8b86972a9555901a53b6f79d174a77f7aabf4766923eca994667eec1a4546a9c

Analysis

user interaction
yes
max time kernel
1799s
max time network
1801s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/11/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
madium.decrypted.dll
Size 45.6MB
Sample261102-mehtfabs2n
SHA256 8b86972a9555901a53b6f79d174a77f7aabf4766923eca994667eec1a4546a9c
MD5 421f42d124390b98ffb47639cfb6413f
SHA1 9f53dace472fb70b8faef73e9f2026535675e083
SHA512 719231032867dde7f57354c7420327621703e5fcb458c5b16ab92e634c6fd79cc2ed966f684295bf102346433cd852444be8ab3a123673176c2df2e22f9bf161
SSDEEP 786432:3LvYvrBRVEcQhj6kF5KgZmGiwZXnPHCAvYaPL7H:7wvfQdtMYmG/ZXP7vYi
TLSH
T166A7AEF721D1A1EEC466C13A8713F93FDAAFB0352721D5D3615892564E23CC63A2AF06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3912	FNLB-Setup.exe
4980	FNLB-Setup-nsis.exe
4400	FNLB.exe
2212	FNLB.exe
4644	FNLB.exe
1808	FNLB.exe
1128	FNLB.exe
1068	FNLB.exe
4376	FNLB.exe
4692	FNLB.exe
3888	FNLB.exe
3088	FNLB.exe
4932	FNLB.exe
3608	FNLB.exe
4840	FNLB.exe
4824	FNLB.exe
2536	FNLB.exe
4692	FNLB.exe
2464	FNLB.exe
3304	FNLB.exe
2816	FNLB.exe
808	FNLB.exe

Loads dropped DLL 34 IoCs

pid	Process
4980	FNLB-Setup-nsis.exe
4980	FNLB-Setup-nsis.exe
4980	FNLB-Setup-nsis.exe
4980	FNLB-Setup-nsis.exe
4980	FNLB-Setup-nsis.exe
4980	FNLB-Setup-nsis.exe
4980	FNLB-Setup-nsis.exe
4980	FNLB-Setup-nsis.exe
4644	FNLB.exe
4644	FNLB.exe
4644	FNLB.exe
4644	FNLB.exe
1068	FNLB.exe
4376	FNLB.exe
4376	FNLB.exe
4376	FNLB.exe
4376	FNLB.exe
4692	FNLB.exe
4932	FNLB.exe
4932	FNLB.exe
4932	FNLB.exe
4932	FNLB.exe
3608	FNLB.exe
2536	FNLB.exe
2536	FNLB.exe
2536	FNLB.exe
2536	FNLB.exe
4692	FNLB.exe
2464	FNLB.exe
3304	FNLB.exe
808	FNLB.exe
808	FNLB.exe
808	FNLB.exe
808	FNLB.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
808	FNLB.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4896	powershell.exe
3240	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1108	powershell.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\FNLB-Setup.exe:Zone.Identifier	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FNLB-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FNLB-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FNLB.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FNLB-Setup-nsis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	FNLB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	FNLB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	FNLB.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FNLB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FNLB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FNLB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FNLB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FNLB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FNLB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FNLB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FNLB.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe

Modifies registry class 50 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "5429"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\URL Protocol	FNLB.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "0"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb	FNLB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\URL Protocol	FNLB.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "0"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com\NumberOfSubdomains = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com\Total = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "18904"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb	FNLB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\fnlb\\FNLB.exe\" \"%1\""	FNLB.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb	FNLB.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\shell\open\command	FNLB.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5429"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\shell\open\command	FNLB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\fnlb\\FNLB.exe\" \"%1\""	FNLB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\ = "URL:fnlb"	FNLB.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\shell	FNLB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\ = "URL:fnlb"	FNLB.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\shell\open\command	FNLB.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\fnlb\\FNLB.exe\" \"%1\""	FNLB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\ = "URL:fnlb"	FNLB.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "0"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "13498"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\URL Protocol	FNLB.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\URL Protocol	FNLB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\ = "URL:fnlb"	FNLB.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\shell\open	FNLB.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb	FNLB.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\shell\open\command	FNLB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\fnlb\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\fnlb\\FNLB.exe\" \"%1\""	FNLB.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\MuiCache	SearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\FNLB-Setup.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1108	powershell.exe
1108	powershell.exe
4896	powershell.exe
4896	powershell.exe
4980	FNLB-Setup-nsis.exe
4980	FNLB-Setup-nsis.exe
3240	powershell.exe
3240	powershell.exe
808	FNLB.exe
808	FNLB.exe
4680	LocalBridge.exe
4680	LocalBridge.exe
4680	LocalBridge.exe
4680	LocalBridge.exe
4680	LocalBridge.exe
4680	LocalBridge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
700	Process not Found
700	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeIncreaseQuotaPrivilege	3240	powershell.exe
Token: SeSecurityPrivilege	3240	powershell.exe
Token: SeTakeOwnershipPrivilege	3240	powershell.exe
Token: SeLoadDriverPrivilege	3240	powershell.exe
Token: SeSystemProfilePrivilege	3240	powershell.exe
Token: SeSystemtimePrivilege	3240	powershell.exe
Token: SeProfSingleProcessPrivilege	3240	powershell.exe
Token: SeIncBasePriorityPrivilege	3240	powershell.exe
Token: SeCreatePagefilePrivilege	3240	powershell.exe
Token: SeBackupPrivilege	3240	powershell.exe
Token: SeRestorePrivilege	3240	powershell.exe
Token: SeShutdownPrivilege	3240	powershell.exe
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeSystemEnvironmentPrivilege	3240	powershell.exe
Token: SeRemoteShutdownPrivilege	3240	powershell.exe
Token: SeUndockPrivilege	3240	powershell.exe
Token: SeManageVolumePrivilege	3240	powershell.exe
Token: 33	3240	powershell.exe
Token: 34	3240	powershell.exe
Token: 35	3240	powershell.exe
Token: 36	3240	powershell.exe
Token: SeSecurityPrivilege	4980	FNLB-Setup-nsis.exe
Token: SeShutdownPrivilege	4400	FNLB.exe
Token: SeCreatePagefilePrivilege	4400	FNLB.exe
Token: SeShutdownPrivilege	4400	FNLB.exe
Token: SeCreatePagefilePrivilege	4400	FNLB.exe
Token: SeShutdownPrivilege	4400	FNLB.exe
Token: SeCreatePagefilePrivilege	4400	FNLB.exe
Token: SeShutdownPrivilege	4400	FNLB.exe
Token: SeCreatePagefilePrivilege	4400	FNLB.exe
Token: SeShutdownPrivilege	4400	FNLB.exe
Token: SeCreatePagefilePrivilege	4400	FNLB.exe
Token: SeShutdownPrivilege	4400	FNLB.exe
Token: SeCreatePagefilePrivilege	4400	FNLB.exe
Token: SeShutdownPrivilege	4400	FNLB.exe
Token: SeCreatePagefilePrivilege	4400	FNLB.exe
Token: SeShutdownPrivilege	4400	FNLB.exe
Token: SeCreatePagefilePrivilege	4400	FNLB.exe
Token: SeShutdownPrivilege	4400	FNLB.exe
Token: SeCreatePagefilePrivilege	4400	FNLB.exe
Token: SeShutdownPrivilege	4400	FNLB.exe
Token: SeCreatePagefilePrivilege	4400	FNLB.exe
Token: SeShutdownPrivilege	4400	FNLB.exe
Token: SeCreatePagefilePrivilege	4400	FNLB.exe
Token: SeShutdownPrivilege	3888	FNLB.exe
Token: SeCreatePagefilePrivilege	3888	FNLB.exe
Token: SeShutdownPrivilege	3888	FNLB.exe
Token: SeCreatePagefilePrivilege	3888	FNLB.exe
Token: SeShutdownPrivilege	3888	FNLB.exe
Token: SeCreatePagefilePrivilege	3888	FNLB.exe
Token: SeShutdownPrivilege	3888	FNLB.exe
Token: SeCreatePagefilePrivilege	3888	FNLB.exe
Token: SeShutdownPrivilege	3888	FNLB.exe
Token: SeCreatePagefilePrivilege	3888	FNLB.exe
Token: SeShutdownPrivilege	3888	FNLB.exe
Token: SeCreatePagefilePrivilege	3888	FNLB.exe
Token: SeShutdownPrivilege	3888	FNLB.exe
Token: SeCreatePagefilePrivilege	3888	FNLB.exe
Token: SeShutdownPrivilege	3888	FNLB.exe
Token: SeCreatePagefilePrivilege	3888	FNLB.exe
Token: SeShutdownPrivilege	3888	FNLB.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
4400	FNLB.exe
4400	FNLB.exe
4400	FNLB.exe
4400	FNLB.exe
4400	FNLB.exe
4400	FNLB.exe
4400	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
4840	FNLB.exe
4840	FNLB.exe
4840	FNLB.exe
4840	FNLB.exe
4840	FNLB.exe
4840	FNLB.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
4400	FNLB.exe
4400	FNLB.exe
4400	FNLB.exe
4400	FNLB.exe
4400	FNLB.exe
4400	FNLB.exe
4400	FNLB.exe
4400	FNLB.exe
4400	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
3888	FNLB.exe
4840	FNLB.exe
4840	FNLB.exe
4840	FNLB.exe
4840	FNLB.exe
4840	FNLB.exe
4840	FNLB.exe
4840	FNLB.exe
4840	FNLB.exe
4840	FNLB.exe
4840	FNLB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1068	SearchHost.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 4980	3912	FNLB-Setup.exe	106
PID 4980 wrote to memory of 1108	4980	FNLB-Setup-nsis.exe	107
PID 4980 wrote to memory of 4896	4980	FNLB-Setup-nsis.exe	109
PID 4980 wrote to memory of 3240	4980	FNLB-Setup-nsis.exe	111
PID 4400 wrote to memory of 2212	4400	FNLB.exe	117
PID 4400 wrote to memory of 4644	4400	FNLB.exe	116
PID 4400 wrote to memory of 4692	4400	FNLB.exe	118
PID 3912 wrote to memory of 1808	3912	FNLB-Setup.exe	119
PID 1808 wrote to memory of 1128	1808	FNLB.exe	121
PID 1808 wrote to memory of 1068	1808	FNLB.exe	125
PID 1808 wrote to memory of 4376	1808	FNLB.exe	120
PID 3888 wrote to memory of 3088	3888	FNLB.exe	128
PID 3888 wrote to memory of 3608	3888	FNLB.exe	129
PID 3888 wrote to memory of 4932	3888	FNLB.exe	130
PID 4840 wrote to memory of 4824	4840	FNLB.exe	135
PID 4840 wrote to memory of 2536	4840	FNLB.exe	136
PID 4840 wrote to memory of 4692	4840	FNLB.exe	137
PID 4840 wrote to memory of 2464	4840	FNLB.exe	138
PID 4840 wrote to memory of 3304	4840	FNLB.exe	139
PID 4840 wrote to memory of 2816	4840	FNLB.exe	140
PID 4840 wrote to memory of 808	4840	FNLB.exe	141

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\madium.decrypted.dll,#1
1⤵
PID:1016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,13085751165633617583,4731562985565450205,524288 --field-trial-handle=1872,i,10328387389457937597,12889021767153670650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3120 /prefetch:14
1⤵
PID:2876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,6037241937582365280,1575148270295196952,524288 --field-trial-handle=1872,i,10328387389457937597,12889021767153670650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5344 /prefetch:14
1⤵
PID:696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,14723569058974079728,7773933242284773872,524288 --field-trial-handle=1872,i,10328387389457937597,12889021767153670650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5476 /prefetch:14
1⤵
PID:348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,16731330556680947512,4354291711677901732,524288 --field-trial-handle=1872,i,10328387389457937597,12889021767153670650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5336 /prefetch:14
1⤵
PID:1908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,9143441328575218536,4759193998073675495,524288 --field-trial-handle=1872,i,10328387389457937597,12889021767153670650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5752 /prefetch:14
1⤵
PID:984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --metrics-shmem-handle=5772,i,17188551130784895579,17831344269827747191,2097152 --field-trial-handle=1872,i,10328387389457937597,12889021767153670650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5508 /prefetch:1
1⤵
PID:3560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --metrics-shmem-handle=5796,i,5478145885763602545,5678574030054517766,2097152 --field-trial-handle=1872,i,10328387389457937597,12889021767153670650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5600 /prefetch:9
1⤵
PID:1660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --metrics-shmem-handle=5740,i,1574843409444464751,12888580809107610103,2097152 --field-trial-handle=1872,i,10328387389457937597,12889021767153670650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4620 /prefetch:1
1⤵
PID:852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --metrics-shmem-handle=4628,i,9259784179258970459,3801182096905070543,2097152 --field-trial-handle=1872,i,10328387389457937597,12889021767153670650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4608 /prefetch:1
1⤵
PID:3456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3404,i,7242004525797608248,13673769980089270588,524288 --field-trial-handle=1872,i,10328387389457937597,12889021767153670650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5832 /prefetch:14
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:2704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,3942602210590717826,1504236584967414683,524288 --field-trial-handle=1872,i,10328387389457937597,12889021767153670650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5340 /prefetch:14
1⤵
PID:4848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,8811946260065103917,10291053292516078202,524288 --field-trial-handle=1872,i,10328387389457937597,12889021767153670650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5844 /prefetch:14
1⤵
PID:392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3416,i,1089546743092756605,10374035117586325772,524288 --field-trial-handle=1872,i,10328387389457937597,12889021767153670650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6240 /prefetch:14
1⤵
PID:5032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2740

C:\Users\Admin\Downloads\FNLB-Setup.exe
"C:\Users\Admin\Downloads\FNLB-Setup.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Users\Admin\AppData\Local\Temp\FNLB-Setup-nsis.exe
  C:\Users\Admin\AppData\Local\Temp\FNLB-Setup-nsis.exe /S --force-run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1108
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4896
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\fnlb', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3240
- C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
    "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1860,i,7694004475069574435,4686721784364827230,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1864,i,13063598480981552999,18014551056918165871,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1848 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4376
- - C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
    "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --field-trial-handle=1860,i,7694004475069574435,4686721784364827230,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1864,i,13063598480981552999,18014551056918165871,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1932 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:1128
- - C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
    "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --app-path="C:\Users\Admin\AppData\Local\Programs\fnlb\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=604893263 --field-trial-handle=1860,i,7694004475069574435,4686721784364827230,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1864,i,13063598480981552999,18014551056918165871,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2452 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1068

C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
"C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1840,i,7270477817299156264,11430974308501043637,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,11192281771453093123,7531429985508859064,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4644
- C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --field-trial-handle=1840,i,7270477817299156264,11430974308501043637,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,11192281771453093123,7531429985508859064,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1912 /prefetch:11
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:2212
- C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --app-path="C:\Users\Admin\AppData\Local\Programs\fnlb\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1840,i,7270477817299156264,11430974308501043637,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,11192281771453093123,7531429985508859064,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2104 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4692

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\9d688b8dda73479cb63e84c839997e05 /t 3728 /p 3628
1⤵
PID:3328

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1068

C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
"C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --field-trial-handle=1884,i,8145983104008169020,2925057083488664789,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,10127290013929101427,7077866673117357430,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1932 /prefetch:11
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:3088
- C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --app-path="C:\Users\Admin\AppData\Local\Programs\fnlb\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1884,i,8145983104008169020,2925057083488664789,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,10127290013929101427,7077866673117357430,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2144 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3608
- C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1884,i,8145983104008169020,2925057083488664789,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,10127290013929101427,7077866673117357430,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4932

C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
"C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --field-trial-handle=1884,i,3456512813581668243,7451196169330372722,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,2480325439239801296,13150109987340410702,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1928 /prefetch:11
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:4824
- C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1884,i,3456512813581668243,7451196169330372722,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,2480325439239801296,13150109987340410702,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2536
- C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --app-path="C:\Users\Admin\AppData\Local\Programs\fnlb\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=652488347 --field-trial-handle=1884,i,3456512813581668243,7451196169330372722,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,2480325439239801296,13150109987340410702,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2184 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4692
- C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --app-user-model-id=electron.app.FNLB --app-path="C:\Users\Admin\AppData\Local\Programs\fnlb\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=657160004 --field-trial-handle=1884,i,3456512813581668243,7451196169330372722,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,2480325439239801296,13150109987340410702,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2464
- C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --app-user-model-id=electron.app.FNLB --app-path="C:\Users\Admin\AppData\Local\Programs\fnlb\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --launch-time-ticks=657328556 --field-trial-handle=1884,i,3456512813581668243,7451196169330372722,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,2480325439239801296,13150109987340410702,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2664 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3304
- C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe C:\Users\Admin\AppData\Roaming\fnlb\fnlb\.fnlb\zenith.mjs
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:2816
- C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe
  "C:\Users\Admin\AppData\Local\Programs\fnlb\FNLB.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\fnlb" --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1884,i,3456512813581668243,7451196169330372722,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,2480325439239801296,13150109987340410702,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=2616 /prefetch:10
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:808

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 56b3adbf18e46f82c8075f712785ea8e59e3125a90ce26b8b0d20687401340d6
MD5 9957e974f5f56a44037770c8a45dfb1e
SHA1 799090afbb1a0f8ce52605687d1013278a68516d
SHA512 3967c71752cebb57254c981d715077ebd988ca8b9cab6d81aa3207770139958cbd95991d2aa0c690a7aa5908f37cba8053f388896014bbe4e47b42436cc915a6
TLSH
T1A64149303221B5D84D436F1205286AC9A2EF478AAFAC9F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 78e03328f42deca6121e3a1b1c06d3d4587d610d609d671e17b1fdc4374fbb6d
MD5 ffd23d766477fc7f31d07cd1ccb39cb4
SHA1 480f32f104222c1dfe8ee8ab5a2183d9b90d1403
SHA512 b6e32b9a74f0cfc1de607da7998cf6b263f4d6d175302262ea0f24268e13e2221183d8e7e78878ea86ab915aa28012e8f4450f5dffd8103fcf3c3192d5bbe36f
SSDEEP 384:gL3H961SS1lWPcrcFRHEMd2lGFHonNvjs2CCe99BZjsjXd1mNx:GYSSMMURPElGJmvj7CCA9BZjs7d1mf
TLSH
T17A72B3AE614F26C3C8992378D10A054FF4F2DECD431E13C9B72A9E3B4A9CA5E507C598
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 2d1f44522810993e456e85e4ed290f80a20c647c42178e458b799cf3e0417270
MD5 6c7b058c319c66958fe02a366b397e2f
SHA1 e1d43a567d5309fcdebdf69a208971d8a9e37cb9
SHA512 bb4ebd7d2696405b875c80fc0726303f8217b49e5ea0e41576323ad49eb4f290826fe62470051eddf888f7371cf6c68d4c70a1342ab766c65236b129d2e37255
SSDEEP 384:1L3H6RSSpA9ZCEMmiR7HnHBjsauC6XCbFZSIdUjSdWN:t2SSC9cmIhjONXNCUjSdWN
TLSH
T1F1721AAD326F2256E5A123F4C412079BFEE18DCFC38856DD77209D3B158EA2540E91F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Programs\fnlb\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Programs\fnlb\LICENSES.chromium.html
Size 19.5MB
SHA256 7b328b8c7463ac9bfc7dc648c751533517c8441a0b5b21047d6c0b2620e60d70
MD5 142cea93256b2b7824b854c62af026e6
SHA1 265c66c606344122b35f20c68086890017a75505
SHA512 82c7f1c6f17ba0af42ad552062db614bca8cbb6c317a456d15c6199f11b031decf2c0816770b0004326830899264a5640796d1333c524979f9dfcf64d7b57fee
SSDEEP 49152:ZehWCrdOOoVo5TYp2xnuCQpc3txsJM+QAFId+wi4WMEAccr:y
TLSH
T16E27B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\chrome_200_percent.pak
Size 1.2MB
SHA256 30fa4a6e27c9ff2fb0f939f01158477e621a67d86e9ecb84cf11b3947db8eb9d
MD5 62dc1994f062c83fce3944c829165007
SHA1 1ab2de2406114a4c4e32ca3dc4d6f8515cb4d6cd
SHA512 1d4b7acedaa54d376764ea1709750cb102b326fa4a993bad7b8ef4c4961950c52541dd79a8789709bfaa5aebbed0c6fe5a781866512c56da660ea7ed2c55befd
SSDEEP 24576:73WBS9n2zLmmibkFR8+mZiqr8BWhQumesXRvQtgIQwuSXAkpbaUGQ74:73P23mNbkFRJmQ+8khQRn1Q68uSXAk78
TLSH
T1754522D7D770AC3EDD520B77939B20E0FD7600271A61190F0B26BD7929276C8DA96B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\fnlb\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Programs\fnlb\dxcompiler.dll
Size 24.6MB
SHA256 d3d1e235dd33811bc5073cc451510c5ef550ebacce74b4f4cbe1d164e9c84de6
MD5 72415ba4a6b306ff3023ee5cbc684f1f
SHA1 7abb7e1a1391e88fd90a5d66558720531f0cbd68
SHA512 dd04c0aa43f0dfc6638561efaaabd2ae98e5b8993440c7423a9998408ad77ffd3a13b30af978e040c3d85d4d546b8812c9699c276bceb259e5fa2f8509c9cbb2
SSDEEP 393216:utVBbnfisDYebTKnU82a2dAkluY8si98FVR:OnoU82axk2si0R
TLSH
T1EB472A122646D49CC099C879C7678B268A2C30E73FA7B9DFC0F461252B79DBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Programs\fnlb\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\fnlb\ffmpeg.dll
Size 3.0MB
SHA256 45c9e035d19ad0764100e9e3fbeb552b00d95a4ea20597627f9a91c404e79363
MD5 dae1bb657ba5e1c0c32f4035fa45aa3c
SHA1 d70b61b656fa9cf686aae80baf4841bb51016168
SHA512 bea38aaffd659264c5a9cfe083c30f58712f83d2b95496f705d72fb7637e0300e461066520cfbd249f641bd7601b9dd57bd2d472e916f7f3755a04d0f8f37a4c
SSDEEP 49152:81p5IU7Bpdk9imZDtoAwULMsvpTwDownIxQ2t46aLuXk5vTvhDbc:8lBOimZpoAlxFaLu05vF
TLSH
T13AE5AE02F6D251EDD019C03497AB9213F271780A8F205AEF17E05A253F66FE86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\fnlb\icudtl.dat
Size 10.4MB
SHA256 9f48c7f9c7c94d516a14870707e910ab94d75ae640ff6842c4af53276cd26ebe
MD5 c9d17441b2314fe514cd8cb951577c1c
SHA1 15cae4dee805f3e04171e00781da13fe40036439
SHA512 836d4f4fa591ee059dbfb943c2f13ded58a0f5048b5505214ec7105d0963106e0078aa262090d0dac9cca80995c7961a900ffa7a2af8ff315aabad1313bd37a4
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89j:1/cBhORok2HiXUxO/RJk3IWhlYntjdOj
TLSH
T1A9B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\af.pak
Size 621KB
SHA256 3017b141bd16e24190d810f0748612f0fd4352ca8553002b9a63a7f77f7154f8
MD5 cd886deabac5d290bcfe505aec6d2936
SHA1 33b05211957f11d5d5bb563258b585c30ecd8870
SHA512 b1c79724837e2b52e5015dcb9c0b93472dca52e1c392c5b6bec3f554d3b77f74b1a0d118ea18ddf6abc8dfa175b8717a1a6c7344d479c7246bb1783e5cb9ae96
SSDEEP 12288:M1MEn7kwUPQ6tRGtAX9F17ZrzgNslCFW+pyGpgvi4H2Jyn4NsmUAAL/5THozvbjx:Mr7APftRGtAX9F5ZrzgNslCFW+pyTviB
TLSH
T103D41B0AEBC1273D09A07696FA0845F7BB5D626CC770F2BADDA982310966DFC10BD1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\am.pak
Size 1005KB
SHA256 67b938d162bc75db067120bb8366b5bafd9a75fa99a0ca9ad4f46b47d1d37634
MD5 6d22dcd650f3157f3b500d609c630b76
SHA1 fb063a5bfae0bdc3649e772e9fd86c285b26f954
SHA512 c27e6ab4b09c527ad462b968b02d1bf85205a62f16a63bf0b97a26d1f979c69113799cf8794ff2ddf3f1a3d360d267811fc4990d1932a788b9b6e653399bd091
SSDEEP 24576:O8VvT31VYRThTCKHyWVt10RTjHgvvevzFI6XdOdvwilgB1VewHZtPoIp:ZVZBF
TLSH
T1DC25AB547EF9F7570F8E8A1994320E4F9594AE4652802C38C35AE3FC2B2DF1B4DDA219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\ar.pak
Size 1.1MB
SHA256 a6eb037da4ac7930a8661c8bf602deee090fc4409bf4db24db8aab65c89b1d06
MD5 8edee8a2eccb4c26a496e9d04838282d
SHA1 27d322da64b4b359f0165fe01eef96884db53d55
SHA512 c9bf8573f5fac070399adfbb6e34780c61e31c68f761aae60328e1a73178d28007bcdab8a81000eb0c735548be01aabe4826c35470a3288942564644b365de3d
SSDEEP 12288:rlWarBHApLxC14Gei8wj3ri2XYrvZU4pbk26ISeQN7+E6W0ZYJ66:zIEj
TLSH
T12D357BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\bg.pak
Size 1.1MB
SHA256 2eb9c74c67e4b13b45a73061fa978738e335bc245da71bab0ea9b205fe91074e
MD5 651366d5dc136aee8364ec625a917f9e
SHA1 9bfa9240d8e675a00c77608668775d9036c9a0a5
SHA512 90b84232f84cd67e88ea99af7f274629286ae02c292dd610ef4efeaa7ed4154ba7048e415f62a5c98fb785c8e4377deabead87aba2cefc1fed7a3d3429d52019
SSDEEP 24576:uuI9WglWLYxgCzQkEC1U1Vb6lNs7e373ZGm+X4KxUfVDIohD74uOVnaNmu8BtTJ1:ux9WglWLYxmEU1Vb6lNs7e373ZGm0dU4
TLSH
T1D24524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\bn.pak
Size 1.4MB
SHA256 415621a5c0b1546e6e447d43b76414425a8703cc7681d637ec1f283ad0c787e7
MD5 668f9188aa073a9a1c706fb67bd1de92
SHA1 9e0b1912544d3c722d41ebbce8abcec30d606c69
SHA512 60071949463a9029c15b5f85aee8c2be008fa97bae2e07d11bda922ad92066cf92dfce0d25115c12f785c94fe1d5aed390fd29cc47fdac6620a6f16bf401a5da
SSDEEP 3072:cCpCO+qbfG/1xsOktuHrcKqt2DOUzhUygJfGCARuItWNAypbjBbLR3QXQcjC8wkz:cCpfFfGr7ktuHlIAypbjBbmwOqM
TLSH
T16865EE209C6E81B6A8C5CDC9434C6370C123AE9B9B65F74DDC17A25538ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\ca.pak
Size 700KB
SHA256 6f28297c1ccb628f534d65dade167ae559f83eace359acf47e48ff890b9409d5
MD5 ddf227a00ab2b50a8de153edd0309499
SHA1 aad2e096c7b13afaaafd01261602fee51723eff7
SHA512 f10992e172cf225450dd4c90496201b19f30a57247c87a63313addb829551e1d07028f53a22cc6a94f4413963da6517aafff2f54480ad25ad327da95d8967010
SSDEEP 12288:2ztZe+rqQR7IO4yCiX7rmipFa8i5PsFzN3Mw2juwwPR9zejm0t3ltuFTjK85nCRC:stZeYqQuI59L8wWqTM0zrcC77JEw
TLSH
T1C5E4F8239BC93B7744D3331EFB46C253B48CA9847A06D254F4AE0B1622CCA9CD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\cs.pak
Size 725KB
SHA256 799a789ce531991cb975425730db310f9a8fe74091eee568f3e65fcc7ef0cd57
MD5 3a0e295c5386eb3ad6e45a38fa8e47f4
SHA1 f5b447f009a49210af0d53358be73b737df8390c
SHA512 6abd677d06ef1297beb437a8e76907d3ca69d005b3616280e2761e690a5a2a390059786e59427685796a80d75219dcb0276d861f93e0e57e775c9ac89a33f81e
SSDEEP 6144:1ozOsvAJKTtn9093lBlu+sV5ApvDEAdzBzB4DVw8OCJSBs78QXss:m6SAJ2aWJV5ApLHzBeVw8OCJSu
TLSH
T1EBF4391EEEA36425584002487FBE4228BD5E83540B6EF5BB7CCF9C912575B7A8EF0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\da.pak
Size 650KB
SHA256 9a2cd25537a4818897481ba944981e8aee3d89c7ad37588d02f1deebff3f62d0
MD5 8f269582659ed33ada04721915062e3e
SHA1 a75712303ab59a929b922a8ee6e0422d690cd045
SHA512 6254d6a3950549010fc40da41755eda605b7f86633a9febedadeb1b8c3cf688c225e6d26cd14e98d7fc7567cc87926b7dcaf714a1df63ca5dc975e2ce4e75b5f
SSDEEP 6144:cEA+aIRt3zVmf6J/Ql5znDXyefnlI6E/92IY/wlUYJw3zbFNVSpPzv2TLqGs5LIR:5aIRtSdIKav2XDsaJH
TLSH
T158E45B4BDD9C732FD9A90729F3108DA7EF6D543CC684664F64D8943A09CBC6092BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\de.pak
Size 701KB
SHA256 fcf63fd89e613a7ef69f16054b97b3493948e5c665aad180a91d3635256fb7d7
MD5 098eb9f6f26f22877147b5ec9e430fc4
SHA1 122dfb0f1422188f7ad83b2d6f7298631b1069ca
SHA512 55bb3b30474ca8a78f7873ef2b17c75d2fec3203727a2fe8bafef74e5ee391bc8ab71bd1db6814a279776073123aac3775f77d8f2df0fd39bbc3c05819793d31
SSDEEP 12288:H6z0eZH5+8s/pEOwENW3K7UpkZEgyOqL9l0VXybQUeecCtO:Hhe55xs/iO5W3K7UpkZEgy9L9O4oCtO
TLSH
T125E41803ADDB625ED78673617705CDB77B19E36FD342312A88EDC02B650B5B283AC522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\el.pak
Size 1.2MB
SHA256 37d2e1ef69fea9bdb1e0902cbc61a458baa9009fc3761029bd1c1882a7a0c9b2
MD5 6b335073ea816b2193fda87420a8666c
SHA1 008e233d6450160f6de6527ab577312eb2708e3a
SHA512 c2f9f9070a605611863d52c42320b08a6dd6f36a148042f969dfe461f68707591575b9625b8f47301e2e9c6183cf67662271fbb613058333026faff2370d789d
SSDEEP 24576:BD9dSFbrxq539bk2tHZucYAJXDsSj8msAcByz2HSegLC0LqvMIvNAHx+4BWyjsHW:BD9dSFbrxq539bk2tHZucYAJXDsSj8mh
TLSH
T1D355BFEFB4582DED8046950785D8B07C2BC66D6CE749CBD8622DCB60BDF80719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\en-GB.pak
Size 566KB
SHA256 01d9200a5daee1770f7147b166d25baa6a8dd72c138c3c526421e656dec789f5
MD5 3382cf191387958d2dd901f22f35ee12
SHA1 8820631a23d2cc48465a619f42b4a50863c20b51
SHA512 062f6141f1f1c2a2f6900f54acff263c36313a579ebf13856b4861ee7ce8fab551fde398639283c3535db49e4f3ae26368f981ac02c1a095ec6137498a25d44e
SSDEEP 6144:q/Jlh7uqK6aG9NZxjTixh+4EYDNSPzELMxNiMP9Uh4bifaY1x+VKpDgBc7RK6:qhlxEk7Zexh+kNvM+h4bUhDj
TLSH
T161C44C1FF784122A05935162BB0AA562FF23D07CB36112667CBD811C33B6766C27B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\en-US.pak
Size 572KB
SHA256 23b271e8009bfa14783700cd0712b4ecaa5b8f2ea28a4d81ae1d7e05bc0c96b1
MD5 3d66180f21df40a9eb941814676972eb
SHA1 b74b6ceba72cd5ca9e662acca19285037995c362
SHA512 4ef14702236e389409bd875dfc0b3f467f8b15c9e97c13dacedfc751642445141de31d6ccc574c8aa4dd788c2e756a16ded3262eb0c577b2b0e82ff526638efc
SSDEEP 6144:pUTO8xSUd/7b7/wg7HfwKOF7Nt3/p9XhMP96hgREfaY+43Um8tjmngcs/wEwj:mqL8f7/weHfwpNbMUhgR2uj1wj
TLSH
T12AC44D1FF784122A05935262BF099572FF32D06CA36112663CBD812C3376B66D2B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\es-419.pak
Size 691KB
SHA256 6ff6ea0a14da50cacc4b72ab8c8c7b49c8423abb64f6a3a7f1643d8c3c74e6e9
MD5 826089b2c92b1065a8f2acf09bff48c8
SHA1 98adc5c1c5852359d93932d4f8d82a14e2856aee
SHA512 c3ee92f0220775d058709d236dcbcfca28f76be48ae994d9767dd9b3c8088ac03945dac766ab944c3fbc036bf490d63c62380d9740e399fe97fea50b70b0c0b6
SSDEEP 6144:XLESsa+eyeBOFaU2tGSsSno5qM7zvsYTQoZ2zgrOJJ85A26+ZTGm/X:Xns/eXGvfSFoPr+2OJIAoBX
TLSH
T118E4E722BAC81F5314E3A388B743D753E8D89545B408D25BE8EB876522CCF8CD967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\es.pak
Size 687KB
SHA256 4578e08033967a5062bfd3b1937e711df84571d444e4940b8ffe5366bce4e778
MD5 74be7e2188f212c3ec5b2b0cdd40a13f
SHA1 e1c0ce5411129702babf1e7375d2ebd981626acd
SHA512 1ad8f1bb5890717ae3a01ffe69e1520529fbd664aeae3d1ae91f196bfad59620a615d0e6572f1e0ff457623bfc00fc3f9c05d9a8571fd759a247f9337ab73e0f
SSDEEP 6144:Hz7Y255H4JsbxtEO1XFoiDgdNh+TU3cWFGDZ8jAOKhJ8aW8tWf6k8+6PZCud:HQ25J/VtAi0tMWFeZ8jfMJfW/fb4
TLSH
T19AE4F726AACC0F6314A39349B743D753E8D89549B408D25BE8EF876621CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\et.pak
Size 627KB
SHA256 dd1205eae606f12510e24ce39f301439c98b3293d766ca5839dc292a14d7973c
MD5 1b82280edac606f3d7c318bec8a86f7e
SHA1 3304de615ec541211608f24c22b55dd96bd92322
SHA512 eea35f302b6e61865c4981ada63209f52dd78f33b95fe1673340df9bff191ed27a40b6522d730fdce5c07b236e2e3759c26fe01efafa8fa5dd2efc6948e53b02
SSDEEP 6144:yGJvIIlg3SnkZu4VcBzVOL+vNnnyW0inFaXSOJ44LsxfBPOCXy1gX8ZV1aBYvNpy:yATgioVVcG4NnfnFaXSyd1aqvNxqnzP
TLSH
T1CFD45C42A27D771B242412F9E737A937DC9FD7D8B4000D9668974A0970EEF8C38B6B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\fa.pak
Size 1.0MB
SHA256 f3675255feb8b054717be9e92e93289262f35e82f25f2f8de0d3ebf3865715af
MD5 dc57426d1b91399785531b8dba3cd3e7
SHA1 0c92c0ea4963d0b1e3fad9d0bc978ee6bec7b948
SHA512 c615d33e39aed7e55d5f23b4a31542cc67c6bf4c93f440bc31c1f83359f587ba1b0b3e1e6282d0027bb1c03236803e0d5660252f01160b502f8af36e36c2b1fb
SSDEEP 24576:DMuH/8u313uyqoz+sw2LYRmXnloThXtCfGk62Yha826JfigXnMX44OqlULakI021:rf
TLSH
T14935B1956AAC9AB25747CA0341D33834C773EF12D349FE40ACB1076609A5B139B5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\fi.pak
Size 639KB
SHA256 1f3123d7fb5c22a95b5250ea17450b665c3c6cd6a6dfd28bbdde15e1bf684a0e
MD5 26071a88b56d045fcafb610c6af8f9d8
SHA1 553bbd02c6e97cc47aab8c3f03c45c55ad168983
SHA512 8ece18be3e368a03b95092c65e3a27b2030286144ec9815cb011264249d938ec651f4f8901d9bea2a1552607cfe60dda85156ae3d1fc10330aaedabf6f89f7f5
SSDEEP 12288:J21mh0Ki36193qYvS3aAYNpv6IGp3Wa9q7Hg/:JVh05RRaQI2
TLSH
T1F7D46D915215C22137C4C29EBDB0903EF5E5E39CCC288D96E843CBD949EA9887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\fil.pak
Size 724KB
SHA256 02e2c70d3d85b0deb677a9ae576ae3cf89e80774532cb3315c14f1e8ce64b310
MD5 bc775353314653b56a92b19e25089e2e
SHA1 deca4713ed0d95a96b6bb857c683d9b7d8149181
SHA512 a59e0fcbae921c3f33bd2b9de052fb4958d1ba8e73285b2ac2948433dd13c7d95bf8f1fa5d257372375ac522dbc7b94ebbe68fd3958207556013a23ee5a1049d
SSDEEP 6144:sq4QFQ/1nfokC3ZQoM6qFYNFDQIG8xVz7A0gp2ua5vwg6MoZHA1JgiW:shQ6/xwkCJthNvI
TLSH
T11CF4D715B3402748DBC352E56264682F6AE560B83F81786E4FFF269B3BE7CD5D270182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\fr.pak
Size 745KB
SHA256 4db43f1cfba1ed1d7dd347d58fbab0b8d6d89dd008a3b9d2436d8744e3363453
MD5 00ed9456974b5e044302527d54b8c12b
SHA1 007f201c489fb44b7e3877802ddee971ef6612ed
SHA512 bdebae8af70450cb31915ece362465fc37483603a1b52053b0510d8e9b89b1ab9ec6e6f0929411144034a111c653aed9bb345e9bf85a6d2a4eb68028f1e5e86d
SSDEEP 12288:jl9g59yocoZLFCW14PGbVAZgjgiu/WAMnS86Qua6gVA8DvjH48Kh0MVSiYnYPe76:Pg5uFqV6lwC6o
TLSH
T16CF4E65FBAD432CB19C61273FB16D663DD348248F215E300D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\gu.pak
Size 1.4MB
SHA256 e86e8c240d4b6283abb03c49df9e8899607ef9def6d4933c7a541d63b5835271
MD5 d951d00d45269c6850524c5ebe07de7d
SHA1 bfb100d437d2d94095b99111af48e41b6bbb3e31
SHA512 1d12fb98bc3f99f3781c8f6ea9b8686ff46195b515597362c980455d0c4078b8a708bfa8814831420452aae32aba4292e6fc68d3e23fcff8c58d5e40342c9bc8
SSDEEP 3072:3l1X+w3eMGwqlcdzHnfWGtduO5uNCPv0QaPjAwREJKVMjNiT7llj63rA8lDcSi53:3zuEXljWGm6YVsAU+hCR1Us1C
TLSH
T1BE6518D0D7B9F07019DA9F7E819E512086699343D57E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\he.pak
Size 906KB
SHA256 ddc1f304ab1f4489d19ae2b31e7f8e3ffb47dae439520159e8975422c65e4115
MD5 d4b804bf7dc9e7118cd3d38f128cd7f8
SHA1 7a95738e91da1499c3c551fb3f27218798aa2c7c
SHA512 2a1eeeb23c4c18e06592f4af4cdab369463919f359e81a5ab23c3e20bc74895a217603b8d826a125e67a13764ded1583e0af7f083f26f0dfedef79c033ae0007
SSDEEP 12288:PWPwMLpWzu3h/aP4n6nZT4SCVu/rcW0rVWvIxLdN3Za+uiJAEVXRQeQCaj4MlB6t:PWwpf6t
TLSH
T1CB1588C4B2E492255131AAC39FA5FA285FF3CAB53CA27512CB14526CAC774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\hi.pak
Size 1.5MB
SHA256 10a6f19c1982590e33476427dee8d4293b0707e25dc536d6394b5782ecc3b642
MD5 b23c8982a83c363566730c2501347f8a
SHA1 3049610378a71bcf89d90b418cc6f67ecfd32c4f
SHA512 ed2b962bc6c609554ae1354b7553f21db46f29f4f4c2ca3655301a2d791720f103d9bd2eba4e5a95323664bc4763995cc9281ffa916f35a0c917a8fe4e4f08dd
SSDEEP 3072:3WhTplLLsvVWjC+FDejZoY44V/B90ZV1dhuBlOvXoCDtDWejYX55nFs4f4/jtRO4:m+v0O+e9oY49Ik8iidSm4
TLSH
T1EC75F40CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\hr.pak
Size 698KB
SHA256 d46c64ae8af3562e37eb80438aa2bee228fafda251d58ba4d0991291f1c72aab
MD5 8f8a2f1da61e896c7c2cf641726c081e
SHA1 867aa42a911833025ebb4cc30c14614732815be8
SHA512 90e299305b136736934dae850abbce858c5910995259a94468cf47316880fc00274e6f53fe5c6615c8f98c0185955b908f4f08dc144721dcfbfb76bda32c5716
SSDEEP 6144:Rb+L1GEcwOCRAHRG28sirAIu51KrX7K2wVO/ujQ52u:RsUEXOCRAHQ2VVggOmju
TLSH
T189E42A7DBEF2570A0897B24AEFAA43447DFD08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\hu.pak
Size 747KB
SHA256 0a46fc8d50f74effd1cfe1979e677df3de6fc47e6b551267303d93d57bd83f50
MD5 d6cfdd7c401a644dfbcd8e66c9702192
SHA1 2a1a0b58795ea033e5f8b28cb4046180db188800
SHA512 e0cd08e23dea8065656832f696a8e0aabb6c29874ee5140c1db4a211828dd45580b4a82e07518066c099b9aaf0afa70d88d720d4d336015cd48ec201ffdb80ec
SSDEEP 6144:q8auaOrooql8FACP/XDGBrT6Nn4HIuxiXlH27lm7FW3gAezpruS85S85Z49Ka0Yn:q8WOklmxP7zXAi85S83y/7LY1k
TLSH
T162F45BB79376944ABC6C179778643F15582E481BAB2B31FB2887886D34A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\id.pak
Size 620KB
SHA256 f567569c42a25bb2dfc5c33e13aac558c0e2a1d5d4b969592bbd0841b36438db
MD5 3fc5ddd09ea15b88504ae0671979f58d
SHA1 a7f2450660f45e1a860fe036a892a7f5648ef1a0
SHA512 2985a83b41ef90095b49214ac4261b873bce9b16f5eb2b7c974281afcb130650e6c176923ad6d0ad5dbf42541a866ae5663902ae6505e2ed6143814a68c1d7a5
SSDEEP 6144:6/0X4JMvgCGCBUZD1z70mQVqpffhTFjlFlLmBhpvh3xE65jXhBVbm2iTvxePHsE:6cIAGCBuzaozTFjlF9mj265bvz
TLSH
T185D4E8632ECD310C194442D9B2CEA91E7CCE233BAF05B76E8E348F7055A67686716BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\it.pak
Size 677KB
SHA256 899be10e8f46f53d9bbe7cab827fc17b7c2bd7184e31791688016e2ca4df6622
MD5 5c92bce91523a4106a653eabf79b396b
SHA1 1e72af5c303a7273d2854b12c2773e90d953a487
SHA512 8588b98851e292f5ac96b1697e5603c49df43a409518bd1db0355de108246cd9ddac041beb800de1fb407ade53bdc68fccfd77c79193b7e475c46c2dfc289a43
SSDEEP 6144:1MJJq6cv2e+rxtwaiXBRB73N+5aIwSbmCfEs61ltC5jhOfB+QcrMppzSj9f3wyGj:1M+2vLLo8yW5uPHfIYH5l+pW
TLSH
T16BE41B3AA5DA211519976359E611B185FBBAFCCCFE41721CC99B031C22CEE80E1ADF47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\ja.pak
Size 822KB
SHA256 9370c20a0612f5874dff2b015f31482e167eccf1b3c1d1a2efc1c2e38cefa88e
MD5 68725e6d47e22e2e7e921c0231a37d7b
SHA1 b6a487c006c8eb2cfbf81ee801ad4ac65636bc9e
SHA512 87d934475ea8c0cfbeec35bb1d2d798a15f1ab06eb2d62790103d9be5c1b0dd347ded6d1a382d56a4709dd67ce9e618d147034e29cf174ff8c2b7b0d2225e97b
SSDEEP 6144:TkAXo72siMuLvQHciTp7ZEQ23O6fUxbdJaHczcmoVa:TBX82dhLoHco7ZEQ23OSUnkHczco
TLSH
T12205507CE3C969369D6153A22C4E36E17506AC9BFCA23A3A443DC074BD707CEE415AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\kn.pak
Size 1.6MB
SHA256 af5fed2130102ecc0c878059c88faed9d6db2e8b147fb5ae9e15e3fe69706c8a
MD5 254a621dfdcda79b0e130eea6b295e4f
SHA1 0a619e7167c51f8130e815573fd9d6b35b339dec
SHA512 62b112893735452519ae2e10a4dda74bfa42bdbd67ca41f7006f5eaa8e0599e686e2c2f05e09b60f8953decab47590d9ad36230da777ca00c076c8418429fbe6
SSDEEP 12288:Uo788nG/ywDkewDScrOagfNuLBCj+7l7nmsMh4iVW9Tmv:hlnGf6Mb
TLSH
T12E85CD18ADBA7D311BD5006B24EC643ECFF16BE29CA947C2F4DDD7802C66C6A90825DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\ko.pak
Size 701KB
SHA256 0f5bc49c4d35bfea1563db6eb77a074c65b39b49a916cb35a022ef96340338f2
MD5 a2e10a8fd9c595189e3990b20bfbf8dd
SHA1 c7748e372bceaadc3978cda8479d2e017160c212
SHA512 b4f50994931f2e23cd8ee856f87ca6ff7a940f2037f371da3b73c8fadb56dbe7fe51444d906bc0f8e2e1c262f39e88449b51f177c0478d5ba63f230a48a4f30c
SSDEEP 12288:mq0BNgWqqZ4kUM1WNiPszcbifYj4ZGRyrD7bIFPgssDXCFGIE/xESJGGLhwVX0C6:j2wIRPww3+6WV0y
TLSH
T1C8E4B6F238DF63C91193CD82AEF4FA198382D976F75302A4ED44CE449E145D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\lt.pak
Size 759KB
SHA256 af969f4407c190dd01a426fa1244cb1ec7cdf2909d1c3ba5b87ff662ba567303
MD5 d67db6a28c8f559d1273a460e93a5876
SHA1 d26c98cc980c9817d9e2b53be6d848036374059d
SHA512 7f9dd0b418089e214fa4f16c994d7c1bc9a4fdd816e0ef2fb9a93877c4fac7b72401804ac2eb4fc43ba81d9d4778b7f3da6c3b8cdd1e88287a9713b71f5eccf8
SSDEEP 12288:0Yl5uPBw3krMNeep3Utdpy2L71aQYj98wN6j6SFH:0Yl5+O3uMgqSwNOa6f
TLSH
T177F41C0069E3AEFB9A5467C981A8CA74DEFD50009727BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\lv.pak
Size 756KB
SHA256 27e20dfa5585161ef8b641f628aefe6c88d9f9590ffedb647e0c9da1cacf219d
MD5 c35c4e025561b340dcb57430c912119f
SHA1 7b3f2c5b8c201d447190eb57b6d8e42da70c699b
SHA512 7928900920458ad3ad594d92fe1dec63d4a5266afa019bd5aca423719776d4b6e0c64cfee81f33b1a98bce0600e55c2cee39c8467cbf5e0d428d661ef73d1154
SSDEEP 12288:W7F1gskiXWSlZ70XM4CPPrJ0mn8cBTtStX+Gi:yFkiXWSlZ70XM4CPDJ0mn8cituGi
TLSH
T14EF42B959EC68FA94D904DCB732AD122A8CCD740FE07F112ED798B3A560F52432B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\ml.pak
Size 1.7MB
SHA256 b5606265910e45098a88e989202a550531f6d00333c6b112ed4c5cbc07b2ff6a
MD5 9c29191c67c3d9539df9c936d31ca2aa
SHA1 7554192d90ed72687ae5920e464f94210177825d
SHA512 ce792fcbf46b0aabf6099904ddb9284d641f1dcf8b5ae75fdad04147affa78e0c3f109e5e31e3e884bb4f89c57c1d38c558c00e945fc54c3059c94e205a25f73
SSDEEP 24576:WiF/U/oZAuuxyYl+9y9XBkx/etEWaKfijHeBAzXT4+v2kiNk3Ma/W0b37:91
TLSH
T1DE85AD57A036CD3B0FD102167B4E2FABCD5B9FA140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\mr.pak
Size 1.4MB
SHA256 8465d4077ed5414cbcb7d9bdb00d85e515a1a069703cdc1d4d67c9d6e5623fb0
MD5 00192057578bcf97c8fdf81963e473aa
SHA1 d3441e0dd2dc3e840dca38400710ce017855d53e
SHA512 c623512e7ae3ca0acf7a65e757715449892c5241822d9f473866f742ca52fa5e041e4e5fb0d9a590870d27198e3a72fec86bb59a1831f0c9f5cb0ea1473ec4e9
SSDEEP 6144:WUASC3+M3K2rwb2XtiWUEFBhAaYRbIl9Bk5mty/DK:WUASCuMaWwCh34bIl9Bk5mA/DK
TLSH
T1B765D24DF77AF3685DACBC8E36540D3BD8FD31B1C3E9925648E1B3A74884CB401996A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\ms.pak
Size 652KB
SHA256 af7021a00befa586aa067ae3ccb339079e6f13ee0cab1621836f6abb608b6f2a
MD5 4d315df981e03002091c3320cc9caaf1
SHA1 4d3869a0c4d59d808918687436c3b56d6763c6e2
SHA512 969345b9b60fa3b9344e07a14cccb48df24ca09e3d1872546d897c64833fe7cd81ecee03dc7871f87002ce2ae5a4001603ce9116192b418a4dfc686d87d920f7
SSDEEP 6144:8O3AorsPjhhrF/t3pAHglSobUHuqwjroR+DhyWSzAbaR+Ulw7QCy9h2zR:jwfrBt6gMHuqwjTwrlwP
TLSH
T13EE4C6579EDE3118085843D9E2DDAA1B3CDD3332B705AB2B4DB08FB0166E7A53315B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\nb.pak
Size 623KB
SHA256 d97a2b0cbe6adc99add2ed3ce0d15d0bb124b778086c466c126634d60ea72608
MD5 820ea44fba453034b2a8ee9bd7e76611
SHA1 bdc2faf8211ab4ce0f175b6f380ba1d252661d8e
SHA512 a3fb0a5e05d597840aea11a3105fd3c6f6cbdf15440df3733447c1359b0669ae4be3a94d669dd3e27f2da93e58249956af2dc3babad45e9a4259a03ae75c2f44
SSDEEP 12288:fGkyTyHOJDAlQSoU/Op7fDYjG7PGcu5lBoU42wW3:OkyTyHK8ofZ7PGcAlBrN
TLSH
T116D40883EE86B72EF69442A8F518865B9B7D943CCE98199B54CCC52E0CC7EF052BD1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\nl.pak
Size 649KB
SHA256 9d82c384fbb6480c7a6e721c6bcd1f2cd19665d848b056b5a2911504308ba037
MD5 66875b40b0226463846de55fd1eb9f3c
SHA1 322d02144c14bf328b10a0cfb00aca65ec7f18e2
SHA512 4b2c3b1e4001ed1c3a9f237187c18b731849d2818f5b52daa7b64c4b91cc6b6178b01f8a846fe7643d86b01f6976257f470c66f67bf86a43e484c48c5ab5ae1e
SSDEEP 12288:sKl2A8IoRhAulbJWQuslUe+Kg3MHkTFBy7K9qHhG1J:/ARhBlbJWQuslU/MHkTTy76qHhGX
TLSH
T171E4F907AC8E253E59C0A349FA084BBBBF2ED22CC26CE67DD4EDD5341443F6851AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\pl.pak
Size 724KB
SHA256 8a0969fc743d3e2f5111387d53c0d79e8c1d9f68256ad6553b87fca2bcaa7e6e
MD5 bfb7498aaa8f4252f8fb5e521a3e61b8
SHA1 c89c6944d186987a9cb5be348d01bd52c7287bde
SHA512 9d73a56e374df5b135f85cf3fba9f2d99fbaf89110563db007d85d6e3e14c840c35905c20b3f5015bd79499f5b17de18d21614c4611b020c980ad87da5fb5e12
SSDEEP 12288:felyrOtK+N2tfQfuzSJQbZ4brnPjCUdye3m2UawMAmo1QhalNRPvLoolyOXd:GIgNrjwMQ1QhQVt
TLSH
T1E2F44B0E56E59A4E8CA008E6F6EB1B7CACDCC808F108D35FE45F452A619B19FC9BD5C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\pt-BR.pak
Size 680KB
SHA256 8272a84e2e6658dc4da17c6bd21995011fbaa6c328efafd24c4ebd4fe2e64916
MD5 1fb1aa4f9ce6069fda5d7092867ac4a2
SHA1 92e1c8f9a43330edd4aabac925bde5972854dc0a
SHA512 5c51e6a38e9747e339aeced9af15223228f498670ee51abcfd90f3dcef7b903c97621bcfdde2fa6999774c4aab13490eef8bd2f39d891827b71e206be52c9d64
SSDEEP 6144:byhojkOK6gLRGVM9NBXBLdYchaNyza5E3pzu0LsRyU1y4:bYGkX6gLfhEEgasRh1P
TLSH
T156E42B2E6DCA136615225350B75EEB03E5C80645FE0ADA87DCEF4B06A3CDE40D933BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\pt-PT.pak
Size 684KB
SHA256 bdfa7264dddf70f936f1785737969559a577b51d1952c820a468c611d18b17ca
MD5 161594d74a17bb74189e1fab6a3a99a1
SHA1 41332934f91785e616fe675317adad4a74f275e2
SHA512 81c22b6a5f2c3217d56f323cb63596ca7361a9636a314e192674c38e4807b6258c2127a603ea8b827c703abec0bb6f2675e149b0d3aaf522ab5e1d35452be40a
SSDEEP 6144:GSp8Fahf2pW8kuvFieJVJJxh/SUxNwyf8mBn9ITNKSRLc:G3ah+pW83LBn9AKSRA
TLSH
T1F7E429286EDA136605235351770ADB03FAC86655F809CA87C9EF0B4272CDF84D6B7F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\ro.pak
Size 711KB
SHA256 1e6b5b0dac63a9e951daf523de310f6bd9e5c53e281f37706d41bd35d2a08bb5
MD5 42b62d8b4ae6c44d00e8324038884bce
SHA1 4227b5185310d602cf78b9b181afee118b7b739c
SHA512 279b167f4ee8902259095e6feef515848926be23fbf566dff20520a664f1bc048444f119e8f12084c53ca6c633ff261b694e28fcc6786282303500153490e992
SSDEEP 12288:mtj+AUFtka335aKPBJ4RJBDepv5m0tsr/+Y:mN+AUb5m0sH
TLSH
T1ECF43B23A1C82A972D5152B2B73935D3EC8D105DF640E28DA4EEC97910CDDDB852EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\ru.pak
Size 1.1MB
SHA256 52a31a7ca057b8c76208620932120927a089502ddfb66c30de4324959f9e0075
MD5 b807c6dcf6530310eed1a97d260d9850
SHA1 e9870241cbc63942f5c4720930bdb41a798564b2
SHA512 2394b9e18338f5286053f52d162eb7a29616b0529230a9a407575b3fc6c9319147d83370404a8a4bf2cc9d6a7d7dfe30881ecdd7af67f15281de08dddaefd160
SSDEEP 12288:vrEzIAfQeRo4YeeMObzJ9sF8aTjBL1gJqSvYsqCQKki6vR3Fo8N5K4ZM+MYHenOs:DEFL2o3A
TLSH
T152458760669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35219A42D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\sk.pak
Size 737KB
SHA256 a53551e8d251fa01305afe1d0d187144c56bfdffd5d1aa9f96a9350b96c0a252
MD5 2ba55cf57be2147c064a259d08ce3550
SHA1 573549af46fcef2763a620af6806df45722cb7c6
SHA512 901296af8da1ce4b8f9e77afdec85be4f17f165aa71c73303c97d91e7a0592696725d22b9bc00840c47485855ddf49d2b2406459ccaa2ea20c647fb2b4c1c4ea
SSDEEP 12288:MT1NIunNQL7DF562AexuBYinyteLKo1nszYkxb+mpTjsxt9we:M8ui156NBy3Ykcdtae
TLSH
T193F45D3FDBE7181E8E8D0144FFEA7110FDAE86508A4EB0A5944F364714E26EDCAB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\sl.pak
Size 705KB
SHA256 e1371c8df577b979e3a515af34b0aaa3d07153c7a5c55d39a9b49a7ffe62d3d2
MD5 acb3ab2a8c329fc279c544dfbaa0de24
SHA1 3db50d028705d92eb70890afb3870be04a15bcc0
SHA512 67842b58b8d7e2bcb189eccec9a3fc69d1ece7bafc69366582fe79b89cad0989858720db15c5ffd56ecc099a26164ae4428635ea4bd2df2659f4acc4a5cabb05
SSDEEP 12288:kOCIF0cB2t2TraflWH1ToJ/i/fzbanql/aA:kOfFv3af8H1Tqi/fzbaE
TLSH
T102E42C397AA75E0F0C9AB2CEFEA606007FDC044CE251E6A1FC4F336A5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\sr.pak
Size 1.1MB
SHA256 be4ce17afac24dffc1eb36609cb51e766e77097d6656b1008a2a825e59609cc1
MD5 fb8f7a2776afe0eac16e9a43b6fb0601
SHA1 ea6697f343cbcdd25ff8b4aeba3c77e9ca8a20dd
SHA512 702684ca6b7506daf30ddbdccc98d08657887e1a68ff105d65acfd170da6bd50ca301ce86fa4ec9645f3e78c4e20b9d2d9271740fd93c859aae5fcc55a9ff223
SSDEEP 12288:c/gCTfk6F1tc1LcIMy3S1dRBCm3i4xsJmExKVVhvPChxV1T37Vbu9D/k/E:c4scWzVChO
TLSH
T1133546A19B9E64DB0901F41BD808BE493DAF41FE3FAB975211601DBD34E10B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\sv.pak
Size 631KB
SHA256 8bdff8855d23c739ece357f653c0a17bb36fe97577a5761912080d057ed341a5
MD5 4b9547213c2ee4e0b6785c8f65e1ee84
SHA1 36058595a34932a2820e3515c8467c4888d54981
SHA512 1646f96607bc68f4a92a0d4c7bdae7f2d8ff2cb1a99ee858828c8359f69ec8eee169bf3ee750b5a0984029cf2c4890cbaf3d547d54116155cb51d9680575c53f
SSDEEP 6144:zE6QThwkBUDnfjdInisqkqQCJYxqxEFUlTOe+9kRRFczd5RtGmNS32M0hlMSOmU8:WCY8y5xzLixM
TLSH
T19DD41B438A60F526FA72530DB608115F0AEDE25CE3F2954EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\sw.pak
Size 669KB
SHA256 312b225a81cc3cc15f13f80c45dd0e0bb3655d31873d2956861207e70c33c1dc
MD5 c4c4d34f79f884b662eaf269c632055c
SHA1 ee9aed1f7b419f215afa963ccf8e5bb39fa9c05d
SHA512 1c976932ab622559c2467787fe56f14dc5fd1377aabc0572d328cbc2ef9ab6e1f36f4f9038ea66d160d53decef87fe35c9bf5efddc25d19129634ab219160932
SSDEEP 12288:9PtihCcscjas5OuexGF2qjOWd9pGIbJ/BEB5WmedqU6jRdkgbyddYDhibWShgnJe:nuHehzFCiYBr
TLSH
T17FE4D6629871E1191233618903DCFF732BDCED5C692B2D935A46BF0F218F48C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\ta.pak
Size 1.7MB
SHA256 91fb1460711df108d8d435a378c8be1d1e80b0886c0158d8c6ae92f35812681b
MD5 7afd6d96cfe0cfca886da43d0ac33b84
SHA1 7b4f97d8a8775d1ac5ba56654c2bb075cbcea5f2
SHA512 58e944b4e889d3d7ee9f0a6c2ad636f2e2ba7d90ff0e16067db3826f26ab3f53210a94d90740bb525b5f0a397327111711e655af9fb1d65d34a41bf92bcf69bb
SSDEEP 6144:fqE4cGuBERDmPH6kHJgGPjkqwtRoKtm1vYpiMyZ:auYDmPHzgG4qetm1vYpiMyZ
TLSH
T1A0850CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\te.pak
Size 1.6MB
SHA256 fc8c2706c5dfd36e7af8e380a240e0f697cc5fe969b512092a2185896512c4af
MD5 2341fc51095d918c2c32d95d9f4fd20e
SHA1 1f0e537d5e4f0751df65bb7757b9014b544ac6be
SHA512 44db2301b1686fc878249a93d76ba7d68bf936db1f1468d253add22c6c6dc51b68d5ae0f0338e73b7588a84f06aa7be72278b968aba362924ce36cf380f7d964
SSDEEP 12288:/qSLrojq7MZKNby4cJPISF602ZLHgKmoQRT51bDC52CMzRWnB6Ic3p1Fqih7Rsrr:/qSLEuIhEced
TLSH
T1237593023A6AD310DBE60273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\th.pak
Size 1.3MB
SHA256 c1f4235c31bc05153230b0e55b7aabc9020d7460d5b0a025c386885e1e4bda3c
MD5 17455a1ecd74aba39c2244730346c97d
SHA1 f5b737951c6f2dda2299e6440650661d67cbeba1
SHA512 259dd57dc99bc055c604032c44009ee58b50f43656cedf4daf4b7d3358b63c3fc12a7789b3ab9f204eb0aac9812b43629d075ceeaefc7d2deb7de8f017749a62
SSDEEP 12288:JVdax6N9LyZYAbzALaSBs6ojhCQskJUsXw+sO5eXwpbDF1uRHKHlPijR5eysD5UC:fdvsn
TLSH
T1CA554DB37247DDD479481B5B262A7789672DAE653F73F8E000C9215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\tr.pak
Size 681KB
SHA256 ae87bbd88ce0adfc2dc3c460736a7d0513472af62fc856caccc638dedfec9b4a
MD5 2ec02801a22904ff9d7a5398a676e7ae
SHA1 57fe8ca8beea60cc3374ef55935806133c3ef468
SHA512 c56fa666dd163c5b42cb39747d6acf1bb32e35bde9cc521e7981d7fd3511b61e7d7e7b8ac11cfa00ed89431846742c00c3375df6d17cf6b0bce703862065ef99
SSDEEP 12288:VYwzAbpjHpq6E+SufWHl6sgwhqlyfFfgddbeRrc4V:Gx9E+n7be64V
TLSH
T18FE4D88178EF281C8FB9278FD6E91666F8DF0666B331F4469A1A8636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\uk.pak
Size 1.2MB
SHA256 a6230520dac708a6235588f5d9e894fcc9b1391e18a70e3220e06ddf80f76688
MD5 f818709d3215dae023cddf8a1fe9d233
SHA1 9091ddb0262086c4b56f8df0b71decfa993e229e
SHA512 fa66a896949081d57b74c9eb56727646b28c45f91428d7d30d4af8159cdd5d04d9fb63227f6affa15fc52df2dca37ea624484d78793aeb7eef30cf7444d003ec
SSDEEP 12288:URMjhlk2ub+QKjbzI9wkfWd8SihGx2sSr+amnMtBps7Q3Bq3tKINnsoA6Q+qz8+f:/pxQ8+quv
TLSH
T1C645A9A19BAD54DF0105F05BE94C7A0D7DA740FE7FA6871625A43DBF28F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\ur.pak
Size 1023KB
SHA256 c218e21744df2ff0669a87d497d65d76333073577360d4c662c592de146bf82a
MD5 37e3f75291ad8763ab34dd68aa05ba05
SHA1 e0c952ecfcf67cddf9b39eac7dff3bc7a6bb4508
SHA512 38b0eee7af8e0b6e4d2f92417a1ce84ba056fd5257f907aa8f4dcb2755023e8b46ae89257b6074ea14dd234aa85afdb8c0eb18667491bff294a1d5aeb9e95144
SSDEEP 12288:9QKK9e0uiT58PPPK8VSzqtdQSSidbyKFil2iOETcE88GYOa9NQYrjEYjwadcJKwN:9hg9G3b
TLSH
T13E2500D2A6BC96B35A21D92780D33C34CB735F13D34AF285E92246C54E9A0135F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\vi.pak
Size 810KB
SHA256 42f3f0c4f645aedc66c12c74aee7256336a929798d736c56853daec91d44511a
MD5 7ae6d8de41a99566a9bd52604e975cf8
SHA1 9a385321d2b016a4643f8aeca83cfa14354b8c10
SHA512 5337d0f766e9c41963a7bd68f138b1ec4040317bd11fae4acfaa2ece4d4eb30bc08c4a958988b1490557bccf980fec9745bc9ff5d4337ff69968c075c50c9fa7
SSDEEP 24576:uHu+cOAV2zKMKoiwEwke8lg4NiOG2oq1ljV6:ui/NiST1ljE
TLSH
T1BF05951216E1702680AC553EC6CD540D6FCEE42FF7C0CFE56FE429746A221A46F25BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\zh-CN.pak
Size 578KB
SHA256 ba8ac4bf82b50728d907215d1993948457835bf2942a4d7266a3f8af5f51de15
MD5 63db84a38410314f86f27b659c96b1b7
SHA1 e264b871a59aa6445a41f84af8aaffd68d870af3
SHA512 00f0a96653e89caa96abb6f4d0f0584673e1996a9fede3c19f7e5e284fac547445d0c10a64f557f1f07ec8ff733ab2accf2ce965fca7648e27fcd10040cf02b3
SSDEEP 12288:8Ch4Rd6craOIOUzQi+lnfO26wYeDMEbjT:8K4Rd6craOIOUz1+lfO26wYeDMEvT
TLSH
T15AC48DE924F9BDEC004A90A03729613D7C40764BF627EF266ED248ED2A91F9D0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\locales\zh-TW.pak
Size 570KB
SHA256 82739378d17ea73e57c8efae31994e0c8818ab2d0d12cb1f6b20d2f340b3229d
MD5 eeea004461f1a51341865f946711f49a
SHA1 4ef822a80a1676ef60190082ca05acec104e7299
SHA512 72b5e7dd24d1b1bebf546ac7571a4b505303954d3ed1bcb056cdfa14c513902777e1ae0df28154c9f34e925a8a7fb6ae45c18cb708eea48078b37a657f90b253
SSDEEP 6144:e2lPNeqJJ0jOV4AP7lPJxgaB22Iuxau5nzOLHHDWqYi4C9aUmm1OPSTs:rlPN1JJ0jOj5gYJau5zOLH/18
TLSH
T1D6C46CBA0CFBDBEE0901F484B7C9923EBC8B386DDD337636FC851C942D69A5819A1145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\fnlb\resources.pak
Size 11.9MB
SHA256 cdbcf9a043ddf01b0ac30d63c257131248406c3e4fe9eddc182ef6ef49a34dc5
MD5 97d71bfc530f4fce9b1d3eb44f9db2bb
SHA1 3a9fe135da801b430fe0563f02f31eddfbfc3f10
SHA512 418aad74fc7e13dbb21621bda10af24737cc42634c49a40fd09357c244a479c25cb9b05eeb0b35098ae34353809d2ff59614008aa01b6878f41ae6158a309c76
SSDEEP 196608:XRR3ZeqsPzZOgYimq8oR/5e7sbaeejrCeV32uDKOIKOrsY5OkrFAWeC/Zh20X3fT:XLZelLgg9mno8sbFurC281OkrFleCD2k
TLSH
T164C6339433A4286FDE2123F3822D1237DA29DD0B15A590E30EAC705CDEB796C9FDA535
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Programs\fnlb\resources\app-update.yml
Size 87B
SHA256 995a6fb3df2479a68056df0a01d9e018f825238dcfec67579449875fdeaf38c6
MD5 ae50cd612af5a5b5b87efa9aaff0baa2
SHA1 9c11f74ba3b63324eddadc00567405093a0013c8
SHA512 e789e01698469559a582a5c7911a509e29ceefa7a02b2c9c506318020427d393013e89784f8b0049bbef1da0f9448c6f2f647ce390a054a3e99318830df0c035
TLSH
T1A2B012308118C03003B2081D3428492170581259F081003455DA401491238640E854DF
MD5 SHA1 SHA512 TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Programs\fnlb\resources\app.asar
Size 443KB
SHA256 a6768b7712bb2213ff45cc0debb77eecfd454f52290dcd3af90def9a5cd011c1
MD5 f47363220e44cceec01c5d5f64d5f124
SHA1 3d0085c9246f8e02c2768fdc1c1521fafe11b745
SHA512 be067f3a79584fba967510d801c4cee02f82cc78cc03ccbe42fc78311115323d846c1b442419504635e8df3fdb88dd679bcb216f4a02b9ba86b48e7a122ce61a
SSDEEP 6144:nIJIJdUNsk0BFiiiOP5XQGUL2ML4/bTRlFZoJm9e+/YdgHp/Bi0:nIJIHk02OuGUL2ML4/bTRlFZoczi0
TLSH
T133A40C562DF7603142A370B95A5BC402F338D017261CCEA4BE9C83556F8986CE6F7BE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FNLB_alt.ico

Path C:\Users\Admin\AppData\Local\Programs\fnlb\resources\assets\FNLB_alt.ico
Size 5KB
SHA256 f02b25ada4191345f99172078987e2bfa35c7338753ec5ec7515524bab3f95fc
MD5 f6023ee4030cef81e2826c7668010fe2
SHA1 9609f150946d76025be93d7079b4d0220fa269c3
SHA512 e3c2e2e1d5ed7576f6ddcfffbadad964f7b0a4a240b98a1994de0394b0429500241e79eebd251740dcd0c1474d29fcd27f0b13baa0f2aaa2db388f10a2b8ad7a
SSDEEP 96:DrhZc1ZAR9uYMKVtiRilAO2DkTJR3I0cOKFtOidAnOlc/JvV:DrhZsZADxVtiR7D2P3dcO63dXlchV
TLSH
T1CFC16B48A5F9CE48CCB5A690CB7A049E3EB9A79973C926C5A1F99793644543C38C8CD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FNLB_alt.png

Path C:\Users\Admin\AppData\Local\Programs\fnlb\resources\assets\FNLB_alt.png
Size 27KB
SHA256 b32552fe3209db5fa7da58c816be95a2d116eca0f4ae49997848dc8332924b1c
MD5 bbab0cd782fb2f316c9c659b5190e886
SHA1 84de7c0f7088529b0cf75554a8a355906883bbdc
SHA512 94158244149fb3da6be4098395619899be87e70d7e36e589288685cdcb7c578527fcb9875167d3314d0c0eb244ea4e68c8bb4e17ce6e2b71c0a5372b4cae2d27
SSDEEP 768:KniZdhfKFHpSe9p7PeDPaLdaUBvyWubTY9F2FxMGOCX:/Z7fKierbeOL8wvyWMYPkFOCX
TLSH
T12BD2C0468123C2BEEB50FA384691C34B4FDFC1ECBA22516BE9943D0DE5A4467676B1B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon-beta.icns

Path C:\Users\Admin\AppData\Local\Programs\fnlb\resources\assets\icon-beta.icns
Size 448KB
SHA256 549560301cd1f2b055a25abca64a98bffe2326a26008bc03d37e13aad9570aa2
MD5 c7cb1aed05e0a600b6ce1fcb4c52056c
SHA1 449dce871a164558fa9b51d8a6cabd93f9bb7bc5
SHA512 5b1f0c0a6d7efc56e8538e64be5474849b92f81b7c52ebb96acdc74a8a2a4fa1b96fa819be626505f6e6f8f6c56aff40cac4699f5274d96469a394dafa4a3c43
SSDEEP 6144:V3pPOe8U4waWTd1LDk43pPOe8U4waWTd1LDkKu12IhZSt2u12IhZStXFASP58:V3T8bwb5513T8bwb55Fu1KIu1Kt8
TLSH
T1D0A41266A563D2184FF28A24850B52F4A60C976337D30DDBBFA28DCEF542A21E738571
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon-beta.ico

Path C:\Users\Admin\AppData\Local\Programs\fnlb\resources\assets\icon-beta.ico
Size 264KB
SHA256 34723863dc8e5a162a1dcf7c684af2f9620f19d73db819212059697f0c0c0d73
MD5 10b66151cd35efad9a257c07fc8dbf54
SHA1 1f4132c74f61d19662b66704b3a6249375c69678
SHA512 b55b4a037be92be297e28bcf1c0b1218e60a2c6f7197015a360a1aaa4dbaa63ce5c5fba51e76216efc896ebe33600e1f8c16528a1f6715c1a4ae288c18b650a7
SSDEEP 192:RtYymGL29cEALUH2bw+GsEsB2a7LqyppZnE9bj2tK+HhX+h5uwx41Nn4/0oUCnqc:D29oUHe97EsBjt3AH2tK+H575CnhcmJ7
TLSH
T1724400B92DB43D28CB55CA38E4564405817AAC6C8C68E2B1AD5DBD047EBFCFCD713099
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon-beta.png

Path C:\Users\Admin\AppData\Local\Programs\fnlb\resources\assets\icon-beta.png
Size 43KB
SHA256 b594bc9b32ee084a58d935dd112324a4ea8235bcea215fda44d2c7660ca6c6d9
MD5 0ad9019114622887876309b8f7d87b72
SHA1 777ddf7d7a942985e996077ab65295fe45f42d5f
SHA512 199082fa956242f968967636a0b870247da491492f2f42d715f7f1b6a0c5551ac63b3c76ce204c3aeb504955acaf7a7d580b3abc001d8e14b592200e3f5ddae4
SSDEEP 768:32nW8ICQiDY8gyXURuYQC0Yvu3L4hIyOnoU8nqDtVkXaCLYvacIr2+vKM:GnWQFY8HURRrpCnFhED8vacIr26
TLSH
T17D13BE44D3AA827BF165182474A5098B06A02D3779D4CD8215DB386F338FF761CBADDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon-dev.icns

Path C:\Users\Admin\AppData\Local\Programs\fnlb\resources\assets\icon-dev.icns
Size 343KB
SHA256 2114cdc18e8998c50be54e37c0681d7383daf4dc3ce879c30d92f030fa647989
MD5 4eefb3ef1a3e81d18edea0b2fbcd4e92
SHA1 fc2b7cb0a8da1199aa6fcee1a717bee0627ae116
SHA512 8a961850cdb3c8f8183eed766dd9d76036a69a7adc038523b53dc761ff4695655ab28bbdbb17ebf70806ef9f044ae89fb908cb38174e1a09605476f6703430a5
SSDEEP 6144:OTMxAUS6ZAw6F47QRhXvWPoTMxAUS6ZAw6F47QRhXvWPihB3YHnfTeIlhB3YHnfu:4iAVKSFxRhXvWeiAVKSFxRhXvWMIHn7v
TLSH
T1E074133909A1F0572C77B6F4AEE96B876D1F584807FA3AFFE8D45B1C8D14C289844AD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon-dev.ico

Path C:\Users\Admin\AppData\Local\Programs\fnlb\resources\assets\icon-dev.ico
Size 264KB
SHA256 0562d2d17ece675a41b037d55b6f26f903ceee4d4620424c3d05e20ca50d92ec
MD5 b0ba09f992e913c587ed3dd8676c9e02
SHA1 9324c913e1d1f8ba475b58f75f6dfb3cafb75827
SHA512 4505898a8278c6e37a11fd6e5a0012b19c8c5b5e7db2f58afe5f76b35b1c5b9727cfa5998855f715bbacc8e199fac3c7b0d9f4e842f703afabf6fb15c30ed03e
SSDEEP 192:ogTI2TbG6GAY3Liiiiiiiiiiiiid3JpPzumweWnxPf65TdpACiiiiiiiPNjS3+aO:jTI2/G67CqumwFa6NYi0/JTHW7
TLSH
T1EF44739DAF0188A0F3D594FC53119A06D1679D20C3FB467EE4AF723B0739E63296468E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon-dev.png

Path C:\Users\Admin\AppData\Local\Programs\fnlb\resources\assets\icon-dev.png
Size 41KB
SHA256 1609b0bc2743e334281f2438592be4e1c81288f069566cec83f32b97d2051ea5
MD5 0f1c49c880cdd2c6caae4443d7198891
SHA1 d1ad4364b45760df3ce87e17be45cce61f8eff8e
SHA512 2d2b3c58a55672dc961b5367fdda0897f9cc63238c2c617cd008ae03a70cded3bf45fe242b1c706cc5db01d29256880f7f0be84e4865979b7b4d396ce43f84b1
SSDEEP 768:9rpN7NhPf7HyXg4/2ZzKYKmztUvMLY3BLiBmFaz+axvtpUcnF47HqCpbLD:t/nSw4MBKmzthWiBhz+axvnUoXCN/
TLSH
T1CF13CE16C7A54037F9A0958879900BAB1AA86C77B876DE5864C7365F2353F322C38DF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.icns

Path C:\Users\Admin\AppData\Local\Programs\fnlb\resources\assets\icon.icns
Size 77KB
SHA256 2cc1f0b81c3f20ab80dd22391063fc3f80fba5a84167512f102ec58474b15b36
MD5 7ab2ff3fac068bd35451009e3aa1d1a6
SHA1 4d2b687cbd028c63789640e4902b1f9956cc6ec6
SHA512 b78c5be8f0809b20855b17c50416dd2a0df0cf80b618e1b63bb61e3fa840d052e3022ff4074c5ceb2c14e2e6c1ec81025f1ab8ce8bb5df8e74e50b04eb1027c0
SSDEEP 1536:dfI5qf/1Hxk9g85L/xHWdwszh/Y3jqq3qtBmIpPvjRT6ltRnD1rWjc+jPJQM0bUC:dw5AxxsRRpH1szh/iqbTmIpdWnD1ruDg
TLSH
T1D4730237C7D6564CEC078206B39728F90B11BF6D96F27A9953830A78F964120B5CDB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.png

Path C:\Users\Admin\AppData\Local\Programs\fnlb\resources\assets\icon.png
Size 41KB
SHA256 4cb616f18740f670b79282edb5d065e84ccc9df7c76a9299ba23041837e91b54
MD5 68719e075f0372ac17d50deb8ee675fa
SHA1 9a56b8078a681f517d1fcf300882ed5dcee932c7
SHA512 fb571dedb3c28f3f45d899431bb3cd8bb3261dd1e0c69e753eed9a43b829eca7eb9ae94925492dd5445bd6ee2cfb69313204e6c39d61510ee0c8278d514ce0e4
SSDEEP 768:l04aW8GMVQofvojtBcVETbxfPWVlejMcITfYsXLkCspSLgy15eqkFAFUxqEKoiv0:l04aL/8tH3xfPW7DKCspCeqkaFaic
TLSH
T17613E08A6C42DFB1EC8058B31CBB4B866720491E994983575B75C856B9EBBF31433B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Programs\fnlb\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Programs\fnlb\snapshot_blob.bin
Size 360KB
SHA256 71985d35233bc9d298d333e1b2a9940b67f1cfd54abc1ba031667f189a044c15
MD5 5b981ca4f8c6665a0620ef2d409849ea
SHA1 dcaf2420c82fcd96a1ace0c1da8d1ea87be4943e
SHA512 fd1aef29035f71a29f45c181aa71ec0d786930d57b848d197fced03d1ce0f1fcfa9dfb4f8610b5c13e7b9a8282e77ec7ecb4307e2ba723954e8a63ba61746348
SSDEEP 3072:rlOt+xbRt251RnmDqKikZoQwcKWvt3E/mnqCqoW4k4DMwjZ9FTsADVYx3sXCOwf7:8t+Hw94Zoh+ncpI5TsADsqS7
TLSH
T14574FC46F15AC625CCE212384EEDCED83AB4F5CDDE4AC21B324047BDB4B96609F9258D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\fnlb\v8_context_snapshot.bin
Size 724KB
SHA256 390aea732e1d72311c7993ccf5d6f3367ca1a56acfd71f1169e1f4eb680d8c56
MD5 c91ad04ceb04c2f9dfe20273f08c1654
SHA1 42bc4206941be3436460e42c67620da75e95ef20
SHA512 7a9b39df38c95b8d69b058007cc8bed7dc160298ed90efc76ad25258469c47c49a30fd393160480a3bbc143a0cb7426c169e2ac8063b8c2864eedd77f1212cd5
SSDEEP 6144:Gt+HwQVl/kJ+RLcl2W6tgrYVLrgV2wXrIr2ffnTsADsqSebb6vTB5d1wVQGdPO1G:TL8J4Lcl2W6tPsNXFydUZkOr
TLSH
T11BF4B3B6F50B8B31CA951B3D8EEB8E4B3A74F19DEE87C10B3151577C65B96A08E4240C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Programs\fnlb\vk_swiftshader.dll
Size 5.3MB
SHA256 2108602059eb529119ed7eaf89f5de96f96b1b22c805fc6c49482cdf77de0e60
MD5 549c5d210dfe92acdd9ef94c9c42f548
SHA1 a226a1bc4ad50bf2456a6bd91368fddb64476587
SHA512 a8c5f2bf13ab3092e8e6397bf1580586238c1f53881edf2604c6f8011140d1b8376f85b6c6eebd70d11c70ba2730f39ae896b532b29902501c48b080e8c6ebff
SSDEEP 49152:49bld3kgte4nPZnCN3VL4wzvBjPwnGAP/DcrxN4jepXrGLEuuJUw7KF38Q3Yod0P:49bl8i7kN1OTXI
TLSH
T1AF464903F68681D9C06DE6798B5FA623F671F8800B2276DF56A00F192E66FE0673D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Programs\fnlb\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Programs\fnlb\vulkan-1.dll
Size 917KB
SHA256 2de557a55b67211227f3bfb96a299c4096e446831300d05269c251f4da56e910
MD5 e6f6fb717766c9fb671c7beea852afc4
SHA1 fa785c2e8d1d9ba11c9fb516f3071afa5028a1a4
SHA512 22c6dde2a3014c3bcd82819573bc6fe25e2c53be014ddadd6f3d6bf74e148387c022b28758b90c69fb8d11dc84bf47c365c14466e57acf416bfe8e0f0041119a
SSDEEP 24576:V6sHcf38sq8YEkLUiMGXSEZlUE5tqtwKNlC1E+Dkw7+DQ6g3v0TAE7yoeHYx3:YsHcf38sqykoitlFnqiKNlC1E+Dkw7+T
TLSH
T17B156D63D7548AB9D676C034D9D18A0389F174812322BACF02B917147F6AFF46B7CB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_srmfycpu.e2e.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_srmfycpu.e2e.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb5EF0.tmp\7z-out\chrome_100_percent.pak
Size 702KB
SHA256 ab7c4b7b6cb8832a31d44b95ec50ce52294f49422a3bdde4e21968eca2930cbe
MD5 8bd180ba5ae087e7348c8e5d3fc747b9
SHA1 032e54936f0a96b9e008a77666e8739f6ff56341
SHA512 8f52ca1c25bbfacefdeb869ba8b2725a12269f5df40ae50744bcb7f4f68df6cf8ab6a6a63116969d07a9ca80caaadcd6b3542f056cf1317e55e7c1bfe8c2b28b
SSDEEP 12288:QI3HWfJwNjzgsz5B0GDJQrnKs8SNP+QSsEHeilSTe+gnzzmg/YJblIt6kjKQCrC:H32Bw7zEEmPLVbTe+gnzzmgwbc6kGQt
TLSH
T159E412E77370AC7DEEAB1677426614B0FC375A280B51060A17DAF8796923B48D8D93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nsb5EF0.tmp\7z-out\resources\assets\icon.ico
Size 11KB
SHA256 33350b7350e018895dd4c18172f300e68b9de1a83b20f31bcc53c484800f3783
MD5 12bb4550fdc005d92af236bed8fb58dc
SHA1 4672d9c88b7727547ce862625d111ef66b33c6e1
SHA512 db2f3c93eadebc1219e07f49c575da30189992290fcfcb29286bc4d3074d85aca92e5b65144db681dc26ba3b18a5966997fb04bc8f9e10f03549db1585c8ed94
SSDEEP 192:h6Oje/t5xfNAMjwlI45nm95oecorS0J5KSE/upiEBOyFx4amnS68wQcX:h+/dNAMjwljVg5olorjKSzBBOyjQSGQQ
TLSH
T14732C0F800FCD5A434C4FC744628E28C656357867F19AB3DA8E9A9D0BF142F6D597483
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb5EF0.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb5EF0.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb5EF0.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb5EF0.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb5EF0.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\data_0
Size 44KB
SHA256 f98875dc4e12ad6351fed00aa8ce41b37e857cc147638238f664741ae70c14a1
MD5 d4f88cc1adcc6ef0db499775bb49edca
SHA1 5afcc41e43f99b10ba5c7c0c7d0673297fd77e43
SHA512 3a014863416564f8eceb0330ebfb16fbf58647a565a13ffe720fd9892528a55ff2d963ad03ab57d2d914d8a5f1679d665988894c81ea4b256ddb3523c3ee96af
SSDEEP 24:dWEGi+YxygC7Rx//SK7vwYLuHrxXhUk00WPMoBRGhMSUW:YEYYxygEz///jwYLu9XhH05MdzUW
TLSH
T1FD13CE3D85759E24D4F19B3D40BBC33C1BB88148D5501C1FA6B4F83937747A4150E2E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\data_1
Size 264KB
SHA256 dffc29ffc62e2a72e71ded88a043be0bf28eea7d4f2180a274b4890c6070e318
MD5 813de7e61e0bd6263289edcc063647f1
SHA1 f86bdf71e0fe069fc13a2be0f0becabdad01dd57
SHA512 20f57e1864a9bcb768ddc8bc5bba1e3343556acd9ed0127ddfd1a95d57d8aa0693f21cfc3d317d69f0574b2e873c5e3231169b15d57e524723e896406aeb6ad6
SSDEEP 48:MtkCxn2w11ZS+rw3weXgs+Y/CLWQQPlxOxDtkhXnQgBnO+1sPAi1dXh3agf8p:M6an2o/DsypkqtuBnd1xi1dXh3U
TLSH
T17144EDFBC46D5806CB24877C602B93EC816B983E4FBBCEC8D62AC4D95D552313BC4585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_000001
Size 19KB
SHA256 2f5e10188e3a342c40c2ce8d854d08c050525db1a2dfab205854ce046aca2194
MD5 f4fb38e983535d5b4703ef03d882b3c3
SHA1 b8731a1a6819930338aa9df98bcadc6ee1fea5fc
SHA512 04cb6f9116360f8ee72c4a45f041e15da518d0d803d35a38dfd5eda78d6a03895de1b1b02efae11aa64e2ca75357aa83c2b7d48fde91cd802215459ab3ba79b3
SSDEEP 384:y7w4B3DrpAJuhOE3m2rp+rBZsJir1Ablbn5T0i:y7w4JDrpACtrp+lZssrMlbn5T0i
TLSH
T12292D0D0435BFA28BDA72305325A7288B5F34583F7412E8C4D3056723BD629C77562DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_000002
Size 16KB
SHA256 23d27248a61d867850ef958d005d438044f6d45c2817047c9246bb7ba4401cb3
MD5 682b76658379cda05319dfa70a250370
SHA1 a04c6fceb0a0a1c912d094d24fcce0b23a8b2b86
SHA512 c24fbda8051167f0d1b0d90e45fc07d284b6617ee112ec1c511f49f295c780ccf8dfd76ffd70d3b4980c028ae749a0b44e37a9759d435ac1668c4d775b647f2b
SSDEEP 384:gMuO7Vr/pHCTE9aj8cmMkND6+MzYmJFInihAIjDui:mSr/YTE9aj856DYmJFISh/b
TLSH
T1CA72E1AD1B2A1685EB1C0639FACCEFD87304DC19F43A40917067A7365AB4FC669D00E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_000003
Size 92KB
SHA256 6d0e73f2d15aa005d184bc34467911774f09d54db96be66a5d792746dbd41b4c
MD5 1f33ecf2431b32a7fa8cebcef2476a4d
SHA1 391c17c497ba1b9cb5abc38f68ac461623acb2cf
SHA512 58a63b485b49d441b50de6d5c1b1e1104c06fb5119c0d46f826d5e62f0ffd6b3e1b1ab278eefa87c4998951b3c8b710559be6b286343ad361a4e160b0d0799f3
SSDEEP 1536:YEANlj/M0zUj3A5U11q3aGl5zji6Y5Zh8EZHpd57BuZRkWZYGk9WhCaZ:LKryN1AXze35b8EZHFkYiP
TLSH
T13D9312480A4023FDA697F7AF15D0AC4DEB976FC0624DC6EA8A0E74DD674419D2CEB930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_000004
Size 104KB
SHA256 8d4a5858bb7f72cb2166c6120fe59258595d8f2f9366376e898f38333d31eb12
MD5 163a7f60a7eebe6f06d0c6f6998e0247
SHA1 ac6ffc251d1d49dd870c2a82773241734a28d8c2
SHA512 8d738f085656aa43d3a8e1e44c256cdb14153f1a2f0580665834a1abedf4709469780d4b223e41f35a581f8a86b21d9143fbec63e05b97f544320080602ba73a
SSDEEP 3072:FGO9QCBJVFhoOI3wWNgYI7HugZB+OgCos7DY0of7:FGihBLFGT1N8OgZBqCDc0K7
TLSH
T111A312B0DB1C405FFFB1D9089D0A677A228DEA65FFF408B8AA6BD1475C898A0DD50B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_000005
Size 40KB
SHA256 66b27c467eab3382db14bd06c9646e7ec6077c8ef9b06c815c1e24a0304f242d
MD5 5b84ecd73045a1b73e2cc8ae10344e68
SHA1 13ba74cc42ce674a8620d7f20dabd44cb32753e3
SHA512 be251c38364d290e357b6e99861a848a8d560978cf0113ed52761678f81df711cb9f3c61f3331079fde59a1f92aeca43093e54ce573c88662efa944f728231d2
SSDEEP 768:k8z8GV7KMz2+QQEJcz9GENqOW4izUwLxW3CYnILy0KFb/7L8AF5QLrhA:vZwMxIJcz9GBuwkCBLYVUAjWrhA
TLSH
T1381302FF344F1997DA6817AA54223E06AC84D3D1B7ECE7667205152AC361E2F1E43531
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_000006
Size 38KB
SHA256 7ec8974420cfba89588fdb877b043b57744ac2c9e7f7f5ada7f8ac4320262b31
MD5 ec4705f0010596b64bc1ebbb44de6259
SHA1 c62a719587ea379ab2a8824069e2b05f0745fd21
SHA512 357519bcbe561916e3b17aab0e6ce5279dc7e261cf878dc650b4945f2cc47cba8f99b7f958f37140c24b21ecae44594d5e1f14bc4ea2acb689a6a1d92ad024a4
SSDEEP 768:jhKKmwWaL4wVNVBZ0gIqDau/2lQ7z2ybdfjOIR1h3xzQ+Z:1KKhNVNau/0w6KdLO6lxE+Z
TLSH
T1E003F1D70DAF6F4EB861000754D8308BC0D9EAF0ADEA96DD593671061A4C51F7FC6748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_000007
Size 91KB
SHA256 aeca5afb9ea1c17b3c53388152c9774d346937e2d51788f0ccf1b2dc6ee7edee
MD5 a24ef7c90803e216315c496e955671d4
SHA1 f81fbcf91205409df72463ff3ff8a2bb1f2c556c
SHA512 44a02cce8742f4a39867bf9cbd036ede354940a1002e9b492ca673be308fc37931042e3d9c193ac8fb18d51806c27415c1602e54d1caa610c27bb4130adf535b
SSDEEP 1536:T3OED3+pukniquftm17dy0lBnSB3dfUXldlcR2fJn0TFdIEHBwpAY/P1lFsnL12R:T337+pukiopYAZSBdUXCaJ0hdDhS93Fd
TLSH
T1B0931226E25BB750FE33651892023CA73C5C6E20F79840F38D6C85E2797E966B643D2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_000008
Size 167KB
SHA256 eb9944ddf4546a37b61b10f68fc66986a162d15fd84dcfa5e6b436163bcd5ad6
MD5 f1263d0b11cf05fce7acd15bcc858ca7
SHA1 37746ce6a118a45b53b888ffe5932c73653a8bdc
SHA512 cb216287701a49dd3021e4b2aea4be26c43158d0c866cb73b9f2f6bef290d44c1ff2f3f910b703e65c979cb9a2b53a679915b53d2fd2f8d9bca8d5258a663949
SSDEEP 3072:7ftthpsWlJq8lF0qwQIXUdzF8UQcibHi5AZad+7K9OkDkaQ3B0OgEVo1e9snJit1:7ftlsWTq8TdGUdzF8iiQd59OkglR0pE7
TLSH
T167F3232B6947CEE4FF4298B20F77E78B895D58B34B96FCE8258B7E53C12051630A510A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_000009
Size 78KB
SHA256 fa10e49495e38c15f980c2729411ecf2fe87e5b9551f42d54cef82215d1f8333
MD5 061ffb119ad5ac1c33c80d17bec55d9b
SHA1 02d87ee9ced19a5365cefcd902441c532955449e
SHA512 e3578c4e03b1c3dcdb6e22d5310ce2e709d91c29c26d3d7b138e9ac4eb15bd48661924d4d9d3468b0c6b1cc0241735dc901da737602fc1257d161b0b39fb3c7d
SSDEEP 1536:EY9xNVuFBwWeOtIRhJSwkx5Ye1dA9lI7YQdgu9bpqyD:EciB/6Rdt+7P+u2yD
TLSH
T129731217C0A62C357B6C3E5E8224422D62341590A098DF69BFF0E89D133EB5E79ACC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_00000a
Size 39KB
SHA256 b641e2b7e8014072b7fb378648a492aa8fd249407ed9078385a4fa158216c2c2
MD5 533745ffb2c5f710801d01895e153a1f
SHA1 d5fbcd25d4a50d54e6b1475ed759bf71c31399e3
SHA512 351fb74dd7cae2db5af2bfbe49d7422fcce74763575c992a4590779eff64c5c586463383b80909b47d4b9f0324232ea07342b6bf7a30500592dc37c27561f99b
SSDEEP 768:e7Nc0K04joHTg3OVluVH5ousfosYKjLtlWzox9SZ:eFZA5oTbtwox9SZ
TLSH
T15A03C91F853C28E31BC156A67E6F9DE67938016A43058CEFCC99F82D01BE661122F9D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_00000b
Size 45KB
SHA256 64763cb5c43241133d7db4ad64f94d84c52852403c4232eaee643da4241f5c18
MD5 e17fee27d3e12a181358898a9b225540
SHA1 421f5affd785bb031fd8ca05ad4984f50adf8eb5
SHA512 f3b5dcb4b681ddaea32ca485fb1ccdec7c70fb2fc629774c10f2b120798f510f7220544dfcd111f928b7f098e7f4411421bdc0a43586b17c4359e90a78ae7d23
SSDEEP 768:R7/c0KA4jovIDTg3OVluVI5ousfosY0jLtlWzox9SyW/fHSg:RBYX5oTbtwox9S5fyg
TLSH
T1F423B71F853C24E31BC1569A7E6F5DE67A34016A03058CEFCC99F82D02BEA61126F9D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_000013
Size 150KB
SHA256 230da3889205652536fa6661776bfd43030a27c0f7d827283a0954537cf2eb3f
MD5 a41cc36ae163f05271875b20905ba930
SHA1 f9ae4b7cc58b6808d60cf8ef5cb461ff37259773
SHA512 fa4ab869be19c15e77a93ea9980929de9f532f8d85d7406a4a1368e2ba2fd88e619f23b1d8cb2791d41ea1e6afbf1d3f10271114710e7a0013afb0fcd82a6a5b
SSDEEP 3072:+4j4gCVr8ZgauzvguKoUHC0+nAUyxtsxSX9HVdDxPUDBwd/fBum2:+m4gCzaEdKDf+AUUt6SdVpxsB0/wm2
TLSH
T199E312C0444F928DF8764E0994BC1FEA94F5D6865EC79643E36FB0A18C893E31E45ED8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_000017
Size 252KB
SHA256 8987ea174abe4ac4f078567561b05e42830872ffdb90428bd8a942a4f6349bcb
MD5 889d2fc54d14271979be004d748a102e
SHA1 24dc186d7b98f98ad53bf80e09ad6db6b4da55c0
SHA512 40687ffbb72109a66751c85f784bdc860981dd8df97cc78731324dc73c39669c247b8e9e18abfd485f7995c22d3263d1f050da5ed2ee419921271dca306a8ed5
SSDEEP 6144:i67oO4k5YjYnbV1ad2Vje+wTxmHiS7ij0g/0fuzx1U6S7J:rP5rx8d0jdwTxmP7Ct/0om
TLSH
T1A8442335EECC33CA1B20D759AFD1A46632170ED050A7B9CBF54A415DACCD92BA8355CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_000018
Size 187KB
SHA256 315f63e0a6dd2c588b5a805035e07cfa536d54c127e4855cf98ac76b153a495d
MD5 2adfb086c8890b3b0dc1625213f68f49
SHA1 7029ebc58ec43c20c28ef54ae54b94ac495b278f
SHA512 f7e6034db8b57c09583c08d5ea03a7f56b43f1e3b3d39dba8e96ec6f9741bda9ebb004f1a5f71cda121ba8d7064244e3c0ca4fa804831c9288efc0f9a5bb859b
SSDEEP 3072:HgpXLETeGSgsHPlceGlwZaKKdYooWqUpVyqQOmQ791LtQQwfJETyFNyQt8X/moWC:ApXYOgsH+4aKOzpVye791peWmPVBIrbb
TLSH
T1181412704C148F7398E7C056B06659E47146481C86CEE3FFFB9BA65DD2890F98FBA091
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Roaming\fnlb\Cache\Cache_Data\f_00001a
Size 263KB
SHA256 e936d30250642029328670edeed039f958400851362a8f0c5fb67b131904a854
MD5 4be510798427b22affee6569f0e9945d
SHA1 8e8ba43f973b98c3bd83c909a989389d3a516c69
SHA512 62e945ec682e7c44ed3719d28065727089b6dad17b8f88ac4c19ecf8a6b73aa2a150b2c0d06aa2a2d8ba2d97952185fd9c07b1daa04fbcff6ed48c337d75a150
SSDEEP 6144:kUmwNH9y4Bk8B57lgxRVrBdq7xpv55T4wEv2MVIpb8:LLNH9/e8SRVLq7/cxbEb8
TLSH
T16D442335E055AE2E5572FB1BF3AE932A7415F31FB280545EBFC039E06DA921636C0292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\fnlb\Code Cache\js\index-dir\temp-index
Size 576B
SHA256 dc00c3284493ff36c596ce453153a9999535d26942376391cad4dc46ad865989
MD5 2d5f7998674287a70c6ca1e110a1acce
SHA1 baedd4fb8e2a95dbdd9ff0aec1df0d2e8960530b
SHA512 25a2fab4b7a89cbcb1e63f3e9f8e4749da493d0f6ab159a21a75c8c3a01e6e4ea9957d46ea73c9f9a07f131a2319424dea58308195b59bc0994f084aca65c16b
TLSH
T1BEF0E5C011D13240CFDBCF3598B2DF0D16518456552AFF0F6459A0BA8FA36C499F5021
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\fnlb\Code Cache\js\index-dir\temp-index
Size 792B
SHA256 6cdb1bedafde16840e87bf0c0bbfca3678f2d1555e9d15912901279f6c9ddc1f
MD5 cb0db3d5aa616627c726dbb43cc1c74a
SHA1 3366d8906217494a71b33d3dd29138c444bc220d
SHA512 56bbdd83919e56642feb8755be846d668900b4257136a94b3d9f5b577942e3352141fd6abb8441fda5115ac152e3d197fb79cdc43c8f6aaeb4695b937c06a12b
TLSH
T1D40146A204D4122BEF261135D8F34F4C7921EB4552171F12887468BE48D2BD199F3520
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\fnlb\Code Cache\js\index-dir\temp-index
Size 576B
SHA256 bf6de5776329477bacdd932e341208d8f52b8ee85e2272e2a7b3cac9588a9220
MD5 42c75561d798ceb1f2dc7a06d4a45823
SHA1 72bec0357d72b4ac84417a15a2863925f53e6816
SHA512 d77db5510c47c529946228aa1a1e6d9daf3351bd949162d8a5ef2bdfd3c8fd9c9c6ff401ad5b17800991bf0f817a35e685e7f8833793f409719808f2c549ff1e
TLSH
T144F0EDA544D01390FFA61D31D8A14FB59B239847C2298F03A49477FB88633C0DBF6420
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\fnlb\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6759612eba89131566920561a15768fc7eddb69268697d88b94bf7c9d05d5fd2
MD5 b6830c7fca9ae10c6ed8a3645d6a2a54
SHA1 477422e8a5f77d6bf905b7242fe684145d08aeb7
SHA512 8bb69dc86caad7aee2563466a43d14cb947346a72bbc9806c4e98b798dae679a4bdeb1da3a0ac9fe67868584328ece758a377d40acbbd2a39538ee771d9860da
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\fnlb\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\fnlb\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 b457ae8b89e882763226395da33b870c318ef287c91ff0a0dba734d0afdf2d0f
MD5 7609260f9e10b03979b10d3efc5e76c8
SHA1 785e2bb94a2811db11917f8da85dff6a8609d745
SHA512 2b90451093fce322a25ea988bb011c5b598af30a2100fc988b4eb36b88f8045beb07f04d59c1f743ecb0f253a128f67e89b5bebc1a8d91eb28c6edfcbdd942a0
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\fnlb\DawnWebGPUCache\index
Size 256KB
SHA256 710aa91ebcec81be5a6db5045f66bf214319c96987cbafe33477f5e0aec1f562
MD5 2c50a86523028aaa42b4ec1821de7227
SHA1 ac99547d0c0bbef8962a615ee6ee16703e305c4d
SHA512 0c779354e6a3e5f51bb96adfe2d6f81b325f3812a49f617a015ef848ac8bb69efd895a352c364d970822e4bd6298ace7dde47471dfea06c17b4ec782deafcacd
SSDEEP 3:LstlNllkll/lYu47Y+:LsX3lEtYu47Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\fnlb\Local State
Size 490B
SHA256 902238da11319e3acbbfee69eff3777794ac26fdf08a8e051ef8d76b93904b3d
MD5 86c56256a7007586354d7451623bdfe7
SHA1 c58273939e8c9058c9b4b1a8f2c2c43670c0142e
SHA512 fd1ea83add3d21267b05adabdbd6c307f070fd568251a79174ea0a169e213693f5bb48ace4f33cad40d23a695e1f3358060d17191280aec71e08afbee7874cf2
TLSH
T18EF054FD4E60B3A87925072E844BB7261E702CBB96E08300A689430104E9C8A320AE35
MD5 SHA1 SHA512 TLSH

Submit Download

Local State2ffcfa7f-deec-4664-a53e-b5cd614fb474.tmp

Path C:\Users\Admin\AppData\Roaming\fnlb\Local State2ffcfa7f-deec-4664-a53e-b5cd614fb474.tmp
Size 490B
SHA256 be9345df30e2a7b525b8868572faad72c7cb8fcf9f627549f681b520eff14e0b
MD5 9c2e10f0c724f8edfdb7679f17bb5809
SHA1 011e1a60ed6a93c3bd3e40222a310acece946cc9
SHA512 6e21c3fd20f07c61791a1b2e20ac9303e8b4dd5882a55b74e65856e292c4a9e5c07c416e586281b0bb5e9913677a753da53a534144901e684c9d2e2ee6e10a8a
TLSH
T14AF00EB1189497E132708F519B1797024C30059B4912120435DCB51341F9CC9EF0A830
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\fnlb\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\fnlb\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State0151410f-9135-42e8-b49b-aaba41dd404e.tmp

Path C:\Users\Admin\AppData\Roaming\fnlb\Network\Network Persistent State0151410f-9135-42e8-b49b-aaba41dd404e.tmp
Size 1KB
SHA256 3f7dccd3a1f86ca343d460e77f4dff26d90a9ee5912db69898458c1125f12d13
MD5 2684c45723909fbc06519c410fad4b82
SHA1 6e164f69d7822aff0141d3286ff808a07aa5fd2b
SHA512 14cf5e7795d8cc1dda899d0c545faa8168a10ddee937db0203b56abd739dac07c4865aa447ed50cd1451b2869ad18c9f76a65de51e12ecafb4b264d53adffd4d
TLSH
T140313785C2EC077D946263F61B21B977C1BE5A1C52283C06CECAEBCE97D1032926274E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State0404620c-9918-44d2-8c03-6e83feff53e0.tmp

Path C:\Users\Admin\AppData\Roaming\fnlb\Network\Network Persistent State0404620c-9918-44d2-8c03-6e83feff53e0.tmp
Size 1KB
SHA256 953c00a3aaed2d9376bdfbc2986ff2730362f59dcab1a603c2a52befc66c9438
MD5 11da6f396691091d8bd362c62935a474
SHA1 db2329369e39201aa3d3ea78e0af3f04d6c77091
SHA512 c8ac96036fc36f096bd34f687675b05bdd31d9407bc00522e1908e23907ee1a343d21208a82a18d65da6fd61c549b881c98e4820dd90b41879c823e30b887eb5
TLSH
T19431BBC6C3DC463D852227F61B31B96BC1BE491D52283C03D9D9DF8E9BE5032629164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State09e3608b-15b9-4098-8008-aaf3a1ba33cd.tmp

Path C:\Users\Admin\AppData\Roaming\fnlb\Network\Network Persistent State09e3608b-15b9-4098-8008-aaf3a1ba33cd.tmp
Size 1KB
SHA256 982d197675f02c215e3f41db3577b4b759d1d478b74cbee5b179446b61bdefa4
MD5 23d9e73146c2f85b4018336b8c56e4c5
SHA1 f29a3b5d5afbdbfb27b55134e98c9507a28ebf30
SHA512 1c0915b26ababb23cfe0113b7b834d08a7153744e315f4f2b872df81f9845b7e7f763916a653f4dbb2a5eb87751eaffc3347fbc208533e768d563fd0208e410a
TLSH
T14831BBC6C3DC463D852227F61F31B96BC1BE491D52283C03D9D9DF8E9BE5032669164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State3ec85966-df89-4c80-90ab-6e880eeb587d.tmp

Path C:\Users\Admin\AppData\Roaming\fnlb\Network\Network Persistent State3ec85966-df89-4c80-90ab-6e880eeb587d.tmp
Size 2KB
SHA256 f73667ebccc6b13dc5d91b182280340e9b5de1b28a23b4862d5b4daf108d9458
MD5 37947fcf2d9a375247ffe223a7ce27e6
SHA1 e87b2e577fc5ac01f3b65bd37b6108b44312af59
SHA512 de6c58e77d011ec7df492f9c9b89ada241c9c707c7be46a2f2ef2e29058db72bc0fb73ef37b3e22ddec1ec350492862d52240bcd3b2c5216408b1a647349ef35
TLSH
T11E5146C6C7DC063D846267F61B21B96BC1BE5A1C52283C07CDCAEF8F97E5032965264E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State6bfd4b12-408a-4ca6-b749-a564cb5c9554.tmp

Path C:\Users\Admin\AppData\Roaming\fnlb\Network\Network Persistent State6bfd4b12-408a-4ca6-b749-a564cb5c9554.tmp
Size 1KB
SHA256 65296997fd652380b398557061a4b9f5a3c93e98070284a65697e91609bab118
MD5 9ec246e830499594216f3bf48e0544a3
SHA1 de90f98d9366196bade8df168a68ac7be37980ad
SHA512 4e9a4dd3c9058e4dccbb50cca632c851b23b1b82c94ad727c2982598da6e4a1ac2e4f772d2071a06c014cd0e415967b65111e5510e231749a023ac6e0e4c0330
TLSH
T15631A8C6C2DC063D842227F61F31B92BC1BE591D52283C03CED9DF8E9BE5032625264E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent Stateab65e8bf-e81e-43d5-a176-0fbdab54e6b5.tmp

Path C:\Users\Admin\AppData\Roaming\fnlb\Network\Network Persistent Stateab65e8bf-e81e-43d5-a176-0fbdab54e6b5.tmp
Size 1KB
SHA256 14c58624ad896c7976d02fb61dd234568a3ba8f294fad167100eac0aa288d48a
MD5 0e6bcca68a68f700d98e23e1081b866e
SHA1 33cd1035bded7a8f1a7708fc424e1ac1a14da7ab
SHA512 ed8659c279463aa5c0d7a29b29961942ca498e796186d360bb34f2858c05e17cf0010433f29ef201671cc3352a41168db8b8b865a3b76378e1165574fb10bcb4
TLSH
T123314685C2EC067D956263F61B21F977C1BE550C52283C02CDC9EBCE97D1032965274E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent Statee5c1ef80-b6ac-44ad-b770-6c1425e88afd.tmp

Path C:\Users\Admin\AppData\Roaming\fnlb\Network\Network Persistent Statee5c1ef80-b6ac-44ad-b770-6c1425e88afd.tmp
Size 1KB
SHA256 0eb5e76813213ca21983f6e4651b6cfe3a96c4a38a3e5f80da3a5ac1a60ae6e5
MD5 cdeba718bdee0ab235cf0aedaeca2d5f
SHA1 3636216ce2bc41eebf1a398c0c994264b062f9fa
SHA512 d614ea390b438af94879ad0433f83c99e93977fb1fc1318dc8f45655da09719ad6687c30851bcc007e4b28847cd1614b4f95e0f16eddd29b9bf50a4c5266b7dc
TLSH
T14B4147C6C6DD063D84A267F61B21B567C1BE591C52283C07CDC9EB8E97E1032926274E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent Statefff11ac9-24d6-4d6f-a758-e41a6d229ba0.tmp

Path C:\Users\Admin\AppData\Roaming\fnlb\Network\Network Persistent Statefff11ac9-24d6-4d6f-a758-e41a6d229ba0.tmp
Size 2KB
SHA256 a9230c448d1349a6174bfb20605f5d49d5acf0b34b5b26ed062e7909851d9c93
MD5 3167185ff4cf7d51f7abb0f804eef2ee
SHA1 e90188bcb4e48fccf4c39454047b1b8713b13ddc
SHA512 a7edbf53b8e1d16748b9945d42aa4622fe4fec104bc28ea52ff9162ace536337fcf19a7f07275a8e656456e2dbd074a6ff8807826bafff8bb57d073b43fefce1
TLSH
T15B51ABC6C3CC463D846227F61F21B92BC1AE5A1D42283C07CEDADF8E9BE5032529264D
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity62c4da65-70fc-4107-8702-81f958f7a520.tmp

Path C:\Users\Admin\AppData\Roaming\fnlb\Network\TransportSecurity62c4da65-70fc-4107-8702-81f958f7a520.tmp
Size 855B
SHA256 73ca8c851657fad92d27c6a0960f78ff56c45fecfc8911548ee7c7767369cd8b
MD5 1aedf861a31a819c4086e9e85d3670fa
SHA1 280e6d9b12184e0c269070073c279be5d2ed0c14
SHA512 d79ababa6b93875e7865f85db05c2844a873534a34a4b27bb67f38707e0c2798e8d5c27ba09260cdafa43fe922932bc93f8e3798398bdb841ce26125a47b6385
TLSH
T1C6114C6789FEE826407B89771D45BE191E79B4371143A8F4DEABC32CA0925B31602046
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecuritya13ad604-9d15-4c6c-bc6b-d904b9c1e4d1.tmp

Path C:\Users\Admin\AppData\Roaming\fnlb\Network\TransportSecuritya13ad604-9d15-4c6c-bc6b-d904b9c1e4d1.tmp
Size 1KB
SHA256 e775b120d72f051fcd390724b04298ef05665bc1189b59ba29eced58de19a7de
MD5 bd67ab6a4f11b45fb244ee559ec76fc0
SHA1 cc7972d852ecf9bfbca377a2a305675ea5514aee
SHA512 12d90d2279a09b17e1a338942b093c78bf202bb4482dc8296bf8a3c89b651a785b79d13efeaf872651bf17af3e8a2b4679fdce7d59ce8dac3d6ca7126c0ad8af
TLSH
T1742148538ABFF837103A8DBB1C557D196D79B8370142A4F4EEBBC22CA09A9B31652453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurityb4b6e142-bcbe-4cb9-820d-b37e715b82e3.tmp

Path C:\Users\Admin\AppData\Roaming\fnlb\Network\TransportSecurityb4b6e142-bcbe-4cb9-820d-b37e715b82e3.tmp
Size 1KB
SHA256 4c876a6a152213fb71f83cbbca4be95350aa68e88a349398f476605d3445f1f3
MD5 b7746fe880d502b7c8addf46df1f86aa
SHA1 0085b17766992b45202eb212cc0403fc64b2446d
SHA512 8a5ee5302edcab23120bfa08f69c0f4141e3553236afb7618755e9344174df9cb4cc4d2d1368364a92f72af52b93888ef3cb7dd496485c1bfc398ba7a11d7089
TLSH
T101217B5786BEB867103E8DB70C547D196CB9B833014364F4DEA7833CA0899B71A02016
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\fnlb\Preferences
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences0606b269-2d19-4d21-a9f8-47ba9595649c.tmp

Path C:\Users\Admin\AppData\Roaming\fnlb\Preferences0606b269-2d19-4d21-a9f8-47ba9595649c.tmp
Size 121B
SHA256 89670687ddb870b856b674402696e3177a0196e01e16e9236a69e35990c81b69
MD5 a9a4ef015c6e7b79986d48813f436022
SHA1 f547f42e32a055fcd349613e270671856d73b85c
SHA512 1d14f4fa53a918c7db60878ee4357c49f58efef3610046856aeb960a324c462f18300ae640add68f8a2f5618d95130199c39f7960ad25ef5f1ad1880d416ba29
TLSH
T159B02B52343034724D0F1E21000D781904B1002149070C4341C4314D0913A0D0483009
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\fnlb\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

metadata

Path C:\Users\Admin\AppData\Roaming\fnlb\fnlb\.fnlb\cache\metadata
Size 4KB
SHA256 a2082719eac1532b54e1bac81e55104763ae962616e2f7560d195a5671cec16a
MD5 f33ca8fe99aabc6444bbdfe6e6021ec0
SHA1 d9f75d6678481a641aa3e7084d73aa167b325038
SHA512 a1e4352be027f58dd57431e1103e0fd5c21a0247dc0a6d4015117dbbf7e60f3f9928652c82b21994aed600af773752fe6afeb5af9ec7b31d55f95b1f4930cda1
SSDEEP 96:1rwzykXeMe68e3emejevceKe+eXe18ekebegeuce9eCeGkeG/eG1eGXeGsGTF9mM:18z7dDqnsv
TLSH
T1FF915DE3664B3C134CD4B56B33AD97197C7EC6B74C9AC7980194A08A96AE80251F4D3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.log

Path C:\Users\Admin\AppData\Roaming\fnlb\logs\main.log
Size 778B
SHA256 54f8a671c293b37c860ea3248fefa5b3288df8991bce5c874a1b84776f637d4e
MD5 1223ff20eb3267afcabe3714ecc8facd
SHA1 0cf5e72b4b93731cede873d546d5518a64925274
SHA512 643f7c577ea21442cf739c9a570873a18fa8dcca5a72f861f83472bbb9c1181ed3c9128faf9e6ee9cfe582d08e42bf004e57b8e9732a3df4f9333ec04d9bc727
TLSH
T1FE01FE71088660FB11508230FCE95D5D2E4826F70FB958D99785C80CF615C36EFD3875
MD5 SHA1 SHA512 TLSH

Submit Download

main.log

Path C:\Users\Admin\AppData\Roaming\fnlb\logs\main.log
Size 899B
SHA256 c03188728f7ffc739555a03d0320852fb7854dead7c6390f6c900f93086a4bb7
MD5 a25218863d5c89ffb758d504573d6fbd
SHA1 5d12e11f7ef95f000af5bef7f2b1095d71b8ab2f
SHA512 42df20d18227de2decae8c48e1da109638c206c1ebabb08b444e0465be66f1bf824a33c8b7d3d1d62051c2e12b1b7a99f67e8646e00074fed2984652a37a160f
TLSH
T19411A771088A61FB11518230BCEA5D5D294826F70EA998D997C9C80CF615C36AFE3875
MD5 SHA1 SHA512 TLSH

Submit Download

main.log

Path C:\Users\Admin\AppData\Roaming\fnlb\logs\main.log
Size 436B
SHA256 7e97ba415199a6d43f4e7247b7bc601e4a0afd52e4e28517799e18981eb45879
MD5 73b85bdd589289f11523699518438cf4
SHA1 23a3c68f46f7a3eef7741ab0bb827fee0a0c6e44
SHA512 ef1b7fd4d2050a702aa9c39d3a2807b4a83e0ad446e603705852599d0316f142b17338921f873c57b5dda34d15129853d9a781e31960e7d3622f10a3698e9cb8
TLSH
T11BE0E5B108C5E1FB01504234BDF90C5C1E9827EB0FA9A99E9B46C80C7642C26EFC2879
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\fnlb\settings.json
Size 658B
SHA256 dd08f1e2593b2abab71ae8c71a5f7b939afd40bcb582db5d8c1d686aa2f34d72
MD5 621b3647919263a8983ab2317cb4c1c4
SHA1 bc234e0b827cf7c67ef2f0d10eb72a9f7bf0be50
SHA512 67bb06601a40fe43f93ac629b4a70f181448b8791316eaa8422689106b6c294959f8718ac654a83374c39e88f79297267169d0dcb75f86c4aebd541d38983c81
TLSH
T1FF018C60D55D0ABA6AE1706CDD9DA6232B318E1102093C6C871B0819264D73371B79EA
MD5 SHA1 SHA512 TLSH

Submit Download

FNLB-Setup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\FNLB-Setup.exe:Zone.Identifier
Size 134B
SHA256 17875c7fea232604506c946dcbbbb60d8f2fca893bd573f919d681b531460b7f
MD5 084a70480de51e6a9e8fc59605ce7795
SHA1 ecd15cc6cee7f0c005ae54075455b1924a9d0df1
SHA512 8030b8485fe1b27f28a54d17cd7ee6483a7f0c0fc656da4a4c93d165dcf921df1b43c11adf1ab7bee33475052ef276f681d44ab5a7c8250579747ba6c3af4241
TLSH
T1AFC02BA3440842A413001ED715EAC1DC5007E4000C704240C580C08388CD09583CD017
MD5 SHA1 SHA512 TLSH

Submit Download

memory/808-1834-0x0000025195540000-0x0000025195541000-memory.dmp

Download

memory/808-1835-0x0000025195540000-0x0000025195541000-memory.dmp

Download

memory/808-1824-0x0000025195540000-0x0000025195541000-memory.dmp

Download

memory/808-1823-0x0000025195540000-0x0000025195541000-memory.dmp

Download

memory/808-1825-0x0000025195540000-0x0000025195541000-memory.dmp

Download

memory/808-1830-0x0000025195540000-0x0000025195541000-memory.dmp

Download

memory/808-1831-0x0000025195540000-0x0000025195541000-memory.dmp

Download

memory/808-1832-0x0000025195540000-0x0000025195541000-memory.dmp

Download

memory/808-1833-0x0000025195540000-0x0000025195541000-memory.dmp

Download

memory/808-1829-0x0000025195540000-0x0000025195541000-memory.dmp

Download

memory/1068-1165-0x000001ECFF260000-0x000001ECFF360000-memory.dmp

Download

memory/1068-1205-0x000001EDFFF60000-0x000001EDFFF80000-memory.dmp

Download

memory/1068-980-0x000001E259870000-0x000001E259871000-memory.dmp

Download

memory/1068-1276-0x000001E4A1BE0000-0x000001E4A1CE0000-memory.dmp

Download

memory/1068-1051-0x000001E259840000-0x000001E259869000-memory.dmp

Download

memory/1068-979-0x00007FFCB11B0000-0x00007FFCB11B1000-memory.dmp

Download

memory/1068-1203-0x000001ECFD200000-0x000001ECFD300000-memory.dmp

Download

memory/1068-1204-0x000001EDFFF80000-0x000001EDFFFA0000-memory.dmp

Download

memory/1108-103-0x0000000070540000-0x0000000070897000-memory.dmp

Download

memory/1108-87-0x0000000006670000-0x00000000066BC000-memory.dmp

Download

memory/1108-101-0x0000000007BC0000-0x0000000007BEA000-memory.dmp

Download

memory/1108-100-0x0000000007A30000-0x0000000007A3A000-memory.dmp

Download

memory/1108-75-0x00000000059B0000-0x0000000005FDA000-memory.dmp

Download

memory/1108-77-0x0000000006090000-0x00000000060F6000-memory.dmp

Download

memory/1108-74-0x0000000003190000-0x00000000031C6000-memory.dmp

Download

memory/1108-78-0x0000000006100000-0x0000000006166000-memory.dmp

Download

memory/1108-85-0x00000000061C0000-0x0000000006517000-memory.dmp

Download

memory/1108-86-0x0000000006640000-0x000000000665E000-memory.dmp

Download

memory/1108-76-0x00000000058A0000-0x00000000058C2000-memory.dmp

Download

memory/1108-102-0x0000000007BF0000-0x0000000007C14000-memory.dmp

Download

memory/1108-99-0x00000000079B0000-0x00000000079CA000-memory.dmp

Download

memory/1108-88-0x0000000007630000-0x0000000007664000-memory.dmp

Download

memory/1108-98-0x0000000008030000-0x00000000086AA000-memory.dmp

Download

memory/1108-97-0x0000000007700000-0x00000000077A4000-memory.dmp

Download

memory/1108-89-0x00000000703E0000-0x000000007042C000-memory.dmp

Download

memory/1108-96-0x0000000006C60000-0x0000000006C7E000-memory.dmp

Download

memory/2464-1675-0x000001C1F46B0000-0x000001C1F46D9000-memory.dmp

Download

memory/2464-1669-0x000001C1F47E0000-0x000001C1F47E1000-memory.dmp

Download

memory/3240-137-0x00000000703E0000-0x000000007042C000-memory.dmp

Download

memory/3240-144-0x0000000070540000-0x0000000070897000-memory.dmp

Download

memory/3304-1733-0x000002B688770000-0x000002B688799000-memory.dmp

Download

memory/3304-1673-0x000002B688A00000-0x000002B688A01000-memory.dmp

Download

memory/3608-1516-0x0000027100360000-0x0000027100389000-memory.dmp

Download

memory/3608-1397-0x0000027100390000-0x0000027100391000-memory.dmp

Download

memory/4680-1997-0x000001FC9EE80000-0x000001FC9EE88000-memory.dmp

Download

memory/4680-1995-0x000001FC84BE0000-0x000001FC84C0C000-memory.dmp

Download

memory/4680-1996-0x000001FC9EE50000-0x000001FC9EE5A000-memory.dmp

Download

memory/4680-1999-0x000001FCA0800000-0x000001FCA08A8000-memory.dmp

Download

memory/4680-2000-0x000001FC9EF00000-0x000001FC9EF22000-memory.dmp

Download

memory/4680-2001-0x000001FC9EEE0000-0x000001FC9EEF4000-memory.dmp

Download

memory/4692-1142-0x000001BE7D6F0000-0x000001BE7D719000-memory.dmp

Download

memory/4692-997-0x000001BE7D720000-0x000001BE7D721000-memory.dmp

Download

memory/4692-1725-0x0000018D59260000-0x0000018D59289000-memory.dmp

Download

memory/4692-1590-0x0000018D59290000-0x0000018D59291000-memory.dmp

Download

memory/4896-125-0x0000000007650000-0x0000000007661000-memory.dmp

Download

memory/4896-124-0x0000000007720000-0x00000000077B6000-memory.dmp

Download

memory/4896-117-0x00000000703E0000-0x000000007042C000-memory.dmp

Download