ece00cb92420f9d50d485cfa5dfcaf844f3af17ee6cb5e9ca5c46345fe4bac86

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 31.6MB
Sample261029-22746sty7m
SHA256 ece00cb92420f9d50d485cfa5dfcaf844f3af17ee6cb5e9ca5c46345fe4bac86
MD5 47044c4e42eef764683f808a7649616e
SHA1 a019c38f99bd9790abc7fcd7db16bf162b7d61fe
SHA512 16aa3c7ede4f561ddab6194ee33106ed0b954601f0a0f306b356d5b5c29bdc51129101821a6e28ae6803cde72caf3f9c8920d5a4ed9e9213f86cc458ec080469
SSDEEP 786432:OPW1Ag0tDswa5vO54zjgIBh8HpFnY77sn4jOLHjByBjX:OFg09iOC4IXGFnYvS4jOLDBQ7
TLSH
T1E777339482656076F6A9313115A507E0FD79372C98F71D29ADB1E8EE0CB2E683FF2074
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
3936	balabolka.exe
3592	balabolka.exe
2308	balabolka.exe
4232	balabolka.exe

Loads dropped DLL 64 IoCs

pid	Process
3500	setup.exe
3500	setup.exe
3500	setup.exe
3500	setup.exe
3500	setup.exe
1892	regsvr32.exe
3856	regsvr32.exe
3936	balabolka.exe
3936	balabolka.exe
3936	balabolka.exe
3936	balabolka.exe
3936	balabolka.exe
3936	balabolka.exe
3936	balabolka.exe
3936	balabolka.exe
3936	balabolka.exe
3936	balabolka.exe
3936	balabolka.exe
3936	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe
4232	balabolka.exe
4232	balabolka.exe
4232	balabolka.exe
4232	balabolka.exe
4232	balabolka.exe
3936	balabolka.exe
4232	balabolka.exe
4232	balabolka.exe
4232	balabolka.exe
4232	balabolka.exe
4232	balabolka.exe
4232	balabolka.exe
4232	balabolka.exe
3592	balabolka.exe
3936	balabolka.exe
3936	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Balabolka\uninstall.log	setup.exe
File created	C:\Program Files (x86)\Balabolka\skins\TV-b.asz	setup.exe
File created	C:\Program Files (x86)\Balabolka\languages\Finnish.lng	setup.exe
File created	C:\Program Files (x86)\Balabolka\languages\Hungarian.lng	setup.exe
File created	C:\Program Files (x86)\Balabolka\languages\Portuguese (Portugal).lng	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\languages\sample.txt	setup.exe
File created	C:\Program Files (x86)\Balabolka\utils\hunspell.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\utils\libgio-2.0-0.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\utils\libpangocairo-1.0-0.dll	setup.exe
File created	C:\Program Files (x86)\Balabolka\languages\Uzbek.lng	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\languages\Vietnamese.lng	setup.exe
File created	C:\Program Files (x86)\Balabolka\utils\7z.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\utils\libgdk_pixbuf-2.0-0.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\languages\Chinese (Traditional).lng	setup.exe
File created	C:\Program Files (x86)\Balabolka\ogg.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\help\French.chm	setup.exe
File created	C:\Program Files (x86)\Balabolka\skins\Cappuccino.asz	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\skins\Neutral3.asz	setup.exe
File created	C:\Program Files (x86)\Balabolka\skins\Neutral4.asz	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\skins\Smoky.asz	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\utils\libcroco-0.6-3.dll	setup.exe
File created	C:\Program Files (x86)\Balabolka\utils\syllable.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\help\Spanish.chm	setup.exe
File created	C:\Program Files (x86)\Balabolka\skins\XPLuna.asz	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\utils\chsdet.dll	setup.exe
File created	C:\Program Files (x86)\Balabolka\utils\pdf2blb.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\utils\syllable.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\utils\viewer.exe	setup.exe
File created	C:\Program Files (x86)\Balabolka\skins\Neutral3.asz	setup.exe
File created	C:\Program Files (x86)\Balabolka\utils\freetype6.dll	setup.exe
File created	C:\Program Files (x86)\Balabolka\utils\libgobject-2.0-0.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\utils\pdf2blb.dll	setup.exe
File created	C:\Program Files (x86)\Balabolka\languages\Czech.lng	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\help\English.chm	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\utils\libgobject-2.0-0.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\utils\MMConverterCon.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\languages\Chinese (Simplified).lng	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\languages\German.lng	setup.exe
File created	C:\Program Files (x86)\Balabolka\languages\Romanian.lng	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\languages\Serbian (Cyrillic).lng	setup.exe
File created	C:\Program Files (x86)\Balabolka\utils\libpangoft2-1.0-0.dll	setup.exe
File created	C:\Program Files (x86)\Balabolka\libogg-0.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\vorbisfile.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\help\Ukrainian.chm	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\skins\Office2007 Black.asz	setup.exe
File created	C:\Program Files (x86)\Balabolka\utils\libglib-2.0-0.dll	setup.exe
File created	C:\Program Files (x86)\Balabolka\vorbisfile.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\skins\AlterMetro.asz	setup.exe
File created	C:\Program Files (x86)\Balabolka\skins\Deep.asz	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\skins\iOS dark.asz	setup.exe
File created	C:\Program Files (x86)\Balabolka\sounds\error.wav	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\utils\freetype6.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\utils\neroAacEnc.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\utils\neroAacTag.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\libgcc_s_sjlj-1.dll	setup.exe
File created	C:\Program Files (x86)\Balabolka\help\English.chm	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\help\German.chm	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\skins\Deep.asz	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\skins\GPlus.asz	setup.exe
File created	C:\Program Files (x86)\Balabolka\skins\Graphite.asz	setup.exe
File created	C:\Program Files (x86)\Balabolka\skins\Topaz.asz	setup.exe
File created	C:\Program Files (x86)\Balabolka\uninstall.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\libsamplerate.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Balabolka\skins\Moonlight.asz	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	balabolka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	balabolka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	balabolka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	balabolka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3040	PING.EXE

Modifies registry class 35 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bxzfile\AlwaysShowExt	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bxzfile\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bxzfile\DefaultIcon\ = "C:\\Program Files (x86)\\Balabolka\\balabolka.exe,1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bxzfile\Shell\Open\command\ = "\"C:\\Program Files (x86)\\Balabolka\\balabolka.exe\" \"%1\""	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\*\shellex	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bxtfile\Shell	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CB83A5A-AA68-4895-9F54-175E789AE149}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\*\shellex\ContextMenuHandlers	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Balabolka\ = "{6CB83A5A-AA68-4895-9F54-175E789AE149}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bxt\ = "bxtfile"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bxz	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bxz\ = "bxzfile"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\*\shellex\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bxtfile	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bxtfile\AlwaysShowExt	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bxzfile\Shell\Open	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bxzfile\Shell\Open\command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CB83A5A-AA68-4895-9F54-175E789AE149}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\*\shellex\ContextMenuHandlers\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bxt	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bxtfile\Shell\Open\command	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\bxtfile\EditFlags = 00000000	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bxzfile\ = "Compressed Balabolka Document"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bxzfile	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bxzfile\Shell	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\bxzfile\EditFlags = 00000000	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CB83A5A-AA68-4895-9F54-175E789AE149}\InprocServer32\ = "C:\\Program Files (x86)\\Balabolka\\BFileExt.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CB83A5A-AA68-4895-9F54-175E789AE149}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Balabolka	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bxtfile\DefaultIcon\ = "C:\\Program Files (x86)\\Balabolka\\balabolka.exe,1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bxtfile\Shell\Open\command\ = "\"C:\\Program Files (x86)\\Balabolka\\balabolka.exe\" \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CB83A5A-AA68-4895-9F54-175E789AE149}\ = "Balabolka Shell Extension"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bxtfile\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bxtfile\Shell\Open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bxtfile\ = "Balabolka Text Document"	setup.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3040	PING.EXE

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
3936	balabolka.exe
3592	balabolka.exe
2308	balabolka.exe
4232	balabolka.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3500	setup.exe
3500	setup.exe
3500	setup.exe
3500	setup.exe
3500	setup.exe
3500	setup.exe
3500	setup.exe
3500	setup.exe
3500	setup.exe
3500	setup.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	setup.exe
Token: SeDebugPrivilege	3500	setup.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
3500	setup.exe
3936	balabolka.exe
3936	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe
4232	balabolka.exe
4232	balabolka.exe
3936	balabolka.exe
3936	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
3936	balabolka.exe
3592	balabolka.exe
2308	balabolka.exe
4232	balabolka.exe
3936	balabolka.exe
3936	balabolka.exe
3592	balabolka.exe
3592	balabolka.exe
2308	balabolka.exe
2308	balabolka.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3936	balabolka.exe
3592	balabolka.exe
2308	balabolka.exe
4232	balabolka.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 1892	3500	setup.exe	93
PID 1892 wrote to memory of 3856	1892	regsvr32.exe	94
PID 3500 wrote to memory of 3936	3500	setup.exe	96
PID 3500 wrote to memory of 3792	3500	setup.exe	97
PID 3792 wrote to memory of 3040	3792	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Balabolka\BFileExt.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\Balabolka\BFileExt.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:3856
- C:\Program Files (x86)\Balabolka\balabolka.exe
  "C:\Program Files (x86)\Balabolka\balabolka.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c deldll.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 -w 1000 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3040

C:\Program Files (x86)\Balabolka\balabolka.exe
"C:\Program Files (x86)\Balabolka\balabolka.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3592

C:\Program Files (x86)\Balabolka\balabolka.exe
"C:\Program Files (x86)\Balabolka\balabolka.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2308

C:\Program Files (x86)\Balabolka\balabolka.exe
"C:\Program Files (x86)\Balabolka\balabolka.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BFileExt.dll

Path C:\Program Files (x86)\Balabolka\BFileExt.dll
Size 362KB
SHA256 8a9a359dfb2b732daa10b8094456823aa7e54488038e6af33a0b6db1fa864e51
MD5 7df9b5b1a7e974e486743b4a4bfe1350
SHA1 266c862d8c771568d5e47a9e7b81e036fb937606
SHA512 62c3627e242b0cb3e3b49e45b45181fbbda212da739d451edf2bceb230e0a13c80d12669229ea4f5fbcf981dec187d0ed13d5be5922b62bb2656c7a42fde6437
SSDEEP 6144:EAnf0IJRB1RfzV/jQrR7BA6MZ+I5UZgUfhil/GtoL:FnfPbBr16MkNZgUfhTtg
TLSH
T1FF841A6BF552CA7CC08FCB34589696F29231FE500AB16B8923C9231F5F71E50AEAC51D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balabolka.exe

Path C:\Program Files (x86)\Balabolka\balabolka.exe
Size 12.2MB
SHA256 5eee0d187347762f61d4fafbf898203791800033bf5d2ab533620f73ff8f8d7f
MD5 5d95ad15adbb47a9efc96f4286954a94
SHA1 338f52bf7349db5bd9d579fbc4d3be45043ac86a
SHA512 6d0725bd2dbc30cbba880b680e638608d2175fd6fa68abe5ea6f1ec9a103e64c6b6b39878c1ba2ecdc296c12e8546e4d1a4900fadb6fe352b715892839c7953b
SSDEEP 393216:LnVf4c1arRfRne66mdtI4mOHqxdPIBk3yv9ms:mI4mO9L
TLSH
T13BD64919A388D526E1631E7B4D1EDAC878257E315E20C94F7BA82F4C2F39F42E924753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Program Files (x86)\Balabolka\libcrypto-3.dll
Size 4.3MB
SHA256 c98e95630b01eb42e7d930c9ff39fae91b69ab4664816bbdef6d2cad3c290f3f
MD5 29997f2d8c32a3836292c04dc586a30a
SHA1 4e2dbc570fef5d64df2c494593662cd39a0653fa
SHA512 50708e1ed615a9e7835ac319b59e3c9b0af1eb9b633eb7cdd0e71abafc337b6813b29e60c40ecc17c25cf2e8aa5796451de4696959a7c8cb60207d187efd194a
SSDEEP 98304:pqJsqJX7+mFiQlx69F91CPwDvt3uFA0C:gdimFTlx6931CPwDvt3uFA0C
TLSH
T12326AF16FF976690E9CF817E12EF677F4E394B14C72498D38E622499C825AC1633E360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_sjlj-1.dll

Path C:\Program Files (x86)\Balabolka\libgcc_s_sjlj-1.dll
Size 96KB
SHA256 fb3abbf91940ce2ac17210f04d98b27925e3c01613c15e4e7da99b4ffd017345
MD5 7b2ec0079672375f6e0b4142d9fa70f1
SHA1 d18bec62dcfde1c65c1743ba63e956b674776703
SHA512 405944552a63070e4cc56de80331e3bfcd1d1feb13c2afabe50c183ed31442865f333ca7ca1ddf1c918ef162b9a4d8d452f50817318e372329c865ba0d79f804
SSDEEP 1536:pUnudqAAri/Eiz8V2PlMF4v6C7382gYbRXqWb53CxsI/:py3AAri/dxlMF5C738FYbIW93+r
TLSH
T14BA31D40EACF91F2E94B1CB0A573A5BF97302B0B4474C974EFB0D787D621663A929606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libogg-0.dll

Path C:\Program Files (x86)\Balabolka\libogg-0.dll
Size 24KB
SHA256 87385e740235a7f7122e549edf1d2149b051c95c78965f1a78449e5959788a1d
MD5 0814e1d3d2c7b0de438338d9a57e25d6
SHA1 57f34473969d782c4246397dcc362ab675bbcfa5
SHA512 562504ac40a789e6809c728916d6b310a66bfda4898c373df350df671bad9bbf270d3f1f0bde09bc82eb7c1cc788fc4fe178d4ed4885b340a8ec6e6876527728
SSDEEP 384:FAmXQ/s/h3z6ooduLBMuzCBZFrEw+8JvX6RBbBg8:pQ/+dziuLBsBZFEUJ/6rf
TLSH
T12BB23B469A47D8B2CCC711715BBBEFFE6BAA0606CC25D730C374E54929B31E2A138D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libopus-0.dll

Path C:\Program Files (x86)\Balabolka\libopus-0.dll
Size 311KB
SHA256 fde67ca0f13abaab469c3625dbeac4feb623edc415695382e07ba3517d54a5e7
MD5 7bbda91da8aa0a1f4219969df9bdf1fe
SHA1 c3a3920613412cc35e96f20ba714852a6d50b849
SHA512 c52e90582fd236ac1bd6208ebf1c611b783b81b630ea965597f14eded84fd63bd7e7c84d5afc69d704c2b23465257ebe328444ed7a9242088d4a8ddbb535427a
SSDEEP 6144:Mrlz0c5YU5WK3+XEw5618Pej5ExvfwUEgCIY/mYCP:MBP+U5N3S561+KEldiw
TLSH
T1FB647C02DA4791F3C0A315706717BBFF8B24673590A0D976EFA4AD84EA73BE66214313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libopusfile-0.dll

Path C:\Program Files (x86)\Balabolka\libopusfile-0.dll
Size 50KB
SHA256 0e28e09bcc45b229e5c76c917f38b18a4ef9cc435f4f64f1ad9ffa0438bf5f3d
MD5 600a58801a8283cf04ce61e0fc4932d3
SHA1 d75069331223d20bfec8d670401db24881600b7b
SHA512 66a03d1252dd239cf8fa73c43325c59a5984f16b7c0dd732c99b4b0945361263d6248874062ff7495774566057799c2b6583f890beb1b2fe86b57d0774c914a4
SSDEEP 768:y+9my3oMNJ4DkWDpY6eLtKaTW+WbwR+FtpeBKQ/z:yc5okq66eLtKOXPM2
TLSH
T17B332980FEC7D1F2D86718B051B3B7BF4A304A02D924CD79CB689E85ED77662B01A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Program Files (x86)\Balabolka\libssl-3.dll
Size 1.0MB
SHA256 18fef2964424cf31e0aa2935df3445840c7f6c52180b5d70f46680bce6c0a14c
MD5 39b426d1beaffdab6a1b7165a4dab5ae
SHA1 dc6596ebeb57fc1b251e6f9a7749ed3d13e28db0
SHA512 0c747e2f09abfc7f47fe0a07ea159b261396613aaed77fd2dffd7cfc72e360a882368620da96cfcf4e320026dcea1b412a78535ec950bafdf8ef97b638847db1
SSDEEP 24576:jRSAWUTPSSSk30WG+uOJzIopjze31Rg5aYsrMK:NSeqveyn6zcRg5aYsz
TLSH
T1C7358D42BB825DE0E5C6827D16FA23BE5B3967149364C8D38F622975CC222D1767F3C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Program Files (x86)\Balabolka\libwinpthread-1.dll
Size 48KB
SHA256 1354d208c322e5b0adb6911562cbfb4bc6c4c82e4f73497cee563642037aeaac
MD5 9a74e1fb74cbef58dc03483ac569de5f
SHA1 fcace8d18f042b6fb482601b313ba3dba7031997
SHA512 d0e4493fed88d068e8b42748ea0283e28b1781d76c98407cc6443637be1298a70151fa72a9c5b667b92d248894ef3bf14584d9a34fb92c2da78be40ee0bab0f4
SSDEEP 768:efCpmSsbBAJavC9OXgXaE35lrnSPQQ1RdW/jh2rim3Y3yb:DpRsqAa9OX87rnNYrim3Y3yb
TLSH
T189234B09EF4F48F9D09319B089F6BFFB4B734602242DED65EB29D458A97B911F10D40A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Languages.xml

Path C:\Program Files (x86)\Balabolka\resources\Languages.xml
Size 247KB
SHA256 762f2f45aebc1fc5ddc544bd83fef931172ccc6eeb5c3a28d9f7e6556d5a7aac
MD5 eb4370fc64d542d783fe6c62e6b42c30
SHA1 3e62ac273f313e2671d835b10449221d72e95760
SHA512 b100999fad26788a5b6d7c664006cd8b66575c78f14a9f1925db1a578d83862e73df90dd3e700c3bf3005c5ac41912fb864eb20a43e6bd968040d86f6727448f
SSDEEP 6144:ZUgupWngjToDG/qG8v2fPobJgxazHdm08m1:GoR
TLSH
T12B44F814AC7EB015469A12C76FF4D81A3C7EFB57421DA2929C9FA1B687C33CF4936224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.log

Path C:\Program Files (x86)\Balabolka\uninstall.log
Size 4KB
SHA256 302ae081300e42a57f0c663916994bc47de526c3ce8b366c839665b56dfea77a
MD5 1de3c190eb61db992f878cbd7f003e15
SHA1 9d02c0f259be275345f071077b0d9c96a93a49b5
SHA512 4de5a1ebf7c2794559e3bb9271d8c8e9945d54c6018636368fcbc5f57d29a94522efd626cbeb4431278f46af3b396cac244f5e7a88d38a68b2d57cced86b4dd2
SSDEEP 96:nmofO9PBcOQnrNz2piJU/wUSfu6bda1SzE7tywUubUhU5UkUbU5x+TWey9lZ:nmofByz
TLSH
T1C3917C51944A8FC9B30254D3FB852E010AF99D743E6A0425BA95CFFB50CBEE1317B6A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chsdet.dll

Path C:\Program Files (x86)\Balabolka\utils\chsdet.dll
Size 131KB
SHA256 4fc191654e975fe38e68369bd59cee9b27f581e08666e3430ca3f595f37ad42a
MD5 0aa4ee0a869ba2d4a9375734a9d8fc72
SHA1 d06ea0d11859b215f10f019270d70c08be11f128
SHA512 746aaf2f0fc4434fd16da45d02a85a1374750611200c8c097c1c08ef5fac8225b48e15ee149aeee2af011d3aa43e0a8d212ec99953f4da7d10782a3785444c09
SSDEEP 3072:fTXUis9cVZM9OjOXl8rzJj+lNvPeWyNg2it0RN/:fbU96VZM9yfcHtd
TLSH
T12FD32907BB97B977D0650E3448B92755A739FB142B338B9B15983A34CC6A3C32F852C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libmpg123-0.dll

Path C:\Program Files (x86)\Balabolka\utils\libmpg123-0.dll
Size 541KB
SHA256 07daa0f7c6a4f6ab56d81cbd31292ade3aa3a932ba4a98ccfd1b75c905b3cbe9
MD5 17207ac2046f9316b35ac0a34bdd713f
SHA1 5ea44f99327da69226a4b0d95d434a92edc7c943
SHA512 6d279f21b8cc564647a08fee5e3ce25a4d45da323d2dce284f03ebca2542c547bae2e70b4e073be35d60e0b2c377609452a3bed9cb6bce0980c4f8cd1a3cf0a5
SSDEEP 12288:yJjr0lIgrO9dLEpPFYBfaAF3b+ES6a1A5c4/zE:yJjr0CgrO9EFYBfN66aSm4/zE
TLSH
T18BC46C40E6CB40F2E85789715587FBBFDB392F014531CF63F9A41A05EA33B96222B259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syllable.dll

Path C:\Program Files (x86)\Balabolka\utils\syllable.dll
Size 1.0MB
SHA256 f81446eec908bdc09488debb383fabe1a0beca9576324ae5a1249c87d4ffe8c4
MD5 4b1ff372fbb332d443739d48e57cada9
SHA1 f9c1452f65562e6917c62f726ebe5092c616087c
SHA512 78212be1f83339620c12ec83a53f7d244b83e498a2bc7c82f38a051b08bdf33aa60e153e4e3145baefd50be15eee7233fecd828a1e97ea7e2fa84d7cbe604758
SSDEEP 24576:JVYrWB8iHFVQ7W62D6OLep9WmcRgGkgP9oDOGwvM8q5c8YzIgBdbM6I:j5BBFVQ7W62/Lep9lcRgG1P9HjvMd5cU
TLSH
T1BC358F2AFA91D127C0E22774DC0AD0F1B814B2701F65F087F9C5DBAD2E3AAED2719516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deldll.bat

Path C:\Users\Admin\AppData\Local\Temp\deldll.bat
Size 200B
SHA256 9131de0fcaaf968896af9d58b6f37b4aa443455bb97c97bc142f295cee577bc4
MD5 ea190ef9b139757a890cd48bdd44b0ee
SHA1 95c684e41bf7919408816aafab881621fface202
SHA512 22802ffc1965c8e27f799ee88e3fa46debb316c27507a570b0812bc5de0d59a9c2a2105b8cc204851b3c29984ef1dfb7842131819952b185b7e4325a032fb6ad
TLSH
T18DD0A9FA154008A3908A0AA28A2C6CDEF20E60AB43CE5394301309E2CD6D2349338C20
MD5 SHA1 SHA512 TLSH

Submit Download

7logo.bmp

Path C:\Users\Admin\AppData\Local\Temp\genteeC1\7logo.bmp
Size 7KB
SHA256 41a433347bbab486ce9604bf1deb626782f08523ca64b80641ef415704c0c61f
MD5 ad07d4379a8e09f7d4c647e90cd845a2
SHA1 ee199c9d073c1726545327b55294303f4553807e
SHA512 6a3f15f096b94e38a3583526ae41a6db02823b4279ee81b7e2536919ebebb50f5c219fe093b126294370d242f8d183af653e5bc0a120318a8f7a3de47e2d3980
SSDEEP 96:P211epmqsTyvTMJBVv9F7iF9CwPD1bCgZeCmL8cj8uh9SOvafJvJ:PwuYTYT4k9CwPJOgoCBluh95CBB
TLSH
T11CF1E822717ADAB0E5484736EE5CD2FD92163F70FC4B116BB009774F797A290568BC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

guig.dll

Path C:\Users\Admin\AppData\Local\Temp\genteeC1\guig.dll
Size 20KB
SHA256 005c251c21d6a5ba1c3281e7b9f3b4f684d007e0c3486b34a545bb370d8420aa
MD5 d3f8c0334c19198a109e44d074dac5fd
SHA1 167716989a62b25e9fcf8e20d78e390a52e12077
SHA512 9c890e0af5b20ce9db4284e726ec0b05b2a9f18b909fb8e595edf3348a8f0d07d5238d85446a09e72e4faa2e2875beb52742d312e5163f48df4072b982801b51
SSDEEP 192:mxonubPh9zJCEvCZj6beDKnYFRJvS/QwC3:tubPh9N6N6k3z
TLSH
T16892F6B672D244F7D28B02F50E932F9E7B7999515B7438720E234BCE54A6541F83AA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unppmd.dll

Path C:\Users\Admin\AppData\Local\Temp\genteeC1\unppmd.dll
Size 8KB
SHA256 d6f3429b8ffe80e1bc023de22bc23d9b4d384d89a9b22db51aa27c804581642d
MD5 7b97f7a822f0f4f54c54b8ef92aaf09a
SHA1 d0916590b36d8e0507b6722449d7ffd2187498a6
SHA512 d33c0c31df17738f0cd5384f579bacb512668ec8fec9c96e12125ffe58a38a46ac498f5924c8620a146b762fc318dd7f291efd27caaec45ca9f16d80dae05387
SSDEEP 192:8oZxb6fmKexmyVMoScaVqAbQkomcOqLPW3axP:82xGfm1mm9SZVWko7zW3
TLSH
T1AA024B62CD9231F2F6898A7D08CBB357D6BDA7005F40D47E5B2E467D6D281B4AC33242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

genteert.dll

Path C:\Users\Admin\AppData\Local\Temp\genteert.dll
Size 60KB
SHA256 54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831
MD5 6ce814fd1ad7ae07a9e462c26b3a0f69
SHA1 15f440c2a8498a4efe2d9ba0c6268fab4fb8e0a7
SHA512 e5cff6bcb063635e5193209b94a9b2f5465f1c82394f23f50bd30bf0a2b117b209f5fca5aa10a7912a94ad88711dcd490aa528a7202f09490acd96cd640a3556
SSDEEP 768:BVPbKk9022j0efXs6X8zqk3pT3oMapzxc7Ep+DnSIiacDwGpr1a:BVTK+022j0V6mqMozpzxcXOpwEr1
TLSH
T16A536D03678600F5D6526A7A342F7277FB34DFE742E6C6836F69DC902D221A1A52A1C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balabolka.cfg

Path C:\Users\Admin\AppData\Roaming\Balabolka\balabolka.cfg
Size 91B
SHA256 63fc93c688a859524dd3a44ab05d85f7649c40d8d63af2a510e5c5c646cc8af5
MD5 bed50589994965da234466c6ce92ae03
SHA1 6dcec32267001dfd79699248698ac6bd09c250f4
SHA512 365ceddaf7b1ca82fadd5f8f1e9423832971445bbf3a5b784451fd337ec8c64b9988f1a7fef90a095b6ee702faefc519c318494fc73d1be9de6e59af16c63369
TLSH
T176B01204003024B775B8B024A4C3075002D294C489420C2DA3179C5535C3C589BF4440
MD5 SHA1 SHA512 TLSH

Submit Download

balabolka.dat

Path C:\Users\Admin\AppData\Roaming\Balabolka\balabolka.dat
Size 26B
SHA256 93412431b44db63c2589ecbdc99c532e582a621aa0c8af02c06989ddee1543a1
MD5 174574676056f9e031ffa407871479a8
SHA1 9e189ccb370e394c3627b90db89be97cc8ca28ec
SHA512 4550c1e8fda3a31448dd02fcb4c9196b9c7022cb05d0b252978b92149c45b2a2ed50ff83238658aafdb7d6feae3990dec1a8e18aa62c37b58d3579d7b6aa10a9
MD5 SHA1 SHA512

Submit Download

balabolka.echo

Path C:\Users\Admin\AppData\Roaming\Balabolka\balabolka.echo
Size 4B
SHA256 6f75f02bc7f65e75ad7e3cf0aa48d03276ac196d810f71f0eb162e127bee4a59
MD5 504621802ad758c38b7853bf42eac13c
SHA1 baccc989a51c6a8f7d22a3ba48a16caf1d0e1adf
SHA512 c12288a5c95663d01b6863c3bfc1b7788d294a52515bd49c2a567e1e2f1f46f5b7885fbf733086a882a4c6be22e80c692460fb8a051cfe7ffec7eb79e1c4592d
MD5 SHA1 SHA512

Submit Download

English.hmg

Path C:\Users\Admin\AppData\Roaming\Balabolka\dict\English.hmg
Size 793B
SHA256 71c93cb8678860be64d331185b3fb98a25eb6b8bc82c5ffa947997d9b738d134
MD5 388349bf4ceb45aa611bf389c3667cf2
SHA1 38792921d4fbd26f704e22beefab7f6d97ace84d
SHA512 9e0c77948894dc2325019624995866a7679ef58deb4e292fa81b9b18c6693bcae5316b6602614bd664ef0aa96463825b8573052182864be32d55fc31377e1442
TLSH
T11E017541A410CF2A030C15F7110538A0F85A1670A9F812DEB5F9C0D191F4F6C25F4A2A
MD5 SHA1 SHA512 TLSH

Submit Download

French.hmg

Path C:\Users\Admin\AppData\Roaming\Balabolka\dict\French.hmg
Size 1KB
SHA256 93d2ced1363dc7ac6b5f714b6cfc63083eac4d27c1adb20183f844a677df73c4
MD5 977bcca61d4db0c5cc5888bf592574a9
SHA1 fa7ad0d37da724518a0ed4dc8e708b731ce41840
SHA512 ee213b94399d530e41e5f9f01a432a0220a42e8ad0a33b557e88422df5e1fdd2c295c21a62611de2009897a0909a552d3833574681030daa75887ca771134fc4
TLSH
T1234155B4F09065D06C729A74B01156A8A79E8CD189F220115F8EC3F9B1CADAEF5706B7
MD5 SHA1 SHA512 TLSH

Submit Download

German.hmg

Path C:\Users\Admin\AppData\Roaming\Balabolka\dict\German.hmg
Size 467B
SHA256 06c5a18a46c69572f412e892ea292eac0619ef2a4108235e577cd2224ff88e34
MD5 c17ca0d895510482cb363afd61cc4a77
SHA1 2193f6059490e5f185e8365c1c43764b4a48eeda
SHA512 f3a2955752c649a54833115b22f01386363f9790a22920482f5b26f8b96897a5d2a4c3925d1b2937549515275ef3748ec784bdc86392573ef3dd077e1896d30a
TLSH
T171F0273C0AD6170A5146C7637A8C19B9A46F165A0495C408F9B0A32FAA5DB2F2B4A838
MD5 SHA1 SHA512 TLSH

Submit Download

Russian Nicolai (SAPI4).hmg

Path C:\Users\Admin\AppData\Roaming\Balabolka\dict\Russian Nicolai (SAPI4).hmg
Size 66KB
SHA256 ba98e3122ac14f4906499be6af1308613d4f4ee607ab2a36e30e408a6bac1f8a
MD5 6b059aa8daef971b4330d94a22d7a81e
SHA1 ccf319abc2d48f8a8a45af01de9c52d1ec7a0d60
SHA512 3a472a78f7ae2a8721e8459cc6aefa33d25f5c186500a3c185547815f93ee35a486cdf9c8f85d0d2a704c98aef23fb2da1a021a8b037b0cf4676ff34149abef9
SSDEEP 1536:mK26fumbhDc/iH2a/Os1EDcDQqoUZDNYi9Av8G0lJozS5S+cK7gPR:12guchA/c2UOMEgDyUZpYi9AFfzahgPR
TLSH
T101633B12A245389E0108F95AEC486E0D7866D0FD7FEBE38A327429BD75F2466C77834D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Russian Olga.hmg

Path C:\Users\Admin\AppData\Roaming\Balabolka\dict\Russian Olga.hmg
Size 66KB
SHA256 d5e31449c29a88e0b992ed6578f2fcf7f791e2e73867e51f6094d5603ce37c4b
MD5 7c29cec030b0d1f51cbf0e29443b837e
SHA1 a39c979d0a3c9ce7a71ddec4dcb4c078571d2263
SHA512 a3303bacd09bca07be89058a98891f3bb9190a6450725b0bd187bc673c5286904b4b78876e9c58596af1523d6e25907be1acc921191ac751173ebdbd8c8b0932
SSDEEP 1536:wQSdeIm4m9eMGUCyOVIuSK/u1mJLoKRuK2tQXqoNMtc3s+:tOeIm4m9eMGUCyOVIw/u1ml/paoNMtc9
TLSH
T1CB637B19A68635FF0108F95EE80C2E4D7C6680FD3FEBA39691243D7D75F30668A38285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ligature.dic

Path C:\Users\Admin\AppData\Roaming\Balabolka\dict\ligature.dic
Size 392B
SHA256 8253d49803e1d7d1b99869abaab08b344f441484355944639ba2ff2aa18b2b5a
MD5 005f42012def7e29e1f8e5e63242646b
SHA1 ad6547870769f52d029ed22ca0123322f9b959d6
SHA512 74e771e87acca2ccc456de01ae3665ecdbf9e86051a467935d705bb9dd730f497b0a843dae959fb73073c69a65479a71f110885fef85f91224921cd68967a0d9
TLSH
T19CE0D8E42671A9728C5B89FB077D72C98ABA105227CD01BD2E2452844E6187ACE3F26C
MD5 SHA1 SHA512 TLSH

Submit Download

sample.bxd

Path C:\Users\Admin\AppData\Roaming\Balabolka\dict\sample.bxd
Size 439B
SHA256 ba740dc63018d4c2f387cb7421432d0d4c196fc81709e74f8f0db89921f17aa1
MD5 793b58d825f597a901cba29110330dff
SHA1 2a76b8998946d25edd3eec211249369b37950695
SHA512 211e004474a02d6f0d5bf031f2ce25216ad4b988d9ddc6c644f012b96fb276b866994c9009edf35a30eb9262a9c6f22eb4e690bdfa5e73d9f228a85ccf1b001a
TLSH
T154F0812CA2D7312641E802C0F40830338E3C028C089BEF4C06F85BB02A18C7F3CD00CA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2308-779-0x00000000732C0000-0x000000007334D000-memory.dmp

Download

memory/2308-783-0x0000000070880000-0x000000007088D000-memory.dmp

Download

memory/2308-780-0x0000000001090000-0x00000000010B6000-memory.dmp

Download

memory/2308-846-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/2308-778-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/2308-786-0x0000000064B40000-0x0000000064B54000-memory.dmp

Download

memory/2308-818-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/2308-797-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/2308-867-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/2308-781-0x0000000003BE0000-0x0000000003CF1000-memory.dmp

Download

memory/2308-782-0x0000000067140000-0x0000000067154000-memory.dmp

Download

memory/2308-760-0x0000000001090000-0x00000000010B6000-memory.dmp

Download

memory/2308-785-0x000000006D0C0000-0x000000006D0DF000-memory.dmp

Download

memory/2308-884-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/2308-768-0x0000000003BE0000-0x0000000003CF1000-memory.dmp

Download

memory/2308-784-0x0000000062700000-0x0000000062754000-memory.dmp

Download

memory/3500-25-0x0000000003D10000-0x0000000003D11000-memory.dmp

Download

memory/3500-26-0x0000000003D00000-0x0000000003D01000-memory.dmp

Download

memory/3500-698-0x0000000003D20000-0x0000000003D21000-memory.dmp

Download

memory/3592-762-0x00000000732C0000-0x000000007334D000-memory.dmp

Download

memory/3592-893-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3592-763-0x0000000001050000-0x0000000001076000-memory.dmp

Download

memory/3592-761-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3592-769-0x00000000048A0000-0x00000000049B1000-memory.dmp

Download

memory/3592-842-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3592-830-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3592-863-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3592-787-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3592-741-0x0000000001050000-0x0000000001076000-memory.dmp

Download

memory/3592-905-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3592-806-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3856-696-0x000000011005E000-0x000000011005F000-memory.dmp

Download

memory/3936-753-0x00000000732C0000-0x000000007334D000-memory.dmp

Download

memory/3936-897-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3936-810-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3936-752-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3936-774-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3936-791-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3936-754-0x00000000014D0000-0x00000000014F6000-memory.dmp

Download

memory/3936-834-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3936-876-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3936-755-0x00000000048A0000-0x00000000049B1000-memory.dmp

Download

memory/3936-721-0x00000000048A0000-0x00000000049B1000-memory.dmp

Download

memory/3936-855-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/3936-711-0x00000000014D0000-0x00000000014F6000-memory.dmp

Download

memory/4232-816-0x0000000001090000-0x00000000010B6000-memory.dmp

Download

memory/4232-859-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/4232-838-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/4232-880-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/4232-815-0x00000000732C0000-0x000000007334D000-memory.dmp

Download

memory/4232-817-0x0000000004760000-0x0000000004871000-memory.dmp

Download

memory/4232-814-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/4232-901-0x0000000000400000-0x000000000104D000-memory.dmp

Download

memory/4232-796-0x0000000004760000-0x0000000004871000-memory.dmp

Download