66f75b7768223d15130ad58232c5f0c59d
SSDEEP 24576:T3Pn8u313uyqoz+sn2isRmXnloTUoXtCfGk62Yhk826JfikW0MX4dOqlUrHkI02g:bPs
TLSH
T15D25B1957AAC9AB15747CA0341E33834C773AF12D349FE40ACA1076609A5B139F5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\fi.pak
Size 623KB
SHA256 18d904efd7d15a49ef3638c45a40b3aa604e5ec4b68e017ab3f568e6a8202fd4
MD5 3d5e89e58a263b94ac4f49e4e8c76adf
SHA1 1d4d5c23c74c7e98ad49aea4ff1e67424afe6245
SHA512 10a1b6134dcf59d01781e59f7733aa45d3c24e76182f1da6d25921a98600571be1a3b904430dc64707b6bcfd43238929be8df37576c86df10bbcb35dac5672f7
SSDEEP 6144:8c+vwr1RbX48u19cj80ar6NmSFrGkAgoFRjPVOEmHbeaq5pLx7wvpVv7IJprWaTK:AvObX4x19C1a8GtaRvpVDIJprWa/gL/
TLSH
T138D45D915215C32237C4D29E7DB0903AF5E5E3DC8C284D9AE843C7D849EE9887DB276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\fil.pak
Size 706KB
SHA256 4034bd7ef11f48d7d646aacb7006562f0f9caec888785a13c36e31b9724dd798
MD5 ffef924fde59f90f783517b96f700a48
SHA1 51be8b9ee59c13bd091105bc075c141a11e45a16
SHA512 fa32dd493d819bce89e1a02dca48f202e0e4b1bcc3470ea8071d1c242983bf6b8805a64acf588723f0e49fbdaf38cde322e6003e190fe2bd80bbe91ae168bf57
SSDEEP 6144:kBp5PvYzZfRuh6uNW9cqiKb8yzDQjGXa+Ea3o/VzV8H68v6/C2oVHA11EW:GpJvYzZUfNW9BnvG
TLSH
T103F4C616B7401748DBC352E56260682F6AE560B83F81786E0FFF268B7BE7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\fr.pak
Size 728KB
SHA256 5c2ec8e30476184d5366427784646b4e35954dbf3490fe9b50fe84642e34f32d
MD5 be4c0c66e81ae1f489c93c4c6df8fb95
SHA1 ae2f33a6541ac39c85d909cbe213b117c4463f15
SHA512 759fcdc629cb0c4f47af470bfac80b45589fd3a618cf4ece685fa45a40432bbdaf72fd562b475512c6466ba06da695886d6c8337d9e7a9447b4bda96871c0b8c
SSDEEP 12288:UfUQCNZLkW94S+bvZZiuK6QuargVCcm8N+bezEh0y4VoZuYnYw8jw2wW3S1X4Ogv:aUsvDVeLmh
TLSH
T15FF4F75FBEC431CB19C60267FB12D6A3DD348248F215E344D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\gu.pak
Size 1.4MB
SHA256 b207f2046791aa8150015ca78f9f76f2f6509953a00c5e89b155bb40e3a26474
MD5 7daaf6a5370eb04dd0e1d1df08d35f15
SHA1 d861655e79aa6165e9101d7de18f940b5f9ae976
SHA512 051dfe0a1ca3c09dce67456d75bf595dc36d1ebcba5f5003a1effdfb679531cd29593ebe524612c54104bba0e8f442e3588da966f74ac1655cb3fbeae501c18f
SSDEEP 3072:KD8i2t5BaX1eq0o5KPjAwREJKVMjNiT7llj63rAulfcSi5NnWsWi+/GQoynAzl/q:M8DmFT15STsPffC+1KsP9
TLSH
T1BB6508D0D7B9F07019DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\he.pak
Size 887KB
SHA256 33c380725d0ab1a858c594fff41a2363cb2a0ad3bc0ed7209aacdfd7a60c7c60
MD5 5ef51e044f26108fc57f9a98c54aef8e
SHA1 1ef88df97d3c89035d7503355aec229248ebae5a
SHA512 1a270d5e545e5e85db116bbbae240c000970b1e684eefed061d7c51ec5cf8d2b8f6c2e349486a453113a937da2c69ba920b982c987dfa2025da81b08c795f013
SSDEEP 12288:lo+tHxhMPBBAoyTmXdUulrYyIQDAlCWq+/8mrguckANXkxeQCaj6Tyi6jcAf5OOa:lo+t864
TLSH
T19C1599C4B2E492255131AAC39FA4FA285FF3CAB53CA27512CB14526CAD774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\hi.pak
Size 1.5MB
SHA256 6e58e12bfc69547d03d61f23445bc996e1b09ed5e8599b00f553bf8d022a08b5
MD5 a92068a3af1464a4b02fd50f8a8e949e
SHA1 908e45081c10142a0486be6e5adc6991a2d4eace
SHA512 bf6413010c40ba838e494bfb86a4c23ffc6b9bb9e8a0b04bb00ef7d82a8262cb98cca3874e9012905243f3d1cae37232bf8705550d873b50f88997624d66a617
SSDEEP 3072:uAFAoSJLHQ8ZyjAHl556oN8cH1JEtPV/B90ZV1dWuGlqv3oJEdtDVejnPs4f4/B9:jF1SBHQ8wjAHlr88J+ja4RldbPk
TLSH
T1CF75F40CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\hr.pak
Size 682KB
SHA256 6990ba056fcd1cac97ed5b48024be4ab366846a9c517d43a181cbb0eefa095d1
MD5 18123099716cba1fffbacee72dfc1315
SHA1 67fae0cd4739e964b59460aa1c4d8b2e6cd9d707
SHA512 ee2f3f6d54def03a8562f4b944b341d2b7e5d98a6598e05aa6009c810003f92fb1d0d9539a6f078d70a0a985e3d41958824a3d8e27ebb2b67491f0b8c36ee355
SSDEEP 6144:7hS9VbVbml6edNJgUVaT5ja46TzKzbayoE6pOWOYwhdbYu:FS9Vb4IevPVoadJJnOpku
TLSH
T12DE43B7DBEF3570A0897B24AEFAA43447DBE08DCE56597B7684F522E0003F4C6AB4149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\hu.pak
Size 729KB
SHA256 b83fc60c6d3ce3a04338ea16ba4627d6dfdf81f4373fe4921ac01c7c9558bcb6
MD5 9b7c0f6446817764f33fee01e82db019
SHA1 40061f4276cdde875303b709fe783c2d52e2a60f
SHA512 ea1ca65c71b5a216865cebb7cfd82774f0f8184a09dc0943321c9d5d44d94ca8858e99c11ff66c58cf35f943ac75ce82b917594ab21f53e1049b26a047bf42db
SSDEEP 6144:dzgVHf66Wfsxn/3BLk5dnTpJ7yHlEx+XlH2sSaa0zA4ttAuSU5TT78bZ49JxTYhW:dcHjKsx/3ykJA9U5T38e7rROyr
TLSH
T144F44BB793B6944ABC6C178778643F55592E481BAB2B31FB2883846D34A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\id.pak
Size 603KB
SHA256 a6ccb8c77ecd0db5c9d8d3b809937e627fffb136737ffeba65a9c09e6469a243
MD5 dcbf88b94b3a13d9c6ff165f55d61a61
SHA1 16e08e3e951321229a492ce6665ebbd10d2eb9f7
SHA512 9c538a1246c0b57d6df4668f36d068c696d81123069ce9adf9c1167a35a53d9df332a77721143e745f1639f65c3ef691e9b1942e9b94886862db03b009934662
SSDEEP 6144:4wzPkpLIRUmd2k5b5OZhCNBL71y7W30ffpTFjlFKzmBHCY26kkC68jWOBZFm2iTP:UpLYb5FBLEiQTFjlFCmpCP685vC
TLSH
T1D1D4E7632ECD310C094842D5F2DEA91E7CCE233BAF05B76E8E348F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\it.pak
Size 660KB
SHA256 35a28c5136ba21b8d42a3c792f1571b2d0fb466392104f35e821f101e5696f37
MD5 9dcf6d7d9f3461e6e1f2871c632dc104
SHA1 fd574973768f0bfce5ea743a3de1acd52ccd5487
SHA512 11c7091f04281a661a741aeb6691b5874fc25da8d4a3a7d89c1b174e40f5cd5b22fe4ebd570c3e4e5041ca52ac92a82df96f1eba48ca712d5d23a627e859d76d
SSDEEP 6144:tI4qdaboXcyh3J3ikJd52N5zVX2qlSfqBCfEs61ltM/whOea1xIkYMcrFqpzSj93:e3da2cyYGu8d0gzP1nJGlNp3
TLSH
T127E41C3AA5DA252519876359E611F085FB6EFCCCFA41721CC99B131C22CFE80E1ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\ja.pak
Size 804KB
SHA256 ba5b0b157956274ed1b8e1af1d858ca9862d59ce3ba5b833f54a613697153825
MD5 71ee525dc05162ad20fd35b2a3dcebf0
SHA1 8b9104bbe4852fc9f9098a7d01d9e8fddd5b720e
SHA512 d4364641d8e05741cf81adf941954a95592e955f2e22de5e2526bcb3b9041c5502092e5b38f5853cb774ebd476dbe9c35859890b21c11d31e4b3f5d45aa76b32
SSDEEP 6144:Dqs4O2N3leWF84EQH1oZJMxkZrQ2TMaDeCbRACGVHhsV9:m5lHtH1tkZrQ2TMqeidGVHQ
TLSH
T1C105307CE3C569369D6153A22C4E36E17506AC9BFCA23A3A443DC074BD70BCEE415AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\kn.pak
Size 1.6MB
SHA256 d154c50013245a268ba9b4b49639516ab0593922d893bdd551e4aa30ee6a3e2f
MD5 05078d08dbd65e9bc4e27a903ddd6462
SHA1 3ba2c33a01ed59102ca3cfc7d5655ea693d48bb3
SHA512 158017227b71a8701de418a0e02896a339b61c4a9416248c6684549068df241c0487ffbae170c3d5181b38b0a074c1e0eb2bbb2e4a784f53ea242d617c44b3be
SSDEEP 12288:12bz3zDwQNSWJjQgY2BQvwT7N7zSyMW4QHyGEV:udMl
TLSH
T15075CD18ADBA7D301BD5106B24EC643ECFF16BE29CA907C2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\ko.pak
Size 684KB
SHA256 8a899f9df64736f4f8b295361bcb95f501835350b9320c2396e1d6f03cde5ee8
MD5 b824bdbb456bb1c25db280e927751761
SHA1 2c77d102db32e5ce2c59b4edae5e7d4ef9a0ec9f
SHA512 7c218c980eb6e3fdeb04b391c2e06f821b4a8745057675f542f1a62f19d7bbc61f2b96977b395c54fd8120c401231d87584c087477a0b4f5432745604e4af87d
SSDEEP 12288:U+/9QDguTbckmM1WNiPszcbifYj4ZGRyzDRIE1zHFQgC0lIJ/xESJGRG1KLhw1Lp:U+/WWIQC83yyOt
TLSH
T189E4A5F23CDF63C91193CD82AAF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\lt.pak
Size 742KB
SHA256 0c755ce72d1b71e77d58ab014228458d8ce2b0c51a9b00769635c6609255c9f2
MD5 1cf07cb33fe89bc96f45994a0ad98a62
SHA1 b8a9c25eb8fcf9f606f851b61a3e97cb2bc0524d
SHA512 2d9382136b3444b8130317ac658c04ab275a20d0e684420709840029c3c50ef69ffe19e51f6ada312439d7d2fb4a8c8d127e0202987d55612e7923ab323dcdcc
SSDEEP 12288:GXBwFUg40MQ/u3qhD78baD0dRyN7UJiuoE6SSH:GXWrMkbKQ6J3oV
TLSH
T1ECF42C0069E3AEFB9A4467C981A4CA78DEFD50009727BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\lv.pak
Size 739KB
SHA256 911f922f6ab11d04c4913b04088619276994104979b2c5f132182953fabc24a9
MD5 797904d9b8cc446bfdc8823f8efd249d
SHA1 178b5ae7a875e50646cee8a9c34be60bf68f3ade
SHA512 854a126b5a7dc48513729d476c540608d557de3049868b2329e507451beb9a73d38a68a2517a41d9a85f2b1970087630b334323bb307af1a58d49052972f920d
SSDEEP 12288:HjFJa4VAWdx/N5g/1qrcxm29c4TloHD+oB:DFJa4VAWdx/N5g/1ucxm29clHCoB
TLSH
T132F43A959EC68FAA4D914DCA733AD133A8CCD700FE07E112DD798B3A550F52822B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\ml.pak
Size 1.6MB
SHA256 8beb5df27b5a1b88d0f441518a807b2c6acd99a81820cd0249710ea12bc179d0
MD5 1ee0b429a68d70f8e14d90fd5fb740f1
SHA1 704642c287bd4cbcaf472923062fe06c26a8b489
SHA512 c3961d0b06e8ac84b9d4c1a943b03049ae59f58028e0dfd99ac9e7b7b7735673c5ad936759f14dd218ba924f27170bae2093c602082ebd0f2eaf1e45a4293ce1
SSDEEP 24576:kQm/CzR/oZAuuxyYl+9y9XBkx/9tYFrKfijHeBRJzXtK+v2/idf3AaIH3F3u:PMp
TLSH
T102859D5BA036CD3B0FD102167B4E2FABCD5B9FD140AF668B5869B2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\mr.pak
Size 1.4MB
SHA256 1971da05e4868841c9d9f78be5e17ab09178af99b86a6c07df385015a0c9d9ef
MD5 626fbf6ed8eca2fa44e52ae9cfc8b856
SHA1 c4b8fb73e8dd22f1adc75a609fa15b917e98a049
SHA512 83534bcd0014c7431599e49da7f1c18fbdf4176085bc170c78acf31965fe375dcd1a0d2814d4374cd7509a4bd5c07859e811262bd637ef341ba822aa8a3887f6
SSDEEP 6144:VIU8ZtwrTSAld7dSCyiWUIsN00UH5rCS0mOygEb:ewrWS5TGXH5rCS0m/gEb
TLSH
T1C565D24DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\ms.pak
Size 636KB
SHA256 b60c552a9ced5d0e1f4ed408f65a04068acad7d80db7cf88528fbebbcd337e23
MD5 a31481e751f6bb180968b2381d793d05
SHA1 a8b197bfe937469497c53e7df3796d11111b6024
SHA512 5793f68de93a896b689fb52ea82e2102c7d89550236dd108758745d22e68db055c577634dc41f1e2cf80bf4954d4167a84607dd282daf98210882a996685044f
SSDEEP 6144:njqCnjw23rq9CrUOP1dXvkSLxEHuqwa528WN3wcDiGPUlw+CV9hD:njq6jwQUGX4HuqwaSZKlwp
TLSH
T113D4B5579EDE3118085843D9D2DEA91B3CDD3332B705AF2B4DA08FB0166E7A53316B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\nb.pak
Size 608KB
SHA256 cb50908b03c77263297e63ff75d4d3c58fb0cb491c69a8964239e787c762f52d
MD5 d1ee1aee9d6944eb8ed7a658333cc91e
SHA1 1faad08736d478e7d25a144dc906147781e6de5e
SHA512 66d6741740d59d442fadd734ec4285cdb15c6559b448bad513bd9aa08062487acaa36cc0c88c289d37e64c89ffa05cedaa70f4473046b20bd6d3f850e5fc0c09
SSDEEP 12288:4FzGCp19tcd2Ql+hB/Op7fmPYiGkJcKb8B0Uim2r33:4FhX9tcWhn3GkJcq8B/gr
TLSH
T1C4D40883EE46B72EF6A44394F519865B9B7D942CCE98199B54C8C23E0CC7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\nl.pak
Size 634KB
SHA256 b6a6cecceeb0097d5fd9628c684d53339f7871948655740e0f625bfedbf526ae
MD5 712c3de8c9c0f50e580ac82074d7ee76
SHA1 9c69e08019dc195037c0d83fa0b21c8e6227a5df
SHA512 011b60ec55581ee7cf7f20715d31c46e923462fa6604e9c13c6b0920e986a54b6b262fc7c09b454791dcb96ad9c0cd27a12103659465c8ce040af17724c1c5cb
SSDEEP 12288:EUodlCCMZnLplbJWQuseUBW/gISKdaFFygn9qHgG48J:8QtlbJWQuseU+SKdavyg9qHgG4U
TLSH
T1B9D4F917AC8E253E59C0A349FA098FBBBF2E832CC26CE67D94DDD5340443F6851AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\pl.pak
Size 708KB
SHA256 dee5b710ca72425cd4d1236ce260f8d68b41bfdfceaeb2f98c8e89217b24208f
MD5 7a5ab308647d031a3cfa1311dfaa3ad3
SHA1 b7893bcb9951b554234f9b3fb60441617aae3661
SHA512 a5a25d3971f16ac49a20d8506a0a05de7253308cd5befdddfa232d9bbae9b5356e5c5ee02b69ce740440ab332c55f1b99c33bf327882e6b84377f294dfc7d673
SSDEEP 12288:cOQ2r1eDw9OjK4mZefQfuzSJabZ2bn6jP6CUdwe3m+UwDMSmG1Qh8PNRNGoliJSd:XJ5hwmX62DM81Qhnm
TLSH
T189F45B0E56E98A4E8CA008E6F6E70B7CBCDDC818F108D35FE45F4526719B19EC9BD584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\pt-BR.pak
Size 664KB
SHA256 4993d091892f4aecc9eab20bb78962f0a69c44bbea36bb5d8a65b036391cf56e
MD5 3832ea5a8292d97e62e4761aedc90f8d
SHA1 63cdf03381e55930e74fe673985ce4574d83303e
SHA512 1471c4b1c21ffa0376d2bdc40f29b5381f983e059fb43b24a711e166bb3c504539aaf770417cbafc19692359003b5490352ce2c89524bc7537018d72870a1af8
SSDEEP 6144:1Mz1t10Vz3HBaYuhvNBXBLPwVofzyFE5EVL0oNtsRGU1pV:WR0ZBaAoVEvDsR11n
TLSH
T181E42B2E6ECA136614226350B74EEB43E5890645FE06CA87DCEF4F05A3DDE40D933BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\pt-PT.pak
Size 668KB
SHA256 266e49a497c6bf9e48502c7eb01aea1fa90260b6fb1609165ff50307a3d81b59
MD5 70557f8ad0981e4545ada8988c6053af
SHA1 43569e4fff4f1ec4f23e3592ab299c474ef40289
SHA512 e8df0f34431dc4fc4c0610208e93ab63c13d70e9bdd7c9153a63268a68b0d3c1d1043c7951ab6c4b007901022b695d8ea48321d5c0dd0e66a63e6b718400c24d
SSDEEP 6144:bqTin/hF2VNusBieJVJJxhTIjPNsWfwgYnbioBcSRhI:byi/72unYnbDcSRq
TLSH
T1B1E4192D6EDA132605135341770ADB03EAC85695F80ACB87C9EF0B4272CDF94D6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\ro.pak
Size 693KB
SHA256 16b11fb73ea0c5d0336de453d3e2abd2de69b3e6c66dcd72bae318666525bb18
MD5 9b2ffd81518422f5377295885d980161
SHA1 23e2177172bb965b5faf4e4667ef000d5a60051f
SHA512 2426e87b53dd8c4d26d34aa4ff685449edbb2547c1f1ccb17e4ebb53e4372896748ec05bb89ccd7880cece4e176467b3e2c18c53694e93ee2e99e96a7ebd9525
SSDEEP 6144:1e0qK3JQ0EghDYnnfwT9o0PBciVgzD+NrF1tcAGLtOVmdO547HW2wsQo/Mr/j:1erKOVDnngo0PBhgD+VB3mw5OWsd/uj
TLSH
T1BFE42C23A1C41A972E5152B2F73924D3E88E105DF641E2CDA4EEC97910CDDDB852EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\ru.pak
Size 1.1MB
SHA256 7ad5e7c2c2491e8ec74a55dc0a4b453fc7525208f58a8eec03fbcca27c436bba
MD5 200bc8c10bccb6b86cf1d90570dc9aff
SHA1 e20f4498a724f15e0bdc2399cedd300f53609942
SHA512 2b6ed0bfe0434751d0d797f223d2f5931ea207d74c4ea594318f1c43e160ef3c503a986244e2d90eddc42a6d664fa63c80d42a56abdc82d6632285df99a2932b
SSDEEP 12288:x7tFjrSfQeRo4Yegsp2zJ9sF+oa+UlZHO6HzW/ZqSv4sqCz6kE0LR3Q8Nirh2YH5:xxF338oBB
TLSH
T1BD458760669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35219A42D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\sk.pak
Size 720KB
SHA256 8c14d528efad4c75e09ce70719b0b3d1162954b4de4013112e014e2ac6a84d3d
MD5 729a2d39f83ad855dc5c57c00bd9b72a
SHA1 091f1e778ad60f70d3ef91b572feb36c561d1571
SHA512 032a14be8980feda7b7957f7a6167af6126c7a2b28b233eb2862ff38867df3a9f342721867d589cf7f9f525c8b7d4c45dfbd51d424284a6431fe7e00bde9b23f
SSDEEP 12288:HqSr8kmKWjowk74V2AI9+bi3NWTnjzYIng9pTjsxt9we:tdLN4VG+fYzktae
TLSH
T1FAF44D3FDFE7181E8E8D0148EFE57110FDBE8650864EB0A6944E374724E26ED8AB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\sl.pak
Size 690KB
SHA256 1550f8df161a3484a6c7af9bc5321fae524e10d6853467afcb8749054a73e601
MD5 f9983e0770e42bd3c3efd4731795efa1
SHA1 62423b22e235b64f4c0a543aa89e122437249605
SHA512 269d4877cf58ae67e713acb40acd58e98349832e8f036e2d4cce42598b52cff013eef0019fa19e65ce4e23e7478ccca77944410cc71764b3fc80518211d0b1e9
SSDEEP 12288:slQdT2FT8cB2BynElanWHDoiNi/fzoDKql/af:9duTNElaWHDhi/fzoDq
TLSH
T10DE42B397EA74E0F0C9AA2CFFEA606007FDC044CD256E6A1EC4F336A5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\sr.pak
Size 1.0MB
SHA256 a76930f2c72e49dc3a2c9be7e7bce0f9da0c93de03b6e275521fa86da0d2d39c
MD5 a44e04518c70dff31799dd47379bba04
SHA1 8c4830e17cf5d7d33d5296e030c2ca4eedf274ed
SHA512 09b0193ab1c803bf2e66a998079728bb17d4daa1cd7b0a8197dff35cf59bb4d415c697dd836347c9a32ca3b16d2f37b66770c4474ae84d9a5167f9f58c74ac14
SSDEEP 12288:vwnK1PVzj34noZMFI83SS0dR3Ckdi4B/J1rpb6hKPCHxYX037XKue9/k/z:3pZjY7aC+a
TLSH
T1933556A19B9E64DB0501F41BD808BE493DAF41FE3FAB975211601DBD34E10B847BA39E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\sv.pak
Size 615KB
SHA256 b101225f190ed1f1738059283058703afb7eb2e0fb245dd076f919d993427b04
MD5 3cbf6535f2427183553a9fd56f665f45
SHA1 e36d51088c6f3c1b2bf2bafdfdfa5e182783926a
SHA512 733fae171edebc81531e1f85a454fa724a4d434a01d5e8c52fcc6fe009d5ee80a43b64ada5420fe83392d577e71671f2082281a896f7de03d85dc603e7ceac69
SSDEEP 6144:x8AxMqKJxiS/ZQ8lUJIcpjwdux+xzL8lGswiLOVRFcz5RtGmqeqMWkSMXtSOT0Kp:CAKqY/q6cxyAipg9
TLSH
T1D8D41B038A20F526FBB2530DB609115B0AEDE25CE7F2954E78D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\sw.pak
Size 651KB
SHA256 f4e0e2f5b49d9d767884074cc3ee8d0dd83a986f7c1d2de236885998d7a53460
MD5 c45ae1d02bba66df5e1720faa9b062e6
SHA1 0281a51663763ca1a5622a4d0e15dc361b04c80b
SHA512 abfb709e1229208f68e723448b9766bbb2aca6f0d21df9effa6cb6198a00f546475fb59d760e1a634543a085c1e3e02b8b26c3162dbedf1e87fe83b9daab57fb
SSDEEP 12288:/+4khPft7byxGH2qDOKd9zGI/d5NmedqNGjRdpiayX1jt3hFinSLThYFaKI3z9iJ:/WPfNBFYi281
TLSH
T111E4D6628C71D1195232618603DDFF332BDCED5C693B29935A46BF0F218F88C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\ta.pak
Size 1.6MB
SHA256 2c5f8aaf21c9a035f71d763cfa9a20886892fcde7cf71878168a9df0faa6d417
MD5 db51dae96bd76c432ed4c0328bae8378
SHA1 93ca9f691f6949015c3cf8983d5df0c93dd173a6
SHA512 359e9c9da19a15320c37523aa6c4b5f1ffb03f62ac56e1f9bfb5c26dc0b7cc2bed32f55bbdb0c776281bb77cd07bbe1c500be0cac08c69d9344ce536747ef936
SSDEEP 6144:i0JoYKj15Y0ykwuiGP2wqdtRAwtm1vYpiMyx:ZmY01aaiGXqPtm1vYpiMyx
TLSH
T11C850CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\te.pak
Size 1.5MB
SHA256 e9e85c763b92b5a98e74290c3ff07e7953269ab6228a4cc343745229819d7f8f
MD5 827e945321a758570fc55c9ef1576db8
SHA1 86e3214190e55c2902c77a7fd49d903154ca1dc5
SHA512 ee2c24d1dba914261dcece37cbfe03897d2ab44511f081ceb850197c985d0df7a0cfe1f0630dd5d345c72f4abeccd1bc96ff4bb7adbe4060c5de914fdd70763a
SSDEEP 12288:7z7MZKN/ywG6USF602/LDgIC8ymoQRT5qbDM52CMYRWOB6ym3p1FW1OhEaC/ly29:7tXscRq
TLSH
T1407592023A6AD310DBE60273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\th.pak
Size 1.3MB
SHA256 fa33c671ef03a11f1069cfb389df5c8f311daf145f7359ee78758c3a0709b209
MD5 e6f0bedeb524f56b79799df543693246
SHA1 c262dac2bbed4c6ebae79a71096fe4f725502f1b
SHA512 bec94d24ed790db2b7ade098604762d82cd711a8b6da3ba66af54880d45ecd1e05c533c060c9bf4e1e207fec72b5ff3340db8d20aa9c6eca9f7a169795b4585e
SSDEEP 12288:OTlu6kvYN9LyZYAhzYL6Lys6o6hCQskJUseOPsO5eXwpbDFDS6Sud2mKHlojghvS:O3CsR
TLSH
T10A554CB37247DDD479441B5B262A7789672DAE693F73F8E000C9215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\tr.pak
Size 663KB
SHA256 b45fc423de628212dc8c8112641567fe050c7274eae82291b39e8209085b6b09
MD5 f6da896716744cbe51ef21652559f2e4
SHA1 9cb6cbd1830b3b1f316009b25338dc40a26bcda5
SHA512 13073605c6f46b6bb1f94449096c1aebd226edaed02a58d143d4d5d5b6215f22a5854a0d252332f27b20f3d80498f87d7d576028c659c4ec25908feb77c4937c
SSDEEP 12288:nS/92w49o1gVCk6Hz6sgwhqfZF4MwsN9epd4+R:nS4wx9QN9q4+R
TLSH
T195E4EA8178EF282C8BB9278BD6E94666F8DF0766B331F4469B168636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\uk.pak
Size 1.1MB
SHA256 39e272f1acb9c0b0bc791efa0347b92cb29e20cfbb5ae14f539628f10f45b0f1
MD5 6b422573ebc1769223710a6bd8fedf39
SHA1 0a14ebb6d3091cb3b0e9adc336e088eef87a81af
SHA512 fd7a6c02c62ba7b303f5509e947b761ed3a65af986ab8fe9b6dd5e18cb99074b96cd7bdcb81d486b4dfa909dd790f04c2da3a84880a6682813c584aa867e8eea
SSDEEP 12288:lc7n9OSlH+QKjbCI5wkO16UgBRrsSr+UznS7BNb7eBPSlFXKNnEUA6QzAz8Pi6N2:y79Sv8PG
TLSH
T19E45A9A1AAAD54DF0105F05BE94C7A0D7DA740FE7FA7471625A43DBF28F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\ur.pak
Size 997KB
SHA256 0c1cfa61d9a9be6338b0a160b43ff362a982003053ae5be3b3ec867e78374d7b
MD5 6cf3c36a589dd5dbfc00b19cd96ddae4
SHA1 2f35469dfa15eefcce47f35231b4c19b0ca5beec
SHA512 8eab2e970a05171d3acf514566bd5183155dd6bf59dd26d4a909deec18bd67d4bf9e375c85608233879ca8bcfeca93b5cf7daa8447dd53b151c465b5162b8f3f
SSDEEP 12288:KYuEnE4YoPL8P5yzqtdQeMnyyK32By98qsE8dGZOv5dQYr4KYjwadcJKwUlubcoF:duEnBLGcb
TLSH
T1F82500D2E6B896B35A21D92780D33C34CB735F13D34AF281E96246C54E9A0135F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\vi.pak
Size 789KB
SHA256 3594ddfb89758a3d87d51bf90e676a5dd6107a6becd96c8840df6739cf268af1
MD5 278b92d960d7b13690df141c5f39a3c3
SHA1 6f3200f7260ed32219b07d41cdf98450f9111d9a
SHA512 5aa31895c350d3e1ba85655b4c4223955d4dbddcd957a0aa855caf45e734ff13134372fa0299d852e50ce102e54e424259b8a141b0651e90946fb6b7f09d9c29
SSDEEP 24576:T1P/7+ce5VM0LMuoVbE7KHJlFtiZGfoq1ljP:SotiiT1ljP
TLSH
T1A705855216E1302680AC553EC6CD540D6FCAE42FF7C1CFE56FE429787A221A45F21BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\zh-CN.pak
Size 564KB
SHA256 6e427060d2a08f2dc73de05734c1f235d3a04ef0540914587166138e0f44fda8
MD5 6cf1ed98231fe626c8cdf8f873804a4d
SHA1 cdbe64716e843011f544f78f7006b99d8cc2268a
SHA512 65d535d40c7ea5dad90f93760c6200ff2799dc63f18dfe7795b093765c9ccd6add995749f973c565305b91719810bac837f166392a3d8f04918d949e5aefb177
SSDEEP 6144:+CXLDPQ+4Cm57cDc+qvYnE7MpUcZXo9ddwTQZyRU4YoDMe2ZHtNKEglu:+uS9+qQnBpUcZXoX2Um1YoDMtHPH
TLSH
T1E4C47CA920F9BDEC004650E03729613D7C40764BF627AF35AED248ED1AA6FAD0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\locales\zh-TW.pak
Size 556KB
SHA256 8e831ed21bd21ce3610dc4b658aa337229c83dd6d7cef336923d69779d0365b1
MD5 6b9341f76a06591356648427e4df6f4e
SHA1 964cdc835647034e404c503a2d4b5d833a92fa33
SHA512 cf82a06b17c366f20ae80d828f2477974352a1baafef85014771791723cda71c75432b4c514df7715539ebabd288049bb2576ed97f212c9a5e4627ca7c96c556
SSDEEP 6144:o9uZDCn3n/DAYuVJoOk6a2iuooryf8w7HLD5O9B9aUmzTq:GuwEYlOPaoryEw7HGPH
TLSH
T1A1C46CB618FBDBEF0901F484B7CD512ABC8B382DDE773636FC851C982E7AA5409A1145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\resources.pak
Size 6.6MB
SHA256 5585dc0e39e6efe9ee79979c8d50938633bf72e329848ca79ca07998d4d8c949
MD5 06a4f687b75fbe3c6bbe926545da3a37
SHA1 d55567a6d6f87f0c863d3eb99ae5a0651682fea6
SHA512 7951fafca6402d9510726f67f0683c63edb33ab430f1798e6d42d4fb682f04617ce06c75c817acc6de6f03c84cf7dff1c4667af64686652aa9bd92749f94f0e7
SSDEEP 196608:L4BRzefMlDTz9u4bkriACmZnC3gEL34tVrW:ETSS/zlkrDntEoVrW
TLSH
T1036633D276E2A81FCD80677945448F35599C6F2532D0B1A3889C6219EEACF6C0EC4B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\resources\app-update.yml
Size 126B
SHA256 78890ef39b82d3e9ac91efdf5d9abcddaf2a6c232c9b79af95d0db2258966d4f
MD5 433c82724ee045761541ac260801c8d9
SHA1 1f57c43a559234b915ee2c10087ad0af1f366922
SHA512 a5848490482a8d5374106f3318e0f8599eb96d60667a66e9f7b94d6b8580cdac3b8ac67bb4c377b3627bf3b40e15487a0cb21a9e4891c3fff880bd087fe2d0e3
TLSH
T104B09BE59106C4B142633755144DDF3755C4500555721135E5A90465411F73C5D960C8
MD5 SHA1 SHA512 TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\resources\app.asar
Size 6.3MB
SHA256 e506f5f7544c3a06e7b054512def6ef3140c6d3612376cb27a2200a75a4512f2
MD5 4109a60b3aa780622a67cf0d7499182b
SHA1 65fab8de95a7a9e72026a4437cf0c84052579d66
SHA512 014f6a78f68f4159e36807f7660e2f4d905dfbc1721c7be6a4ede04a4dd2ae55774f78705362c5b21573b242d41bb836087a4fbfa4266ede1ab638f872fbc349
SSDEEP 196608:2lZUO2WrsHJ7ulDLtgLaKNXMDH8SBLi8JH:2lZUOZE7cL0dWcSBLiIH
TLSH
T14D660185EBF56022C753A2B86A5F4006F279C0172509DD64BC9C93942FA893886FFFF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\snapshot_blob.bin
Size 338KB
SHA256 1320c8871e2cb7ec86461c41a9a91aa55eaed73e6e4c7c30c7825147e465128f
MD5 62df1b76956602db4dad2228e431ee81
SHA1 58325e4c66072271ec41c1d51d3d382c996b726b
SHA512 9ec7f702192ddbf73fb4af5fa7dcb81fc0eeea7cba15c07824188e96e05ecc635afc2bfc152675bd34ce724bb6e201c0611bc5d61dd86ae5591c19cf91335de0
SSDEEP 3072:AuOiXK9Ot+xbRt2FJRDLdd6peM8yN/SyNsCvuVq/khbvXU/P0cA/9:Au5Xzt+HwtH64e/BNso/kpMP0Pl
TLSH
T17A74EF12F709CA26C8B635745EF98B942E24B2CD9D89AF573060437DB4796640E2F38F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\v8_context_snapshot.bin
Size 704KB
SHA256 8dabdf8d4de742014304df4c67f63dff3efd3470895fc6af1db6ce782c13240e
MD5 e80d8fa5f16049f81f8be03fcb7d2f89
SHA1 0bb7230afdf00c0822876bc23092b48253650dd3
SHA512 85ab8d2990656542813757bb7097f451a85dd824bf426fede60e36ef7e061e00bbd6dfb1208839cd5ff8841d37141bc5f220a958d96c1d5cadcd3ef179bb3b1d
SSDEEP 12288:S15XrgAJ8ph2NdOeP8POqYUdEMH+jURWYS:S1pqP4H8POqYkEMH+AtS
TLSH
T1BEE49676FB0ACA26C8657A7D8DE74B063A34B2DD8EC6EB077011937CB4B86544D1E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 c1a23152c6f6ba2acfdf18d1abb9ac9d4ed386db7324a4adf7d78ee532e11de0
MD5 ae93e727a6f99cb30a1d0600416a013a
SHA1 f066a660d7929d0ccf2fb16dd0b614ae21a4b9e7
SHA512 fb0eb7e81c8b5658a8c91ccea3fa16d6684f3ef3d4ae18addd7763f618f603b075d5c17ab4e431ca587673cdf229dae5233286072ba2e522852036474ea1ba7e
SSDEEP 49152:SvMQibTIlI/EyGhcIDlpcSJ13DFDUgcD2Qn9agdGgkkDCqBK2WgPM+2HryKAoxw:SvMQCkgUrr+2yso8FX1+
TLSH
T120464903F68681D9C06DD6798B5FA623F672F8800B2276DF56A00F192E65FE06B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\7z-out\vulkan-1.dll
Size 904KB
SHA256 3adef87fbec27706c1da5eed0393a607f60bf7ca949a47b848ab3e2f4c26440a
MD5 978ec46b88a1379087dd87cdc6da6388
SHA1 0c9a0755a3490b87e407e87f9436d9f48fb0b0af
SHA512 0537b83a9bb0153e03a7a49c1dadfd79f65a04228de18ea32e2cf21004c49af99d9e0c4a59ef76c2c36ff83b819743662f9da81e7ea8dd27f6d92795e4773d0b
SSDEEP 24576:ZGq7F7pknIiAXUMKzUjvg6Z5WzcxDYsHkDE6g3P0zAk76oOH0YU:8GF9kIiZAjvg6Z5WzcxDYsHkDE6g3P0P
TLSH
T149157D23DA548B69D67AC074D8D18A0789F074851322BACF07B817147F6AFF42B7DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw9F35.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4968_1642163921\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4968_604043853\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Otherside Launcher.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Otherside Launcher.lnk
Size 2KB
SHA256 139733f75fc83e1d83160be5d35c104eb882867444b28470fcd0c45b22014518
MD5 396db0ae54306893df90c8dc832a1cda
SHA1 e7d34a9538cc283126c6c30e8c9d2720cf560f8a
SHA512 1ba98b8d3b03164bf5818a7de344c642fd599d44f35239a0784babec9c3d8c06087866eccd60a4beb9f5d2cddb57fd08b273ac14c4f5c1eaf08e9d0f809525fb
TLSH
T1A151B71057DA1710F3BF7B31A6BA21645B36FC5AEE36E69D0008C24A0D79B04DE58F6B
MD5 SHA1 SHA512 TLSH

Submit Download

4f9344b1-2654-4eb5-9d2d-75ad9e0ea4ca.tmp

Path C:\Users\Admin\AppData\Roaming\Otherside Launcher\4f9344b1-2654-4eb5-9d2d-75ad9e0ea4ca.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Otherside Launcher\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 c0d10edfd5837ec4a79f2c66a95673c4154f8b5fb3a47e983c3a5ec84d18da7b
MD5 fc57ef972144c9e10716df6c1b677681
SHA1 b61ab8474178d409b05738e77a6d405bb1274519
SHA512 68a1b5be37d95bad38b4e119aef55cab35d04af42d24bda68b2adaff5216079a98d88cc80a12672b4739b03fbc52c3a69cc405dfb25e059b26750cd2f6d0f660
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Otherside Launcher\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Otherside Launcher\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Otherside Launcher\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Otherside Launcher\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

b9bff8c4-b522-4105-8781-345e96703c3e.tmp

Path C:\Users\Admin\AppData\Roaming\Otherside Launcher\Network\b9bff8c4-b522-4105-8781-345e96703c3e.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Otherside Launcher.lnk

Path C:\Users\Admin\Desktop\Otherside Launcher.lnk
Size 2KB
SHA256 8d90b2f084bf02cc6e4d5b4dc1cbd80574aeca6f83d2af136b8896ec9714e618
MD5 90c6977168147c4e408e99cd6fd1f538
SHA1 78233c0e56eff18d677f54cd86298fe20a11281d
SHA512 57dd01c46fbb625cdb18a9d794318145e3c7ec7cf116c6f5294d186932b048c120e28e5c8cb6a7ceec8d2a2d8cae0c8ad32be15b60ae791eccd0ae750bb1bd30
TLSH
T17351EC1057DA1324F3FF7730A6BA21644B36F85A9E36E59D0008C20A4D79F04DE58B6B
MD5 SHA1 SHA512 TLSH

Submit Download

f6a07c1e-7c90-4ae3-822e-12c3ce4cf470.tmp

Path C:\Users\Admin\Downloads\f6a07c1e-7c90-4ae3-822e-12c3ce4cf470.tmp
Size 862KB
SHA256 9d5ebd92db7f4d1bb6e931ab27a91dfe7ce4e714d2c644c9793b2c550cbdd18d
MD5 7ed2d075afa6dcd4875552cb6055fe82
SHA1 cc7b2e85205aab74c2e1779269cacae0cf1900b4
SHA512 43e2e128a8244ed03e92fab233cd138d7124ded7d03194ddb1aa9737c323fdbd300418aecb04d4decebae79358278c08ff6097f48a29afcc76d8ba71e851a18b
SSDEEP 24576:0ZCIVD6MvmP6MZ5uJ1W/O5OA7d0k87zmDU:0bVVvEfwJ1WQdPI
TLSH
T1D6151209FB61D496E2B808308764DA665731BD2D7C340B133EB67B7E35F678BB816920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4968_1815617327\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4968_224381907\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4968_59850163\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/2320-1448-0x00000189523F0000-0x0000018952564000-memory.dmp

Download

memory/3952-306-0x0000000008080000-0x0000000008116000-memory.dmp

Download

memory/3952-289-0x0000000006500000-0x000000000685B000-memory.dmp

Download

memory/3952-307-0x0000000007FE0000-0x0000000007FF1000-memory.dmp

Download

memory/3952-299-0x0000000070020000-0x000000007006C000-memory.dmp

Download

memory/4952-332-0x0000000070020000-0x000000007006C000-memory.dmp

Download

memory/4952-329-0x0000000005820000-0x0000000005B7B000-memory.dmp

Download

memory/4952-339-0x00000000702F0000-0x000000007064B000-memory.dmp

Download

memory/5196-1708-0x0000025ABC460000-0x0000025ABC5D4000-memory.dmp

Download

memory/5196-1702-0x0000025ABE810000-0x0000025ABE811000-memory.dmp

Download

memory/5196-1703-0x0000025ABE810000-0x0000025ABE811000-memory.dmp

Download

memory/5196-1704-0x0000025ABE810000-0x0000025ABE811000-memory.dmp

Download

memory/5196-1705-0x0000025ABE810000-0x0000025ABE811000-memory.dmp

Download

memory/5196-1706-0x0000025ABE810000-0x0000025ABE811000-memory.dmp

Download

memory/5196-1707-0x0000025ABE810000-0x0000025ABE811000-memory.dmp

Download

memory/5196-1696-0x0000025ABE810000-0x0000025ABE811000-memory.dmp

Download

memory/5196-1698-0x0000025ABE810000-0x0000025ABE811000-memory.dmp

Download

memory/5272-1591-0x000002148D2E0000-0x000002148D454000-memory.dmp

Download

memory/5448-252-0x0000000006580000-0x000000000659E000-memory.dmp

Download

memory/5448-253-0x0000000006600000-0x000000000664C000-memory.dmp

Download

memory/5448-271-0x0000000007820000-0x00000000078C3000-memory.dmp

Download

memory/5448-272-0x0000000007F50000-0x00000000085CC000-memory.dmp

Download

memory/5448-273-0x00000000078D0000-0x00000000078EA000-memory.dmp

Download

memory/5448-274-0x0000000007940000-0x000000000794A000-memory.dmp

Download

memory/5448-275-0x0000000007AE0000-0x0000000007B0A000-memory.dmp

Download

memory/5448-263-0x0000000070020000-0x000000007006C000-memory.dmp

Download

memory/5448-262-0x0000000007760000-0x0000000007796000-memory.dmp

Download

memory/5448-270-0x0000000007720000-0x0000000007740000-memory.dmp

Download

memory/5448-241-0x0000000005880000-0x0000000005ECA000-memory.dmp

Download

memory/5448-250-0x00000000060B0000-0x000000000640B000-memory.dmp

Download

memory/5448-243-0x0000000005FD0000-0x0000000006036000-memory.dmp

Download

memory/5448-244-0x0000000006040000-0x00000000060A6000-memory.dmp

Download

memory/5448-242-0x0000000005680000-0x00000000056A2000-memory.dmp

Download

memory/5448-240-0x0000000002D10000-0x0000000002D46000-memory.dmp

Download

memory/5448-276-0x0000000007B10000-0x0000000007B34000-memory.dmp

Download

memory/5448-277-0x00000000701F0000-0x000000007054B000-memory.dmp

Download