fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6

Resubmissions

19/01/2024, 01:18

240119-bn7ndadef77

19/01/2024, 01:13

240119-bla7dscefr10

Analysis

max time kernel
29s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
19/01/2024, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe
Size 71.3MB
Sample240119-bla7dscefr
SHA256 fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6
MD5 65abecd9d4eab0048f0ef67a660c1edc
SHA1 8159e27cc52129b51c41dff996243eeb604a4129
SHA512 76ecb58c10f3332a26a1601c9a61e8bbb719fcb813173381e5f28718c95711cb50432109b8447f5e9b00a41856815f6093b16a44f1cfef177e05c1d7ea90a92f
SSDEEP 1572864:Z4/4rzOchPJt8P77r/4UkZNQyaSz3Ek+yvDuWjXMzbP0TdVwGz7:ekqcdb0PwUknBjzvDHXMzQ/7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DarkAdventures.exe	DarkAdventures.exe

Executes dropped EXE 3 IoCs

pid	Process
3300	DarkAdventures.exe
1928	DarkAdventures.exe
2772	DarkAdventures.exe

Loads dropped DLL 12 IoCs

pid	Process
4856	fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe
4856	fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe
4856	fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe
3300	DarkAdventures.exe
3300	DarkAdventures.exe
3300	DarkAdventures.exe
3300	DarkAdventures.exe
1928	DarkAdventures.exe
1928	DarkAdventures.exe
1928	DarkAdventures.exe
1928	DarkAdventures.exe
2772	DarkAdventures.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-771046930-2949676035-3337286276-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDriverSetupRq2z8u = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\DarkAdventures.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ipinfo.io
5	ipinfo.io
6	ipinfo.io
7	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DarkAdventures.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DarkAdventures.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DarkAdventures.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	DarkAdventures.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	DarkAdventures.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	DarkAdventures.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	DarkAdventures.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
11040	schtasks.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
11100	WMIC.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
8440	tasklist.exe
8344	tasklist.exe
7536	tasklist.exe
7376	tasklist.exe
8752	tasklist.exe
8640	tasklist.exe
8228	tasklist.exe
8008	tasklist.exe
7984	tasklist.exe
8400	tasklist.exe
8352	tasklist.exe
8300	tasklist.exe
8096	tasklist.exe
7624	tasklist.exe
7368	tasklist.exe
8744	tasklist.exe
8408	tasklist.exe
8196	tasklist.exe
8000	tasklist.exe
7420	tasklist.exe
7908	tasklist.exe
7648	tasklist.exe
7952	tasklist.exe
7616	tasklist.exe
7576	tasklist.exe
8556	tasklist.exe
8424	tasklist.exe
8336	tasklist.exe
8204	tasklist.exe
8164	tasklist.exe
7512	tasklist.exe
5384	tasklist.exe
7460	tasklist.exe
7444	tasklist.exe
6768	tasklist.exe
8376	tasklist.exe
8292	tasklist.exe
7884	tasklist.exe
7528	tasklist.exe
7864	tasklist.exe
8236	tasklist.exe
7936	tasklist.exe
7848	tasklist.exe
7176	tasklist.exe
8812	tasklist.exe
7992	tasklist.exe
7976	tasklist.exe
7116	tasklist.exe
7680	tasklist.exe
7500	tasklist.exe
7436	tasklist.exe
8616	tasklist.exe
8532	tasklist.exe
8448	tasklist.exe
8368	tasklist.exe
7696	tasklist.exe
7428	tasklist.exe
7544	tasklist.exe
8068	tasklist.exe
8308	tasklist.exe
7916	tasklist.exe
7828	tasklist.exe
7800	tasklist.exe
7688	tasklist.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3300	DarkAdventures.exe
3300	DarkAdventures.exe
3300	DarkAdventures.exe
3300	DarkAdventures.exe
2772	DarkAdventures.exe
2772	DarkAdventures.exe
11192	powershell.exe
11192	powershell.exe
11192	powershell.exe
7740	powershell.exe
7740	powershell.exe
7740	powershell.exe
10980	powershell.exe
10980	powershell.exe
10980	powershell.exe
9208	powershell.exe
9208	powershell.exe
9208	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4856	fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe
Token: SeDebugPrivilege	1292	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2968	WMIC.exe
Token: SeSecurityPrivilege	2968	WMIC.exe
Token: SeTakeOwnershipPrivilege	2968	WMIC.exe
Token: SeLoadDriverPrivilege	2968	WMIC.exe
Token: SeSystemProfilePrivilege	2968	WMIC.exe
Token: SeSystemtimePrivilege	2968	WMIC.exe
Token: SeProfSingleProcessPrivilege	2968	WMIC.exe
Token: SeIncBasePriorityPrivilege	2968	WMIC.exe
Token: SeCreatePagefilePrivilege	2968	WMIC.exe
Token: SeBackupPrivilege	2968	WMIC.exe
Token: SeRestorePrivilege	2968	WMIC.exe
Token: SeShutdownPrivilege	2968	WMIC.exe
Token: SeDebugPrivilege	2968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2968	WMIC.exe
Token: SeRemoteShutdownPrivilege	2968	WMIC.exe
Token: SeUndockPrivilege	2968	WMIC.exe
Token: SeManageVolumePrivilege	2968	WMIC.exe
Token: 33	2968	WMIC.exe
Token: 34	2968	WMIC.exe
Token: 35	2968	WMIC.exe
Token: 36	2968	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2968	WMIC.exe
Token: SeSecurityPrivilege	2968	WMIC.exe
Token: SeTakeOwnershipPrivilege	2968	WMIC.exe
Token: SeLoadDriverPrivilege	2968	WMIC.exe
Token: SeSystemProfilePrivilege	2968	WMIC.exe
Token: SeSystemtimePrivilege	2968	WMIC.exe
Token: SeProfSingleProcessPrivilege	2968	WMIC.exe
Token: SeIncBasePriorityPrivilege	2968	WMIC.exe
Token: SeCreatePagefilePrivilege	2968	WMIC.exe
Token: SeBackupPrivilege	2968	WMIC.exe
Token: SeRestorePrivilege	2968	WMIC.exe
Token: SeShutdownPrivilege	2968	WMIC.exe
Token: SeDebugPrivilege	2968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2968	WMIC.exe
Token: SeRemoteShutdownPrivilege	2968	WMIC.exe
Token: SeUndockPrivilege	2968	WMIC.exe
Token: SeManageVolumePrivilege	2968	WMIC.exe
Token: 33	2968	WMIC.exe
Token: 34	2968	WMIC.exe
Token: 35	2968	WMIC.exe
Token: 36	2968	WMIC.exe
Token: SeShutdownPrivilege	3300	DarkAdventures.exe
Token: SeCreatePagefilePrivilege	3300	DarkAdventures.exe
Token: SeDebugPrivilege	6768	tasklist.exe
Token: SeDebugPrivilege	7328	tasklist.exe
Token: SeDebugPrivilege	7368	tasklist.exe
Token: SeDebugPrivilege	7376	tasklist.exe
Token: SeIncreaseQuotaPrivilege	7640	WMIC.exe
Token: SeSecurityPrivilege	7640	WMIC.exe
Token: SeTakeOwnershipPrivilege	7640	WMIC.exe
Token: SeLoadDriverPrivilege	7640	WMIC.exe
Token: SeSystemProfilePrivilege	7640	WMIC.exe
Token: SeSystemtimePrivilege	7640	WMIC.exe
Token: SeProfSingleProcessPrivilege	7640	WMIC.exe
Token: SeIncBasePriorityPrivilege	7640	WMIC.exe
Token: SeCreatePagefilePrivilege	7640	WMIC.exe
Token: SeBackupPrivilege	7640	WMIC.exe
Token: SeRestorePrivilege	7640	WMIC.exe
Token: SeShutdownPrivilege	7640	WMIC.exe
Token: SeDebugPrivilege	7640	WMIC.exe
Token: SeSystemEnvironmentPrivilege	7640	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 3300	4856	fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe	78
PID 4856 wrote to memory of 3300	4856	fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe	78
PID 3300 wrote to memory of 1008	3300	DarkAdventures.exe	426
PID 3300 wrote to memory of 1008	3300	DarkAdventures.exe	426
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 3300 wrote to memory of 1928	3300	DarkAdventures.exe	393
PID 1008 wrote to memory of 1292	1008	cmd.exe	392
PID 1008 wrote to memory of 1292	1008	cmd.exe	392
PID 3300 wrote to memory of 2772	3300	DarkAdventures.exe	80
PID 3300 wrote to memory of 2772	3300	DarkAdventures.exe	80
PID 3300 wrote to memory of 2544	3300	DarkAdventures.exe	389
PID 3300 wrote to memory of 2544	3300	DarkAdventures.exe	389
PID 2544 wrote to memory of 2968	2544	cmd.exe	81
PID 2544 wrote to memory of 2968	2544	cmd.exe	81
PID 3300 wrote to memory of 1620	3300	DarkAdventures.exe	388
PID 3300 wrote to memory of 1620	3300	DarkAdventures.exe	388
PID 3300 wrote to memory of 4596	3300	DarkAdventures.exe	387
PID 3300 wrote to memory of 4596	3300	DarkAdventures.exe	387
PID 3300 wrote to memory of 4796	3300	DarkAdventures.exe	385
PID 3300 wrote to memory of 4796	3300	DarkAdventures.exe	385
PID 3300 wrote to memory of 3036	3300	DarkAdventures.exe	383
PID 3300 wrote to memory of 3036	3300	DarkAdventures.exe	383
PID 3300 wrote to memory of 816	3300	DarkAdventures.exe	382
PID 3300 wrote to memory of 816	3300	DarkAdventures.exe	382
PID 3300 wrote to memory of 3444	3300	DarkAdventures.exe	380
PID 3300 wrote to memory of 3444	3300	DarkAdventures.exe	380

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
9220	attrib.exe

C:\Users\Admin\AppData\Local\Temp\fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe
"C:\Users\Admin\AppData\Local\Temp\fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
  C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
    "C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --mojo-platform-channel-handle=1912 --field-trial-handle=1700,16714614490477755136,11751177253740798355,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1540
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:10960
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:11008
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:11000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:11060
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:11108
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:11100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:11152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:11192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
    3⤵
    PID:7644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:10964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:11072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:5308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    PID:5280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\resources\app.asar.unpacked\bind\main.exe"
    3⤵
    PID:5264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1008
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1292
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:72
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=3300 get ExecutablePath"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
    "C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1700,16714614490477755136,11751177253740798355,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""
    3⤵
    PID:6936
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
      4⤵
      PID:1548
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:8360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""
    3⤵
    PID:10140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""
    3⤵
    PID:9608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:6256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "& { $Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DarkAdventures.exe' $Trigger = New-ScheduledTaskTrigger -Daily -At '12:00PM' Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName StartCacaTask }"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:9208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\"""
    3⤵
    PID:8272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupRq2z8u /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\" /F /rl highest"
    3⤵
    PID:5816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupRq2z8u /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe /f"
    3⤵
    PID:8520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=3300 get ExecutablePath"
    3⤵
    PID:11216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1008

C:\Windows\System32\Wbem\WMIC.exe
wmic process where processid=3300 get ExecutablePath
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:6768

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7176

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7552

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7776

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7864

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8068

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8308

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8556

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8648

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8812

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8752

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 session
1⤵
PID:9068

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8744

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8640

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8632

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8624

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8616

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8532

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:8520
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupRq2z8u /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe /f
  2⤵
  - Adds Run key to start application
  PID:7004

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8448

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8440

C:\Windows\system32\net.exe
net session
1⤵
PID:8432

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8424

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8416

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8408

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8400

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8392

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8376

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8368

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8360

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8352

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8344

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8336

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8300

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8292

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8236

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8228

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8220

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8212

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8204

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8196

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8184

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8172

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8164

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8096

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8020

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8008

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8000

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7992

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7984

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7976

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7952

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7936

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7916

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7908

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7896

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7884

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7848

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7828

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7800

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7756

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7748

C:\Windows\system32\more.com
more +1
1⤵
PID:7740

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7724

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7696

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7688

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7680

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7672

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7664

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7656

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7648

C:\Windows\System32\Wbem\WMIC.exe
wmic OS get caption, osarchitecture
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7640

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7624

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7616

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7608

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7592

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7584

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7576

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7564

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7544

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7536

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7528

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7512

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7500

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7460

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7452

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7444

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7436

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7428

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7420

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7376

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7368

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7360

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7328

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:5384

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\""
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:10980
- C:\Windows\system32\attrib.exe
  "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe
  2⤵
  - Views/modifies file attributes
  PID:9220

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
1⤵
PID:10020

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
1⤵
PID:9896

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:5416

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:1212

C:\Windows\system32\schtasks.exe
schtasks /create /sc onlogon /tn WindowsDriverSetupRq2z8u /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\" /F /rl highest
1⤵
- Creates scheduled task(s)
PID:11040

C:\Windows\system32\cmd.exe
cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupRq2z8u /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\" /F /rl highest
1⤵
PID:10944

C:\Windows\System32\Wbem\WMIC.exe
wmic process where processid=3300 get ExecutablePath
1⤵
PID:11204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

2439ae1f-9c85-4eeb-a758-42a6275f74d4.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\2439ae1f-9c85-4eeb-a758-42a6275f74d4.tmp.node
Size 45KB
SHA256 6a03cc765b5a54860856b8620e1db7fcc02a24ba06184831c5a014a27e638687
MD5 413943e3da30a83896846812f2e16b22
SHA1 1312cba180da5a07f3017e88d258d8eaaa03627a
SHA512 ba2100c99be15637cc59fee2e404f467a288f6c2b6a4f882b9f50357d73d90ac89bfb8b1dc9cd57f80c6a50aabe7715218d9fa6a10c5ee04e2603c212aca3c1c
SSDEEP 768:LCy8G/zoY+Ecn8iplByImA8aLvfvYaxbHH:Lp8UoxR2I4aLv3YaxbHH
MD5 SHA1 SHA512 SSDEEP

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\D3DCompiler_47.dll
Size 1.3MB
SHA256 0e563decd2809e681c64b6e2f434849111bba5971ed1341baabd279518ebfbef
MD5 1c8b984f596b9f2b58d2d941503df713
SHA1 56fee06ea33ac6f00709e24fe2ff067d33e6c7e9
SHA512 70de6814acd8baaac6ef14a3962bdbc1e8c27ede5f05d666d15200d6ac7c7006b8ef2b9bea508617b058e655d06c14e00211c3c415c91a82a5d9a0556869d279
SSDEEP 24576:aYADjRKc9J2R20PM2SbMLKam+AIMrLi21fIbCTq6/vjR3lTcI:aYlc/220PPiMLKam+VMrLi21f4i3jnj
MD5 SHA1 SHA512 SSDEEP

Submit Download

DarkAdventures.exe

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
Size 96KB
SHA256 4c43501076aec10c02ab2e3d5dbe98ec0725557b0a40029d8996c1b12d109575
MD5 03d1029af4abca976cc02b7a10143385
SHA1 bf1bb74a64b517e0e967cd52cb81120885af1ea5
SHA512 a7029ad0542d50234b99aa667e395b878ba18045491710724b615300a4285aecee8039bb302798e265eb7b0ffc86e17f4b39321529cc2fcf685cab98c045aca1
SSDEEP 1536:mF5aXyidsSP6E08lIpppPpvwLl4jy7VW0GcbRL1y95Tifg:K5aXyidsSApppPpv5y7VHRL1yPf
MD5 SHA1 SHA512 SSDEEP

Submit Download

DarkAdventures.exe

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
Size 1.9MB
SHA256 f71a2cbfcbb582d25e2b97dbd18a1f68c15e81a1cfaadc68d395dbcf2e4421dd
MD5 1fbc9c1df909b5f90c55aa087c7a63b8
SHA1 f2a276f2c57664148c2be917c8109bbc1dbc0cfd
SHA512 9aa770c2026d7993b7fc28a6d18d0770fba2a8504b8d2b4509cb8ca1879c8fb7ce27b17f2cbb5733fe93ec6ad6d2f3ae4ad82601a7d356b0181d35e3beeed0c3
SSDEEP 12288:K+K/VftUzlLqOy5KigTmAz9cX6jdQE5zPwoMyAkvyy:1+uuWjjdQE5zPxhvyy
MD5 SHA1 SHA512 SSDEEP

Submit Download

DarkAdventures.exe

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
Size 57KB
SHA256 bc074b79e69e275f0f32841f662a9012ba011e720cf6699da963021daca63014
MD5 8d686f266a588a94688a1405ee053073
SHA1 a8d7f4019f1620d7b6d3ef54c91b0787bb95a506
SHA512 88f4aa292c7b710f0fd867de445ceab764a3db67ea5afb59ed47baaf4c342619071632e1a5e802137eb8b72c0bd7baa7dcf65b4b0fea7c2fce65ff66fff1d9b7
SSDEEP 768:mF5t8G+y2eAd5qepP66g18rOSJf0QpBFQcBoLiCFSDQJ+iGN6DU7t81pppPpIwQ:mF5aXyidsSP6E08lIpppPpvQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

DarkAdventures.exe

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\DarkAdventures.exe
Size 1.3MB
SHA256 ce79b9365308670acb5fe77d0c1e0150168282982a1214b91a5b992ca1c71959
MD5 5877dc61c1ba5c952c70940e6e2e2194
SHA1 ddc080acc92b007d0fa4b8cb6485bc6ed61be402
SHA512 d4e1559cb999cd390e42b94b539ec767742e336684cc69b3480d10e1d81c2525c9db1086be8bdcb402a8704aabd35fa11db5aba2671453e0b24a583bc474b453
SSDEEP 6144:KvJSAK11yPH4xtMVmehR+b7/78wqtyeYbQaC8ArZjg:K+K/Vftu
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\chrome_100_percent.pak
Size 138KB
SHA256 53102833760a725241841312de452c45e43edd60a122546105ab4020ccef591b
MD5 9c1b859b611600201ccf898f1eff2476
SHA1 87d5d9a5fcc2496b48bb084fdf04331823dd1699
SHA512 1a8ec288e53b9d7e43d018995abe4e3d9c83d329d0561fbb7d022e8b79ffecf033e995b9bc6af352a71c646a1e8afba4addb54deab7455f24b7a279a3dd7c336
SSDEEP 3072:+Kzw9bp66mdgZeMj6g2Z8Gb0+VRLf0ld0GY3cQ3F2DExm/KLQ2I:+Kzw986mdgZezgm8Gb0OV8ld0GecQ3m3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\chrome_200_percent.pak
Size 202KB
SHA256 4a438f0e209ac62ffa2c14036efdd5474b5ecaa7cbf54110f2e6153abdfb8be9
MD5 b51a78961b1dbb156343e6e024093d41
SHA1 51298bfe945a9645311169fc5bb64a2a1f20bc38
SHA512 23dedde25ad9cb5829d4b6092a815712788698c2a5a0aefb4299675d39f8b5e2844eabd1ea42332a0408bd234548f5af628e7e365ab26f3385ebfa158cdd921d
SSDEEP 6144:MDQYaF+9b16mdgZezVk5GMRejnbdZnVE6Yopym74:hfs1FdgEj6edhVELo374
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\d3dcompiler_47.dll
Size 1.4MB
SHA256 4a7fb57b6fe959cf88b1823a42adb54c6b1b46bdc52bf8f54e8de95cff3d8d04
MD5 ab44f6473d846c09a13fd46023cc3f14
SHA1 f241218576dc2d71fc26176dc2d30d545f691ab7
SHA512 6510ac803f0493a3f999987b68b62ede867616ba98ba674de9226aef8abbbd6ea6109cbcf1a6e90e7cb35aefb4d4ba20253eb8d83fcf317e27399dd9fe2c23c3
SSDEEP 24576:aYADjRKc9J2R20PM2SbMLKam+AIMrLi21fIbCTq6/vjR3lTcK4:aYlc/220PPiMLKam+VMrLi21f4i3jn54
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\ffmpeg.dll
Size 51KB
SHA256 75f79ef3f912440336a63022209a52ad9b52cd2d7fa5d33a4b1def50ecc921aa
MD5 3edab693f81ddaab01bb9b24272f2f5e
SHA1 ff0d0061a7c0333b8f322a0e8b1cddbd87cfae27
SHA512 b881d80253f79fc0895e40f3be05152858d1f3cb082e69f1c48f6dbf22e270091fa258406609788218e8b4393e3d5bf9e3b197eb0b560def444dae477c837f64
SSDEEP 768:uGoAWEB/j27aRSNDKUqITMnClTh+QVDmNkJjNM8zfG4lSDGuBabl7vWK:uGoACaEDOITMnClTh+QjJXTNEHo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\ffmpeg.dll
Size 30KB
SHA256 e469a1e95c557be0adb3f4638d3dc698be7d004cfefc320fd1dee7ad0a15e43e
MD5 482c0431a3af68546862508dd1b371fb
SHA1 c5f98421a96bc4c3c8f191405d1787fd971b9a00
SHA512 f65bdc8127f08ad3e0c5c1b4b8d3fa65b548e7ce5c97729db1620003ed6c31fea6711f0844852bcd9b311a4c56b2f645b5aa81238d960af8b55bae8fd273cdd4
SSDEEP 768:uGoAWEB/j27aRSNDKUqITMnClTh+QVDmNkJjNM8zfC:uGoACaEDOITMnClTh+QjJXTC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\ffmpeg.dll
Size 1.5MB
SHA256 874910c88ea4c942ee6abc684d1f72a9de7cbdd020dc5d2117582f7cfedce133
MD5 0938e955236b7efc35761db9c9aa1080
SHA1 48f6a9877ff9479b775395dae662891b50226fc6
SHA512 abc4da5b8cfea579d0a6d2611dc530c7f292e64bc4787d265044abeb7d08978d59f038da8abe5ad95afefdc79ed771bdfeef18c3b25d01b298c0c1725f24c6b4
SSDEEP 49152:JcMr6+FXptsXTmgP7he370olRK+KCKyRb+kyqVZWxX0b4A:RKer0olGyByY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\ffmpeg.dll
Size 20KB
SHA256 00308938486fd57f6b56fbf11794c786d3326509bbe6751047f92e8d1d1233ed
MD5 0a8790a510b26524c646b1ade540c14b
SHA1 d9f991a79141b6b524abc854b26fc220575293c2
SHA512 575fdad57eee89383a4d3b7d18ef8292110931241785c10772d1515b450335cd6c955e88b9fb0acc564fa3cc302f8113e7e3f5de066d871e940fb4ce6881f36c
SSDEEP 384:uGgpPIWEB4Ej8b7cGcR6rg+c76NV5V5ui4+9MLcTclMScXlcAQE80sf:uGoAWEB/j27aRSNDKUqITMnClThq
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\icudtl.dat
Size 52KB
SHA256 eabc9e4454e96033872b368711fe080e1ff0d27dd596f1c0b663a7f1b5637920
MD5 1286b2bc935931065cda11b401c396f5
SHA1 506cbbbc1b62e34b3f284a8774f259856eed09d2
SHA512 38e6906dea2502a213b03bfe68866b9b87d1772e5690dc229cc73b9617ec4cafd5891d52b4ad54161c65e2f5a0dc2e490b2122f283edc15a565bc150f122e655
SSDEEP 768:nQuOxwkJw9H2R4i+VmXQfFDVzm2m6DUrrX:1kC92UVek1Vzm2mYUrX
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\libEGL.dll
Size 437KB
SHA256 14a4aaa010be14762edfee01fd1f6b9943471eb7a2f9011a2b5c230461cd129c
MD5 8352fd22f09b873193cabc2932be92f0
SHA1 5bd2b58854b279f1733c5f54ea2669ee8a888d9e
SHA512 7281e980f2e82f1cc8173d9f8387a97f6e23ec5099ed8dca02222c4e17fa4cfef59d6aa300b1cf06d502bdcf77d9a6dbb08ad6658ae0a28ae6f9f995109da0d2
SSDEEP 6144:odpiWYLBViWOSdAr1Knk2mI3LpxE0RYqowpW6VmHrtff1FI:ipvYLbiWBqrQnPxE0cKmHZ3P
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\libGLESv2.dll
Size 1.3MB
SHA256 91e31b9d45af01894b00ea1d22b682341019ab8007a2956fbd21ee48ae2d2bab
MD5 cb4b84b343691a300c2427b59c43a24d
SHA1 b7109d4536c63a0df9c7439a5e9afc93e7bff4d9
SHA512 b5e356a296d686c50b7326b401e2ee09bff096380f1ed1b03fa5dbe47d1f08a7b58042a217a9e4fa0df551f55a52a4768aebf58b46e82b97fd21e3622ebe2d5d
SSDEEP 12288:UckX5zpSkw9KKoHRdpqq4J4hzWwh2Nih5fpnFzQxbSS9S1LjqTxlK6Bpq:1kX5zk5KKKl6cWwhCm58ASq6BQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\libglesv2.dll
Size 1.3MB
SHA256 b69028590c1c15e7ed4e2ef5d295285ac71dec471eea8d47fa8dcc794a059c5f
MD5 c98633517d20181f624e957bc8bf3c05
SHA1 d09f2aa970938518075049fac8e31b468f152e00
SHA512 4c101c18e07d6b8b48de431908468293a90a9e59fa256e6e40e2fa995b30a95dbfc5d330c63fe077115575f0d38d9e70f3a88a87537ec524148b69eda893490b
SSDEEP 12288:UckX5zpSkw9KKoHRdpqq4J4hzWwh2Nih5fpnFzQxbSS9S1LjqTxlK6BpCH:1kX5zk5KKKl6cWwhCm58ASq6BU
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\resources.pak
Size 62KB
SHA256 35c8657d70f368416c97b62086a81605c694dfb3251ad47c53be2982ece2ed54
MD5 c9a8989ebfb45d8ba064c7c303b6b3d4
SHA1 4766ea1d65d00f6fbf7dcc3aeaf4df21450c6701
SHA512 7be2979416edfd3c320232a30ae2171650838c24f90694b917294547c1c8ef6eb5bb0cd386f3d1fa3f7a8d27e1bad236f939c11a3832458518ba4fe6d4d14a11
SSDEEP 1536:wqrF4NXPZVmt9CgN1WqzOZ4IY7qvbooX4AHobFvuj7cYeKfYvUgQa:LahPZeKZL7vbBbHSFY7BRfYvUa
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\resources\app.asar
Size 79KB
SHA256 a988af66bacad04bf2f76de97f24e5c946a8af00a9cef931c1727b5389c3e35c
MD5 118eeb5bdd8fbc93f1ca93b0cd9f9975
SHA1 b06d961863bb6e90a7b84ffc73a54d203ec8d671
SHA512 837f0435e966975da1f37f364beba41bdb828bf23cf100b1686e7919dad7f41700f521c50e97e7d7904ca594f42f3649da2987d79b4404e36e0cafb2c3da1b78
SSDEEP 1536:97UzTskzCG7q3qfgCklcUo+9m3p+VMnGtuUalCjNLR+Nstg+v2Y3JKbgRmrIt:97UzVKmDsr2AZRH
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\2b8E8SiG9E1heypYMAe7xjpKggh\v8_context_snapshot.bin
Size 92KB
SHA256 b783944e3519a3220d556badb5d4a169f5dec74675e3b8b47e7cf8d8b0ad8c50
MD5 cc32a18b6baae7c86f68f8e28604e201
SHA1 3a07203bfe0a4cfb7732f3f7c0566ba2051959b9
SHA512 79c5bc6d17b79bfcbab9957d821e4ddf768ac313d42bfb166d318945d39c45fe1a8a71f2ec8d43cfacdef136bcb08a228ed14587ceeb978a8931ef66330c9261
SSDEEP 768:UPkW49g/AP8LVs71+2EurrL5kqcJ7pZuNeAFAXbd6lVqPviesj1+U:U8nUAEJo1xXLyN7pYNBibd6lavxO1J
MD5 SHA1 SHA512 SSDEEP

Submit Download

9669a53b-96b4-4c78-988d-024a6997d0fc.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\9669a53b-96b4-4c78-988d-024a6997d0fc.tmp.node
Size 92KB
SHA256 ba616c3fa52bbb2b28d159a4a6d30e64d6d829ef1313c889fc6adc5de0f2f2b4
MD5 3260db7301ef9728dde1e61f96996a20
SHA1 579e659493675971c7853249e15ab086da175f1f
SHA512 0ea16403f85c721c34c6baf8aa8548cb833aafed8dbe7c30bff7c53c0a8efe725a05f32f237934da78b8ea6010bb952962f0da096416c1d9709fbb4f284a9b66
SSDEEP 768:4wi/ymPfTQwdQq4c6A3AU2uPO5Sm8xJ7a4VJICdYUEiOkVymrAoZiQC2n/3miwR3:fQPB76AwPuW5SRxJ7JsQP+RhqVmL
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_xt0rw4tu.4m2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xt0rw4tu.4m2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

d5d3970e-3d6b-4369-b2be-f5a8f86adf01.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\d5d3970e-3d6b-4369-b2be-f5a8f86adf01.tmp.node
Size 46KB
SHA256 068ad3bae7cc7f29e6d825b99e82f9368e0c704e7da53fa2c82e59967360f879
MD5 6dec7ff241dd03e55288231ed0d9d669
SHA1 f669ad6faefc08c2a3b6aff8e85c908477ac3de5
SHA512 d99e5ae07dd401aafbccb3fdf5c50e0c889f98b1d8b4ff0c918ebcabba19117d997076adf00a09bfb9f7c78b446f518e2b9e121510cedbbc77f408a3be02ab12
SSDEEP 768:IGdLfB5K/YTrwhS9O/xZeMGxVNVyDdLPKoex:DuqMS9MGxVNV7oex
MD5 SHA1 SHA512 SSDEEP

Submit Download

DarkAdventures.exe

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\DarkAdventures.exe
Size 2.3MB
SHA256 17b398cbc4a1e3098323964c486591f103201c27b4e5eff376cbee265cf30a2b
MD5 7dc1630697fa502a00c4a6eb185280c8
SHA1 c6ce460bba8386c90a71efd7a280e92ac336a7c8
SHA512 8949cc43e00fe9aaf5934a77b43a6f41d40b136974e2c51380b28c642e8d5c82306d4ab984e8df2267514a1c1ca15f040fdb9550bca16d583a2d080f331202f0
SSDEEP 24576:1+uuWjjdQE5zPxhvyhk50pMjt/sYv+WFiiIviaR:1++TPxhvAk5jsYv+WFKR
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
MD5 SHA1 SHA512

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\LICENSES.chromium.html
Size 2.1MB
SHA256 4bc9e510b98c99d3454fa36505781f1a09ac4ba13a239ca366274475dc2425f6
MD5 ffbcc24eecf5a69cfb5bf3938daecd56
SHA1 56fef7ed05398f8391061f3b5816d568d564c0d5
SHA512 55e2306b10ae338c16fb6c09fea0fe570db33fc110e3fdb951c4e5304de1e5fdf4735dc14c7262a21fe1b68b97fbb44e8958c5ececd843d8036db3e65fe439aa
SSDEEP 12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZp:sPM95FCWSY
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\chrome_200_percent.pak
Size 120KB
SHA256 6e703452cfc16dd2c50ecd087349ed0788430225666240bf0ba39e867f066d9c
MD5 ea0350853a09c10d67c37b3280eebf20
SHA1 631929fe3e1d389d9dfd3d3a514085d8d94d1ea0
SHA512 8cb68eb2984148f0dfedbecc0a913448618beee204bbd49bbba39567e6fe040e961b6f023ccfffe253fa3dee15b9f0c649b6c8b9c15862e5b377b96282fe8664
SSDEEP 3072:MDQYaEM+9b16mdgZeMj6VfR+5GMR+F44ffbdZnYw9p4AbI/:MDQYaF+9b16mdgZezVk5GMRejnbdZnVE
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\d3dcompiler_47.dll
Size 57KB
SHA256 4ba40ce9aa94de9ac1107e72c80d7036292a19421f1eb333e92345c67eba8237
MD5 1a9827996a6a60cfd02fe327ef7cdb20
SHA1 9d5e7aeaa4408b01834160080dcc7e6ef02bb3d8
SHA512 7c4202a96839ef30e13292a982fa196a73cf6fc8774cda44fe2e417866b09a644a7b34d9a0a83c67b08b6fc5ff151ff43c5fe8f5770acf3ca1da6287fa42e757
SSDEEP 1536:eCVdquhKCjRYy8gtvPMxbRyWf4LBSC+u1YW8:zVphjYWtvPLIf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\ffmpeg.dll
Size 2.1MB
SHA256 10b462ba3886f1af7aa3af58019daf0f6c3d3dc38753280b361ad3ba85ce5813
MD5 0f6a3fcf88877d7855ec558bcf75be73
SHA1 ea99fa4ed1ccba59e93cca94f38b6bb233727797
SHA512 8d946f54e0d5412da18f3e05c81e9725107fa45a83bda30dca51db915954a6e804c0de940f4e8cdec758b5a1a951f0b6fb0f8334671294018119890fff3cc50a
SSDEEP 49152:JcMr6+FXptsXTmgP7he370olRK+KCKyRb+kyqVZWxX0b4unfr:RKer0olGyByEf
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\icudtl.dat
Size 2.5MB
SHA256 093143590e88200f4f18bfe0b13625bfa748256a76df9234d92050c0201e8e90
MD5 58a735e8d4776326ca0f0e4c2db7dc02
SHA1 2da88d936fb276c55feb051982e834080ed5575c
SHA512 e835c5bafff0b817589861425962c6484a789afa15fd9ac13a2be81c449ae64dd65f5b8c75de35be52bde8ddd9ae3b2fa559763582736f310497cb7366cf1596
SSDEEP 24576:ArvDOhw3zVtjaSEjF9Sy581GbSBrz22wpwiReEEC4X1XsCfji622dHuAXJOWLgCx:w7bt6jK/wpcEOX1dWIdHPULRuRhCX4
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\libGLESv2.dll
Size 2.1MB
SHA256 582e0e6cc7c68b6665f27386de1ee1e2c51901e0f946a64662774d5ac507af2e
MD5 d6d5f0f57679a8caefe39e1bed5c993f
SHA1 cf6748396e2ff8b3c08328994aaadf4f32c6bc32
SHA512 344ccd35c862b1497025feb59446ed3d8da65f415fc72a1f1241ca01b84433187e757b827c78752eb8c92ac879b90aa32bc61dbe4c567f8541abdb027c77763d
SSDEEP 24576:1kX5zk5KKKl6cWwhCm58ASq6ByWv7xn/7Ip2oS:aYKj6OhH5vSqGZ/UUoS
MD5 SHA1 SHA512 SSDEEP

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\am.pak
Size 175KB
SHA256 7c2b9098130f1f9e0cf4507b64c0e96ac6354bd6c3616be20e2067cfccc820da
MD5 e18a450ef034b42599341c3d09f280f1
SHA1 2001c8a85904962ac3a96938eccc69ad2c110fdf
SHA512 ddd87571218fe9f179a6c2a8a15b182625a71a7c19ed90c0969ca2e0e9bad823b926f8b8a6b390cb6fe9c95f4b6c1f1ec7b5167a8424ab1921943922208f798a
SSDEEP 3072:u5ghhWHOj0/E92t7Rh4rgEkDvuh78oeLtykiqfVGMqyZJjhEf2WAqT5b0kek97G4:u5cW/gUuAQPPgx30jH8+D
MD5 SHA1 SHA512 SSDEEP

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\ar.pak
Size 1KB
SHA256 548f7adda185b25fda947b3a632374b7f1122c831c00dd5a065e2f7d4a8e39ea
MD5 bcc18008f570974f0673a985e896cf86
SHA1 fbe1ad1e3fd83ea5faf3da97061d5b231e517b67
SHA512 b4a4cab70e0fb198170f98c63914af415cd1a531505caac61d10e7ced7428af7e87dd8eb92105570e540687586538611779a531a66f12fb66d39835309be90fd
MD5 SHA1 SHA512

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\bg.pak
Size 41KB
SHA256 02cd2a4a6db64029e2a34cca5ae6491855934ffe80d4edb88d067770c35554df
MD5 a5b8b688fa2d9ecccc327c380e8ad3e6
SHA1 c36b3f77d4e951609648dba1d3f745dd7b2b988b
SHA512 75b74b8bdf1cbfa89c13e0a61e406a3f34d3fea10cf3a23f9ac419b42c9295110e20bb65d0fdad66f136c6979518e7b49c2e85a90a92636042522972babf54f5
SSDEEP 384:KXVNzUMf8BM31MVqaBhhCLp9OY/TWSfgtdV4xuOwP27Bx1xJxzRAT6tpgmWLVYq7:CXzWBMFC5kLp9ad7NWzdFLWX
MD5 SHA1 SHA512 SSDEEP

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\bn.pak
Size 253KB
SHA256 ceed32e429ed1018d4c49343cf52105cbfd1e877c531a5738fd6e6cd33d27da7
MD5 47c95e191e760dee3ef43345577e2379
SHA1 609634315270a91d4ec631642b18bd0036367aad
SHA512 46b5f8d58780d19e79136c31a67d075c57ddf7e6a1eb197dea4088cc414a0dc24a68fc8ebcaac03b3940af2461123b586706d5dbf8dbdf6fbea0f7bec466db21
SSDEEP 1536:xX/nV+Lr+p2KJJr98JMgNxpDwuDrXvuhKRcX:xX9++9Jr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\ca.pak
Size 122KB
SHA256 7a39af99d55a1ea838d8d78c5f0da3e1402f9404d32255e31b676ceed4f0e414
MD5 423651c45566cd90ea5edd8631e823b8
SHA1 13bed4173a08bcbfefba034aada3d838eece6d16
SHA512 e09085023beaa37e9d5f7fdf3c32d0c001672b85e2826f0aba9a662ce958ac93cac17bf63495a604e47cb407b1593049388a4bf1b22b2339ead84a206a10569f
SSDEEP 3072:HGOugDaRcg4H65rqx0hm/BL8lmoT69Q1HSNO5ufEfXiBCUpYEHPPXfI5DozRhqAF:mOdCcgwoFyO5vXiBCUpY+PXf8DyBnkAH
MD5 SHA1 SHA512 SSDEEP

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\cs.pak
Size 125KB
SHA256 8be34e4f8226c1dd4e725711ddd884ef4476560f7863edcf378573dde9db3cee
MD5 3cfd9dc564cfcc33cc5524711365c376
SHA1 2e5016d2643017f37658262122974429f18625a2
SHA512 6ee156d2fa3b6f601df28e38968d0eae2812d70b41333348dbecd833d5ee6ff944183f0eecde96be433cf1e98c8ec22d6a6d5af5153145842175ab43c73533ef
SSDEEP 1536:hsS2h3j45qcD4pP7zoDtJ+17V3JIAixmcRbCN2lDfng+5XS/iRys8QYSXw:ShTnjzoDtJ+17vbN2lDfg+5XS/s8QYSA
MD5 SHA1 SHA512 SSDEEP

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\da.pak
Size 114KB
SHA256 e190187adcbb5f829d162660968ba598ed17bd11339062ca4d807deec8a27fdb
MD5 55a8f5883805a65c854d25edb3959209
SHA1 d4b3b6bd2a26cbd021fa931d1f63c9ea64e2c268
SHA512 4e1f9e6da32f553cbc8cf162726d7aba9e23e2216d6d05b995cf19fff3aafa05ed08fce29b2f8538d46583366402b8630672e650dfbd46952a611e9db0d8016d
SSDEEP 1536:03mzdvvRTcwcSB3CxjDqg5vszO52G+5JGAD4g8pOmPEQG6RH:ocdvvRTHC9DZszO5L+5/dS7
MD5 SHA1 SHA512 SSDEEP

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\de.pak
Size 123KB
SHA256 6dda3fa65232ca0bff7314f916942a2aa5d9be73a0b0c7a6d016eb34ea6fff5b
MD5 b73344e5a72fca6f956dbab984c123ba
SHA1 0561073aa40a63a9ce9930dd18b18e12ff139b2b
SHA512 e8a12da397369f23c102244b3f18f533ec79afa6978785566056bbfe07b10a21ff4973bf17aa829fff65609363988c033b0e48d4a82c846863377c08d8df009d
SSDEEP 1536:uphAWy43SfCGQsqXghFrahUbnzKUG5Cf645LmQUve6S6vXQHHxQ1NlkGfA9ZcCAF:OhAT432vQstQhUzzKk0S8eH8NrsBgsFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\el.pak
Size 216KB
SHA256 b1f78df8a7edc914357a2e90bc8dc0ac46f4df642bb22894569fe4905fb8ea0f
MD5 38440b98bfdf5ed496da0f49d59534c0
SHA1 1498d9207ecaf4923a47271e24c68a817041c82e
SHA512 95ba788fc2e1f07d54e398f1ec4d32c664cfb13118d46cb7af7a993367e032b10de84f3e604ab6e659d6410e2d736097ec5e9b3b002040c54412358f0ea10229
SSDEEP 6144:86R2vCi+hFMkDuntVF5IcRrl3ppSP3/5zFMeF+fY2hlL6Xa9YlXSAzG:N8vCi+hFMkDuntVF5IcRrl3ppSP3/5zY
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\en-GB.pak
Size 99KB
SHA256 83ff81c73228c7cadba984d9b500e4fce01de583ecde8f132137650c8107c454
MD5 52e2826fb5814776d47a7fcaf55cb675
SHA1 51fbbc59dcd61116cbc0a24b0304d4c1c58e8d0b
SHA512 69257f976d01006c5f3d7e256738c97c59115471f8e7447cfa795f7fa4ff12d6fd19708e95ffb2aa494b50c1763fe35d5885b9414112d2934baf68fe668ed7cc
SSDEEP 1536:tmCSXTzmWQWGmjrD0KDK4Rr3ASr5iBqgqQSOiJedMJrV9ZvVfm3ggl+1hK:tQX/mpmjEKzkBqgAbu3ggl+1s
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\en-US.pak
Size 100KB
SHA256 5c56df9699fc7e8f09ec81421e50a6264cde055e822f5a8cd9bb1edb3066d816
MD5 0bb857860d8c9ab6d617cea5a5bd4d00
SHA1 351b744d95846bff2ce5f542fec2e87439aa0f8b
SHA512 33fb73cffbb6781488cedbca4c92a7e4f66923a799beeb7f5cba58dbc23ba8f5130f63a7dac7114e3c3ef6f1df87884fbeb8858bc7604aec9449fdfd16c25078
SSDEEP 1536:SQo63sGGuW5Rt0FDSED0FhiL2tr/OSa5dBqg7GSO0JedMVrBphVfD3ggl+S4jwh:vo6cJl8DSTh1QBqg5fb3ggl+Sgwh
MD5 SHA1 SHA512 SSDEEP

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\es-419.pak
Size 120KB
SHA256 1380b9edc9cee4b505f12e8eefa288d8c746ca995b52ceaba27c7741ae8a5cd4
MD5 b261b1efe945365588befdf68879040f
SHA1 616f44a5f73f0449b483f36ccf831db6474a10d2
SHA512 9ea14234b9d4d09364e5727b3886fc14544d52508b3e45fb9fd607ca88d2e432361a02b2f7ba34c3d6ecd94b91f9eccd4d54047a97a1ba4eea580ead00b91cff
SSDEEP 1536:q7CIgyEhjRb4Zr4h3mxaXGQ17L46ddPcHYKCRKfKW0JWFsMH5BnVZ9ove:Uxql8khYcM6ap
MD5 SHA1 SHA512 SSDEEP

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\es.pak
Size 122KB
SHA256 5b929216ac823dbe2b0bb98e64db76519900e09a86c8513019325271c66ade0d
MD5 f83d8f7f6108786c02c2edbf3d85f147
SHA1 57781d9d9eb7c90cdc71f78e25d0763045b6d29a
SHA512 12747a4a61cdd21cad6e3f768cb43b8bda5ec9de373337c191b6994b20acd676c9d0a6cde8410a1e18f35dd5d2d332ea1bb7e7f8f6fc4b73d8774559e33398f1
SSDEEP 1536:6f648LDdr+wZ72bev4dYNiE/XFjqh3viyTcHVgFW9XlhgoYKWlux6PZ3h2J:/48fN+wZ7jRNiEFd5Isx6PZ36
MD5 SHA1 SHA512 SSDEEP

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\et.pak
Size 110KB
SHA256 e8af084ef5e1062c5966dd7802074ac24f3672dc3c9b9c5453a397644727191f
MD5 c76db3385190c6840315c4497e40258a
SHA1 34f1aef2ba2925bebc5dcdb70e5b6c1a138a5c46
SHA512 90a870369d307758b33d74e6213676d65c2d332f42577c8aff23d96b512f3c2a2bdace8d6d9007f88b9175eadc6f2ae28b498b1265550849ff9317465a37ad29
SSDEEP 1536:fMeTTURxwKul73Dyf4xVyNlysg9jXeuLECstZFsPQWcu:EkURql7Gf4xVLjtLEtwPQWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\fa.pak
Size 173KB
SHA256 300fc1c735e92917a5ddf92feb812cbf3175d988ec7ad5955110248a1addbd34
MD5 6458a239e994d8d18315deccd35389ed
SHA1 75c985f43503a6c44645786d46639a6b555ae163
SHA512 3062075b6be0c25c957ac88e537880bc25ff86b8ef0703a05209e9676e943e89476b7997394aeb25064e03a93be614fef535676e9cdfaf44b46035225b1b2cf5
SSDEEP 3072:8OWfrcwA+7MCzXv94Rawpa8k+6NS9/W2ESEmSzR2XQmN4o6XsHdBfv7fDb8YIO/W:srcwAyXV4Rawpa8k+6NS9/W2ESEmSV2s
MD5 SHA1 SHA512 SSDEEP

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\fi.pak
Size 112KB
SHA256 b1cb0b32efa78fd8634652c74f298f1d5127f2363ef601cf000417e5c7fefd20
MD5 cc592d91ce8eabaa75249cb78b889376
SHA1 f2f0f7f105a17f3e4b1a97ed0e3c2e871c2c3eac
SHA512 58e2eaffe26d8fda8df43e7ebef449cfff1065e940c128efa0276511e34e96e52da9230f294b01d4ecd8ef606b792d372bff897d6d8bb67c31379418ce867d48
SSDEEP 3072:fYthQlWmiTUqWUEv4jZEEZ18JloRj/YmjwjNM17X4pf:Cg79EZ18Jq/mnf
MD5 SHA1 SHA512 SSDEEP

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\fil.pak
Size 126KB
SHA256 39a9d63736e7b4593fc6873ed3c19d45fbf9eb78a012bfdcee0fea5906ebc5b2
MD5 40bddaf97f64dfea9ebafc7f82166f80
SHA1 90d1fde3c0b27d2184f0353991259c2a92c7820c
SHA512 d1e61c53e09a0dc50edf5aba5cf286a251ee88421aa2cd49332b70a5859646605ecb7d0bb97ea7242d14a18742e23da0a14c04b0b99b57a466ec87f4f66b897e
SSDEEP 1536:z1q909ZywHYfcVrLehf3QzeNvuNpEWnG/gilPgTAM64CzPE2j6/a12uKlu9IdXpU:zh9ZywHE8IfKwPgTAaCz36/hpp25
MD5 SHA1 SHA512 SSDEEP

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\fr.pak
Size 131KB
SHA256 66488dc10517b6e3638686be95b430477a39304e92ac45dfe62b58cae3a77272
MD5 c3095ce1e88b0976ba7bef183d047347
SHA1 b14cfbf6e46ac1f189595fc09660178525301138
SHA512 29f47b1eff4681a9a17a50d6e82d63c22fe7bfe4ceb79862e81d8cd9f96fa38e225978b4c4b1f8e55b220235b91652c776fa8d2e559c68942c6ccf402812a421
SSDEEP 3072:C1EuvO5J3cQRLbJKSG9+l9Z85NtMsEMpSwYRHD+IzKByroFDuFcVRSfwgO35JNP:C1+5RcQRLdFG9+l9Z85NtXEMpWRHD+Is
MD5 SHA1 SHA512 SSDEEP

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\gu.pak
Size 245KB
SHA256 e549ff4e5a094d04c2ce7bc6fd68bea1f03e935437bf164bebb6191c133fa70c
MD5 63a7fdc4eadf8ef1c35c72468a0ce33f
SHA1 e8d064f0e9c8a6a8c6ccb036711e292d011d9466
SHA512 0a097ff875132a984545ec677b04f97785f14c38a1df487cfb4722cdea07d14e1e88fcff7d58b82fa53f05f4eba779a95ef320b5a91692097726d0385a26a456
SSDEEP 3072:EBv5Iqx39v+1A1A626irP8n3M8IrU35YdO3C36zoYimPVO4cGPX/grRHe5GmdRPM:EXIuVQf
MD5 SHA1 SHA512 SSDEEP

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\he.pak
Size 151KB
SHA256 f5cf34ce58b7f0d450936981aa7ffa060821403e6768eee3746ea4ffc9193986
MD5 6a02a37e1ca3215fa9ee0e1b0fbcf5e7
SHA1 89a8a126c0bbf536ac58e29fc50e045fb1b88220
SHA512 6607eb2329b81f1eaf0ed3a564eddcb30e6ab59229f2fbf6fd3d2140ffaa8853a330eda627a4458ef6bb06f32c5183edda869e34cd4ead1f87f88d5c622c1a16
SSDEEP 1536:/QTfl862UVk3NspwWHHe1AqEgS+0HgmGgnQ0MWWWmXWOnw157YGwq1pyP5m3XT9Z:U862up1z+WgLcMzXk5lVB3XTnw6jzOIt
MD5 SHA1 SHA512 SSDEEP

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\hi.pak
Size 253KB
SHA256 089b9dd31090a987515809a68d26f6eeb64cd9283934e3dcc48b151eec7d3ad9
MD5 590e9e73df9cbd83cd87b9c03848fec9
SHA1 da125e60a5a2c51a2d6219d3f81688bd22237b59
SHA512 fd0e5d0f2063e12b711275f390428b88f98ffaf6043cdb14b13674ac1e4aa9f70ae820ae960132d7155daf9b1308238775c4702694ab53068cdc709c50f9186a
SSDEEP 3072:lUGMNtwEnqz5cwfKSIv8Fj3cvEVhYDXoWkO/S/Ffm9NLMILORvTHIf+ovazBKfzd:lCD03g
MD5 SHA1 SHA512 SSDEEP

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\hr.pak
Size 119KB
SHA256 479dc4f75a889d45f62b4ddb6eb48f21c473e37875468c9c26d928a263e15840
MD5 6f92235e6ba003af925a2d6584afd27d
SHA1 3ceba61e9c2975466b6244188f5ea72aaf042fc7
SHA512 82f2642dff4400704c15c2fa02d0ec74ed3fe888dc835447c1afce7463dee8f480bb81be358c306e681625864a6d25e5cd6c96252b8a56e6fc62014b3aa4d26a
SSDEEP 3072:wExtK0dFKR0AGCMxleW+blEdp9lLnMU2EgI7MMoqa7DwOx9s:wstK0TV
MD5 SHA1 SHA512 SSDEEP

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\hu.pak
Size 43KB
SHA256 e3dde0d1cf9876b7fcb55d17e63ff8a39b01d579113a9912e8e18128a383482f
MD5 957dd43e7791634235d0a2532d6f05d8
SHA1 780634d7f0d15ecf057de025aaa5f5a36eda1d8b
SHA512 8444caa44cbca017ed88d42b94a1f3d139511e26f89bd692e1c0ff7418437ffcb65c06f7ad6d0af1158ce373d0aa22f3c14ba77b14f2051823011feea7495a6d
SSDEEP 768:dRKUd9fYQbfcN+iNN8nInnitt7lR5Pu9cEdeKKDiUANgmwoVsHBwDu1:biKfNw8IKxlR5s3kKgiH8oGwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\id.pak
Size 108KB
SHA256 3339ef011c9bb64868da94adb25f4490acbc7f893e4337dbfe2797754cd659f5
MD5 e40cb2f3b4db379e4d187aeef0dfd300
SHA1 537b1ebc615c980c89bbe2b9e91a11199fa7d6a6
SHA512 b87464460077aa55feb92eca8ed23d9a61829378bae7890c8a95dac5fcd735b145d65661f27facfe2586fcaa169692b00d8ee8dd505dc44bff7f7fd090f3e96c
SSDEEP 1536:IiC3VKMLZ/Qcr95/SWDEmIvUwRmNEBce0iBSX1CPWsAzb2ZVLRricCFVdy58:HC3VR9/QK95KWsce018WsAzaZV5icC7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\it.pak
Size 123KB
SHA256 96e02ab6937a1f1cb58762159761a737ce0e1dcd6a253554392baf4389326eab
MD5 5aa225aad4f9fe6d05ec24905a827d88
SHA1 f6d5ed337bd8e9cc3b962d3a498e3430fbf6de22
SHA512 3fa928f19bdf65b8fbb274b478a801821b15c01224c113a8d7f6121a077b432c0cc84eefd9028a76adea9fa4bb65dcb868edfbd4368b1e4d477c49e187e4288a
SSDEEP 3072:iUQ85TJe3cVvEyDhPIyN4tA7kxAjijNPtPhR40Ouq:iUQ85TJe3MzlQyN4tA7kxAjibZR4tuq
MD5 SHA1 SHA512 SSDEEP

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\ja.pak
Size 92KB
SHA256 5aa36ea185423726b993eaf56e2cc73494bb2c825eb8748eeb0447612d912818
MD5 dc0a079ac7bf3893ba37607ede2cce0b
SHA1 9f08c6a265bcbfc2c268b6e816bc654024a56aa6
SHA512 7efcd79f700c6dc27f9305f54d3f2dcc911696cc75d4a42ebe255e9165ea7764f168486972c1988125aa2cc44a150ac63d4a65b1c8d0b6abea7b2506ed8268c9
SSDEEP 768:6avmnpAKv2XktgKy+VWdSIfvUX4TgThBbFCp6EQxd2OS8I4hEU72ZvYINB46rUO8:Dmnjv2XktgKy+34AhBbFKEtINB46w5
MD5 SHA1 SHA512 SSDEEP

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\kn.pak
Size 118KB
SHA256 70ac86df206234e3a3ec90f4eb1395fda3c44e79b8dc922751e4267af3495ccf
MD5 7acb2a625b90098da3a785a342e156a0
SHA1 84b492321faf1a8877a385cbc4cdcd980922dbdf
SHA512 3c2e5a3f211dfc75c070d4ec759702ec7bb9592643713c65ad76360ab791c5f39c59f8d97ffb21d0fb2989060f22a848b1e8bee7f3027bfd1ad8cd82f83c84e1
SSDEEP 1536:dtfaNrb+1eRsIV8LhI+NHsvgt4E+EtLjDd9b7n+CUasJx7XOLKkLKuWzB7izd2DT:dtII+Ix4qhgrtZ+e4PzZELDCHEf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\ko.pak
Size 77KB
SHA256 0704bc7de628d959a5d4d0b0505da928813135af8195a18a1ed2d9ed29136261
MD5 4cb49509483d36eaf4fdd651e13af7ee
SHA1 d49f4b6658e2238aaf5e3caf27271cbc26321510
SHA512 df18da8750cb62251347dd8f2a8024bea1673621929c0c9a70595ca19d8ed811453d137d4863d196e1c612cd1d2cce47958bc38aa70966e4027c2f4cbf5dc59b
SSDEEP 1536:Vgo5H9nMLJyedPNRk7zoI9yLoIfQtTDdGYGMbEM51AgWCYeHw0pFSCukprT2ACNR:R56txdM7zbccIotd9AgWCYeHw0pFSCul
MD5 SHA1 SHA512 SSDEEP

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\lt.pak
Size 131KB
SHA256 776dba792df7b444e1b720326312d8b8312cade74a1372c49456d932b7c65769
MD5 2d4fca437a7548893dc4b51fa5b33c33
SHA1 c1493013d7d981ea9223716e415380992de65c2f
SHA512 b6a55ee1deff48d717a3e9399aef3c45eeec810cc5b5709fa3e9f56850115a5b02e02b7959ec77a6797e68516ee9372bacd260e62ac0d55a8e4c1c27af782b42
SSDEEP 1536:0YPKCj8j0t588FYhxBUMCUacC0YViX26sK5rmz3MWFmmVtM2ID6S2h5nYWSgAGiS:0YCo8emB1CUaW29bXJvM2ID6S2h5nJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\lv.pak
Size 130KB
SHA256 a676a781c1a587eadf23e5c69bc52f2d352346a70bc53ca908450362535eefda
MD5 264c6e20b3088ceb4dae5773cef0cb55
SHA1 fb6ff83ff14df008092bc3ee73bda7491e8e090e
SHA512 01e949f92e1e8599c581929a601d39640abaf1d907ce10102e591c3d490dd3874c679c75bb51308ead55a3bd0c6dcd1b8d4b2daf98ce1cf1c6bab42946e8b1e8
SSDEEP 1536:cHZ2smMA3hkixkDXARcDq2GBrM9AdfeYUdoIvlR8zOHP4/SuAhaI12mE42QtaDuC:cZ/U3e2kDXAoq2Gi9AdUdoI38fASfZ1d
MD5 SHA1 SHA512 SSDEEP

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\ml.pak
Size 100KB
SHA256 2d03c48601be042b68942d3aeea82f0ab56953a9be94ca5058ac8f0e3757db3d
MD5 88dac0aadaa41e92275e27089b7f2a10
SHA1 88cfdb2c89021651f13f96b6a97ecf0b0e36db3f
SHA512 677573157eda05d93e336a6221969ceb2551297c0c89a883a4b6a68c67c2343397b07e64164d487b75834473bbd83dfdde58de3b194995356b102a0698fc7e4a
SSDEEP 384:yLFgeLn13X12U9+SloWkpntmGrTpghY87DYXUzhj4BjvV1y0AhTgEMV4Ff45RtUJ:gKeL13FPMSlGptmGrTdeE+YBkbrQ4OUf
MD5 SHA1 SHA512 SSDEEP

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\mr.pak
Size 112KB
SHA256 34e4e98e0b426aa72dc19c0f597d690ad2d01bb124d349b77ee60717e8f9c39c
MD5 f418b90437091b238457f1167c6374a1
SHA1 efdd79ff2416c153e8df3f35f24daa2075595205
SHA512 760ab0e31c9a217d8db24b1492fb9c5b7d6622de8a3c97d7341881c5dbaa8aeddfe188db32b2a836a2d6177e0dc08936892acd17eff9197ad1a7988e267be626
SSDEEP 3072:6IS/vAuETAbbbMB6D/Wcq02HIUIuc7nCSZhq:QC5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\ms.pak
Size 108KB
SHA256 70e6e336d60b0e17ac76c627640f45b506f745acdbd10bd5cbfd95bb3d6ebede
MD5 2352b7058fc3f23d89191a65eacdb492
SHA1 7b84ad3e2d370449ce7c4c8d0cb4ca0de53966f6
SHA512 b0c44d4504304d9875b4418442a11c0f4210edefc2c3a38a7e2b3454d338a00d8aa2a1e3f845a94918d71f6c37af0f78fd1a0f68b8b008a093ba4b7f8c485b64
SSDEEP 1536:AQRHspdGCYixjxq+9cGnjBSaYOY9vSgAa6o+8uXw:y7GCYOjx8GnjBStx6B8uXw
MD5 SHA1 SHA512 SSDEEP

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\nb.pak
Size 99KB
SHA256 a88e84af31aa2deca20a06b93d3b48aacc3acd558389c5914e7a6cf4590a7226
MD5 2ed5a62d423b35932246409ed16d2ec2
SHA1 96d8081b8bb540072cc98bcaa754b4e6e6a1ee51
SHA512 60cc79f480787758cbbe5805a778896b86fae9a555c0c534f20779a4dc71cd8b513c4f76d6814596c867255ab594e734e09491f8c2c5e9eb6d2e31710f69adb0
SSDEEP 1536:gh98CDQUBlHnHde4O9iXwDXqFQIm8VUvCATpdJ:W+CDQWHn95WDXqFQIwCcpj
MD5 SHA1 SHA512 SSDEEP

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\nl.pak
Size 114KB
SHA256 9a83ad866ad7fd9d65ecbc1e95c276cfce27e8257c76a16950fd14971e66b864
MD5 cf6b1cbfd669e9461553974ba37a475e
SHA1 b33867e9bc7fd88ca98a76dc4bd756bcf18887aa
SHA512 e463029bb37f6bb3ff5cb6281f64291ada1b785fa33137e7aedfc7b5e409e99c75a91e7cf9b6c0933e970f70c14861190de66fc5d68925b687a6f5da02e21077
SSDEEP 3072:nq1YE5LjDjkJkS6/gHkIINe2AyTievOoWnV:nJ6/bY2KnV
MD5 SHA1 SHA512 SSDEEP

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\pl.pak
Size 74KB
SHA256 05c076bfcb8e2d2ee210b4072d4acd2911643549d6b8e43f0a6f674e8d362455
MD5 106785bc5035b70e956bf691c3aa6f45
SHA1 ecd30bfd88ad0704c5f42975041277d234a019b9
SHA512 4fee9aed2f58ef8c6fef590eca7a2fea45a9ab3ac69447510be4999696eefb8f7b204922ab24b37509cddc2e5fad3e14dfcfc0550d27515c7ec4154e01ed6025
SSDEEP 1536:EWf15TjBmqu4RMa8oc/1QCmCwAezXpSOL:LBK1QC0XpN
MD5 SHA1 SHA512 SSDEEP

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\pt-BR.pak
Size 119KB
SHA256 25f0bb0b0230d99a9064d52668636f3be85903bf27a68124d79a2fe93c30fe0e
MD5 88ad860c73676ffb4025b5c691f29942
SHA1 3c5e5b999ea7153ccdd1b4cc7b6162de3456b558
SHA512 41589bb9ab1b8307f62ceb4e6493d7903731a3e63807e0044379c4acdda881c21839234f5f1b8ad1af732bfee6231c0556ce92e582505379ed949980185bb750
SSDEEP 1536:eU4WKuobNr9WUVFDjy/4NvWIQFv0Y0q4qc6x0xGUCXg5KM0mR:ewKuobNIg5e/OuIQmi/M0w
MD5 SHA1 SHA512 SSDEEP

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\pt-PT.pak
Size 123KB
SHA256 fcfaa9c44c445876c286388b6a1abc1df949f3dda3d64fb57d6e0d54a05cdb94
MD5 ecd84b296d3bb312ee18e21017311986
SHA1 f5625523f85c10723750834a54ff59a2dd886fb3
SHA512 e95b74238220024cdd0bd1c0f18beadbbe427d76cd8d6b32d5700adcd34ffb068ad0bf75404921485c8077f395f5111cd40d5dfe2b5b8f34c62e6fc80b507456
SSDEEP 1536:kHf7ZrGN9DedEq311qsrX/AmrLVQ4dmxz2qKHftLmLaIDl1+U:k1+kusrXIOVQkLeaIDl1+U
MD5 SHA1 SHA512 SSDEEP

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\ro.pak
Size 122KB
SHA256 38290b1c9712296d82ea1681ef95544a1eef4872289134b11e50af735e6deaca
MD5 24b01a438a3ab9699d4ca97c081b5e82
SHA1 0d0b082544d23425a74199fb0a6c11192f0bdf7d
SHA512 43199772312156f4633c4202499cde8f808e5e632c2013ec1129acee01a3f184e86df2616626173178efe04b6f0773ad9a0e8b8cc6a735d23d68dcfe9dfd945b
SSDEEP 1536:V3wMhjK82Ipb6k3qvImoMyVwd0pDv2Q2CpsPlJtWCXh68umVhwMs:RpGyqKpr2lPnXh68umLw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\ru.pak
Size 172KB
SHA256 af5cf10ee91fbc3307c1fa91b64bfa6d9834eaf41ca8f212769c3d0fac37322e
MD5 890645d561f89fcf1f61e2a94bfa54db
SHA1 d3bee92dddd5fdb40be2166887c8e16ca4e345ff
SHA512 076835b56a3368a03a4508b1333c42aae2dcea7482a22e5c75c04b1c31d7ca32f261df5a470f0506471f0e5858abf549d814c7355e1d55d1d5eaab8071df43ae
SSDEEP 3072:jSwEaX+/sLgHnp0oFV+TQy3EtkdOTOFQsL48dQgIvujRnKa93P3Maqb/BLu1hLzt:hEaX+/KgHnOorP+SkdOrsL48dQgIvGRx
MD5 SHA1 SHA512 SSDEEP

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\sk.pak
Size 127KB
SHA256 f47bc1f7f5ab64681d0b152e1a019da60f0ef057ee8bf2ccede019dc4030c177
MD5 b35daa0bd9627ca88b413a5af7c6b4a4
SHA1 d5efdcbc7ca17de29f3075f6434f31ab2e895826
SHA512 48abb6ca2290820db2898b05820bb25e70fb1292c816eb0c8f17b3c5452de9fff7027d216d2bf413900f408f44ed4ac99151b28142a212c5cff8dfe229e87b9b
SSDEEP 1536:1kwlkWgaGF52MJ55Fvxr8YaQdOQb7SexkM+zBHCYpGd80G1gQPa:jlq1MKVxNaQotckM+zBHCYpj0G15Pa
MD5 SHA1 SHA512 SSDEEP

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\sl.pak
Size 87KB
SHA256 7a6bb3a028836d4e250db651ce37866bac38bfb3093a0a37770a90a77477be04
MD5 a6c1373f718e48a6c7095e69709ae2a1
SHA1 3ea1d31ca57b26094ad6d34f043a7d30a2f192dc
SHA512 35a4ca9c1ab163dec6ca76e86aa2ac49790ac98f0ed0c662db0801c26f2e57775d1fac96f7ca8b1144694129fa56c43b5c8a4cf2db3a5ba1966c580f340f62a9
SSDEEP 1536:8gm/5D4zKn4qce+66W4xVsDn4Kph9VnJx:AWKn4qnRwxuU0Vb
MD5 SHA1 SHA512 SSDEEP

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\sr.pak
Size 133KB
SHA256 01eaa1a3df6c46ce9f705cdae06444ff5b390fc833707398cfc7cb8df3217c2e
MD5 56f425306782e2b51ac18725772ec230
SHA1 f18dd5f4b3cebbf815f62602b9824a7c06d15186
SHA512 ced6ef29812485b0cd00d7f0b33b871b03cefe4cba8f3c0d5b61f4cd2935fa8dabf730fc8de9509eac4f6bb1eb0be0d0d1470662f7cc9cc1cbbbc80242664676
SSDEEP 3072:1aL+prvr04qjOFDq9iHG3LFYJQaklw+f1AXFgDf37SjBn0I:1aL+pLo+DlaazXGL37Sdnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\sv.pak
Size 111KB
SHA256 2533676479e9469ffcdaabcb47d3e39bebfe7ae2b80f70784e918a8827439e13
MD5 41e76f7775fc9a2d6e3c02c46e9b32f6
SHA1 088c15c74a68bee69682bf89c31055332b68c84a
SHA512 6cde752d748c4772b533c8894f18134e5842113f8c7590b44a7dfa088aed65b232361fd16170df3b0d738066dbc3a769847adf4dd8ba42de63c9c2b33f9beb6b
SSDEEP 3072:3ax4Vh/89KU6VWZtgKqrAuxHcShUpDm2jb1+r+z:3ax4Vm97b1
MD5 SHA1 SHA512 SSDEEP

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\sw.pak
Size 98KB
SHA256 a09048abe6ab3f6844fc79fa94c6702c5ba655e83e7b25cbfa6fa3afc70e659e
MD5 8ccd227895cdb17db80f4a0482cfe85c
SHA1 f5ac9025c9e9c072fce2b697ddcd772030644aff
SHA512 a3278c69912743ef1266bed1d8f379cd1d014dcf9dce8b38b05a6c8676aa5392d5b280850a768d92b5509dca81c2af419e24c5c0de29ffd8a002d83b84b234a8
SSDEEP 3072:IkZ8kRBeYLIdC9gDifpvjoXiPXptVPGuLeB:LWkr9gDiiX0wB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\ta.pak
Size 57KB
SHA256 57228cacb8795c1ccde2cb2d44de810138dbb4d24bd9254aba9d40cbde45df09
MD5 1e8419e3f27a95f94e82723e05b22116
SHA1 fd3fc8d636a32cf6265d2947edd21bcc841e6168
SHA512 a029257ef049369013d2d1e7ab3aba93f080b743ffd595d15314fd1a0bbb64869b165363d97e3c6ff0d789aa2660bc0335163115e05ce710727d92fa7544cbcc
SSDEEP 384:y8TtTNZ/oIi+NcWeRnQOkIzohXAAxhgToiOLdN9l1XMqD+DewmPez:y8R/oGN1rLRxqToiKtMm+DewmPez
MD5 SHA1 SHA512 SSDEEP

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\te.pak
Size 48KB
SHA256 3f6f5213c3ec610a4adfb658fcfb3b06d44df6147fe471fa0824c9ecfcf1591e
MD5 511b39aab1f904c413d2e24e4ebfb5ae
SHA1 890ce184a9a3268288806e5e4b6722b4b04844ab
SHA512 e47307e32770b1a13699b46b0a4d335bef7b390888b7bb44a0b74d2a580e7a9f902a80ced0c380bc2b985b444b24f5f24a005c379d0f6805a7d898450233afef
SSDEEP 768:qaxg+1MHhv10uDlo7gQIzgCK6iPHKCtCSZFrKe/7cGW3I3pC0d6eeMd/56YGr5Pp:hxB2IsWkFECKHhAR/TaJAg9I
MD5 SHA1 SHA512 SSDEEP

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\th.pak
Size 68KB
SHA256 c5938b847161f0beaf278d54ef8b037491b5e5ccb7183b8090f06e8cdafae141
MD5 9805cd47245c44e214cf063b2bcc695b
SHA1 8b399697057578ed7f39016105f3d196f1b367ad
SHA512 50feacff6a47b52a331aeb0349c510965f21d2efe9594ae8ac30454443e4ff1dfdd4b0033285525ca6bd8108fd0e116128be0a41e09900bc31deb76ed0fa9fa4
SSDEEP 1536:J6aU61Qe/LSCDnCJFkcSCkIO+CSrjDzIqXCh+m1rXIlzZK8Qh:kaU6aeDnCJFkcSCkIO+CSrjDzIqXCh+6
MD5 SHA1 SHA512 SSDEEP

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\tr.pak
Size 117KB
SHA256 43e99e132acaba88971b81a43531845dc7fc3a1e0794c3373de7d9a50a5655aa
MD5 40491896ad21543f339467186c5efb40
SHA1 695dde7cc35056dcbf0a533aff8299d4c6b61bd8
SHA512 18d5ee9914849462e0b1bafd1ca216b29d0795e282ae0bdb354b15caf5c18f37f44fbd6f626b2cbb095e3398a6496de72e5b0d15621433979b5a589e34fac818
SSDEEP 3072:B+bwkMiMrAyvDsPnnNtOLlh74OfkiO8ru0j1914j4UDhJaaEiWwi1PLC2Ba5Y8GO:B+s5AVOUGaEvwiBFCH
MD5 SHA1 SHA512 SSDEEP

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\uk.pak
Size 21KB
SHA256 8748c2d21e667192608afae6844850ecfe8cab154f699cc40ecc1b8d18e65a2d
MD5 7479fe8ff564d9f56192fca9059bb4b7
SHA1 8202c4102aff1436d996f9e5c7d73dc4f9a73633
SHA512 a99cc9ab5c704a47050bd05f554c83dc74a4d0c4d4022ffe6b6e74153155f40b680aa9b115596fa18d8e1b8b94682836604a524acbfdab3792fcd02d63affcaa
SSDEEP 384:e8I0Q/JuQmrcTWiN5kqYmnBO9HhSCT7VZ/a3JEStP:C0QsBBqfnBCBZeiSt
MD5 SHA1 SHA512 SSDEEP

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\vi.pak
Size 140KB
SHA256 d7fdb53592de803a5fbcd8561c4918f1562f92fc8a3fd0039a2a1a7b76a8ecc2
MD5 69c8796439192577f48bd249175aaf37
SHA1 97c52088ca69dada593db0e42b2135d264646454
SHA512 65eb7cb15291474ec7f9354775e59bcf334c90ddf3498ebd184e4c47118308421b2405bfa679e4b3a70ed1790e167c109fc2c72e89c3e31b5378cae975424144
SSDEEP 3072:xcMRcddKMPni2Piz+sjoOa29C+UVUcEtya1bHNgqoziL8KqW8LTtdLpFeSBhvOg:xcsyr8Fs+UWPbtYzigK8T
MD5 SHA1 SHA512 SSDEEP

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\zh-CN.pak
Size 101KB
SHA256 a55f568ad3a8854cec25699484f55024501c8a0967738ba694e073151e5981c7
MD5 098d656a4f4bd8240bed10e7678186c7
SHA1 0c19ab62b4262f1b51558e8aaa79e7741f73393a
SHA512 084538ce774233ca6d4393bb42239b0b85e11bd73dd19ba47e55796ca19848941b037510c0fca4ac08b4b2e0ccbc9b4ae72ef88a3e841738dd211961dc53c1e2
SSDEEP 1536:CA2TixLkUB92k1VjicViixWnUnkg9QoxllnS:32tU/2k1Vji2iiAxID3lnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\locales\zh-TW.pak
Size 47KB
SHA256 2e0f7be1c1143f750347671ef6c4f849abcab3f837e0264e1177d3dbdea7a9ea
MD5 45a75efc8f936b1fb031545c41abb5ea
SHA1 15e167ec6ed51ff182342b178132ce991d2f4ce0
SHA512 018131978687346c72a49845e1599a7e9670134a3ddefde7f08d10b58b0f836320474dff78100b3a1f25ddb64e9f60eaf439d911c2cc8009aed05b06529ddf68
SSDEEP 768:ExFlB3il/hveqMqqQHHdBjLJz2r7a7CMMNzRv9hdmW0dRMsJou3mxcbrsi5kkYII:EflslFaqxHdBjLoRv9hdmDMOou3mxc3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\resources.pak
Size 2.4MB
SHA256 dc92c8abf2b3e46463e1e9500c902a26200d6b113bdc24df4d2b85e8aeaa35f2
MD5 7c8f23219f10d1dfcedc4e03ec5457e9
SHA1 11e78a0ca9a3c78b45b34fde8201ad3cf7d85957
SHA512 21413a68a16fc2142af2fa681a593c2f585f1c343cd18ad1b0fb78c2867ddc4ae81746236ee069460c00e5bdc92000b9d3e3a7fe3497f4e77edbe13041ff7b71
SSDEEP 49152:+X/WVnQIHnel8Hhe6HUKtudmFDrE69mIp/01uv9M7pRJoaIGG8H1903pPxtJVUr/:HjeQhQKtSikwpoyS141F8r03pPX+
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\resources\app.asar
Size 73KB
SHA256 dca9794b54aaf69c29378d7895319d179ec2ae085c429f2aea829fee5b984911
MD5 336f696c62fef333a1dbccf77f69ea2a
SHA1 bb20ef67e05316c1495a8dddfb9b40ef0c266f4f
SHA512 5ab498033983315b2f69f58e33ab8f6af5624cb673ca269ed145061c2a63a004ba9fc788e40d64cb9d542700adf02e6bbd3708892e48d9cd8a871810ae85c0b1
SSDEEP 1536:97UzTskzCG7q3qfgCklcUo+9m3p+VMnGtuUalCjNLR+Nstg+v2Y39:97UzVKmDsr2A9
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\resources\elevate.exe
Size 20KB
SHA256 9a4e619063ac01fb4ff38b632f197cd706d24ebe9fec4d738e98c2b3bac85e7e
MD5 8c99ca0c449aa01f7288c747e1de0f50
SHA1 11b04ff16dd992fac2a2fdc2f58dbff771a0708f
SHA512 4abc3a03aff1fe812ff768da3a91bce3bf3294ca29d28a871252c40c8228d5abeb300c93f4e7230c8735c138c93fbe4703fecec8fd2b63f6880f875764692b30
SSDEEP 384:QHzkD1wgQIuV/SsxsP1epU84Bn6clMV2Z2h0euwQA4Edy/4GD8z93xbxk2+Tkd:QkagQ7VaGsP1b86LlMVk2hFuwQnotxFV
MD5 SHA1 SHA512 SSDEEP

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\snapshot_blob.bin
Size 342KB
SHA256 4d82fe1e642fe3ca7ad1a173f806088c0652ecfe9f0f6f6e246066e15a3431d4
MD5 c9ab741bbef53fa0e84952b8891a5f5a
SHA1 e2dcb8d034e07243537c86371de0c52bce62cee1
SHA512 177b98a3090ecfe4b4598dfcd7e8b3ca49efafba4dbd8d6c6d0def462de47c3fabfde831725622783ddc177de982de6115178d9bd9830d918bb544a5a4c27fc9
SSDEEP 3072:p3JCPnnniIvFnfj2YPvS1Ox66vjitjLxyH/QIPc:hJCPniIvFQ1OutXo4Ic
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\swiftshader\libEGL.dll
Size 128KB
SHA256 761e7bb32a6dbfe3e50e0c01eabcd45d7bbd62d6fb634a6b3cb32a682f3553ec
MD5 cca93582594f9ad8ba9a36a51e43ee63
SHA1 54a9fd8e52e39dccc1caec5609154ff6a6814ec4
SHA512 b1555445b85748e67db0399f45de9322aa37469ce9a9c4313056ae55aa90c7dbfb143d8c655cb0f7d9c8aad3563d814ad6e18243f732e9d648123b46f4dadd04
SSDEEP 1536:QoqgrYpVDcI1eq/X/MRWJIOUwQ6e1jq4rWyzetIMsPBzd/aENWjocE2NIhguZY:gFplcUeQPGO83rWwet0hd/9uq2NIhgu2
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\swiftshader\libGLESv2.dll
Size 198KB
SHA256 3c4cdf92479b7c30dcbbf23c6384970173ba2c86c0c04aa572f376a01ee9cf2e
MD5 18d91dbd78bd3f597aa241d0207b7a1f
SHA1 b29e9fc1a9da803d6ec4c31153b6ecf6e0d877b3
SHA512 b88bbc5be6b1ae2f7234dcccc817e64dfceaf31dbebf4389e5543b9a6b38a554eeae329ad6972dbc886ca13599022815e2430a51b16edbd8b9abe9606a7e7340
SSDEEP 1536:UJOZ48qHu0m65VB9IzfKDdGzDjGPXvU2a2JGnMlyBc7CKK39a7tyfhXHL3tynf4x:nZ49Hu0m+XhD6GnJarjBG/Zy9de47Q52
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\v8_context_snapshot.bin
Size 656KB
SHA256 e1249d05bfc73c645b27d269f47b6923b33a3cf8088a8ca78b3b637c90f58178
MD5 47014c0f81bad6d216c617c9c63bf040
SHA1 7bb483fdc5fed3c6ed437d9fe6e5023bc38201bf
SHA512 052d86cf3305a9e493bd2472e6b7ddab5e0291efd6d899984a79bae46e5fa4bd21157e19ab4a2591c9cff9069de568bad18c7baf4f35d117c77134e635466f87
SSDEEP 6144:x7EIYb04YEZ+KnirIhjTR2BrLcR0TQhp0M+qPK0Nq8d2CKySv4x7C/PbFcz:ix0KcStL+MnPpqcHSv4+PbGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\vk_swiftshader.dll
Size 2.4MB
SHA256 6b1b5acbc4f2f1a4b68d536969a02480707f9b776be53ce18956ce695de0ff1e
MD5 3e2c566760ff885e630742743c68e885
SHA1 b10e277ff7b69f78d82f5de05f3aec26862a34ec
SHA512 7dd4613091eebac0778e60a555f6a9f6da4ddaffec22f6dd4cee3718fda12a4f46d636c1563799b7619445adb239002c629fa095bfb6bf2623f8009e42e3c810
SSDEEP 49152:px2VjoakX4pb7QH1fUlTB7zmNmdpTE5NSomaZXYjLlHks2RPF/lOzl+LZ/n6du76:K2DtJ+wm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
MD5 SHA1 SHA512

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\7z-out\vulkan-1.dll
Size 92KB
SHA256 d98c283c0f3180b91c8495e315679621f82f5f1f1d952a9816f1838562f5c67a
MD5 2070d7c4324d9e74027ab3b52cc693d8
SHA1 25a8ba03b34bb64c594c7cced8d390760b535dd9
SHA512 089dc96857010967d0c147f569bf979cb07153291f2d54177ef98999ff4b341ac8364ca933456c1a7e986d0e7686d075841e47561daeabcd302f6107c39fd919
SSDEEP 1536:K01cFl+qIcVkQJ2tY2NWcBmtBqGdasD2ceezhZULwHr4RMJFtxcHLk/:TcaqIWkQJRhBqGdaU3/lZUL+xMY
MD5 SHA1 SHA512 SSDEEP

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\StdUtils.dll
Size 6KB
SHA256 d9bb1a48acc4290547ddfec5e9b52c84dac9c78e6310864851a529b7bc43b0f5
MD5 b6e2b442905f4410ac6e178c8cbe0d8c
SHA1 14efceef5aebfe09aa29a6d3d75293977f9524f0
SHA512 80aa7135ef5db2f99b889bee54d4f06a3a289ef11fc8a7c6ed8326d11c55e3d3a730bba64c5830cf02acc71d789b4c876af775b2d6f5e8ea12ea2f52311c0f6d
SSDEEP 96:n7D1NRQ2ECXRreoD5/EKkDW0NjUCqVP199y2rcl4l8VGGz4UCJTCYPV0lAOVQpRt:FNRQuXVT5sxXoCqVHl8plrDmd
MD5 SHA1 SHA512 SSDEEP

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp6C86.tmp\nsis7z.dll
Size 57KB
SHA256 2116be51875623e2bf92993c80e85b53549af505d9cfc71366da6f7e54c8366c
MD5 6bc9f62c445bf1dcc565b490af1927ae
SHA1 ccaf99b697d41ea2145f2112ae87124544b10bc6
SHA512 26d443e87bef1ab634cbbad8c096181355ddf62ea2fb26c02c7d0a122f42d54811242cf5f2db5bdc810f84ebfa8c559df9514e62bd881a0d5fa84727dbfa0e6f
SSDEEP 1536:gWMaAqgVnUWxzLgyxFmHV7lKDRq8XguQHWCU0S+c0l:xMaqUWxY9Qj7QHWCU0S+R
MD5 SHA1 SHA512 SSDEEP

Submit Download

DarkAdventures.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe
Size 582KB
SHA256 7934c043aaf9cb3039dc6f5cfa8545b53d0272a9fcb7162d43eddd50bdeee928
MD5 b5313a3a569fb1c668d0ec2f16a6e16c
SHA1 20da29a1bedbee48e0c00e1b5e60f417335d5752
SHA512 cccaa859bf6bc9aa08193909fb70e3d244337780221df6276e9d73ceb48437970f93da7e84008b1a0457a4573c8b47f21788d6fa4f2a889e26eb10b461fac464
SSDEEP 3072:K5aXyidsSApppPpv5y7VHRL1yPH4xtgVP0weL/xIc6nAUKPXhesEtRpMnbk8kukN:KvJSAK11yPH4xtMVmehR+b7/78w0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1928-611-0x0000025144DA0000-0x0000025144E4E000-memory.dmp

Download

memory/1928-554-0x00007FFA02AD0000-0x00007FFA02AD1000-memory.dmp

Download

memory/7740-599-0x0000025202BB0000-0x0000025202BC0000-memory.dmp

Download

memory/7740-592-0x00007FF9E0A80000-0x00007FF9E1542000-memory.dmp

Download

memory/7740-604-0x0000025202BB0000-0x0000025202BC0000-memory.dmp

Download

memory/7740-593-0x0000025202BB0000-0x0000025202BC0000-memory.dmp

Download

memory/7740-607-0x00007FF9E0A80000-0x00007FF9E1542000-memory.dmp

Download

memory/9208-738-0x00007FF9E0A80000-0x00007FF9E1542000-memory.dmp

Download

memory/9208-719-0x0000023165E50000-0x0000023165E60000-memory.dmp

Download

memory/9208-720-0x0000023165E50000-0x0000023165E60000-memory.dmp

Download

memory/9208-718-0x0000023165E50000-0x0000023165E60000-memory.dmp

Download

memory/9208-717-0x00007FF9E0A80000-0x00007FF9E1542000-memory.dmp

Download

memory/10980-666-0x00000211775A0000-0x00000211775B0000-memory.dmp

Download

memory/10980-657-0x00000211775A0000-0x00000211775B0000-memory.dmp

Download

memory/10980-668-0x00000211775A0000-0x00000211775B0000-memory.dmp

Download

memory/10980-671-0x00007FF9E0A80000-0x00007FF9E1542000-memory.dmp

Download

memory/10980-656-0x00007FF9E0A80000-0x00007FF9E1542000-memory.dmp

Download

memory/11192-589-0x00007FF9E0A80000-0x00007FF9E1542000-memory.dmp

Download

memory/11192-585-0x00000232BE3A0000-0x00000232BE3B0000-memory.dmp

Download

memory/11192-574-0x00000232BE3A0000-0x00000232BE3B0000-memory.dmp

Download

memory/11192-584-0x00000232BE3E0000-0x00000232BE402000-memory.dmp

Download

memory/11192-575-0x00000232BE3A0000-0x00000232BE3B0000-memory.dmp

Download

memory/11192-573-0x00007FF9E0A80000-0x00007FF9E1542000-memory.dmp

Download