Analysis

  • user interaction
    yes
  • max time kernel
    300s
  • max time network
    310s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    13/11/2026, 21:45

General

  • Target
    Feather Launcher Setup 2.6.13.exe
  • Size 122.6MB
  • Sample261113-1madxsf14p
  • SHA256 28fe94c0d6135dd9d45e0b370265d68804688167bada7ed072acb33b5b08e7db
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 26 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Feather Launcher Setup 2.6.13.exe
    "C:\Users\Admin\AppData\Local\Temp\Feather Launcher Setup 2.6.13.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Feather Launcher.exe" /FO csv | "C:\Windows\system32\find.exe" "Feather Launcher.exe"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5032
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Feather Launcher.exe" /FO csv
        3⤵
        • Discovers running processes
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2736
      • C:\Windows\SysWOW64\find.exe
        "C:\Windows\system32\find.exe" "Feather Launcher.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2260
  • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
    "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe"
    1⤵
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3976
    • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1664,i,8510785754800946767,6050075389155865034,262144 --enable-features=EnableTransparentHwndEnlargement,HappyEyeballsV3,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1660 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4536
    • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --field-trial-handle=1664,i,8510785754800946767,6050075389155865034,262144 --enable-features=EnableTransparentHwndEnlargement,HappyEyeballsV3,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1840 /prefetch:11
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:3096
    • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-user-model-id=FeatherMC.FeatherLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\feather\resources\app.asar" --no-sandbox --no-zygote --disable-blink-features=GetDisplayMedia --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1794606208647580 --launch-time-ticks=551979555 --field-trial-handle=1664,i,8510785754800946767,6050075389155865034,262144 --enable-features=EnableTransparentHwndEnlargement,HappyEyeballsV3,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3136 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
        "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" C:\Users\Admin\AppData\Local\Programs\feather\resources\app.asar\dist\electron-launcher\preload\preload-mod-watcher-fork.js
        3⤵
        • Executes dropped EXE
        PID:3708
      • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
        "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" C:\Users\Admin\AppData\Local\Programs\feather\resources\app.asar\dist\electron-launcher\preload\player-server-addon\player-server-addon-path-watcher-fork-process.js
        3⤵
        • Executes dropped EXE
        PID:3036
    • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-user-model-id=FeatherMC.FeatherLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\feather\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1794606208647580 --launch-time-ticks=562349741 --field-trial-handle=1664,i,8510785754800946767,6050075389155865034,262144 --enable-features=EnableTransparentHwndEnlargement,HappyEyeballsV3,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3124 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1496
    • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-user-model-id=FeatherMC.FeatherLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\feather\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1794606208647580 --launch-time-ticks=562350317 --field-trial-handle=1664,i,8510785754800946767,6050075389155865034,262144 --enable-features=EnableTransparentHwndEnlargement,HappyEyeballsV3,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3220 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:916
    • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-user-model-id=FeatherMC.FeatherLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\feather\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1794606208647580 --launch-time-ticks=562350144 --field-trial-handle=1664,i,8510785754800946767,6050075389155865034,262144 --enable-features=EnableTransparentHwndEnlargement,HappyEyeballsV3,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3200 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3752
    • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-user-model-id=FeatherMC.FeatherLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\feather\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1794606208647580 --launch-time-ticks=562397974 --field-trial-handle=1664,i,8510785754800946767,6050075389155865034,262144 --enable-features=EnableTransparentHwndEnlargement,HappyEyeballsV3,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3264 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1456
    • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1664,i,8510785754800946767,6050075389155865034,262144 --enable-features=EnableTransparentHwndEnlargement,HappyEyeballsV3,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4484 /prefetch:10
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:4460
    • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-user-model-id=FeatherMC.FeatherLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\feather\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1794606208647580 --launch-time-ticks=717640529 --field-trial-handle=1664,i,8510785754800946767,6050075389155865034,262144 --enable-features=EnableTransparentHwndEnlargement,HappyEyeballsV3,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3836 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3116
    • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-user-model-id=FeatherMC.FeatherLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\feather\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1794606208647580 --launch-time-ticks=717652789 --field-trial-handle=1664,i,8510785754800946767,6050075389155865034,262144 --enable-features=EnableTransparentHwndEnlargement,HappyEyeballsV3,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3848 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:420
    • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-user-model-id=FeatherMC.FeatherLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\feather\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1794606208647580 --launch-time-ticks=717683963 --field-trial-handle=1664,i,8510785754800946767,6050075389155865034,262144 --enable-features=EnableTransparentHwndEnlargement,HappyEyeballsV3,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5232 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:664
    • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-user-model-id=FeatherMC.FeatherLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\feather\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1794606208647580 --launch-time-ticks=717754442 --field-trial-handle=1664,i,8510785754800946767,6050075389155865034,262144 --enable-features=EnableTransparentHwndEnlargement,HappyEyeballsV3,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3940 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5068
    • C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe
      "C:\Users\Admin\AppData\Local\Programs\feather\Feather Launcher.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --field-trial-handle=1664,i,8510785754800946767,6050075389155865034,262144 --enable-features=EnableTransparentHwndEnlargement,HappyEyeballsV3,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5996 /prefetch:12
      2⤵
      • Executes dropped EXE
      PID:4024
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:5060

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          LICENSE.electron.txt

          • Path C:\Users\Admin\AppData\Local\Programs\feather\LICENSE.electron.txt
          • Size 1KB
          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
          • MD5 SHA1 SHA512 TLSH

          LICENSES.chromium.html

          • Path C:\Users\Admin\AppData\Local\Programs\feather\LICENSES.chromium.html
          • Size 15.2MB
          • SHA256 906d201edf135559c06f326eec1ec2eaf3fdbef9f669031c716ba404f34657b7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_200_percent.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\chrome_200_percent.pak
          • Size 182KB
          • SHA256 6593ba8ece63001a3fb77bd1d872566edeb26213a1be8e852dd956f6d0e2c93e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          d3dcompiler_47.dll

          • Path C:\Users\Admin\AppData\Local\Programs\feather\d3dcompiler_47.dll
          • Size 4.5MB
          • SHA256 fe86899dadd7cf158ce8dd1105c4d2d5c8adf5eac18928ba4e847da7596a1400
          • MD5 SHA1 SHA512 SSDEEP TLSH

          dxcompiler.dll

          • Path C:\Users\Admin\AppData\Local\Programs\feather\dxcompiler.dll
          • Size 24.4MB
          • SHA256 f997358321c35776ffe273dd4316cd70b402282125f996f01554842b5fc7ad45
          • MD5 SHA1 SHA512 SSDEEP TLSH

          dxil.dll

          • Path C:\Users\Admin\AppData\Local\Programs\feather\dxil.dll
          • Size 1.4MB
          • SHA256 179ab53c75008d91d71bee43fd3ca697d5b5a9f08795146818e6dab62ac86394
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ffmpeg.dll

          • Path C:\Users\Admin\AppData\Local\Programs\feather\ffmpeg.dll
          • Size 2.9MB
          • SHA256 4c154f87225445e0ec05d173624f56aeffb8076b0e43b3cf25f99a3cc3b85726
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icudtl.dat

          • Path C:\Users\Admin\AppData\Local\Programs\feather\icudtl.dat
          • Size 10.3MB
          • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libEGL.dll

          • Path C:\Users\Admin\AppData\Local\Programs\feather\libEGL.dll
          • Size 498KB
          • SHA256 d6392352338083d1c34d921841a863694a75098dabd73894e56ca1eff03851a6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libGLESv2.dll

          • Path C:\Users\Admin\AppData\Local\Programs\feather\libGLESv2.dll
          • Size 7.6MB
          • SHA256 216ac98dd8fdf6d6246928b9fff8c75f7de2119862f78b26e3fa5b3e615c30ee
          • MD5 SHA1 SHA512 SSDEEP TLSH

          af.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\af.pak
          • Size 582KB
          • SHA256 f500ba115f773738d84feb12a909f8e9509f94b1d45bc86ff6eefdca6c7f1fa7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          am.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\am.pak
          • Size 946KB
          • SHA256 4b2dcc369fb50860cc87929488aa9b6e35d973a5234b77ec907e2fe2a8790931
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\ar.pak
          • Size 1.0MB
          • SHA256 71d8f4f3a910647572ccfaa9b75d1cc158073c7aac9fa4372578160380f71475
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bg.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\bg.pak
          • Size 1.1MB
          • SHA256 7ab64589cb8b221ddccd0bba60cd27b57445dcfa1d1bf282a908afcbe24f8205
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\bn.pak
          • Size 1.4MB
          • SHA256 fca72236cef1f37e81a0002b18473237e1fd9c170bd809f2d82dee5617abf082
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ca.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\ca.pak
          • Size 656KB
          • SHA256 8076fe9de4102465252ec963dbd26149918bcd4c8c71bc16ddb5b691f78da14b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cs.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\cs.pak
          • Size 682KB
          • SHA256 d3043f0ea0a91d7089b9bd46ebd2192cfa77a1ad9d07d6dd0e72db2f03307db4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          da.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\da.pak
          • Size 613KB
          • SHA256 4a80237c4e8761925583a5f404f1eb9fc4b0591724cbef057b50c935e67f9893
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\de.pak
          • Size 657KB
          • SHA256 b0fcc971930feebd20752910406a251ab515dd8377c926efbf0730ecdadac00f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          el.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\el.pak
          • Size 1.2MB
          • SHA256 1079cd78b3cbaa80bc5a1068dde1201eae8211f935a4faa8fd1b2e881ddcfde1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-GB.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\en-GB.pak
          • Size 531KB
          • SHA256 d7ff81e2cb2956bc159b6ff806d39177b1f886f6c0de88e5e3a42655b3b0b2c3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-US.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\en-US.pak
          • Size 537KB
          • SHA256 ef30389492cc2d31bc5c162056fe68c27a5d57b0a69f5f878562325f795c5185
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es-419.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\es-419.pak
          • Size 647KB
          • SHA256 0f5af329aae315473ef60e4e9e4cf2168af9a5a53c24c5d6367dd87b7e3f146a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\es.pak
          • Size 644KB
          • SHA256 cc3d7c3f694333f8b83127131b665130705598ab1ad7e1e16a0359ad52a73aa6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          et.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\et.pak
          • Size 588KB
          • SHA256 2d9edaebd948a518ca0074ee9b3e0840bdfafe4391ec8435a1f0f7072d88ac7d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fa.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\fa.pak
          • Size 975KB
          • SHA256 d26e6e0cf1786b01e3f7257469fe048871218113db5c51b9f72a5fa0d242e8cf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fi.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\fi.pak
          • Size 599KB
          • SHA256 b87cbc298d42619699a207cec6bbc34567528cc0b37ea2059f48cd2c63b857a0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fil.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\fil.pak
          • Size 680KB
          • SHA256 be9a51a3e3bbb334ef1dcec3f85f5d884e04d5580b4e7a24e9d5bbf84fa56e1f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\fr.pak
          • Size 700KB
          • SHA256 2a7e6756253d85edb24a27e4e3f8e43ba1b124160cc1adae9792195abbbf7a5f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gu.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\gu.pak
          • Size 1.3MB
          • SHA256 2623480ab810561ca86eacaa6b09ec67d4716e74484917a9931caafe57f183d7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          he.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\he.pak
          • Size 854KB
          • SHA256 c6712be63d5d0337c345cf03af8a492200e1cdbfa124801620b58f7212c20c90
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\hi.pak
          • Size 1.4MB
          • SHA256 04007246aa9acde32d4ab3e0edb6c898e995d6b716579911d76a8e169538074a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\hr.pak
          • Size 657KB
          • SHA256 a6c1d62d5ebf72aba06b83da68c2a7e4ed77817cfa6e5f6f531df9ddd2d67f12
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\hu.pak
          • Size 702KB
          • SHA256 bd054c1c8c9f4a53106accc3c61310322a160d9c66c6317a63c91d17eacee23a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\id.pak
          • Size 580KB
          • SHA256 81574aa518c3cf7dab5e08510db9180a7a4d1e115a97fee8ae471b423301e793
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\it.pak
          • Size 635KB
          • SHA256 516392ee5c30cce472c5e2f6ea72c9607fde7d543791840b2147ba126277fae8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\ja.pak
          • Size 774KB
          • SHA256 f83467016fe545c2d7ffb29818b63141936ddbeb347eecb94dbcc4dd7aebc160
          • MD5 SHA1 SHA512 SSDEEP TLSH

          kn.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\kn.pak
          • Size 1.5MB
          • SHA256 6e4307cb71b0086f9173fe76675f12d017f2318f31930c9b7551552d10608876
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\ko.pak
          • Size 657KB
          • SHA256 ddee44a6cb30a5f19fb7e2f475ef38ca866ccd9454807f04b028f211d6e0638d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lt.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\lt.pak
          • Size 714KB
          • SHA256 38a85c44924159a7096ac757e11a6e3ec94058e40d661b45e796c29b1ffc2fe6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lv.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\lv.pak
          • Size 711KB
          • SHA256 b1789efbe97746e1ceb8eca5fec1bacf84e2f157cb24ba10487141f80a8d0fe6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ml.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\ml.pak
          • Size 1.6MB
          • SHA256 35e3ecbc30a2ba8eeeafa884b63b502876086e4f58694aface215280620b6ff4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\mr.pak
          • Size 1.3MB
          • SHA256 20121228e7790b61c69d3e8a825098002bae61884b2c6cd84189c31415a594f6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ms.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\ms.pak
          • Size 610KB
          • SHA256 3d504ad265b71b6de6e1d65a5a92c0a5f3d9ac188cb073d6391a0884217d6580
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nb.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\nb.pak
          • Size 586KB
          • SHA256 bf454559af0c66c2beb108b45664bbce95c8fc6ca6e9e176d77161c2ac3c2c09
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nl.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\nl.pak
          • Size 610KB
          • SHA256 6562756131ac1966805981bddd08c4330ab4cbcfed836482203bd6a819e6d99d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pl.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\pl.pak
          • Size 682KB
          • SHA256 a7266a664cfb74895e2b9099f67f179043df848e8bdf97264756e8383367c66f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-BR.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\pt-BR.pak
          • Size 638KB
          • SHA256 1ab6dee0fb09dfe1c53cf196efe404041835602bce797877f7fa89b2011becf6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-PT.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\pt-PT.pak
          • Size 641KB
          • SHA256 1001af3f01e2e52b535b8c9f9e37f356998b597ffe6bfa90d23a2500d0efc3a4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ro.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\ro.pak
          • Size 666KB
          • SHA256 2feca2991c73a665d1503b9c1320b518658ea940a62f35b75f7780d4ef0b054a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ru.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\ru.pak
          • Size 1.1MB
          • SHA256 8487e04fab7b7350e17f3441455c4995d12ac870ff8f2b97dd44aeed1a3f0169
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sk.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\sk.pak
          • Size 693KB
          • SHA256 abe4f0f69555a929f3f9e992208cf178b86c300803fb1e01c7c78e5fa96ce1a2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sl.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\sl.pak
          • Size 664KB
          • SHA256 105f19bd95178afdd37507b09187b7e57f660fc8cbaf61840e770a0dbd624989
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\sr.pak
          • Size 1022KB
          • SHA256 c85a6a25a18cbf773861255bdf09dbbbf6e7da0b56196d02ed9ed48b7c1bfa7e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sv.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\sv.pak
          • Size 592KB
          • SHA256 50ee47f0ecab084a1e47fd1055f14204a904e02e76cc11f056880027bb30f0b4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sw.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\sw.pak
          • Size 626KB
          • SHA256 039c517ef328c62d1fed7e8b6d229f6d30f09df5aabd79503d6798e37ed89315
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ta.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\ta.pak
          • Size 1.6MB
          • SHA256 b629034f195f1b354f959186f9c9de6a8e5fcb8ed98f2b120cbe574681a96f6d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          te.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\te.pak
          • Size 1.5MB
          • SHA256 b226521143030f9c0253e26e45603db8817a106253f085e731ded1269be74127
          • MD5 SHA1 SHA512 SSDEEP TLSH

          th.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\th.pak
          • Size 1.2MB
          • SHA256 adec2c1293d2bfc4c4e49d78b4d1a27f1d68b79398935aa45219736ab90903e7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\tr.pak
          • Size 638KB
          • SHA256 b38c37fbc4de0d502fa8fdb0e628d40e84dd4c3ae9a5d3191405635f8c815343
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uk.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\uk.pak
          • Size 1.1MB
          • SHA256 3d19684ee617aa6465e25db6927e257f290ded63ead9402c440a34d5983b7585
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ur.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\ur.pak
          • Size 960KB
          • SHA256 4047d247f7827a03a5c64f252a9e5a5ac9fabc75bdd03b87a3d248eefca03648
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vi.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\vi.pak
          • Size 757KB
          • SHA256 263dbe4ea8b3ab7f189b91d6707fdfba604d02894bc50483a8b562334d303a4c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-CN.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\zh-CN.pak
          • Size 542KB
          • SHA256 cba14b4e279269daf8e7e7925039df8eb37a9b7459a27a41e57c933fccb745fc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-TW.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\locales\zh-TW.pak
          • Size 536KB
          • SHA256 c425d71d1d06ba214857efda2a33b098d8d8469705840e13aa6e663963871db3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          resources.pak

          • Path C:\Users\Admin\AppData\Local\Programs\feather\resources.pak
          • Size 6.1MB
          • SHA256 8ca2bfe185e2d076219d0efcf6771a7aa0d83e72392542168097dd9bcb6f0fe6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          app-update.yml

          • Path C:\Users\Admin\AppData\Local\Programs\feather\resources\app-update.yml
          • Size 172B
          • SHA256 d19bd6ece3162842d98662aa2a192af84bd9a61b0fa1da26f91cdb89adfc8349
          • MD5 SHA1 SHA512 TLSH

          app.asar

          • Path C:\Users\Admin\AppData\Local\Programs\feather\resources\app.asar
          • Size 37.4MB
          • SHA256 c479b84d7c4a83c0da8ac83761d2252044b60f82ad3bcb0ec3d08d735fffaff2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cleanup.feather

          • Path C:\Users\Admin\AppData\Local\Programs\feather\resources\app.asar.unpacked\dist\native\cleanup.feather
          • Size 988KB
          • SHA256 7c7c4e65f874da00f6fbb6c98128da45c2a3d388613aeff0179a22132ec1c27a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          default_app.asar

          • Path C:\Users\Admin\AppData\Local\Programs\feather\resources\default_app.asar
          • Size 108KB
          • SHA256 ba7945028c515f55715aefc66f84ee41fdbc56a60a795287bea4066abe643acf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          elevate.exe

          • Path C:\Users\Admin\AppData\Local\Programs\feather\resources\elevate.exe
          • Size 105KB
          • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
          • MD5 SHA1 SHA512 SSDEEP TLSH

          snapshot_blob.bin

          • Path C:\Users\Admin\AppData\Local\Programs\feather\snapshot_blob.bin
          • Size 331KB
          • SHA256 81ce6161502faa15e5eb290e54dad17a48230387e946222ba176ed64742bacb2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          v8_context_snapshot.bin

          • Path C:\Users\Admin\AppData\Local\Programs\feather\v8_context_snapshot.bin
          • Size 696KB
          • SHA256 6c890447d4edd953a1ec1c53293c74b2136c3241ad29b9661a4c137de6eaf6ba
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader.dll

          • Path C:\Users\Admin\AppData\Local\Programs\feather\vk_swiftshader.dll
          • Size 5.4MB
          • SHA256 9cefc470c455e874ea748a6a9369f5db6baae6411f982751f7738f4897a4b7ad
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader_icd.json

          • Path C:\Users\Admin\AppData\Local\Programs\feather\vk_swiftshader_icd.json
          • Size 106B
          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
          • MD5 SHA1 SHA512 TLSH

          vulkan-1.dll

          • Path C:\Users\Admin\AppData\Local\Programs\feather\vulkan-1.dll
          • Size 933KB
          • SHA256 a3425ea8384d16fc8983ff274a6a2f76c9349b2c6994f0c3c2984aeb256c6b0e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          1fd21097-fffb-400b-bcec-8fb4d2240825.tmp.node

          • Path C:\Users\Admin\AppData\Local\Temp\1fd21097-fffb-400b-bcec-8fb4d2240825.tmp.node
          • Size 11.7MB
          • SHA256 40146c1be5c0ddaf39b67c8ecf05539c8a949cde795b6427b547d1d3c8f7eb16
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_100_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj9C2C.tmp\7z-out\chrome_100_percent.pak
          • Size 112KB
          • SHA256 cbe052e9bd36032cde9d0ad7496d611c6a3c98a130b960e1298d490254be1159
          • MD5 SHA1 SHA512 SSDEEP TLSH

          SpiderBanner.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj9C2C.tmp\SpiderBanner.dll
          • Size 9KB
          • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
          • MD5 SHA1 SHA512 SSDEEP TLSH

          StdUtils.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj9C2C.tmp\StdUtils.dll
          • Size 100KB
          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          System.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj9C2C.tmp\System.dll
          • Size 12KB
          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          WinShell.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj9C2C.tmp\WinShell.dll
          • Size 3KB
          • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
          • MD5 SHA1 SHA512 TLSH

          nsExec.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj9C2C.tmp\nsExec.dll
          • Size 6KB
          • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsis7z.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj9C2C.tmp\nsis7z.dll
          • Size 424KB
          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
          • MD5 SHA1 SHA512 SSDEEP TLSH

          client-id.json

          • Path C:\Users\Admin\AppData\Roaming\.feather\client-id.json
          • Size 51B
          • SHA256 6a9036b25c8547a3c2c18c036b4bd660b2000831f78a666a0dcaddb8c02c67a8
          • MD5 SHA1 SHA512 TLSH

          78c6bda2-19a6-4240-84b1-ad3a08e32993.tmp

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\78c6bda2-19a6-4240-84b1-ad3a08e32993.tmp
          • Size 57B
          • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
          • MD5 SHA1 SHA512 TLSH

          f_000003

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Cache\Cache_Data\f_000003
          • Size 81KB
          • SHA256 d37f2d0abf2f0c0518c897fdb822e1d14fcc65cf9a0b180a52a44b755af5e005
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_00000b

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Cache\Cache_Data\f_00000b
          • Size 16KB
          • SHA256 13232c4850db3285b4224c9c8b6e4b5cd176de7a857444129d0725bfab3353d7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          temp-index

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Code Cache\js\index-dir\temp-index
          • Size 48B
          • SHA256 4080f4f083d70f40e6d5aeae6ad03b05d116677e972822d2515311df45c7d844
          • MD5 SHA1 SHA512

          data_0

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\GPUCache\data_0
          • Size 8KB
          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
          • MD5 SHA1 SHA512 SSDEEP

          data_1

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\GPUCache\data_1
          • Size 264KB
          • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
          • MD5 SHA1 SHA512 SSDEEP

          data_2

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\GPUCache\data_2
          • Size 8KB
          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
          • MD5 SHA1 SHA512 SSDEEP

          data_3

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\GPUCache\data_3
          • Size 8KB
          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
          • MD5 SHA1 SHA512 SSDEEP

          CURRENT

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Local Storage\leveldb\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512

          82c8b61e-8088-4de7-8ff1-f7444b7760f9.tmp

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\82c8b61e-8088-4de7-8ff1-f7444b7760f9.tmp
          • Size 1KB
          • SHA256 87d6299a366254f046a1b45dba1092b7d49afae41ad27d63017b0eb4310ed109
          • MD5 SHA1 SHA512 TLSH

          b8d2901a-c9f2-4947-8963-66e38d5506c6.tmp

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\b8d2901a-c9f2-4947-8963-66e38d5506c6.tmp
          • Size 872B
          • SHA256 30fe9fc08b288c327ed7a6699649d155ce83637368ad443299acf2b2cf6a4180
          • MD5 SHA1 SHA512 TLSH

          f_000002

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Cache\Cache_Data\f_000002
          • Size 34KB
          • SHA256 541d0e0a809088125564c25285d86b44ee58f6da81e981ec7511a6423c976867
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000003

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Cache\Cache_Data\f_000003
          • Size 156KB
          • SHA256 6a879228024ad2560881d214f9b952f50036dc300d5f8ad0486629553ae5e964
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000004

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Cache\Cache_Data\f_000004
          • Size 286KB
          • SHA256 831caf01f103aec188ee28c66d7c32653b8a384c4b3c6c25cd67276220c1afc9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000006

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Cache\Cache_Data\f_000006
          • Size 16KB
          • SHA256 d5a29c73c6200af2ed6918a61106e649b92098ecd476830d725ed4d2ea5a8efa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000007

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Cache\Cache_Data\f_000007
          • Size 33KB
          • SHA256 12f7a2ba40fce051a2d7f605f5baa1942cf628ecddee965fa08cdd3022658be7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000008

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Cache\Cache_Data\f_000008
          • Size 25KB
          • SHA256 9c39210e1b4815d7df0ec9de3dbec12acd19ca27f4c4ad09c70c59dd1eda23a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000009

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Cache\Cache_Data\f_000009
          • Size 30KB
          • SHA256 e6ce711ef3ad3b74e04cfec40f8d759a0c8571a0a2918960ce68eb278d1bdf2d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_00000a

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Cache\Cache_Data\f_00000a
          • Size 24KB
          • SHA256 1f95d67100bbad3a8d2006b8fe134f226072489bec2fc8521b8c0a764942b509
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_00000f

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Cache\Cache_Data\f_00000f
          • Size 16KB
          • SHA256 0f2226c2fb822f85a31ffd50efbc77fdef55b5fd3846cc10d831e6d7cdd1d327
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000010

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Cache\Cache_Data\f_000010
          • Size 17KB
          • SHA256 13f954979523c02db8bc70af9de48b97ddfd3cebb4ec4e4575bdf1298cefb521
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000011

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Cache\Cache_Data\f_000011
          • Size 27KB
          • SHA256 04db5d2fb3e473435764b9c7cea53f0c854f9903460da52de57dded69770c7dc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000013

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Cache\Cache_Data\f_000013
          • Size 135KB
          • SHA256 32773302cbbd263b8491f5bc83abcb5ef71bc9ceed9cd3f7384ab2464d21f15e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000014

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Cache\Cache_Data\f_000014
          • Size 182KB
          • SHA256 a56e33c6c759fda45b86bd2a07a98c231207678a3f9632e68d13309add278ef0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          snapshot-new.baf

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Cache\No_Vary_Search\snapshot-new.baf
          • Size 20B
          • SHA256 0c2dd377ed0cc66161e9db8f89f7d8bcb3ad8c06c4a054bdcba214ab05f58c9a
          • MD5 SHA1 SHA512

          index

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Code Cache\js\index
          • Size 24B
          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
          • MD5 SHA1 SHA512

          MANIFEST-000001

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Local Storage\leveldb\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512

          19daecc3-46d1-4152-8691-585f5f2315b7.tmp

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Network\19daecc3-46d1-4152-8691-585f5f2315b7.tmp
          • Size 8KB
          • SHA256 8793f5a1ba90621e047cbd1fed8ce2ccb8d062ebfe9706c54b168babe22f4a50
          • MD5 SHA1 SHA512 SSDEEP TLSH

          40ee4c56-9482-4f47-ba86-b89bc6af1ac7.tmp

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Network\40ee4c56-9482-4f47-ba86-b89bc6af1ac7.tmp
          • Size 27KB
          • SHA256 6dcd2acd6dc34bca2462c8117801ee55848de1397552560cb5d171ad4907b1aa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          5228be2c-469e-4c6d-8a13-d043a5c6c389.tmp

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Network\5228be2c-469e-4c6d-8a13-d043a5c6c389.tmp
          • Size 22KB
          • SHA256 993735ef11a6d25b0aaa1abbae87faf7dce2205ebd09d4e9c80e2f16bfbf6646
          • MD5 SHA1 SHA512 SSDEEP TLSH

          814a811e-8ca1-4ad7-92e8-e86fa1b8d88d.tmp

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Network\814a811e-8ca1-4ad7-92e8-e86fa1b8d88d.tmp
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH

          temp-index

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Shared Dictionary\cache\index-dir\temp-index
          • Size 72B
          • SHA256 04eb92cd49201631cebf435fb1f5f7131ded31d63209bc71e688ae8fba4f17cc
          • MD5 SHA1 SHA512 TLSH

          the-real-index

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Partitions\ads\Shared Dictionary\cache\index-dir\the-real-index
          • Size 48B
          • SHA256 40182e72a5e3645820d17a786bf5e7a9fbe40a25f4de1079381274c32c3ede2e
          • MD5 SHA1 SHA512

          Preferences

          • Path C:\Users\Admin\AppData\Roaming\Feather Launcher\Preferences
          • Size 158B
          • SHA256 f0d2fb236f43321bada3f48a178ccc227bae1a5a644b658b9ad755eaeabf0e8f
          • MD5 SHA1 SHA512 TLSH

          default.dic

          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512

          memory/1496-896-0x00007FFDB51E0000-0x00007FFDB51E1000-memory.dmp

          memory/1496-895-0x00007FFDB49A0000-0x00007FFDB49A1000-memory.dmp

          memory/4460-1087-0x000002824DEB0000-0x000002824DEB1000-memory.dmp

          memory/4460-1091-0x000002824DEB0000-0x000002824DEB1000-memory.dmp

          memory/4460-1090-0x000002824DEB0000-0x000002824DEB1000-memory.dmp

          memory/4460-1089-0x000002824DEB0000-0x000002824DEB1000-memory.dmp

          memory/4460-1088-0x000002824DEB0000-0x000002824DEB1000-memory.dmp

          memory/4460-1081-0x000002824DEB0000-0x000002824DEB1000-memory.dmp

          memory/4460-1086-0x000002824DEB0000-0x000002824DEB1000-memory.dmp

          memory/4460-1092-0x000002824DEB0000-0x000002824DEB1000-memory.dmp

          memory/4460-1079-0x000002824DEB0000-0x000002824DEB1000-memory.dmp

          memory/4460-1080-0x000002824DEB0000-0x000002824DEB1000-memory.dmp

          memory/4536-920-0x0000016133F90000-0x000001613441D000-memory.dmp

          memory/4536-982-0x0000016133F90000-0x000001613441D000-memory.dmp

          memory/4536-967-0x0000016133F90000-0x000001613441D000-memory.dmp