fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6

Resubmissions

19/01/2024, 01:18

240119-bn7ndadef77

19/01/2024, 01:13

240119-bla7dscefr10

Analysis

max time kernel
5s
max time network
131s
platform
windows10-1703_x64
resource
win10-20231220-en
resource tags

arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
submitted
19/01/2024, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe
Size 71.3MB
Sample240119-bla7dscefr
SHA256 fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6
MD5 65abecd9d4eab0048f0ef67a660c1edc
SHA1 8159e27cc52129b51c41dff996243eeb604a4129
SHA512 76ecb58c10f3332a26a1601c9a61e8bbb719fcb813173381e5f28718c95711cb50432109b8447f5e9b00a41856815f6093b16a44f1cfef177e05c1d7ea90a92f
SSDEEP 1572864:Z4/4rzOchPJt8P77r/4UkZNQyaSz3Ek+yvDuWjXMzbP0TdVwGz7:ekqcdb0PwUknBjzvDHXMzQ/7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4612	fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe
4612	fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ipinfo.io
9	ipinfo.io
11	ipinfo.io
12	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
10576	schtasks.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
10588	WMIC.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
7768	tasklist.exe
5948	tasklist.exe
5244	tasklist.exe
6008	tasklist.exe
8072	tasklist.exe
7828	tasklist.exe
7820	tasklist.exe
7432	tasklist.exe
7308	tasklist.exe
7672	tasklist.exe
5576	tasklist.exe
7400	tasklist.exe
7192	tasklist.exe
5836	tasklist.exe
6796	tasklist.exe
6128	tasklist.exe
7996	tasklist.exe
7860	tasklist.exe
7600	tasklist.exe
7868	tasklist.exe
7584	tasklist.exe
7288	tasklist.exe
4920	tasklist.exe
7088	tasklist.exe
7852	tasklist.exe
7376	tasklist.exe
5188	tasklist.exe
7264	tasklist.exe
11184	tasklist.exe
6188	tasklist.exe
7980	tasklist.exe
7552	tasklist.exe
7408	tasklist.exe
7368	tasklist.exe
7300	tasklist.exe
7064	tasklist.exe
7488	tasklist.exe
5788	tasklist.exe
5280	tasklist.exe
8064	tasklist.exe
8056	tasklist.exe
7988	tasklist.exe
7804	tasklist.exe
7592	tasklist.exe
7336	tasklist.exe
7688	tasklist.exe
7792	tasklist.exe
7776	tasklist.exe
7712	tasklist.exe
7344	tasklist.exe
7208	tasklist.exe
428	tasklist.exe
5544	tasklist.exe
7608	tasklist.exe
7568	tasklist.exe
7472	tasklist.exe
7360	tasklist.exe
7316	tasklist.exe
7812	tasklist.exe
7416	tasklist.exe
7384	tasklist.exe
5256	tasklist.exe
7100	tasklist.exe
7072	tasklist.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4612	fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
10680	attrib.exe

C:\Users\Admin\AppData\Local\Temp\fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe
"C:\Users\Admin\AppData\Local\Temp\fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4612
- C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
  C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
  2⤵
  PID:2376
- - C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
    "C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --mojo-platform-channel-handle=1828 --field-trial-handle=1604,206865263506821821,11398464235774705617,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    PID:3528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3524
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:10640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:10556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
    3⤵
    PID:10892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:10460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:5596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    PID:5580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\resources\app.asar.unpacked\bind\main.exe"
    3⤵
    PID:5564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:5556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupqG0LIm /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\" /F /rl highest"
    3⤵
    PID:10472
  - - C:\Windows\system32\cmd.exe
      cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupqG0LIm /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\" /F /rl highest
      4⤵
      PID:10560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "& { $Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DarkAdventures.exe' $Trigger = New-ScheduledTaskTrigger -Daily -At '12:00PM' Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName StartCacaTask }"
    3⤵
    PID:10968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:11076
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:10300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:10308
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:10108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\"""
    3⤵
    PID:10712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupqG0LIm /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe /f"
    3⤵
    PID:10552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=2376 get ExecutablePath"
    3⤵
    PID:5600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=2376 get ExecutablePath"
    3⤵
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
    "C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1480 --field-trial-handle=1604,206865263506821821,11398464235774705617,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3396

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:6804

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:6796

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:6992

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7072

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:5488

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:6128

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7216

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7424

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7688

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7868

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7996

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8072

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 session
1⤵
PID:8284

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8056

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7988

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7972

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7980

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7860

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7852

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7844

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7836

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7828

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7820

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7812

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7804

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7792

C:\Windows\system32\more.com
more +1
1⤵
PID:7784

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7776

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7768

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7720

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7712

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7704

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7680

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7672

C:\Windows\System32\Wbem\WMIC.exe
wmic OS get caption, osarchitecture
1⤵
PID:7624

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7616

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7608

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7600

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7592

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7584

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7576

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7568

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7560

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7552

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7544

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7488

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:7480

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7472

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7464

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7360

C:\Windows\system32\net.exe
net session
1⤵
PID:7440

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7432

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7416

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7408

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7400

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7392

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7384

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7376

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7368

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7344

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7336

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7324

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7316

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7308

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7300

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7288

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7280

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7272

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7264

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7256

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7208

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7200

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7192

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7184

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7172

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:6140

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:5836

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:2296

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:6008

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:5960

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:5188

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:5256

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:428

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:6204

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:5948

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:5788

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:4624

C:\Windows\system32\more.com
more +1
1⤵
PID:10504

C:\Windows\system32\more.com
more +1
1⤵
PID:10596

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController get name
1⤵
- Detects videocard installed
PID:10588

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
1⤵
PID:10680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
1⤵
PID:10928

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:11184

C:\Windows\System32\Wbem\WMIC.exe
wmic cpu get name
1⤵
PID:10496

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:5280

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:5576

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:5244

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:6188

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:5516

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:5544

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7100

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7064

C:\Windows\System32\Wbem\WMIC.exe
wmic process where processid=2376 get ExecutablePath
1⤵
PID:10540

C:\Windows\system32\schtasks.exe
schtasks /create /sc onlogon /tn WindowsDriverSetupqG0LIm /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\" /F /rl highest
1⤵
- Creates scheduled task(s)
PID:10576

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\""
1⤵
PID:10764
- C:\Windows\system32\attrib.exe
  "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe
  2⤵
  - Views/modifies file attributes
  PID:10680

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupqG0LIm /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe /f
1⤵
PID:10556

C:\Windows\System32\Wbem\WMIC.exe
wmic process where processid=2376 get ExecutablePath
1⤵
PID:3728

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 1KB
SHA256 85ca56b74e2263e05e86198be5f9db77a4fc1b3393754d9d905849b27c911e66
MD5 c4bada70fdbff509b2c911585a5d60c3
SHA1 2ea1ca034c67a1af2a048e619ceba156efe00e57
SHA512 2db5b4d22c8125b8f679cda0dfba0da2838112ca838f10a4cdfbafe17548936874d3aa2ad22ca6f2b51fdf5b78f76b0078ec1437bcf6b3adea2c7d19d4485246
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2679027d0e3875f665efb399f0948356a3cea90e61bfed63c6de4d66d7c60f1c
MD5 16a47f226ff4bb2ab7ea53d8c37705ea
SHA1 610daff97dca19e727518db5f21bcad79563e86c
SHA512 c2f09862f72d872ab5a29d728876aeaa76563349f10669013aa17ee5a2aacfa735d4e5c3b072d30f3a9585ba833a328ecf45611fc8715a27b2bec8a7e51596c0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a525f16758da32da009dabd1772eb4d9ed010f17eb1421863adf88634d8d1d45
MD5 b14054e175011277282a01483fec3557
SHA1 f378e0d5480dd60ae59f132400392727957045da
SHA512 5c83de8fe4f4004e5fa568a244fdb50faa5f0282dfb7c166071271c05329a3153ef2444597e4e8e0c835de88119239654336f2cbd15149fca66144732856e58c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 19fa343373df6cd1c7dd2f40461762209f156d83baa09f56304ffa2561df42d8
MD5 63662345e09fa3f64fcdc2d4e982cb66
SHA1 8fbc03d09aff5a97c3639a1e366dd2ef1ec8ac47
SHA512 b545c554e6f1028cd5c3819e35afcf30123c366a178d7dbadfcc2b1615311453fb479c45de64c2f53a49a18a36456001d495de677e4f1cd8c1aeaae95043bc5d
MD5 SHA1 SHA512

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\D3DCompiler_47.dll
Size 1.2MB
SHA256 5cd34081ff98d2993857f72847335ed73add74824202c91ca118abbe553ff1e7
MD5 d9a3a3043e83f75e5d50dd57c57acb34
SHA1 15903bcc7aac9b30f3dd5f5271ef2c0d8c2e0a3b
SHA512 4bfbf04f97732919d85b1a31a40c8a37b74c44298a18e2f6eba55ce433fd6b969814a546a0b8885102fafb781db7dd0e3a48740ddd9720bd1b6696c8a52f5484
SSDEEP 24576:aYADjRKc9J2R20PM2SbMLKam+AIMrLi21fIbCTq6/vjy:aYlc/220PPiMLKam+VMrLi21f4i3jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

DarkAdventures.exe

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
Size 1KB
SHA256 6ec322571899b43db7d4ccb1b02138c21d152738ec4b9e0e9ec9f1aa2c0fe980
MD5 ba4c19a3ef1303a7b5c2ef76a58df3e5
SHA1 6ffeeb986205d61bf253c35f4f54818bb0b9c32e
SHA512 e26d4c504d09c79c730790e5a2fa6cf4c667223f7848f43838282b3567d390002df92156fe4700b4c727831a38612f5d733108ce693eeba9610546166034cc15
MD5 SHA1 SHA512

Submit Download

DarkAdventures.exe

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
Size 1.5MB
SHA256 e932dce2d98ed28a9275dafe7af31ae415fa8b1db2b14c6cdfba58620b9523e6
MD5 fc4cc054b4c8d12139c79756016b4b80
SHA1 ee9440f5ca3bfe5acf30efba06ff4202d000c629
SHA512 3bf9d0fa9cfbc53956bb6be967e37de3d713f592ac1bb990aabca0e0807c44d4bd6735481aee90d68f92b0ff5fbf14f3135ef950748d9d05d6c1d2948c7adc1c
SSDEEP 6144:KvJSAK11yPH4xtMVmehR+b7/78wqtyeYbQaC8ArZj6JrNr/PewEQVJzlLqOy5Kii:K+K/VftUzlLqOy5KigTmAz9cX6jd
MD5 SHA1 SHA512 SSDEEP

Submit Download

DarkAdventures.exe

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
Size 1.7MB
SHA256 74f2e9937e7f6d70ef1e19917cf11340622412237f9d211c2b31834e8bcbfe13
MD5 1b04677003bb4e9a2916645860d7fc6b
SHA1 6cfb7e73dd7aa0c2f531d372ff677d6abb0e9250
SHA512 748981273880e2a0f1a06b333eed4fbe5af0f04c2c0526aaa3078c8bd8416a2e56b1ec46aec030c25d512325ba67c3885ad65f0d330b1f9c081e158afe582941
SSDEEP 12288:K+K/VftUzlLqOy5KigTmAz9cX6jdQE5zPwoMO:1+uuWjjdQE5zPl
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\chrome_100_percent.pak
Size 138KB
SHA256 53102833760a725241841312de452c45e43edd60a122546105ab4020ccef591b
MD5 9c1b859b611600201ccf898f1eff2476
SHA1 87d5d9a5fcc2496b48bb084fdf04331823dd1699
SHA512 1a8ec288e53b9d7e43d018995abe4e3d9c83d329d0561fbb7d022e8b79ffecf033e995b9bc6af352a71c646a1e8afba4addb54deab7455f24b7a279a3dd7c336
SSDEEP 3072:+Kzw9bp66mdgZeMj6g2Z8Gb0+VRLf0ld0GY3cQ3F2DExm/KLQ2I:+Kzw986mdgZezgm8Gb0OV8ld0GecQ3m3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\chrome_100_percent.pak
Size 33KB
SHA256 2edc11a5f1f402587f683ac3342c977a576129faff3f46f031bdbf277695d1ed
MD5 6894a36927944ad1a4293b05c8687cfb
SHA1 4fc6678114b7b9f142b0443362cd5d4d38b07a44
SHA512 54998c815024b71b7eeb4f6a92954c8b220ae672d32f51cedb2cce438b46d1acfbdad9b11087ad3908c6a1a19d8dc3e339f1e5a7d02ffd0f0864d5232f279586
SSDEEP 768:hCRKKb3QuNaamW+iwGpiG900J0yB4nO5/jbedPEp:hUKKbgwiiwGpiBr6fedsp
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\chrome_200_percent.pak
Size 202KB
SHA256 4a438f0e209ac62ffa2c14036efdd5474b5ecaa7cbf54110f2e6153abdfb8be9
MD5 b51a78961b1dbb156343e6e024093d41
SHA1 51298bfe945a9645311169fc5bb64a2a1f20bc38
SHA512 23dedde25ad9cb5829d4b6092a815712788698c2a5a0aefb4299675d39f8b5e2844eabd1ea42332a0408bd234548f5af628e7e365ab26f3385ebfa158cdd921d
SSDEEP 6144:MDQYaF+9b16mdgZezVk5GMRejnbdZnVE6Yopym74:hfs1FdgEj6edhVELo374
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\ffmpeg.dll
Size 24KB
SHA256 06bbca49f59ce97fc7e9f288a4886b50bf29a530acd5582ecb946929d9c56cac
MD5 b25c6b0356ac9ce347f45bad0af8f090
SHA1 0268919856dee754c0e56026a5d06a4c71cae87b
SHA512 7dc4727a4702114110395cc2c36b53e7ae41595377e85fddb6003f513a97b0c9cf2712d7014fca7d503200814bff4ab64cd0dacff91759f4a02870ac31577af1
SSDEEP 768:uGoAWEB/j27aRSNDKUqITMnClTh+QVDmNkU:uGoACaEDOITMnClTh+QjU
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\icudtl.dat
Size 1.6MB
SHA256 c236dde98505ca83fb9a13382505b891f1f04ae92ad1f7725524f121731c0a98
MD5 d0d56e4a6379d3290a6eb500d09d5cc6
SHA1 d8acddfa55eab7199de8b983cf7fba7051e271fc
SHA512 ae7ea741c58177087a2881135c13c4a3ed01d03d540c62cc49f009985a25b4b3e625a67a021b2984381d4323254ce724029afd36d75a626d39514fef71e652f6
SSDEEP 24576:ArvDOhw3zVtjaSEjF9Sy581GbSBrz22wpwiReEEC4X1Xs2:w7bt6jK/wpcEOX1f
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\icudtl.dat
Size 16KB
SHA256 0c3eb5940d2eb14fba00c5b421c7eb8f9ba698191a75192f83cf8c70ef10eba7
MD5 2ebf07f1bf0923048a1f3211b9659711
SHA1 1651252e477e61083cad8c11b1fcc3fdb12ae308
SHA512 1b36be65fb07e31da5cd05828efe08528d78a743411b7a05e34cd464591900e1e5c0cdab63370263ebc93c492ec2475cf8b579cba3b6ca7efd7a901b5a183a33
SSDEEP 384:nQFsOxmRFC500tbJDU9uu5HaxXR4KHmg+xH340nAXozR:nQuOxwkJw9H2R4i+VmXQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\libegl.dll
Size 15KB
SHA256 b41ba6d2a1092d5d938d982c0f52e2e4380fe5066b7b99c607b16c3ab6ea73b9
MD5 d8da89d73822e27225d42da71503718b
SHA1 880faaf597b109133520bc818d26b5e93993242e
SHA512 bf9ea90ae33183098ed176ebcb22853ff5a0233780cf88a7ac6a2f68f88f97d372649aa1594c34125daf96eb525915ce3d351186137a6d314b234ae8803af820
SSDEEP 192:oazS4cgOEe5QxAGJbykBaHtJnIPC/jVAiVCRKe2xA28m+ATTRzu:ocS4cpAxAGJWkBaLIq7VZ4RB2xQwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\libglesv2.dll
Size 1.9MB
SHA256 69f5c7f0e6a87708ec14c0b01abf6ef7765ae475da32a436c292f0f7145816bf
MD5 5a2aaf0ee0fb7f8d7adae5e5f6e120b8
SHA1 9834b5016b67fed95da6df3d807a77311c028b36
SHA512 0a433cbbbae60abdb0ddfd39215e2c8007429c46c8c4e7f34f1d6a7d327e02d9a59a8efb81087fec241e91dddd8380df868c22104ca85f0e9ab0a551dd016849
SSDEEP 12288:UckX5zpSkw9KKoHRdpqq4J4hzWwh2Nih5fpnFzQxbSS9S1LjqTxlK6BpCDRXGv7Y:1kX5zk5KKKl6cWwhCm58ASq6ByWv7xn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\locales\en-US.pak
Size 100KB
SHA256 5c56df9699fc7e8f09ec81421e50a6264cde055e822f5a8cd9bb1edb3066d816
MD5 0bb857860d8c9ab6d617cea5a5bd4d00
SHA1 351b744d95846bff2ce5f542fec2e87439aa0f8b
SHA512 33fb73cffbb6781488cedbca4c92a7e4f66923a799beeb7f5cba58dbc23ba8f5130f63a7dac7114e3c3ef6f1df87884fbeb8858bc7604aec9449fdfd16c25078
SSDEEP 1536:SQo63sGGuW5Rt0FDSED0FhiL2tr/OSa5dBqg7GSO0JedMVrBphVfD3ggl+S4jwh:vo6cJl8DSTh1QBqg5fb3ggl+Sgwh
MD5 SHA1 SHA512 SSDEEP

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\locales\fil.pak
Size 116KB
SHA256 74400edc21c059e67915cd55e6fc28d2d467b5a461489a91de9fc0b5c4dcdd30
MD5 d1057ce106bb5f8e6dfea4a8b40ecf9f
SHA1 443d2af9021dd4178ec6ddb99fd271d447906465
SHA512 fb622d5e047528f12b28cefe35a9d06ce926183cfc02ac4d4f6268466e574064b722ff19a3bf1e53764b103a25852fbdca0db9e3e7a8663e80bce9c8c47ba603
SSDEEP 1536:z1q909ZywHYfcVrLehf3QzeNvuNpEWnG/gilPgTAM64CzPE2j6/a12uKL:zh9ZywHE8IfKwPgTAaCz36/P
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\resources.pak
Size 85KB
SHA256 22edeea14ed20f6e131a70cb94b9040e7e848488eb43a563203c18520b0925c8
MD5 558397cfdcf3ef8024d881c77a6b5db7
SHA1 21eac60678c6a1e5abc9ddcae0d56da635e3e20c
SHA512 cc26fc19f33f1e1ee66d1b4499969cc52da2a0dd17feb8ea1263ffd4c9240445cb1b3b463216fffc8d13707e4a3715d39d2126000b56eb4046e68e578c269a13
SSDEEP 1536:wqrF4NXPZVmt9CgN1WqzOZ4IY7qvbooX4AHobFvuj7cYeKfYvUgQGEPXkb9Ge4e6:LahPZeKZL7vbBbHSFY7BRfYvUGVwmw+6
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\resources\app.asar
Size 22KB
SHA256 7bba8f8e55bb78b3a6506fb4b7f66a393fae0fc7cdf5b0c4e48581bc67b759df
MD5 8f08c9101ed9ba22bd4dfa3cda2abf48
SHA1 e8a62f6d20430d59f6765e3929278ce0c8a6ca0a
SHA512 8a8d65d48e91105f2469371b7492877f3c2f1acb8b373e13568b4ff98ee1cf21ab18359f3a1ace7e3c1246dd7c90051a6fae0a3daaff6d738d7ae2bf466873c4
SSDEEP 384:vCItvJDu5F702AOq8dmJhmnA8Jq0XjxmK+ZvCUtrLzr6fsa8UiAtVTHzuuVBV9+y:971Q/zTPHUkzCG7qyCNqfgs
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\v8_context_snapshot.bin
Size 46KB
SHA256 578fe1a9378b57631827a1f80d54ab2dc8340241f2da0dcba4c173d7e3d84041
MD5 37f81550e1c9dee3900add03c676d20f
SHA1 050018ce7135a72f95f6994fdadea47ed221bc5b
SHA512 4c7cf093c437bbc7a210da0a22ee74df008a1315e894a0b1fef1af5effd413cd9bfafd757817956f48c589a8beca0bba5e3f2365269abbc754deeee98a4c3407
SSDEEP 768:UPkW49g/AP8LVs71+2EurrL5kqcJ7pZuNeAFQ:U8nUAEJo1xXLyN7pYNB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_r1tde2r3.b5s.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r1tde2r3.b5s.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

DarkAdventures.exe

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\DarkAdventures.exe
Size 201KB
SHA256 583670211e6b8cb336cabfaa5d3e78c2fd1e7356cf89b4479c9efa0aeb7349fa
MD5 13e80fdc4a8fc9e700ccdb75fee49ab9
SHA1 a8c0f4662ec11529622681203b746338a891a885
SHA512 b9e137716429b27598ba18e9952bf729427280c57678ca0ae121ff011574e2edabfd3e3422747e4362db29dc3841454e089db9a5b0d157382019f53b449fb0c5
SSDEEP 3072:K5aXyidsSApppPpv5y7VHRL1yPH4xtgVPu:KvJSAK11yPH4xtH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
MD5 SHA1 SHA512

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\LICENSES.chromium.html
Size 79KB
SHA256 f0980ec218602a8048f3b682c4828a7e8ad77772edfdf7e922c791a6a36f94a4
MD5 95d7a1706f5a824afb1baeb868d29181
SHA1 b82732c6ab8f7671e95fb5a989733815fd242fb7
SHA512 37b47d9abfe9f81c46b3cafc7488d7a7f554dbb67361e2392095f66969508abb60992fa430b02a68543dabe8fa07d1557b00a9ea269fa737fa8427bb577871d9
SSDEEP 1536:/72JUahCOvJUahBsjtGKMkvJUahB3vJUahBSvJUahBTvJUahBUX:/7YhCORhBsjcKrRhB3RhBSRhBTRhBUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\chrome_200_percent.pak
Size 122KB
SHA256 2570938aae49d52454ff40f117b93c343532dfef54c72182306d0d9c539aec07
MD5 f41790918fb2c0425a25c0b0509f7936
SHA1 eff5db1beab61c02cda528c31cd81bd4754a1139
SHA512 90b50d0b9f0b0d4250e550f24b0e66038d3f549bf1abd0177d925e647882d6221839755763fc66698b683801d95bf7ae46a31cc765bc941de0c8f7f5bd02dd72
SSDEEP 3072:MDQYaEM+9b16mdgZeMj6VfR+5GMR+F44ffbdZnYw9p4AbIVG9:MDQYaF+9b16mdgZezVk5GMRejnbdZnVd
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\d3dcompiler_47.dll
Size 195KB
SHA256 494bb19701fbeeaa95cf7cbd9abf8bad640c92bbfd756a8e88b3b55e896836e3
MD5 f8fdcb7d7b7fea43cd160c8bc1a56230
SHA1 ea152122c40fb5b24c9b7766b317d25476a4b3d0
SHA512 f8d11165a18cd0262329d740562993f41ea213275c741a592ab4cb2f61c96f6284623657cad0d02b5bdaff55610892cf6dd60a55b8d80ec4ab97f6e5be7e4030
SSDEEP 3072:zVphjYWtvPLIdYhC49kgyWuf5CvuhtNHvEur8EN2sql:ZEOPLEYA49kJWuRKc/HF8W2sA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\ffmpeg.dll
Size 1.2MB
SHA256 7fad43e1992f42ce3a8e6dc07ad75a287e72e2bb96333d0d43ffcca75dd2b0d7
MD5 bf80c4238b86c6d2957674bc6e032b94
SHA1 b0f1c92e15861d1c47769d0721fb960364232a75
SHA512 1ff518201d5006ac1cefe7b9dec5e9835bc44d2da4d0f000a386330eb5d258d61ba8033917e62b37ccccfcf856eaca3c38dab4b6220860454e80adee38c7b180
SSDEEP 24576:l3ROGU8MUn3/T3sMr6+FXptsXTXDigP7he373qno0/2gORK+xglYLtsyv5JW:JcMr6+FXptsXTmgP7he370olRK+KCKya
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\libEGL.dll
Size 437KB
SHA256 14a4aaa010be14762edfee01fd1f6b9943471eb7a2f9011a2b5c230461cd129c
MD5 8352fd22f09b873193cabc2932be92f0
SHA1 5bd2b58854b279f1733c5f54ea2669ee8a888d9e
SHA512 7281e980f2e82f1cc8173d9f8387a97f6e23ec5099ed8dca02222c4e17fa4cfef59d6aa300b1cf06d502bdcf77d9a6dbb08ad6658ae0a28ae6f9f995109da0d2
SSDEEP 6144:odpiWYLBViWOSdAr1Knk2mI3LpxE0RYqowpW6VmHrtff1FI:ipvYLbiWBqrQnPxE0cKmHZ3P
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\libGLESv2.dll
Size 117KB
SHA256 77043296f8b2628cb0d6630ceab210d7056f9eeb00c87e63393b5606c091872e
MD5 82872dbd879976bf67932fcf2c906fa7
SHA1 ea106ce403fdef79c60dc61aa862fc5d667282da
SHA512 a2b5ac7492880cba3384b0bf73f486a8ae961e13079190dfbc5d95b8689e3714ac268968e10bdd44d7da366a4b68e5aa6860e623935346fc1645dc45302ac8f5
SSDEEP 1536:8dkunJnVRuwCDXtQeqjvCboaJbq9n4o/utUN9kRNiKuVYZ:ukuJnHHCjCe8KbE9jDkbiKTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\am.pak
Size 175KB
SHA256 7c2b9098130f1f9e0cf4507b64c0e96ac6354bd6c3616be20e2067cfccc820da
MD5 e18a450ef034b42599341c3d09f280f1
SHA1 2001c8a85904962ac3a96938eccc69ad2c110fdf
SHA512 ddd87571218fe9f179a6c2a8a15b182625a71a7c19ed90c0969ca2e0e9bad823b926f8b8a6b390cb6fe9c95f4b6c1f1ec7b5167a8424ab1921943922208f798a
SSDEEP 3072:u5ghhWHOj0/E92t7Rh4rgEkDvuh78oeLtykiqfVGMqyZJjhEf2WAqT5b0kek97G4:u5cW/gUuAQPPgx30jH8+D
MD5 SHA1 SHA512 SSDEEP

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\ar.pak
Size 86KB
SHA256 730edd7839b5aca0294558f038967c8cfb9f5d979106e6afce7a5faaec381303
MD5 8b14209eb653409e3f26923abea60de4
SHA1 ec702a7dfda72c22335f3bb3fbd4d3be3d6a4056
SHA512 f1841e4cd229a94d237812c10833b6b4c5d548f2132af325d3bf46666f5b96cf1b0537866da2f6416407850dfca69e119edbd0747e643aff238b07e27d094119
SSDEEP 1536:UkvvJwKKSwtzNg4jp46YzaR7ebQqbvH2ooIeUYPeIl4qhXZaOJ92k5nFxW6zGF+E:3KSwJi1H2KNRpqhXdJXFx3zGF+hF/8MS
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\bg.pak
Size 196KB
SHA256 2339ff55464b4ff704fc3c5bf281eec52a539c494bd059cf0346d9c05ab7cda7
MD5 5ba0c7200362c9ed55610cc8b66ef53c
SHA1 d45239c2f1b00885407771a41a7776fc1fe8fa3b
SHA512 6229dbf08a9322c4ec8de4912aa1832f01800a71b7e3ef5870e7fa2b623be4dd248fec4881c3e031e984616147be84d42ab3dd970ae56dc1bd78913a8682a37a
SSDEEP 6144:jd7NaT75nv/L06ZzrmLy8AqWJ2JAnsUVT:jfaT75nvT0XLy8AqWJ2JAV
MD5 SHA1 SHA512 SSDEEP

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\bn.pak
Size 253KB
SHA256 ceed32e429ed1018d4c49343cf52105cbfd1e877c531a5738fd6e6cd33d27da7
MD5 47c95e191e760dee3ef43345577e2379
SHA1 609634315270a91d4ec631642b18bd0036367aad
SHA512 46b5f8d58780d19e79136c31a67d075c57ddf7e6a1eb197dea4088cc414a0dc24a68fc8ebcaac03b3940af2461123b586706d5dbf8dbdf6fbea0f7bec466db21
SSDEEP 1536:xX/nV+Lr+p2KJJr98JMgNxpDwuDrXvuhKRcX:xX9++9Jr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\ca.pak
Size 122KB
SHA256 7a39af99d55a1ea838d8d78c5f0da3e1402f9404d32255e31b676ceed4f0e414
MD5 423651c45566cd90ea5edd8631e823b8
SHA1 13bed4173a08bcbfefba034aada3d838eece6d16
SHA512 e09085023beaa37e9d5f7fdf3c32d0c001672b85e2826f0aba9a662ce958ac93cac17bf63495a604e47cb407b1593049388a4bf1b22b2339ead84a206a10569f
SSDEEP 3072:HGOugDaRcg4H65rqx0hm/BL8lmoT69Q1HSNO5ufEfXiBCUpYEHPPXfI5DozRhqAF:mOdCcgwoFyO5vXiBCUpY+PXf8DyBnkAH
MD5 SHA1 SHA512 SSDEEP

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\cs.pak
Size 125KB
SHA256 8be34e4f8226c1dd4e725711ddd884ef4476560f7863edcf378573dde9db3cee
MD5 3cfd9dc564cfcc33cc5524711365c376
SHA1 2e5016d2643017f37658262122974429f18625a2
SHA512 6ee156d2fa3b6f601df28e38968d0eae2812d70b41333348dbecd833d5ee6ff944183f0eecde96be433cf1e98c8ec22d6a6d5af5153145842175ab43c73533ef
SSDEEP 1536:hsS2h3j45qcD4pP7zoDtJ+17V3JIAixmcRbCN2lDfng+5XS/iRys8QYSXw:ShTnjzoDtJ+17vbN2lDfg+5XS/s8QYSA
MD5 SHA1 SHA512 SSDEEP

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\da.pak
Size 114KB
SHA256 e190187adcbb5f829d162660968ba598ed17bd11339062ca4d807deec8a27fdb
MD5 55a8f5883805a65c854d25edb3959209
SHA1 d4b3b6bd2a26cbd021fa931d1f63c9ea64e2c268
SHA512 4e1f9e6da32f553cbc8cf162726d7aba9e23e2216d6d05b995cf19fff3aafa05ed08fce29b2f8538d46583366402b8630672e650dfbd46952a611e9db0d8016d
SSDEEP 1536:03mzdvvRTcwcSB3CxjDqg5vszO52G+5JGAD4g8pOmPEQG6RH:ocdvvRTHC9DZszO5L+5/dS7
MD5 SHA1 SHA512 SSDEEP

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\de.pak
Size 123KB
SHA256 6dda3fa65232ca0bff7314f916942a2aa5d9be73a0b0c7a6d016eb34ea6fff5b
MD5 b73344e5a72fca6f956dbab984c123ba
SHA1 0561073aa40a63a9ce9930dd18b18e12ff139b2b
SHA512 e8a12da397369f23c102244b3f18f533ec79afa6978785566056bbfe07b10a21ff4973bf17aa829fff65609363988c033b0e48d4a82c846863377c08d8df009d
SSDEEP 1536:uphAWy43SfCGQsqXghFrahUbnzKUG5Cf645LmQUve6S6vXQHHxQ1NlkGfA9ZcCAF:OhAT432vQstQhUzzKk0S8eH8NrsBgsFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\el.pak
Size 216KB
SHA256 b1f78df8a7edc914357a2e90bc8dc0ac46f4df642bb22894569fe4905fb8ea0f
MD5 38440b98bfdf5ed496da0f49d59534c0
SHA1 1498d9207ecaf4923a47271e24c68a817041c82e
SHA512 95ba788fc2e1f07d54e398f1ec4d32c664cfb13118d46cb7af7a993367e032b10de84f3e604ab6e659d6410e2d736097ec5e9b3b002040c54412358f0ea10229
SSDEEP 6144:86R2vCi+hFMkDuntVF5IcRrl3ppSP3/5zFMeF+fY2hlL6Xa9YlXSAzG:N8vCi+hFMkDuntVF5IcRrl3ppSP3/5zY
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\en-GB.pak
Size 68KB
SHA256 7add9e70a88758d82acd05eba0434f144b4e055e1914f1f871733d85b9fcda57
MD5 77d23dc9f45316627a59242e19db2b21
SHA1 c304b385f2e44bc033fbc3c0d5bb81caaa15c81b
SHA512 4dd7e5033738adb5a2555dad598532e7b2f6ed14bb8294b169001d4cac7fc6124ca67b74b11a773a40d4e1ea2bb5708f974c91572cd0d4ce68cbd2eaa0041f35
SSDEEP 1536:tmCSXTzmWQWGmjrD0KDK4Rr3ASr5iBqgqX:tQX/mpmjEKzkBqgA
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\en-US.pak
Size 92KB
SHA256 df3ca30dbffdb95688473de9da834b486639755e0c710569a02de09cf11b8ad3
MD5 9769d60eeec2eb7d7352f5e8b0518dbd
SHA1 6919c0094004293f0dbf98d82b9b34c34b03492a
SHA512 2615e8620fd35b5aa9492d490dcbd8b577b037bacb2a30d86ba5d51eebf624c299258533df56a0b1b375e0680ac130a493732a088d848fab432990d846c49b35
SSDEEP 1536:SQo63sGGuW5Rt0FDSED0FhiL2tr/OSa5dBqg7GSO0JedMVrBpX:vo6cJl8DSTh1QBqg5fX
MD5 SHA1 SHA512 SSDEEP

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\es-419.pak
Size 120KB
SHA256 1380b9edc9cee4b505f12e8eefa288d8c746ca995b52ceaba27c7741ae8a5cd4
MD5 b261b1efe945365588befdf68879040f
SHA1 616f44a5f73f0449b483f36ccf831db6474a10d2
SHA512 9ea14234b9d4d09364e5727b3886fc14544d52508b3e45fb9fd607ca88d2e432361a02b2f7ba34c3d6ecd94b91f9eccd4d54047a97a1ba4eea580ead00b91cff
SSDEEP 1536:q7CIgyEhjRb4Zr4h3mxaXGQ17L46ddPcHYKCRKfKW0JWFsMH5BnVZ9ove:Uxql8khYcM6ap
MD5 SHA1 SHA512 SSDEEP

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\es.pak
Size 122KB
SHA256 5b929216ac823dbe2b0bb98e64db76519900e09a86c8513019325271c66ade0d
MD5 f83d8f7f6108786c02c2edbf3d85f147
SHA1 57781d9d9eb7c90cdc71f78e25d0763045b6d29a
SHA512 12747a4a61cdd21cad6e3f768cb43b8bda5ec9de373337c191b6994b20acd676c9d0a6cde8410a1e18f35dd5d2d332ea1bb7e7f8f6fc4b73d8774559e33398f1
SSDEEP 1536:6f648LDdr+wZ72bev4dYNiE/XFjqh3viyTcHVgFW9XlhgoYKWlux6PZ3h2J:/48fN+wZ7jRNiEFd5Isx6PZ36
MD5 SHA1 SHA512 SSDEEP

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\et.pak
Size 110KB
SHA256 e8af084ef5e1062c5966dd7802074ac24f3672dc3c9b9c5453a397644727191f
MD5 c76db3385190c6840315c4497e40258a
SHA1 34f1aef2ba2925bebc5dcdb70e5b6c1a138a5c46
SHA512 90a870369d307758b33d74e6213676d65c2d332f42577c8aff23d96b512f3c2a2bdace8d6d9007f88b9175eadc6f2ae28b498b1265550849ff9317465a37ad29
SSDEEP 1536:fMeTTURxwKul73Dyf4xVyNlysg9jXeuLECstZFsPQWcu:EkURql7Gf4xVLjtLEtwPQWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\fa.pak
Size 111KB
SHA256 1da185e3472b92dc97c1fcf8e65ad743792982a1194cca471c491c3897980346
MD5 56dde6acf98acb28a9480b75ae9176af
SHA1 9067f2abe63ed7ff22b1ce79b1af3d6f5ec745b3
SHA512 95f52696471bce644e0d75888570a3f60caa59756a540355487c1e532b9f18b7809bb07fb09f8ce3e5256cc741731eb74bfa4e95f0d5359f3b80a03f41ccd71f
SSDEEP 3072:8OWfrcwA+7MCzXv94Rawpa8k+6NS9/W2ESEmSzR2XQmN4o6XsHdBfv7fDb8YIO/s:srcwAyXV4Rawpa8k+6NS9/W2ESEmSV2m
MD5 SHA1 SHA512 SSDEEP

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\fi.pak
Size 58KB
SHA256 a29b8cbbc309f4d84eb1145f0ec30dbbe0543d6e57b3b491d4e8528a0b6d413a
MD5 61c74a22dd1c7fd92c345a2e66bf08af
SHA1 ffaa66f255486fa57cbde13ef47e3525f13d9205
SHA512 6abfce103156c452cd3073f5c375a81f9f01effd7747ee0c8aa1b5623b36703b42dfa4984aa457a93006c1f7898b3c37812b5da04fbf7bfaabe811f9c7214752
SSDEEP 1536:fK1thQBjWmo7TvIZq3mk74Xv4jZEEZ18lZIOswly:fYthQlWmiTUqWUEv4jZEEZ18Jly
MD5 SHA1 SHA512 SSDEEP

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\fr.pak
Size 103KB
SHA256 e57789bccad80543bb61658ffd3fbc70df436512389ec83e5b076c78baa2a148
MD5 de797a16584820730c704860b1b43336
SHA1 da7dfd46dd90d8a466e22351ddf1f6722c5e42ce
SHA512 ee79fea9fe8c124e4610025d03dac4a3b69d0e5402d6b795fd02d2e9aa22a81e520392b8eeb9f17bb4b8b4983f67f4123d96531ca6ddd52af598258cdd83b777
SSDEEP 3072:C1EuvO5J3cQRLbJKSG9+l9Z85NtMsEMpSwYRHD+IzKByroFDuFcZ:C1+5RcQRLdFG9+l9Z85NtXEMpWRHD+IU
MD5 SHA1 SHA512 SSDEEP

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\gu.pak
Size 102KB
SHA256 a3a69051537811da934b8744d68e23d18e969dce7c6a13a7198b7321e8ab88d6
MD5 3bc207130ed66d00e1088c58d684aae8
SHA1 767a5ff99785b5dbabd5c70c4a5f589e04fd6801
SHA512 416f81dc8613457ef29dbf15fa01c7aa7b7b78cbdbe3d6ef50d9b2e015c9a9e500ef8026a676419d25e632e0786732a9c7e1d5fc2a32d4284704c336eb81613a
SSDEEP 3072:EBv5Iqx39v+1A1A626irP8n3M8IrU35YdO3C36zoYimPVO4cGPX/grRHe5GmdRPL:EXIu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\he.pak
Size 75KB
SHA256 29471b8d151d2f13c26c4e0b4bceeac0cba91dd865441bcb1b201bb1642229f7
MD5 8ca1e29fc69cd7570f8377fe1196d2ed
SHA1 41f45bcdddcf5058b4c053b75b10a4a4fd35fe8d
SHA512 cc4c3678a552ced9f5c97f8aec37f76eae07cd61990d2029b74e51fe0fce8ff6a71b43b7897f6447e6b83991eb7c33fbab8b2638d56b75706cda4fa5aa24a8ac
SSDEEP 1536:/QTfl862UVk3NspwWHHe1AqEgS+0HgmGgnQ0MWWWmXWOnwW:U862up1z+WgLcMzXb
MD5 SHA1 SHA512 SSDEEP

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\hi.pak
Size 49KB
SHA256 c28a9210dd28815a3189c7aad9159f79adedef87e0d021824c6b7e01ea43ab63
MD5 5a7668004651d406dc2b368ccc5af7c5
SHA1 766b0bcd0f06a64db49e8c0ddbf5c8beab9d20c7
SHA512 ba5b180e618a6ec716197b77c658d5756ae9c021166adf035d710d1db63b7344f6515cd043b041341df53421db6fb6128ccd16a7b76c34ab18f3f562830b8d12
SSDEEP 1536:lU3JsMueRXXNwdzOnqz5cwfKSIvfEFj3c0cEVhYD:lUGMNtwEnqz5cwfKSIv8Fj3cvEVhYD
MD5 SHA1 SHA512 SSDEEP

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\hr.pak
Size 105KB
SHA256 349f43fceae32e36c22aab4835fb879e25a58464948a94004457e30e7b19a5f4
MD5 303c4abfd669d78ebe893759640e8bf0
SHA1 e945845844ca47d69dfa5a4ec391f7bcde919add
SHA512 0ecfb24c8ee72d2940dfeb8fa208cd74cdac14505e9e75a5ea19f0bd1780749f04229542595893869f1f355c077686db08afccd5b6466dd8e8d5004249e5778b
SSDEEP 3072:wExtK0dFKR0AGCMxleW+blEdp9lLnMU2EgI7MMoqa7T:wstK0Tg
MD5 SHA1 SHA512 SSDEEP

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\hu.pak
Size 129KB
SHA256 b51bcb888dbc27bab88a8c9d081df7496de8a9a5a4cd2cfe08abc154190e75e6
MD5 71d42cb22d2d7a8b26c4514ab12df3aa
SHA1 cd0307503a7906f1742d1e98fc816959319c2171
SHA512 29c67391bca706807be3a0cc79fe481f220e30263957a9c2485f0a4c498a5b250bdd83b5f4fad8d0b19c8a9a07d5650b5ebd5816b6aae311a1cde78a89303244
SSDEEP 3072:bdLxlRS3jgiHYwfRHiGhnq6wdAS6sdpEsLK5M3ICm:BRYfxiGjC6sdpEB63ICm
MD5 SHA1 SHA512 SSDEEP

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\id.pak
Size 108KB
SHA256 3339ef011c9bb64868da94adb25f4490acbc7f893e4337dbfe2797754cd659f5
MD5 e40cb2f3b4db379e4d187aeef0dfd300
SHA1 537b1ebc615c980c89bbe2b9e91a11199fa7d6a6
SHA512 b87464460077aa55feb92eca8ed23d9a61829378bae7890c8a95dac5fcd735b145d65661f27facfe2586fcaa169692b00d8ee8dd505dc44bff7f7fd090f3e96c
SSDEEP 1536:IiC3VKMLZ/Qcr95/SWDEmIvUwRmNEBce0iBSX1CPWsAzb2ZVLRricCFVdy58:HC3VR9/QK95KWsce018WsAzaZV5icC7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\it.pak
Size 112KB
SHA256 b1e66b3767c73b0aecac60a750c97ef7b8b939e899d1d985d4c7ef4be9b9a607
MD5 b6566db92ddf3def1e030ec04b6798ac
SHA1 1be2c20fbc1ed774a8909329a03e32e747e991dd
SHA512 976da01f1adaa6e24169363477ce2dd7e33e3628d2f2bdf400d3b79daf4ad421e42c909506b1e131ea23d78e3fe190d50eaded64060d48ef3551040aebc46b54
SSDEEP 3072:iUQ85TJe3cVvEyDhPIyN4tA7kxAjijNPtPhRc:iUQ85TJe3MzlQyN4tA7kxAjibZRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\ja.pak
Size 143KB
SHA256 74422db1a5f28522f9a8b31a3bee9a6df794b419bf723cb6a6c88e82eb72cec0
MD5 833e8c4aa70351b6be7bd403e4e9a0a7
SHA1 46ccdbdea35deec8ef13a5fc833776875fad187b
SHA512 e8e709612a5ea81d2822e0025b7306f38571f2cec2ca72ac5a8ab852a0e36a0f5bc7e00d0baf7ac7becc2c54dda3a17c52ec1cd67ce12b14d91b6ae0b726d556
SSDEEP 1536:Dmnjv2XktgKy+34AhBbFKEtINB46wVsg+jt+nF0rw4NPVI:620iPAhBbFKEtEaijt+FSw4NPVI
MD5 SHA1 SHA512 SSDEEP

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\kn.pak
Size 101KB
SHA256 d29a975b1e857bebc6089c3bc939c36249cd0315c7a83c46c911fb2d9e3bac11
MD5 361abddab5121b286d41ff9da71984c7
SHA1 e12a6f0e981ffe4088763a386303896a3a00db6d
SHA512 76e113b71bf05fecef08f20d2ccd9a0197739f87a0523b012e28277125b2956520c4d6494a09216106c086198a50dd07ab2d0fc3d27d705b537f474cf330aecd
SSDEEP 1536:dtfaNrb+1eRsIV8LhI+NHsvgt4E+EtLjDd9b7n+CUasJx7XOLKkLKuWzB7izd2DI:dtII+Ix4qhgrtZ+e4PzZELDC5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\ko.pak
Size 120KB
SHA256 f3581cea2e5b022b121010ffc5d67f86f717e3a0c0402abd81e24c87fd135b76
MD5 d6e2c18c9eabba59b50d147d942125ea
SHA1 0918879203c2050b4f9f449f5616e430897ba0b9
SHA512 f605f7b9893166778af156f9eb76eaa1209e7432450899540cd462ce0ffa69caf6f570b910cdd6d7bef54354379e9892a658e711baa93241da33755c107da859
SSDEEP 3072:R56txdM7zbccIotd9AgWCYeHw0pFSCukprTrCNO/4KiWgx1A/xRAmxJT6rJ6TNGg:R56Te7nVti67oSw4B
MD5 SHA1 SHA512 SSDEEP

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\lt.pak
Size 131KB
SHA256 776dba792df7b444e1b720326312d8b8312cade74a1372c49456d932b7c65769
MD5 2d4fca437a7548893dc4b51fa5b33c33
SHA1 c1493013d7d981ea9223716e415380992de65c2f
SHA512 b6a55ee1deff48d717a3e9399aef3c45eeec810cc5b5709fa3e9f56850115a5b02e02b7959ec77a6797e68516ee9372bacd260e62ac0d55a8e4c1c27af782b42
SSDEEP 1536:0YPKCj8j0t588FYhxBUMCUacC0YViX26sK5rmz3MWFmmVtM2ID6S2h5nYWSgAGiS:0YCo8emB1CUaW29bXJvM2ID6S2h5nJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\lv.pak
Size 61KB
SHA256 924723d2de540dc55c575c59803c1091b8dbefec5e2b7ed073455627895be491
MD5 3fea6a6ef3b25c74ded926b8b49a8f1e
SHA1 fcdf2e16814752d627da1dd52fb94eff1e40541b
SHA512 ea49e85ad051c73dc6124d9592240213596c56318b88097f29502e41f0b1369bf4b6e1a00ea2a02d25d29adc7e9628fce57aab67575de170216c129f5a5babd0
SSDEEP 768:cHZ2CnmMt23h8ekFYRHdPZNNkDXA8ep7cxReO72kO2GBrYB9Ae0WIa:cHZ2smMA3hkixkDXARcDq2GBrM9Adfa
MD5 SHA1 SHA512 SSDEEP

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\ml.pak
Size 104KB
SHA256 2ffd465a3b28f867f1b9eee3b7fb1c05a9d4ca234ae8bcd3c84489031ab58f01
MD5 cca455cafb59fdc1602b4e008ca4420e
SHA1 1ad4970c0022af350e1d8d07a4b6ff41c2c7f5cb
SHA512 ebe003d53ee08e4b3606fe9fe2b9bb09b5faaef97ff85ae5c1f43efc1e8a513bf02ee37377e1cff81cbc721c112536eff8411a720269942ba7a22d8c43ad5f6b
SSDEEP 768:gKeL13FPMSlGptmGrTdeE+YBkbrQ4OUyWk:gKeL11EGE+YBkPQ4Ol
MD5 SHA1 SHA512 SSDEEP

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\mr.pak
Size 158KB
SHA256 f4d1fe2e7d16742730953a7642a00a721f38d03332484ca688765f87b5f7e39e
MD5 30d933b32591636a8e14284f5eb5e12d
SHA1 f68d4fd6b25a394ce0f6de32bfcf426fd759db04
SHA512 9c2fc2f51c3000d37b91c2559108b06d6bd39495b75733293a56ff8f0eab431364725ce53e46cbaf1166ae6a1c78015ddeb88eeb1515dd917b4f8282e5191aca
SSDEEP 3072:6IS/vAuETAbbbMB6D/Wcq02HIUIuc7nCSZhV9u:QCn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\ms.pak
Size 56KB
SHA256 47e764aed9b8f98bc870f04dc69ef6eef73c306baa3de5f122896e4e0e1e0e75
MD5 f4ae49d2340f4f76f9136b7fcfea9a4f
SHA1 be9c70882692d1207538fdb4e7744206c895bce9
SHA512 bb829a7063543e00b84e0f335f837ba4d9d33b2e95e024f0e60cf2ee0540a97eb0c6ff5b5a8730c347da12706282340728a3492864fa94fff6f0bee755d44df1
SSDEEP 768:AQRm+seY3i8gitlJyc50CYifL1jxTQu07+ZjOOb:AQRHspdGCYixjxq+9r
MD5 SHA1 SHA512 SSDEEP

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\nb.pak
Size 38KB
SHA256 1b19b02043400652b23eba484a441de78cb35c2307cb1e92d86775105759fb27
MD5 409abf9585f1205ffd0d1943b22e8085
SHA1 7d60ea3d64d21b3749766744c2df8378a1e8ca9c
SHA512 805472a3f7955bc621388e112366a5eefb09d8aa2acdf4b3f9fbdb9b1959391525bd83a2cd5b4190249ec97d156e57d785ba86842fc90a43e5484bf9fbba0903
SSDEEP 768:Jaf5qrs8CXJFlcL0QUMrGWIAoW6Hm32e0b1GoXR8ssqE:gh98CDQUBlHnHde4OV
MD5 SHA1 SHA512 SSDEEP

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\nl.pak
Size 27KB
SHA256 3c992ca0f0994efd08203adcd12394948e16fda222d25b27946b45326717f34b
MD5 0a2a4e5b25e5424df11f4f9487d69bab
SHA1 000d893f1e866085454318795c9955687bba3a1d
SHA512 c862fd0526244e5c9d136be82efa23a035782e55093764d7593dafd71e2ba7fd07d9a723f4816da927dfc4a002f06f536e77e02124912b457712ca948a150a68
SSDEEP 768:P1DEcjpwOBQc9FWcTuhP8/jZP+1FyFyFaz:tAcFtjWBi
MD5 SHA1 SHA512 SSDEEP

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\pl.pak
Size 92KB
SHA256 248424de0251cb32c8e94db2e98cb50cd4751a57694063175e2fdf2ddbc09ae3
MD5 841b1d5a7d21197ed796c44021f5c5c0
SHA1 6401b870833deab836d0183687c1f91e06d47436
SHA512 05250a2597b5d4dc2f803637e2cbece1f4075ebfab8029ab6e6f27e9d0893c5c5e23cb6ca646e5f9fd5b7094e4009e826fdcfbf9c03ec4203780acdb9b9a753e
SSDEEP 1536:EWf15TjBmqu4RMa8oc/1QCmCwAezXpSOv4KNsg:LBK1QC0Xp94g
MD5 SHA1 SHA512 SSDEEP

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\pt-BR.pak
Size 104KB
SHA256 6a8dababa73d118cefb8315c284acffe2e63af53c88f3368c27dd05b006fcaf2
MD5 c163d53eb5f8b45a6eba537c8dd32a7e
SHA1 ddad5a905d2f23678bb6f4a789b813e0602eba99
SHA512 846a94cf399322c406cbddded49682c247311b3ab134c3fa6fd32b76f930f11a4093031c587614a58d70c8a5cd690dd175cf04d7f62ab2335e75aa2aafce8546
SSDEEP 1536:eU4WKuobNr9WUVFDjy/4NvWIQFv0Y0q4qc6x0xGUN:ewKuobNIg5e/OuIQmt
MD5 SHA1 SHA512 SSDEEP

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\pt-PT.pak
Size 27KB
SHA256 011bfdd4ad6e01c48c4ff6717ced59839633c434ec70de30970aff193d971642
MD5 c795bc5a53f50647779681dbc88ffee7
SHA1 e438eaf57ee6b9170b3957c7d4e84f9c1eb06121
SHA512 48827c25935f0cabff0337e4821cb04cf397be8c46fc9178cbbdf4c774ccfb5ae17afdcd6becd6042cf1684896bddd942cb86801ccf8dce7161ee757652882dc
SSDEEP 768:FcQ3eDLf70K1m4Z9GN9WLMLe8+OS4yozJnUUu1sD8:kHf7ZrGN9DedEq31v
MD5 SHA1 SHA512 SSDEEP

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\ro.pak
Size 56KB
SHA256 e9060cd653ccee3d0419e3472958c9a8a768dbc21de6f23173d83d7cbff4d548
MD5 b6c603e618812612eb3d4c8103fbba68
SHA1 f362019c7a2725a84f184ac5f822256caa07401a
SHA512 9d3823ddb153b1f225e4e36e13ee8103a7f80524d7a5dfdb1fa6ac6ec8ec9459aa72ee521aa6b7f0a4f9fb2f040e54f23b9f49ca30b3d6ea9becc195eda2a24d
SSDEEP 768:V3wMnwLGjRoVeyojoUdIvvgpbt4MGqkN4ZovtBv9pcXXyXcgot:V3wMhjK82Ipb6k3qvImot
MD5 SHA1 SHA512 SSDEEP

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\ru.pak
Size 67KB
SHA256 d2f0d62b71b4d47d86b8473dca7986d4cda26451bc8356918cf7c04c3c0c38d0
MD5 e8911badcbcfad46343f1256e6ea66c0
SHA1 bb2902d28694c691a1d419369efcba55e2eef093
SHA512 e7b186afa4680da51a029df5fd284ba5b0726f05b96a2ececbcb3781d393f0b6115e0886a772486cb8fb8faf8f614f3516a47aee40394584f200c103ea6033b3
SSDEEP 1536:jsBbxYqeTEaX+/sLgHnQW0oFV+TQ2H3E7BkdOTOF0TsU:jSwEaX+/sLgHnp0oFV+TQy3EtkdOTOFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\sk.pak
Size 127KB
SHA256 f47bc1f7f5ab64681d0b152e1a019da60f0ef057ee8bf2ccede019dc4030c177
MD5 b35daa0bd9627ca88b413a5af7c6b4a4
SHA1 d5efdcbc7ca17de29f3075f6434f31ab2e895826
SHA512 48abb6ca2290820db2898b05820bb25e70fb1292c816eb0c8f17b3c5452de9fff7027d216d2bf413900f408f44ed4ac99151b28142a212c5cff8dfe229e87b9b
SSDEEP 1536:1kwlkWgaGF52MJ55Fvxr8YaQdOQb7SexkM+zBHCYpGd80G1gQPa:jlq1MKVxNaQotckM+zBHCYpj0G15Pa
MD5 SHA1 SHA512 SSDEEP

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\sl.pak
Size 121KB
SHA256 99536d1bc73eec81d5bebbff641ea195544ee5e3a41bb17ddcedf9cde9b141d4
MD5 e015b6f5042be2dc96a4e23dcf035502
SHA1 7946509eed8db1e4c1f3da99ffe7155c86fdb4d6
SHA512 b2a2eaae93c506a053862bf1cde02eee53b3ea2e2fe4c964c51dbacb8b44de820a779311cfe01458e2f08f88bce1172e8c5e1e6d28cd3a355ff84baa00023b8f
SSDEEP 1536:8gm/5D4zKn4qce+66W4xVsDn4Kph9VnJzIqTCORji/fzUrGsQqu:AWKn4qnRwxuU0VtIqTCO5i/fzbsQqu
MD5 SHA1 SHA512 SSDEEP

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\sr.pak
Size 73KB
SHA256 5035e8eacd6674fc5de4b8921ef491f8c6f53384795934f7ebcddc1cec16c726
MD5 30f0f2fbe458fd9fc96b5c410a8f1111
SHA1 1bad7149b56a5b105404eb60b6f5f8b87be78db0
SHA512 da575dd358e1e614df23287c033dfd96582496795f9cc38e06cd68a17051423da84c12365f240b85c326a8cfdfb4eac7d733332191ccb8a61b97ede7132210cf
SSDEEP 1536:1aLclp+GvZx04twbqbUjOFz/q9ifwKG3LFYJfDTZ6:1aL+prvr04qjOFDq9iHG3LFYJg
MD5 SHA1 SHA512 SSDEEP

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\sv.pak
Size 109KB
SHA256 4da4db845121a771cb9185f227fc026505b41048a9e18722aab8a7ab64c3a2da
MD5 9c097ddf81e9a03c27bce1461b2a535a
SHA1 45835f0db912519b7caf90f5ac8877d43829a3ee
SHA512 9dc2c8e85c5b2693a96e6fb2409b9a8fca8ce4bfb3178dbed2dd7517d49a0aa35d08b251e989ad12587a847b68173f53a409aa3c4f18e4ae4bf57f1c81e297fd
SSDEEP 3072:3ax4Vh/89KU6VWZtgKqrAuxHcShUpDm2jb1+r+3:3ax4Vm97bh
MD5 SHA1 SHA512 SSDEEP

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\sw.pak
Size 73KB
SHA256 02295950365681643c2c2530c5a4da08116238b96b9e7f9c214ba1beb4dfbf2d
MD5 39f0ed53db7ded0430a752646fecd81d
SHA1 76ec38708788b05cbaee1e174ee39e3ee3333d80
SHA512 fb445a2fa7759991ad22087934611ec86169f001eb438499f7d79f99ff4db79a67ea38aadc6b0194a50896c5a59192e42794f521fa3df8561f25c3ff900ded11
SSDEEP 1536:IkZ8+nRB5EYLIdC9gDiUepvjoCSFG5gNgaj:IkZ8kRBeYLIdC9gDifpvjoXj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\ta.pak
Size 87KB
SHA256 33a99f1f1dd96876ad02b7045863ce665add3ae88c8cab05778079d3d5355483
MD5 8f36119ccefa943400cb0c238a3b071c
SHA1 497525f4d6849427c454ffa8fce51f064030081d
SHA512 04cd3d8834616a02b1d99e6ad22304f041dbda1db399204bde7cb40438bbbb46683b2ba460284f030e9065170c53a5abab9d817cf2c67b0f00b5c3fe55c35a26
SSDEEP 768:y8R/oGN1rLRxqToiKtMm+DewmPew+ztsptf:BRRN1r9xqEiKam9wfw+zuf
MD5 SHA1 SHA512 SSDEEP

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\te.pak
Size 99KB
SHA256 63d6799da73c856a3ca6cff7cfe004c0956c093cf627ef1cf8a5f4884fa32592
MD5 5cb2b40ea117cde02285a3e57f836ee5
SHA1 08190eeaa3967d0a96c8544e84ea0f26ba596d35
SHA512 43ff8e312733b8e6a041dd80ea9305856ab68a6e5984820c91866e6ad588a7398f6d9bc3a963347f574d438fdfbfb32ee90faec3e7c0b2739f2002795a141094
SSDEEP 1536:hxB2IsWkFECKHhAR/TaJAg9VAK9rmbDO8AU:nBHQKNHhAR/TaJAg9VAKAbDj
MD5 SHA1 SHA512 SSDEEP

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\th.pak
Size 46KB
SHA256 6d9e4da2053a512cea17092b0091d1376e0e4a2f398defaa6f7a23ae1e6aa428
MD5 ef9a29dd78b54f954503e8482ec81ed0
SHA1 d56c6912441eb433d06a057241c479ec4a4bec12
SHA512 bccd1b169929d6ce16321bc85f8f83760eca0c6a7f844e004a56cd1689fa7a4873a98d30746dcd5d773ed9b26f18b9a1e710a02fdf578ed5db91f838d735197c
SSDEEP 768:9TwTk4dag561QbK/ICNmbdCnMi5xDQ64YOSnifX2b+Vb3dpJ/OPhNhOA7E8Wsoe3:J6aU61Qe/LSCDnCJFkcSCkIO+CSrG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\tr.pak
Size 54KB
SHA256 5ca047cc4ae5028d2128380140bcba7b960758e9b59eb79d894495d3f53eba84
MD5 1aff9f750cbbd6429add0a00378d70e1
SHA1 435a88cbede79039677aa692ebb474c4e0ac985f
SHA512 8380d07386eb518a5e46026939225dfbf09cfdc8010a48ad887644ee47f32855770ded855966731bcd8a0a834615d7779521d4334392fd0edbaab9361b71eb40
SSDEEP 768:BBIMKphTrVxpVG2HeDqY78RVcXX2heDC/dP81yX3eC/HZud8KAjevtBfvHO0sLWJ:ButVbHGqMV2hyi5mrAyvLPsRhnc
MD5 SHA1 SHA512 SSDEEP

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\uk.pak
Size 17KB
SHA256 3ddc75d9a6ab4f116ae05e54623c4dd4cf074b58c54de716b541131646b53219
MD5 144d927be64a3905a1d7e8717c345053
SHA1 36925d800c3aad1376a053dd9808af36efb1cfda
SHA512 aecdfa9bc5ed016752ef719223c130e36d7a5559bc056ebafc80942337284224231387f140f5dc040945691ede4c094676dc6a7a15096e41fa23b5070256a593
SSDEEP 384:e8I0Q/JuQmrcTWiN5kqYmnBO9HhSCT7VZj:C0QsBBqfnBCBZb
MD5 SHA1 SHA512 SSDEEP

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\vi.pak
Size 60KB
SHA256 9ff3202a164e5820da939bd217dcb80d266354f0dd66446a447eca5fbd15ce20
MD5 a9b2769da39cb9d6eb3f454e39639c6a
SHA1 d450334fef7c47d8a7cd3afb228f4abf4414d673
SHA512 9c138364116007feb44f031000aac380d6775e0758b9bee121fa5eb44c9ba2a9f202a9253985954f267e30af54c988debc563a9e8576241754dc118c604f7e9b
SSDEEP 1536:x5SMRncdLR7KMPnIppQPiz+somoe8Oa2YneUGa+U34c+:xcMRcddKMPni2Piz+sjoOa29C+Ui
MD5 SHA1 SHA512 SSDEEP

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\zh-CN.pak
Size 42KB
SHA256 47f92866d68de345c782effa463c704de6c2d417f88db348094249118663e525
MD5 0389d2f736d726ac7283125e90179f8b
SHA1 3410ae568251699ed73c0ed193c5927dc136608e
SHA512 c450d46864288d20f48ceebdde598b8de394fc79d9559d1122902e9a50badfaab1ee3d2f3d856c00240e9534b9e71d7edf58c639b34c590d4a3537d733392fb3
SSDEEP 768:C6124IkFxkuwe3y9G7HBjJ9nJAAb5IqnbAsdrjdB32D+z5o9RV:CA2TixLkUB92k1Vjicq
MD5 SHA1 SHA512 SSDEEP

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\locales\zh-TW.pak
Size 1KB
SHA256 ef575dac5681cd4670e01368e0cc39e6297670b528c94d56a87a866f928a55e9
MD5 135e5389b8da9b89a58883b9d975aa07
SHA1 ee440aff9d3fc15b0ef2ed023a14affc53c9d379
SHA512 ddf5abf50a47482e65b2175a1ec5b542f332d6555479aaaec8820035f33e15309961735fecbdc58902c7b0a038dfee00f6f264261ad9d3e6111769aa29db6879
MD5 SHA1 SHA512

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\resources.pak
Size 1.8MB
SHA256 c9d52bd6ecf46035b74b1ab9ebebcb846a42e2873240f3b667c947950f6084e8
MD5 4ecc2e8b53f74ebe3c222523fc5bd2c5
SHA1 411dc20907f24026dfe25c5e4a6f1d71bbe24a1f
SHA512 78dbde4fb4386c714f4a61c65102ea2ecc77d48efa9f2f36652cd50f523cee7bd67d3dd520fd378b10f3c3ea5213509337f14ea12983f2d4b85e5f76364026d1
SSDEEP 49152:+X/WVnQIHnel8Hhe6HUKtudmFDrE69mIp/01uv9M7pRJoaIGG8Hp:HjeQhQKtSikwpoyS141F8J
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\resources\app.asar
Size 85KB
SHA256 092eb5241ca3c4680b812d89f4bf05615dfb41ad9d477d0d846cf4ac4a90610f
MD5 1098ce6f9ed90551d6b57fa9ba0ce4d4
SHA1 1761bf00e6d07c016a355be6f342fae5c9953031
SHA512 81ddc2d260d8355ee38e8fef8527ecd81a1cb88190e79eab29f706024323a29df353fe209bcab67ccae234f115b3e0ce760e91847249846db06ce28682ea78bd
SSDEEP 1536:97UzTskzCG7q3qfgCklcUo+9m3p+VMnGtuUalCjNLR+Nstg+v2Y3JKbgRmrISP97:97UzVKmDsr2AZRE14zg
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\resources\elevate.exe
Size 68KB
SHA256 3714bede3eeb0c66ae3b17b301a12bc1a4bc74db13f06e45f1fe3d70a6360e37
MD5 f77c92e90c7c24e4e2066b4b1ee0fe4b
SHA1 b3873e4a51363574ab41361e086647d2b4519c13
SHA512 ce273fbc35cdeaaedf98a4223c47d0d5684f794e0ef98872793f8be8a91b457d2a34db3f95e404b3a4bf4ce633cc41e58d152ae45cd735af0a92318f1f475988
SSDEEP 1536:bagiaD86LnuuwQoPLjiKDt3yuMKRgSXiFPtjwk36ZcXV/a:1bLnrwQoRDtdMMgSXiFJWcM
MD5 SHA1 SHA512 SSDEEP

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\snapshot_blob.bin
Size 342KB
SHA256 4d82fe1e642fe3ca7ad1a173f806088c0652ecfe9f0f6f6e246066e15a3431d4
MD5 c9ab741bbef53fa0e84952b8891a5f5a
SHA1 e2dcb8d034e07243537c86371de0c52bce62cee1
SHA512 177b98a3090ecfe4b4598dfcd7e8b3ca49efafba4dbd8d6c6d0def462de47c3fabfde831725622783ddc177de982de6115178d9bd9830d918bb544a5a4c27fc9
SSDEEP 3072:p3JCPnnniIvFnfj2YPvS1Ox66vjitjLxyH/QIPc:hJCPniIvFQ1OutXo4Ic
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\swiftshader\libEGL.dll
Size 98KB
SHA256 59ae3d1bf07b0cc8e41cfd23f3d4ea5ccbd0373bc73624c1a3e8eef97fe5e97f
MD5 e36f089a49388cf298c0f7d1702ba852
SHA1 b8d1eca3aa03c66d633eecab0507481a6bef00c3
SHA512 df474f03edf9e28735ad8356d2fa7c987d34448152b4657bf772b6ef5220c91375998cb0fc583c3f480e344c3fc20ea4eaaf73391d0a661341f73e6f86bee093
SSDEEP 1536:QoqgrYpVDcI1eq/X/MRWJIOUwQ6e1jq4rWyzetIMsPBzd/H:gFplcUeQPGO83rWwet0hd/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\swiftshader\libGLESv2.dll
Size 70KB
SHA256 28c1e46cfa481517a0670d348e2f7a8a3a1c57578bfee1912f3c007f85d2a5b1
MD5 cbffe093f660d51b47a155112f696ba2
SHA1 da54814178fd2aeb50412c577b112f756815d898
SHA512 1e4dba4ceac11991a55c691169be3ebc64903f613f574e3b0e47dbef2c582153839a5c6e2c808e656d900b5c941ddce9b64f5c297abd862e12f1f652ab2f0583
SSDEEP 768:UFu8HROAsHkce8xhvHGHEQ7PKNBRmYcfImzRJYg9872vsE5r4ABuUlIzAiKDndGf:UJOZ48qHu0m65VB9IzfKDdGf
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\v8_context_snapshot.bin
Size 656KB
SHA256 e1249d05bfc73c645b27d269f47b6923b33a3cf8088a8ca78b3b637c90f58178
MD5 47014c0f81bad6d216c617c9c63bf040
SHA1 7bb483fdc5fed3c6ed437d9fe6e5023bc38201bf
SHA512 052d86cf3305a9e493bd2472e6b7ddab5e0291efd6d899984a79bae46e5fa4bd21157e19ab4a2591c9cff9069de568bad18c7baf4f35d117c77134e635466f87
SSDEEP 6144:x7EIYb04YEZ+KnirIhjTR2BrLcR0TQhp0M+qPK0Nq8d2CKySv4x7C/PbFcz:ix0KcStL+MnPpqcHSv4+PbGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\vk_swiftshader.dll
Size 1.6MB
SHA256 40150043de4aa623f1868ee4fa46d2b698aaaceff49d695b6efac58410dddf5d
MD5 a5c2945af0145f50d9c44f41ffbab983
SHA1 c446987926be3bb1c3c8eeaa9c72eb71d45d82f2
SHA512 257056f0aec36516eabd471eb5ce646f70910acbd7d230d556a4452e670666078cd4dfc854ccdf320e9d76a681004a130045ee495d3ebd6bac84245f55bd67b7
SSDEEP 49152:px2VjoakX4pb7QH1fUlTB7zmNmdpTE5NSomaZXYjLlHkV:K2DtJf
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
MD5 SHA1 SHA512

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\7z-out\vulkan-1.dll
Size 819KB
SHA256 8ba72d98e0f78b77bda7816cd7232809d287310d34e0f1d7472b9d5fda2c6d02
MD5 b91586bd80e057a7f62bdc4422744812
SHA1 a1df644421ece2e740e5bf0ed98b4f269fd85c39
SHA512 94f0a8e3e75e4803891c0fcb257052dbe0e7399772fc7a46ab802629f76ee580ed30b3678fa6bc3744c12cf9f3103bbc8276e88f6711278748148e9fbeef2053
SSDEEP 12288:ekyJJLfcn5To6PuXtLvEdGnZSss43uobIoD:JnhoR5Ed8S2ukD
MD5 SHA1 SHA512 SSDEEP

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\StdUtils.dll
Size 1KB
SHA256 3f1bc7aefd01690f7da8927c81531d7434e9a834259673a825b6b8ba1152a090
MD5 4af88a7fe61bb36635ece1209db7f79e
SHA1 9ae3267f88e6509449d8cdbfda63b8d661641090
SHA512 7a68f6164ab254a51bd56a0f37563c707451d8801c21e2efc83ae833ef39bdeb9de22b0e2d58751527f6aa24b9a1a173fcf272f8bcfcf00fcd03186336f963b9
MD5 SHA1 SHA512

Submit Download

DarkAdventures.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe
Size 628KB
SHA256 ee811f88e5ce396db6ae94f7da6dfb60c922748d8cb7dc821792b8740dce54e9
MD5 fd33b9178b4dd6da0ef32349e134f4b4
SHA1 b7aeebad411cdad3a76507a202b2a9c7d68f6d12
SHA512 0ce1f9b1cb5353bd49d673fb650c6cb0410bf9a34e85dd10f2f433874535e066406846f698ada8b9633cf1805a92c3a282a93c0e8c3e8563aa8fcb15e333b3d4
SSDEEP 3072:K5aXyidsSApppPpv5y7VHRL1yPH4xtgVP0weL/xIc6nAUKPXhesEtRpMnbk8kuk9:KvJSAK11yPH4xtMVmehR+b7/78wU
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path \Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\d3dcompiler_47.dll
Size 1.5MB
SHA256 74f4c9847860447186d40809a591575ea1cef705bd5f104ef605532c8e4074fe
MD5 f7ef3a3620360452e333b531482cc0d7
SHA1 56b93958947a343db12a2ce8b004dffbe0c3ba19
SHA512 6482fe810ce5559db616a523fb6c8d9c721b4bd487fc789c7de0737f783e017d07711a556e4f2d21a98ed1ba59d859df1a187b0b54f567836ce01821e9700542
SSDEEP 24576:aYADjRKc9J2R20PM2SbMLKam+AIMrLi21fIbCTq6/vjR3lTcKZO3N:aYlc/220PPiMLKam+VMrLi21f4i3jn5w
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path \Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\ffmpeg.dll
Size 92KB
SHA256 085d13622f1c54cdce33996a6deacb1237ea60789a903f819202b7e7b6cfa289
MD5 5a9a308937fcc585e6411fec261c289c
SHA1 2e3618c7bb69366c478da6b446f64a1e02c103ed
SHA512 0801d290c31643d166e8d53592791e7309691e7b2d193599c25108c4fa672f68d00cb92e8493d6f0c22afd6c067096f51b3fb190f1db2e65d7df96c92e8b7650
SSDEEP 1536:uGoACaEDOITMnClTh+QjJXTNEHI9TZMrr:uGoAyTMnCl3C
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path \Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\ffmpeg.dll
Size 28KB
SHA256 d29e2a1dced4fb49892a6864be1fb866bf0e6a7c81829fa00e362f031b3ba3d2
MD5 5f01b0699013979b8cd1e845bf332979
SHA1 e3dfe81d4859d794a06ce5c26929517c8192962f
SHA512 92fd72ed095ab1148c2ed5f64236a76e6f838c94fbc8691233de7774369e08f95139fadb018daafacdb4ba3c32c0f0bfb8b07522d562f943c339960b0edf1b0f
SSDEEP 768:uGoAWEB/j27aRSNDKUqITMnClTh+QVDmNkJjNMu:uGoACaEDOITMnClTh+QjJt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path \Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\ffmpeg.dll
Size 6KB
SHA256 947163342f6927439fa74210f8a140a13d63514d9eae20159434122573c9e557
MD5 677f9fa515fd043f56c8bff6a02762d5
SHA1 bb5ffd2dbcc2e4dde54f091e1873d8b2222b1af3
SHA512 aef351df3d8c0fc620bc02ffee0a432c8e4ba85b3a2fc59b0a1c2d40978992684e1a54a85b57bf346da37d3c860f7dadf1fcaefa0b1bd3914f8bb2643e2b9200
SSDEEP 192:uoI53+v4pDTouOWEDFPFtWU4Ej8b7iZGv:uGgpPIWEB4Ej8b7cGv
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path \Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\libEGL.dll
Size 5KB
SHA256 682637db1f00fdf80221443e4edce60288aa06f461f8b7925cb985736dfb749e
MD5 34d9d02e9876781d43eae04433fadae5
SHA1 65b7b46317fce967e12f447d86556adc6ad27a72
SHA512 3445df45baf6d3447c8126d68eb452ec1f71e1308d756526534b6ee8c5d34fab4c0a7fb42f83d8b7cbf3a2cf28b3f53d6bdce0b026d5819090e0955feba8cfd6
SSDEEP 96:ByNAzS4cv2nTArEePhBqQBaIOSUu8AspS:oazS4cgOEe5QxAGS
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path \Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\libGLESv2.dll
Size 1.7MB
SHA256 993e94a14ad39ab50f1165db8e6eabb2c1e79c83b5aeec234769c7709e29d54c
MD5 983957b1bfd33eb627b93e38d987f46d
SHA1 55302a1203154adadef70e516a444729ac6f1f57
SHA512 d736031330a42d4f51fec5a876d88f728a75b76a49ff98e9b162b5c495b63d684434d03a4426ed40e6067e1430f2b3b4be1223c5773f2f0d293be3d094574d7f
SSDEEP 12288:UckX5zpSkw9KKoHRdpqq4J4hzWwh2Nih5fpnFzQxbSS9S1LjqTxlK6BpCDRXGv72:1kX5zk5KKKl6cWwhCm58ASq6ByWv72
MD5 SHA1 SHA512 SSDEEP

Submit Download

6cd668b8-fff9-49b9-99bd-949f4f205e6b.tmp.node

Path \Users\Admin\AppData\Local\Temp\6cd668b8-fff9-49b9-99bd-949f4f205e6b.tmp.node
Size 61KB
SHA256 e968b3ff301e27a9c5aaad6fb03bc5a20e68f57a179971481e61fe68b75fdd7f
MD5 b980d02f947feaa5ab562b3849e2b766
SHA1 3bec1c72f9093b23b1a9c2d0f41a397fb4013ef2
SHA512 a15deaeb9582bd2ff7d2805541ccd88f1051e46e56f2f499f08cd796753398c575c02563b3fb0b0efb9fa3c36a46dc910b8b9606025231a71146900f65972779
SSDEEP 768:LCy8G/zoY+Ecn8iplByImA8aLvfvYaxbHqQBlet0UCFixgWq:Lp8UoxR2I4aLv3YaxbHcEFixdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

c1a6de88-1931-41b4-89a4-4e402c8c68b4.tmp.node

Path \Users\Admin\AppData\Local\Temp\c1a6de88-1931-41b4-89a4-4e402c8c68b4.tmp.node
Size 20KB
SHA256 988fc1a995f5d1ad225559cd77f98b4ca177aba1a93ea2e06e6c463857860892
MD5 10a8013ee01705395d5cf285b0eaca6e
SHA1 f5d5b46749416aa7349dc3d2683de14b69d932cd
SHA512 726a36c3ca23cd78c2b98d3c06aba140eacfde358e7b96c327932aa046dc78281fdc7f3b0c4557a86b0c27b1d295f2f37d9d6701532d9dfce42e76a39af273e9
SSDEEP 384:ctGN7tKuLckggLYITzn1y2Roydr3FrHLTkeBeLP/Ytrdh6RTuwEsx:IGdLfB5K/YTrwhx
MD5 SHA1 SHA512 SSDEEP

Submit Download

e82f6745-6e22-4712-8b98-062fc3460776.tmp.node

Path \Users\Admin\AppData\Local\Temp\e82f6745-6e22-4712-8b98-062fc3460776.tmp.node
Size 14KB
SHA256 26747a760f03d92e7bfcae70e0c696ab5873e7992067b1733793c37b20d581d4
MD5 81e416ed47cac4d74da96d4fd5691828
SHA1 0ac4ddf564e62857839b45a29e245caacb25785d
SHA512 7de87cd2a71fca06b981027d88c26c6abbc6b1998e0986c97269016757b563aac77da5056061b73b28bc8cde62ab7d410ef5c939d1f617febd63682736951d7e
SSDEEP 384:xGwlMiXoEDUExj9GbemPfAMrUzzQdQHoWvg:4wi/ymPfTQwdQW
MD5 SHA1 SHA512 SSDEEP

Submit Download

StdUtils.dll

Path \Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\StdUtils.dll
Size 64KB
SHA256 eb48d459ce1784e591b4176764dc3acb5a695cbf01fa8f432b9141ad7bab3e16
MD5 0015bfde375f3e84a1b9e26071d86bcb
SHA1 b4ee2b9147e31949ce610e69e156d36206b1b2cf
SHA512 663db70f05a1bbb1e3ef74aa202edee3f5c40d6166b6aadbc780847248fbbaa8cfbecdd597d1c2ed868aba0084cda19813fd395d51ec361e159148f5350725cc
SSDEEP 1536:Di3DhuZmJ9TfpZPHjbaGCD2TF7Rq9coGOgCf468hhI:WNuZmJ9TDP3ahD2TF7Rq9cJNPhI
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsis7z.dll

Path \Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\nsis7z.dll
Size 57KB
SHA256 2116be51875623e2bf92993c80e85b53549af505d9cfc71366da6f7e54c8366c
MD5 6bc9f62c445bf1dcc565b490af1927ae
SHA1 ccaf99b697d41ea2145f2112ae87124544b10bc6
SHA512 26d443e87bef1ab634cbbad8c096181355ddf62ea2fb26c02c7d0a122f42d54811242cf5f2db5bdc810f84ebfa8c559df9514e62bd881a0d5fa84727dbfa0e6f
SSDEEP 1536:gWMaAqgVnUWxzLgyxFmHV7lKDRq8XguQHWCU0S+c0l:xMaqUWxY9Qj7QHWCU0S+R
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4512-557-0x00007FFAD9400000-0x00007FFAD9401000-memory.dmp

Download

memory/4512-657-0x0000026E0FD20000-0x0000026E0FD28000-memory.dmp

Download

memory/10680-614-0x000001989E760000-0x000001989E770000-memory.dmp

Download

memory/10680-591-0x00007FFABCCA0000-0x00007FFABD68C000-memory.dmp

Download

memory/10680-597-0x000001989E970000-0x000001989E9E6000-memory.dmp

Download

memory/10680-592-0x000001989E760000-0x000001989E770000-memory.dmp

Download

memory/10680-594-0x000001989E7C0000-0x000001989E7E2000-memory.dmp

Download

memory/10680-593-0x000001989E760000-0x000001989E770000-memory.dmp

Download

memory/10680-617-0x00007FFABCCA0000-0x00007FFABD68C000-memory.dmp

Download

memory/10764-732-0x00007FFABCCA0000-0x00007FFABD68C000-memory.dmp

Download

memory/10764-712-0x000001D2A6640000-0x000001D2A6650000-memory.dmp

Download

memory/10764-713-0x000001D2A6640000-0x000001D2A6650000-memory.dmp

Download

memory/10764-731-0x000001D2A6640000-0x000001D2A6650000-memory.dmp

Download

memory/10764-708-0x00007FFABCCA0000-0x00007FFABD68C000-memory.dmp

Download

memory/10928-653-0x00007FFABCCA0000-0x00007FFABD68C000-memory.dmp

Download

memory/10928-625-0x00007FFABCCA0000-0x00007FFABD68C000-memory.dmp

Download

memory/10928-628-0x000002982FD10000-0x000002982FD20000-memory.dmp

Download

memory/10928-627-0x000002982FD10000-0x000002982FD20000-memory.dmp

Download

memory/10928-646-0x000002982FD10000-0x000002982FD20000-memory.dmp

Download

memory/10968-783-0x00000248B6120000-0x00000248B6130000-memory.dmp

Download

memory/10968-765-0x00000248B6120000-0x00000248B6130000-memory.dmp

Download

memory/10968-764-0x00000248B6120000-0x00000248B6130000-memory.dmp

Download

memory/10968-761-0x00007FFABCCA0000-0x00007FFABD68C000-memory.dmp

Download

memory/10968-803-0x00007FFABCCA0000-0x00007FFABD68C000-memory.dmp

Download

memory/10968-798-0x00000248B6120000-0x00000248B6130000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads