Malware Analysis Report

2025-08-10 12:05

Sample ID 240222-zxekysfb5y
Target Lunar Client v3.2.3.exe
SHA256 560b03c4ba18e5a443f74a69727db0eabac6f455bb836757d620cc51615a92ea
Tags
discovery
score
5/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
5/10

SHA256

560b03c4ba18e5a443f74a69727db0eabac6f455bb836757d620cc51615a92ea

Threat Level: Likely benign

The file Lunar Client v3.2.3.exe was found to be: Likely benign.

Malicious Activity Summary

discovery

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates physical storage devices

Unsigned PE

Enumerates processes with tasklist

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-22 21:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-22 21:05

Reported

2024-02-22 21:08

Platform

win7-20240221-en

Max time kernel

86s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe"

Signatures

Checks installed software on the system

discovery

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe

"C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Lunar Client.exe" | %SYSTEMROOT%\System32\find.exe "Lunar Client.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Lunar Client.exe"

C:\Windows\SysWOW64\find.exe

C:\Windows\System32\find.exe "Lunar Client.exe"

C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

"C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 launcherupdates.lunarclientcdn.com udp
US 104.18.28.96:443 launcherupdates.lunarclientcdn.com tcp

Files

\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\INetC.dll

MD5 38caa11a462b16538e0a3daeb2fc0eaf
SHA1 c22a190b83f4b6dc0d6a44b98eac1a89a78de55c
SHA256 ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a
SHA512 777135e05e908ac26bfce0a9c425b57f7132c1cdb0969bbb6ef625748c868860602bacc633c61cab36d0375b94b6bcfbd8bd8c7fa781495ef7332e362f8d44d1

C:\Users\Admin\AppData\Local\Temp\CabCB4F.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\TarCBAF.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\chrome_100_percent.pak

MD5 443c58245eeb233d319abf7150b99c31
SHA1 f889ce6302bd8cfbb68ee9a6d8252e58b63e492d
SHA256 99ca6947d97df212e45782bbd5d97bfb42112872e1c42bab4209ceedf66dc760
SHA512 081f3ee4a5e40fdc8bb6f16f2cfd47edde2bd8f3b5349775526092a770b090c05308d4289ecdda3d541cf7f0579ac64b529930fd128edad9b0991dfa00b0e9bc

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\chrome_200_percent.pak

MD5 81b5b74fe16c7c81870f539d5c263397
SHA1 27526cc2b68a6d2b539bd75317a20c9c5e43c889
SHA256 cb4fd141a5c4d188a3ecb203e9d41a3afca648724160e212289adcac666fbff4
SHA512 b2670e2dfa495ccc7874c21d0413cfbebfd4a2f14fc0217e823ec6a16ac1181f8e06bfe7c2d32543167bc3a2e929c7f0af1a5f90182e95913ba2292fa7cadb80

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\d3dcompiler_47.dll

MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\ffmpeg.dll

MD5 d5e1f1e9d0ccfe7f21b5c3750b202b4d
SHA1 74144ac93c0c58a9b9288bce5d06814c9a1b1dc2
SHA256 e1ab367644f72ebcdc8eb3fcfe829ff51719559ac2a43a1600e712b16871ad65
SHA512 dcf70d43f1a83c424be99c38e33e520c72115c3d30945980e5e394d460462251bde309e543213b2b08dcbe9769d11d46792e1cc99aa42777fcc34d6f3361a3d2

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\icudtl.dat

MD5 2134e5dbc46fb1c46eac0fe1af710ec3
SHA1 dbecf2d193ae575aba4217194d4136bd9291d4db
SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
SHA512 b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\libEGL.dll

MD5 dd78b86b3c92d61c37b44ef5b157cfe0
SHA1 4dcf9ebc3ff5ca552c0e83469b921153b29aea1f
SHA256 e142752e073c0051a0beb963981af70263ed673959515545521a7941d3230838
SHA512 9d071568dc56db2ab93d034d07a11a477aab8ac50d9ea3c4db3ac4866fcd3c2f3002ba7a3f2c55589a9d68463181fc7a03327dc164310d7e80e30cc6f6bf2423

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\libGLESv2.dll

MD5 af3792b63af63408a40604184ea6ef7f
SHA1 b4d577e1c7ca0d4d3a34e2edb919cf58e6b62952
SHA256 b0ff1bad8e2f34b12dfcc4b5387bdc042f9bc2f963e11dea1758397ca0e907ea
SHA512 d413c52f7c82dd17f06002f3ca6bc3efcf4e11e88379d989d982b2f9f47b71643971c4988abee2dc1212027b2cea148a8849bcb442dd4dbcd8e26ea892dd7a58

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\LICENSES.chromium.html

MD5 af93dab67ac52a6d93a7b5cb2577c24d
SHA1 6554810efa6d8ebb77c82e8c2ee825e7efc8c5d3
SHA256 f1e07b303606c61606f59d7dfdee05dec47b90c2d55bbf64cd4dd8169420fbb8
SHA512 07cad70067e0640655f1e0934479bf7ef94b7f5706f6523b2bf40f442c2f052b6e7fb427b72e63221935ce07465350bac77c60d9bc4db7aeeb19b2991b05b2ba

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\Lunar Client.exe

MD5 8486882612f6e4d69b086bb9f38a01c0
SHA1 565a89df4e2908221b02b92366b34d0ea531cff0
SHA256 da3285cbc8d13b55641006583e2b6bb840dca99d47b8412eb6063ed5890fb6bf
SHA512 bf668e501d380ae0a662eaa5200fbe7e0042134295553dc0b03696ea9e60bebf1970ac263dca086bf7cf3d5b4777789f1b9f3f0c9f5bf9eef76196d4da398d5c

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\snapshot_blob.bin

MD5 3a4095538e021b84396b3ce25affafc3
SHA1 cfc20771227b3c1f3197ff6a91cee68555afb247
SHA256 c1c9145735032bff20b2fff50a4b92ae9cf47290f433e3f3b32e3b232d610c59
SHA512 7b71083180f237f5f37cbe7a9755f6606708b959986562f9c5880cccea17b80a5187649fc0cb6965a8b40526bcb2cb6d980d364be528465290658b4d9084348e

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\resources.pak

MD5 1c22e8f1c6e183aa68fe7a4e84c58fc1
SHA1 e7927e5b91a38b2fbd0fcf07c06b59652df72041
SHA256 282175fe3b2c4498532a9c1a855fd411dd98a14a4ab8885aab91523f1e4c987d
SHA512 1c623bf8a1b1aeeee8bd7386fd23bc2ff52e3a9dccc01ccfe30417d7f8b42595c7388496dc07d1ab3f2583bc9403525cf9c0c875e6f3c65e1a805035b4479b74

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\vk_swiftshader.dll

MD5 fdc0ef21eacf883f5fdd4ab8166ead30
SHA1 849adc196a5e2b2959000fe1705fd5069d516be7
SHA256 71eab8bf4955fc9641ef1c7f4db91ff8da94a26a3a46e187f527349fac0cad48
SHA512 2e2bda9fef7812dd07a07545fd376d76b3652945ef80f274aa8ea7e6e89574753af92880deb4e0cd82e20125cb0d1032b431ee6f9f38a33bf48d35d6548f946c

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\vulkan-1.dll

MD5 d562628f9df56ae61770ffdef79c8d05
SHA1 2423105a960fe0ceb038ca36d6a37638ebd32b6f
SHA256 5789ca1822f3a5a67cd2c24e6ff0307e688b76a2e99831050bdcf8b8d155956d
SHA512 739f9f41d8e3e48dbd20bfecfc5679f38e59b3fc8cb406a77c384fd5146f19efafa1e4f23f15071dbeaa1d0dc71e125966e19fb757fc39e6abe953159669c096

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\v8_context_snapshot.bin

MD5 5db8a5bb87c7999343f30128979057a1
SHA1 c4177c2fe973a495db59b6228ac26264eec46a4d
SHA256 5b1f69f39f3d5865dce13ee3bdbc1af2938f5cc4c056dc9f9e213e9af346ad4b
SHA512 da2d516251376952729a33de2cd23764290d400fafc49642f2ccd799e3f989cce4d5561a76d380a950b77b53b50148dec9089c30de6c3dc38666237e196e569b

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\af.pak

MD5 b293cc5ea7db02649bd7d386b8fa0624
SHA1 32169b9d009b7a0fb7ecdaf650c989e956291772
SHA256 7bb75adef02d28819f1bd3b42fa46ed56d6dfbeae072341997b09b8c1f52d8dc
SHA512 496bc72e7b798d02e453eb96d20566b91405bab774521527ef882c1fcb58f25e2d0718013ddc0d23f7fad883f4cde93b57c6caaeba8cd18a09665c9f6245f557

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\ar.pak

MD5 7214c162b1958279e956eb271ba7bef5
SHA1 48e612eea3fe4d9fee908d45f5734a8bfc874541
SHA256 d0c9bee109161f2e71e50f12780408244bf29b297b9c0234be82354afc09a3da
SHA512 9108a3ff3d2b397828adb3048cc4ccdd5071c5af44d19af0cef2d410f26bbe694b9eba25ab51621a7e0ee8cc8342ed98ad5f966de7276e99f47beb7411eade83

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\bg.pak

MD5 79ec6a5be5379d39bf8cc1589fefa8bf
SHA1 39965832b1bcd0cf4761980eca70f7043a3d8233
SHA256 f14bc5338ef1b9cea37dd3730664e06b980b86180f1d249c3699ee6b69340668
SHA512 cf974e9a4d8d9f50a235363528b5cfc3471fe168d1fe7be02f11eff3c03503339a102a2cdd1b167e64e82c4b73c13313a6b59c87c888e71aebdff55e6f737d3d

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\cs.pak

MD5 e40324f364edc0bcb8af7cdf1d379aef
SHA1 edc371a555c35beb255bb89bfe95dd17451f9312
SHA256 d8753a163821402873410f6f09a3929e2befb93689da408c5a3bd7ac97e103b4
SHA512 f6fad53667dbe8cf35c97403b8c16d48c3db10bd7e831590b28d5eeb9711588ac9ca3b52fa95008c8da5ece3ffe5650210d1c2ae883e3feed386f2e09544395f

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\ca.pak

MD5 32e93462fc5791536e3436e15fe40c5a
SHA1 f37e860704cde9e44fccb7c2ad599a20131c0ebc
SHA256 b2e65e19a89de64609dbbf4543d706c04a85a99ed6f3aaba1801281b8cc46bba
SHA512 3a0e0dd67176427da1a8a201e627e7a8cf77ff83ad6c800bcd8a1a6c30c41b94cbd5c81647075a2b5186e4d2dff5f8f14f78f14bdcf10c4e8a2d3fab03533d4d

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\bn.pak

MD5 0a1ce6d4b120e55fa2850f8a067cccd1
SHA1 6c2f66d503509b177149e724edd6a294c63a32e6
SHA256 935fa26b75a4ae9f47235a3706fd00e057aec5c32a23bb393adb2826de7d8fe0
SHA512 acf1e118f140d15cccc26600d4e0c7dc30ba26c92d9bb6dd2211946dea0b21abbb3b6296debeb75323f7e7a92208f05da01c97eefe5301491e922148f8ad200a

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\de.pak

MD5 ae3ba1359d5d63a02a33ec4505208bb6
SHA1 f6c2c4773ff3b15704871f26d319afbdd986da14
SHA256 2d677c039a6c43ddf5a4b5f97f0a3ba7323091a1f1be569698f08573672a9bcc
SHA512 cdd5a9f45a4f323e4c03b0b5f23acf9c0c80eafd6a0bc40c3adcc2f957304c9c0e035a6c745894d57e92719964d681a22aac1407bd2f6f2b1a5438b612ea92ed

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\en-US.pak

MD5 3ceb2aaa9108dda6e99a343658374014
SHA1 51aa68d02837620247ad5b7ed9c9b962f9bf3ad3
SHA256 4ea06154a2b928f63445d09e7875c44e5e40a380bf8bebba9e060eb00c8e1ddc
SHA512 a73689b9d1746fe8a522a5e7a5d74ffeb97e35809795252434b6cae79c16802db90187e2c04f196620d654c83b1f73e54af88684ed3f276d3f93be06aaf22ead

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\et.pak

MD5 a634b74b913a7d836cbf53671f79d635
SHA1 8fe3a7ad1ef4603e561944af5617c6e1bcd2bf35
SHA256 e387e4581e69b7f268075665b486602da537a669858739e6e473a736b0b6bc23
SHA512 a4933847104066f7eb2f0e47d9963185118ddac8964f84a209976df9df35567d92a19e63e6a5847d7e005cadfb4e35d44c7effaf23cae7bdad38a70863792a90

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\fr.pak

MD5 e8215f786db5ffd6e2d283079a36b9ce
SHA1 3a051378e2ab6eb8787853e45364838e31ee6534
SHA256 42647c18c1f40447e7a34142af0cd344821a0d437c35c38da8dd32173d925005
SHA512 13556d5d600006422a1ae8f3f71b2dba6b3cedd81633ccf5ca70ca504560f2e50aafc6a8188169dc5c6e773cf70a863264ec4eff8b934a0ae5a1a615f4df969c

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\lt.pak

MD5 2e7e7b6f942373e629bcfea0d529f413
SHA1 b90727c5b23b942f3c374bdab37665ec32b0f197
SHA256 4d118822cc130b526a477bfc40ec913d8d0b748b29471e9c7066c4c1e4743f06
SHA512 7ece2b701a1038a7f60748d8124548724d2f499d4f1bd3ffe619688fe4a03a97ac73dd75b0d56d5546b495df87cfe84193886658d4ad95a408d4edf3cd6a9ba3

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\sk.pak

MD5 adfc531d9d407c1bbb82a69e5df2f449
SHA1 072a807250675e27e3db7194d8baf157e1b323e1
SHA256 9fe82f86a3b07c47819548c905b60130566159d149c5317e4d6af28ac7367744
SHA512 f438adc15d25fa036766d920c81c8f1ba6c6292e0aa31391d3b0f00d831f2bb5e30fde666e1d0457d75457e7c1be7de535e122da0e07af15976056cc3eb94921

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\th.pak

MD5 44764d6f7b0704567d76cdb4a390a340
SHA1 5832f3e50e80822add2d84cf298e090705eba359
SHA256 53752e35d56125a28de904c93d7abc9b343aaa0873bb1e8d94e71b75ac3da6c3
SHA512 b7fab999ef4e64d28eed8045fb851f328629d2dd2f90e897d5aa3c6ffd1b66657848a680a7e4120383d728f9f9af3ff44adc58cdeaa479eb42e8494867652f7b

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\uk.pak

MD5 2b5db05d30efd91acf2b8c4c99f46867
SHA1 ccdccfe3ec6707e3b27285f8fb179479dce14dc7
SHA256 b9017347e5d07424b5a7cdd542151111693a0bd183860c2597bb48b454977831
SHA512 b870e428c487f25c5e35c8bf522c04c6bb0d47170698457d70744bc1dfa7ba7b03688b34a2a971286efa3a1e93856d3ca4604f612081de4176afbc51b82ca0b4

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\resources\app-update.yml

MD5 9fafe2931214f36d81e3632b0be80774
SHA1 cac08ef88b787dfea0acc0d18e559fd9180819ba
SHA256 9161bcc9763091ff3670ef98eff99d004c0f67f13b5dd94715c661fae274cf33
SHA512 a671cec02c8957864797cad7657b4d2165b40980410db0696cb6dbd05b9485f0491065f1249461fb7777d73cba601f8d1035c9c2718a52a56a217da859c03217

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\package.7z

MD5 30f1d77789396afc220d4bbcabe01e9f
SHA1 e9b690283089db5cbc157fcd413ee5ce6b48209b
SHA256 eed453f30147df94337d10ccb12906cd5d23880d3625de8bd426f0c5fba42a80
SHA512 a30f7176021655bd161874148b3a3cd72b4c2b33870f93598ebf8ef4794d7dcc4bb67b7ec27a0dc1a5c828415e64bb5c3cccf5498fae5b504bed519c3f6df39d

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\resources\elevate.exe

MD5 3a718e17dc5c9caeced8865ab3c09d3f
SHA1 048ba6fe5b5245e8b3d227bf391c4f31ac90af37
SHA256 16b6f167f09d2079a6be684045d1cee0227755a96469e52259ece28ba25c7f55
SHA512 6ec746b87438d17586a45ffbd73d667bf78b348fca6389976f7aa70533c42bad8bdec9376ea0911db376d277431912bd62c02d282cb45b7990cf71f9cc0aed96

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\resources\app.asar

MD5 297d691b305618b501d638dd2cd44826
SHA1 e0bf98eb57cbea49ed6a15ba5e4c42f7f3335327
SHA256 9a8ea85b8377c1152203e6939d33fab9c2e70b16e428592762e26cee21e6b031
SHA512 ddcd5ad792e3a455c50d7422ccd5a0dde27fdab8c43fceba115ae4727302f68d1ce0a0082c90cf2822f22a32f26d4f2fbaaa3e4da167d0aa2fd7f3f6602fab51

\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

MD5 7ee489aaf852faf9eb7c8926442e0a07
SHA1 b01062bca14791a9ee64924635dab6ac8b348f76
SHA256 b759819666045d62f89c7fdbac62cff32282c65468820418d3360048533b1e96
SHA512 d2ed2bbd73898d476c2f79f243b41bea79891e6a8f5310c8a2ca0e8d8c2f9088401f3bbd3b364805e873c5265e37f210e58b9d068dca4fec0e845d256639f833

\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

MD5 14a55c52e32ff085bd49242fcee54b85
SHA1 8aa74a3c1458ce59f949c60cac804a024203afdf
SHA256 16e3f213e6a7250ad3f070183ccc58a79b662022ff481226a9c912c2c52d4df1
SHA512 b29c0b854bee6270279dee83ce348b20ecc0d3adbe624e853223754b177d88bff5b3d91a5836db6da8ea9ec0c267b455bd7e2331cccccc082cb453dd21531463

\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

MD5 1931bff8d8bc403dafa4ca802438fec8
SHA1 61482ed20d58ec697e0a85cac6331018f2f7777b
SHA256 8ed2761c18fb6ce7a77f335521290dccfe6a7f7b691b748cad412b8fbbf91e8c
SHA512 19144356ec973371dfc4f7be0fe04f46c0ab041f562b001383d631740634673a30234cd9b2b3212bbbac2e39481b22222ff91ac747fcc711ed8ef68e70c83775

\Users\Admin\AppData\Local\Programs\launcher\ffmpeg.dll

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Programs\launcher\ffmpeg.dll

MD5 60bdc224a566a6723bcc061889f7c45c
SHA1 cb1a575ba0a6f9e34cab521caaf8dfa0c383dd71
SHA256 4c4ed0c6cc1a34a2b60b2b2c74d6e9a55cf8516a491cacc4a384e96c7eb277d4
SHA512 2e9fd90f0745192f97147daeb4b4ae5f14eb1633d20f1cec3f6fe2db8d953f987343edcbcd225c806f70262fa0ecb7840e837e3e1bafad9f40af8b47acba2316

C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

MD5 a6189aea9c8e877801a4a7ad98e1b1cb
SHA1 d4649162eec2c4a0fdf724e65be4cf9bccc461f2
SHA256 909178df3d272eff5a07d5acf379bea859531d883113f8101627d3b9239332d5
SHA512 2f7c069123aabccb373cbc4af86222a8465f2517131d4d12adf76cb705e0f5ca09b414662432f83d782716848931a5f8feaca0558c9b43cca3ab112f99b10da1

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\nsis7z.dll

MD5 1219c48bde16cc2a6bbac7fda45297e3
SHA1 c9108dd88520cef653db32cad84ca79c9378b0eb
SHA256 fff91c3997313eaed20f6d578548be2690516f7249bf612899319d3a12258a25
SHA512 7fddfcf26052df142d4c1d1788f5dc0e38478ed05ef21a1bd61df7c073a49f098416456a0a736267170bcc2a99a478d8208e966a469677014f56dc26f8ecd436

\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

MD5 a469d8272a72fd178b0d9200854c7e87
SHA1 ef1abdf4dca525fb2e82c146560ee82560d07da7
SHA256 17156a6c8b74baddbce09df6ab515bee8a6bfafdac01de4f861436f3210f3bf1
SHA512 d5acf93e6bc56ff6c923480f3d6af1a7c844df4f8944ab025d1e73149fd68e13e55ceb6e5919f0f7de8df8e21eb92cd546ded43e453ebdd82665ab1688ec2eed

\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

MD5 34283bca0c38dff54193dac05a070de4
SHA1 0a6851627dad66ae7ca37660ed45c4de859944a0
SHA256 8ecf4304405067ef11d2fee9f22f5eb808df9048791e755b810726ca20ddaaaa
SHA512 45146dcc9421fec06415ffa2e5805e1fb6044d24323bf4d3092b670232ac204cad3d864d2f97a593304d81e6e0078466486b1cddd7d277913f856a84f8c96e30

memory/2724-636-0x0000000002780000-0x0000000002782000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\zh-TW.pak

MD5 c1c8f601f2d0bb06b49d870c80904907
SHA1 6237df5d4580afccaa6a07f35729f9e2737c82a8
SHA256 69d888be9d5affc6086e901cf52936477101374abd8186f8e8f6cc38af826691
SHA512 2d68f116cbfc77a17b9fb550addbde95ca09f10ce1745d5aacbb9e76dd4d041d6de8e423844266711c64fc6733bb805311a5c8838f576d049340f32d4e0eccb2

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\zh-CN.pak

MD5 d15fa5c75a835983af2663466b5a8494
SHA1 6580f7c91e31491a296a039f681c93810281717c
SHA256 b33b23552f8f76aa43671556676298c0af54641e9f1de27a8208750148e737ca
SHA512 39a63db44e1e2b67b1937af803336b221bbe94d3bb31b2117530886fb9e66131efd0eb3969c251d2ee264a7c07bdaecac330c97b1cbe74b3988cac6ff86f3be5

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\vi.pak

MD5 7b2cbb79992021e2fa2714ae9cdf0728
SHA1 a543c9b6d4dabd48c6b5d995cfa3c915a2b76433
SHA256 326e44c27579796e4b55cc281c3e4c9bf5ad7aa87156530709cd6296350758af
SHA512 5c77c2dd9e5ee9d381a2524c733d3ffb55146160393bf919ed8855781d1e8ed0c4d707bd71554d7868ff53bc546344a415e846dc15f68f0e7630d49a94f14049

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\ur.pak

MD5 8d6fa97205a1d2b371a54144aea453ca
SHA1 11a77318f571d15daf7ad047b06e1ec8a51c8f8c
SHA256 578aef61fc8b5c2e0f3765b1487f8af9f72f6506050d501fec9edcbf93c7a3e4
SHA512 9c8dbf1126b97bca195c801b81afdbd8f68e8f44ebd57c563d63f6c1a3f7fa08b1abc76e25a28d1eb2cd8bc47c9438f23b72063f081f0bce6b8f48bd90a56433

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\tr.pak

MD5 418dc1cdd7ccc10679523665e1626280
SHA1 d4407ba9bc55153963150e6e30f23cc5b2304e30
SHA256 26fd3317bedd4080038d7a0003d73923fc0edd40283ef11b5ba80bb27f946c13
SHA512 4a907bf14dc9cd8ecb2f17152ff5ea0a6dc37034c95ed31a445395bcb9ad6fc23d4117e81f94ac82d767869b0b828738eacd33b810df87dd41cc3ec2d5b92e94

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\te.pak

MD5 51356402af92c1912f185b6bc9aa9026
SHA1 60ccd65d7ef35e5219f2bd1eced66e1ba984a8cb
SHA256 11df9eaa9216b091fab01f66fd77bcb17c0bea0db3ea7a803bdf5dc6c6e18322
SHA512 8ddc7946a9445a832b4b3b254d24e12d66c42af8cf7dc13add4cd3a9ae50b83e5178830300c0b08aa145d55d79b868efa9d95a116623044d7df8eac1a6556632

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\ta.pak

MD5 abf95e05d798043abf4f2f514c0517a9
SHA1 b8c6c1cdcbfea03fb106c7a44385a3a8e6806aa6
SHA256 9cd624a97493282afed3b9b1e848b12639234fa54c04b22128169924f9c92777
SHA512 aacd7439df84ec76a3d0c69c39341b51031b66b24be53c87f3ffbced989b38fee416b19db2c3b36904eaf88f98b24e1e26f070bcc8dfb4ecc99dc7bb6f6b911f

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\sw.pak

MD5 bc771a0e8398e14653d9a4373a73496a
SHA1 6e844c7daa666640ac3093d5e51276886a0f5a66
SHA256 7a5d056fd317b7b60a4fbf0df39dfdd21829f2245393a21e1ddccf1a4e3b61fe
SHA512 79b916c737bc44051e6b4c0a9afdfba26928536034c5a5149586594454855b7074f6f8fdaeb98f0b7bde5c3da36d66988f683de8961e13c9c82301676f942998

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\sv.pak

MD5 094d69544816535e4d040ef0ce923100
SHA1 5891cdc73bc4c112855d099ee112da0c3e9cea81
SHA256 110112c2f7ff5d3c8599036669d156e96ec19e70515fbba3bbcb2043ab994680
SHA512 023037077a3482a3bf2ac076b5c00922d7039bfc2098797275465138142fea0f97c1e003f77de71b9ab88f786b7401182618603610c51f634ad17a123faf5bd4

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\sr.pak

MD5 4d1ee9487f4ddfdc4471366d3965293f
SHA1 4e53084fe0d4bf4f46ea980f7423787084152ff2
SHA256 b75a222db70c3f5734a75042718da599881d5e84cc52b332e9162f78b32f4819
SHA512 a44a448203cc9388d8df4c39be9db5436546fa17add0975c18ce01ea0a5cba142692660ce6efbf00699793ca98af8e392e41a07dcd9c183fe03414574389609c

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\sl.pak

MD5 1b02b0834b8bbd12a77f7fff09e1d81a
SHA1 1898cfedde55aae307f7578b88cb0bcaf61e1d52
SHA256 b36e1fe2405cc4b9f34587e30da2feadaa6f03124769b02f79333adacaddb49b
SHA512 b1006053ace6f8842e9436c94934b2e7d1b502e3df9ecd1fe59ab39ae35e69e8f0dcff8728aee2c35a3a1eb7a27f0146d6113b4de0632dbab20eb0a37942bc4c

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\ru.pak

MD5 6092ff0430736682e24595b37b3c018d
SHA1 9d2b9822556ab1f33861c45b2f7f4236b3ea5f05
SHA256 c5264fa2b485326e91d4df7a6e39122554ed632c0c17fa1f130205ed50e2d6b9
SHA512 fdd960f3295c280cc57915f7cabd7ffde0c0cdf4cf6b671748a6f5b8b39376141f2a552afce3e2a428ba18057fb9890da9b95fc6b8367dbda5430e1b205a08cf

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\ro.pak

MD5 e66343d1af0b8f483116ad7689e7faba
SHA1 a245b6aa9309a7c10aca8502cbd10d9dcbd5d8de
SHA256 b7b56396806412ac1721d2648fa98a89a069d1f58d359d8e90dd1c6b8473b9a2
SHA512 9f6517aae57f3d8a65d4f9b354b7ed9923c1bab8a414b78347f4dc375707907d16d458d9d458d8fbd28f065e268e092770fbc198833315ce14e6eecfc0d3f0aa

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\pt-PT.pak

MD5 7074036013be3839e218ec7b15d49215
SHA1 7711ae4e96efd4f4676a3c0281a92af56329deee
SHA256 342381f89058bedd809991a0b416f48642df3c71aea10bb13e13bc15eaaf46c8
SHA512 8a1e9cefb8a64b3664d9496e2d2f76e2281b3c427fe24ecb70ee74f78778d94def66787a7e35ccde6037ec061e29a6ac7fd8b4010f77b13945780e1316bb16e0

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\pt-BR.pak

MD5 4f3f65f6639ae1905fa37b9b6ee2e4d4
SHA1 07553f41c4f8f3d105eb92b65497c4976449a6b4
SHA256 b4e0a6064dcfe876c819ec4b00f9857b84ff52cd3e845bd0c48e31ad43a23db9
SHA512 85cfcaed8fa2026c13735e7d4b6852bf794dd4a8ac078889d5ef46ec2ff7173ae443addcb0b0c711f6a31f80469fc1df5af1a78da6397d9df5e33cabb354fba2

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\pl.pak

MD5 41cb68de75d011281c7936194ef8457f
SHA1 6bd3efbf5142769c6fbe8478185edf89f471716a
SHA256 d52358b8fd70f1f18b3f8ecc4aa9c791591dbb698ef8d8670312e50f024db451
SHA512 ceb90fa9f723c3d8d522a401cb46545c72a2ddd1d04f091e9d7ca5212cedcc641c54cb8fe19595e9c823b2ed374757e5ba7d1813cd763bbd8d726b1e2ebe0407

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\nl.pak

MD5 54817be286dbfd9de461f42304eb72cc
SHA1 79386881a11e6c7d49f2d117822c29d7631f3830
SHA256 3c682e37df71cc036c2b5e91064407fed8091c0306a856121e28c19e7110e1e4
SHA512 d8f922b028b03c6379911308cf240d104b40a9c46f67a6ddbbfcd20110c287e8106376cd6e8295915d054e05b2a8a045b3ab8d98932c1be97b1f258525db1a68

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\nb.pak

MD5 23ecce10db7753622fd7cd956aa55212
SHA1 52affc68e91448d8aecf2396f02ede77d4ea664f
SHA256 29f38d3720c948fd261a2aea7d195e861a73a1313071bd2cbf1ebcbba77c63e6
SHA512 553543bef496052995e33e2f3e8bd66ac845351cd292623479a303261900c393cec35af3e0ecd57db84197e6f7653ffa4eeaf4950647ae2d5304f961890deba1

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\ms.pak

MD5 2c4056d84b980267faadd69d52c17086
SHA1 3b3c5fcf182d86a170c8f35c041bf3869a82b362
SHA256 163eb7ba5f0c61acb6443709c24e38ca6370a33f89a12e13d0a57c258a87ca16
SHA512 47285ab42b46cf7d6556eac2a8f7afb9a9c9abe8cb026fe847b2504e4dbddd481a98c1ea959c74e31f195ecdbb618a3d93df8f20b797411a8bf2b3856fc9b963

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\mr.pak

MD5 1675668911fd3063e092fe34579c210c
SHA1 d1d09041778599002d07a89848ddd79cf5f4f4db
SHA256 436efbdbce605c23f855644a9ff1b04d9a3eca37de3b18de8c3e589930d54096
SHA512 61c7aabb00700773bb55522e7ae9482d1d97ace936c9bbfeaef3215a976c411a51f41a2d5aa05f2b286b0d112b5616215b9fa3632eaee38b1ec090dfb29391b1

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\ml.pak

MD5 fb1a6e31dfb4f4c78a50b4dbece0e1c1
SHA1 367c506478380f8bab411747a906f8f8c60df30a
SHA256 a7afb3ebfa8f4d2e35dfdd5554ff2702182e73dad0fd82f8b4207a61563ed134
SHA512 18afb816e974c9f0d669af7cb6a5d8761e1c5af69317e6ea293559876549692baf1567657b356ba9d52ecdf4d117b7ee7fe003d1820286470d43af89321e3f6d

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\lv.pak

MD5 f8a5403bd91f231db58e77c9d4514e2f
SHA1 7d29e2d8459af6fc3082cec0d9638daf5275bf3d
SHA256 dfb9b5ee446977dc0435cff4d66402d3a9426edb106effdbb7d86379527c5956
SHA512 f491cffdc5cc588f7ec70f87be84615aaf5b39e9c990cd9c835e65beb27f26334517abac1af7419f2b7b18f94c369037c8df4c1c8e26a5fed4288d477dc0874e

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\ko.pak

MD5 c90a42bb27bcbf1bd345dc998f9e410e
SHA1 66f8bb72db6b38e2d288959bcee3c43caefdc59a
SHA256 56100d20a59fe6cb333f57ffdef90157324ae1b90194e852478daa8c46d29de9
SHA512 b5912c895a6a3b391555efc10b15d45fe9a84473c8687327b7d2fa033711e437e2f160345daefd554374357e0afbaeda4a25f4f69ca74e498d7081062f299b46

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\kn.pak

MD5 74f0e9c7c670a981d3651e0d189dfc47
SHA1 a2fd3037311f36aaa348805d57172f9e9b0680c6
SHA256 0c8e0b6a8398d7b9ab9cac634e4a7ce4453540358e79ac6e9c5633efb4182fe9
SHA512 2c555439f7de3902b2b1a940cd43977558c4d9239c449105fc24777952af8de592ba86a7476567d190719c66d38f7a7982c9b94278c0594de1b427dc546f2d89

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\ja.pak

MD5 afd423713e28b3980392443f31dbda7b
SHA1 926560b21af422f22e1cca1a4a2948ff988bc6d9
SHA256 88383ddccacb53f3ce5918cd80b5dafb16b3cf1fab295e230cc15490600615e4
SHA512 1544f7a91b4b63bb80f651833a931204e44745bb0bccfb5564ee9af3149218f140b6adfb6d4ebb5ce5e82f5c345c098cae8a0637b274c42f6711aa53877b0bd4

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\it.pak

MD5 47c89f9ba4993e7cb6640c23f444e9cd
SHA1 0e3755d2835742b7aa4e1d5245454f7cf22a2d47
SHA256 95bbf94625cf0476124763cebedcf5ee46148bb6b5c006f86540a02e8d8c883c
SHA512 948e4da235cf7d0272fd7a99e7238596e5d50913886fc73fe35f9af17d1087f550a3cc3251ee6595f9872ef0b88e75725405382e6aea4850088e068d5b80922d

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\id.pak

MD5 0dcb56f6b196199f7ed802c06b774037
SHA1 f62edd5e814d05cc4aeb5574fc63acfdeffb6010
SHA256 bd512e36a88f0d7e6fecc0b559adb2761589947fef9c253dc350cd8d6ea889f2
SHA512 e03474255bce20004788475ee1f546ee7830e9b9960023b15210d88347032b5376848aeadef3e953ec654d3905baee37279bfaa287af7669ca66e382a4b1344c

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\hu.pak

MD5 2fef83993a62f73f8e4b40a6e28a085c
SHA1 8bae181f3eed8d5ea8fb0f912c679e608ee7c008
SHA256 ca4b4c7c7be45ea0871abf7d5668ab948f712a02facdc1d6bbc189b1b3522446
SHA512 6eed29acd38b662f62381a5c00ebfb254915a57de6fde8e6da77f60dffd13d4846b26b1897d710ef852bcec5728a4460becaed2367f1a06a066da77521701324

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\hr.pak

MD5 23fdde99818ba28131a6ba81decf2c1b
SHA1 c1a87661f80c7dde9a08a360d2f5b72f58042076
SHA256 08fc2b1e6b9652d809a7550f1343b3ee54ebcbad0fe74b009aab6ef926c0279b
SHA512 0f53b131d142c7b88081afa59f10e17be489c342f2e328d0e7bcaa18b5dcfa599b37ca09317aa9ae564e52a3cea06d79021eac6ab5ab38a9c0ec99bdce797e9e

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\hi.pak

MD5 4eb5c501aecb647fa81fb4b65b0cb6d6
SHA1 5154741cceb272352f0814850e75b517f7f8a023
SHA256 71830814b8c7028a114a53a4e715ffa8da12f01d920455242a0cbc35fef48e6b
SHA512 2bf32962d4f018959281f6f09d149aadd901c21131ef25aa1199ecd73dc16e2377eeeb67352e030198aa280ac1fd5962eb226fc6481c654d8d332751a20329d8

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\he.pak

MD5 8b3957dda3c9fd903d2c4b8a5f686475
SHA1 36e45b4d30fd1e59ecafe095f405e0722a814a17
SHA256 ad20b3d634130c247f4ff954f1a5c56687523e5610f2ec6085e257126c4513a4
SHA512 1dd54ce0a1f30ba087a9d09b9aa2928dec3070788d7db3dc2bbd27fa6126f70fa1e05106a1503602b203fa76be914210a38d5dc9c6bb56c56857ef08c528c4f2

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\gu.pak

MD5 0c33e2a35eaaed3572f31e7b24d4493b
SHA1 278498568109ea7d6cb34c634316f95b04155b64
SHA256 0f0fee8a2f22f80a0c4a758e7f4fd90d40be4048dcab0d824135caa5e92efd5d
SHA512 4eebf9be5a8c317d2d2e8e9b1e607774f5c7c35af7d8bd6c80326fe3c6e2e05089f04485eedde8be8c7b71a7b49e407289f361361d86802c0463c5b6b296f2a4

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\fil.pak

MD5 2e6a6728bd5a09339ac01a38bf686310
SHA1 619e27f30c99eff8f2df3ba2287c6f7fe0b5b063
SHA256 e8f03c2e9c88adb04648ef93f9ea3cff87641638ac97c9a6752b751e7f7a8a20
SHA512 0452ac74eafcf971265de92041659c006b5e559919b895b41795bb1307ee7c302e873440b006485b7cffcdab0f6b908a119683fab40a664d5bf3591239427c00

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\fi.pak

MD5 f87a1ccbcf3db6988e95e94333bc5a4f
SHA1 e85f8446eb74d8bd4318354ec98135c17afe3248
SHA256 052a72c9d6f2bb55f02fb1c5c4c68525a32b8cc9120c270d07d7b813d604f7dc
SHA512 c4a7ee0552b343010fce8ceeef70620acf672c9ab56fc24ccfb88abdbad23aac4cee65c8b241c594b7ec92d0841087485aeda583d2e887cf4c823a10b2e7cd3c

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\fa.pak

MD5 87a2305436bad7556fe7abb68767802a
SHA1 0edad3677b0872321a1f8f3d391c17ab373aba17
SHA256 9068dc6c71fd8bbc1a4f3b2009689472d1fd2c096b7e8afb3e089a46b98d8b38
SHA512 6c32b1c83e03b553843faabb5a9c1b63c769b13de60841d2bc81f2c9514b30ebf16551acf33262ef8abaa4a5aa3955600a35a045b0fd446964109c58a2734969

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\es.pak

MD5 c9e0b58f2d9e087b2e8e92d31be2a3e6
SHA1 59a43b7021860db2d2a7fe8ced8fd1a4b0c8322c
SHA256 468e0143c978a948c62d4a3dc743099a4147d39773a6112b303692d0e335810e
SHA512 16160e6375fdde1ec2e17ba8622c9c953a46372143d0b09a33ee55852b2b9f037c1c16dd5bb6bd1f2454559dcb172c8317aa8b6c6b26d44e8da706eb16ec5f07

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\es-419.pak

MD5 c753cb5296cc411ae72964735ce0de78
SHA1 4151545bc2cb9fe4330f3b238aeb28e9ff0dbd6c
SHA256 5fcf21564ceec93eb64d2002de165a55c1875859975e0bf9035cbe96f258b50d
SHA512 5688e1f406125f939840e8308d950a741a02ef24a006fd3619f3e943595630ce32010b51bb7a37768f1c595f4c77b104bb7483ca24ff599eb04434974d894c1d

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\en-GB.pak

MD5 a32f3f357725ff256be9026398a1cd06
SHA1 cf492e3e5c18e9e8c8cdd6b964e987541cc46505
SHA256 914b7bec10c1e8c2a9e461edaa498b2b344aadc130a30321d4116ce0c4c99ad3
SHA512 a96b2b00ad6883c205224770bc2cfcc93a5cf29b41bc8169117771f36264a8a89ad4e5bddc0c50f85c0979f3355188ba86c915f0b3b1013b3ecac9383fa8b192

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\el.pak

MD5 7f92f844b9d8bef68dadbdb85a084bd6
SHA1 96c508fc2b624fe9c2945e2d673a645fe39ad3f2
SHA256 87f0a26d73fea2ebb5017a95e937e08d7c347baecbe93514c1b866c1e28dea32
SHA512 d47eb475f9ca60bc1e7ec33fe2e2a395bb8ef3f109bc4b769fc2e03e2ddc04bb3391b10f1b382b7497555e36ef02fca31cd47f67c03de43d275bbddc3bd8e7ac

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\da.pak

MD5 ba54e3345d61d5cf431db6a0d649f792
SHA1 32b2edc19df7e14e6567e0faf671c038f78a65da
SHA256 dab543bcc1a8abf057f720f9f448e45ca5cfd1c424826bce8933174bb2eccad7
SHA512 5f858c4c876e1d15d4929464b7d9bc2cc497eea93d887c3cf0cc1c651a0f5a81d75f04f7a0b4277dc43bd9deb148d147d35fa1aa2dd218d404fa2c8c389ecb5d

C:\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\7z-out\locales\am.pak

MD5 4cb4b30911e9fbfe6c1de688cca821ab
SHA1 58cc2d8e954b5c74a902f13c522d1f6836769623
SHA256 685ecdff01d4ae92be1d900ef00fd8632616bc41f18a56e682528f312d4a5167
SHA512 6629af841c52463c46dbeb03e3b4b1cad550c2db790c75365d63512e039b3369cdd9f18316e9c50dcf3aa77aa4d2becb6a87570f3b538b456af3041d60393434

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-22 21:05

Reported

2024-02-22 21:07

Platform

win10v2004-20240221-en

Max time kernel

26s

Max time network

72s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4652 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe C:\Windows\SysWOW64\cmd.exe
PID 4652 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe C:\Windows\SysWOW64\cmd.exe
PID 4652 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe C:\Windows\SysWOW64\cmd.exe
PID 4996 wrote to memory of 3260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4996 wrote to memory of 3260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4996 wrote to memory of 3260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4996 wrote to memory of 4872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 4996 wrote to memory of 4872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 4996 wrote to memory of 4872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 4416 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe C:\Windows\system32\cmd.exe
PID 4416 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe C:\Windows\system32\cmd.exe
PID 3140 wrote to memory of 1884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 3140 wrote to memory of 1884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4416 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe
PID 4416 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe

"C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Lunar Client.exe" | %SYSTEMROOT%\System32\find.exe "Lunar Client.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Lunar Client.exe"

C:\Windows\SysWOW64\find.exe

C:\Windows\System32\find.exe "Lunar Client.exe"

C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

"C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "chcp"

C:\Windows\system32\chcp.com

chcp

C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

"C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\launcher /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\launcher\Crashpad --url=https://f.a.k/e --annotation=_productName=launcher --annotation=_version=3.2.3 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=25.9.8 --initial-client-data=0x504,0x510,0x518,0x494,0x524,0x7ff659c5d208,0x7ff659c5d218,0x7ff659c5d228

C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

"C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,9220734844210632513,17255444864986228749,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

"C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\launcher" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1908 --field-trial-handle=1832,i,9220734844210632513,17255444864986228749,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

"C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "chcp"

C:\Windows\system32\chcp.com

chcp

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 launcherupdates.lunarclientcdn.com udp
US 104.18.29.96:443 launcherupdates.lunarclientcdn.com tcp
US 8.8.8.8:53 96.29.18.104.in-addr.arpa udp
US 8.8.8.8:53 o923049.ingest.sentry.io udp
US 8.8.8.8:53 o923049.ingest.sentry.io udp
US 34.120.195.249:443 o923049.ingest.sentry.io tcp
US 34.120.195.249:443 o923049.ingest.sentry.io tcp
US 34.120.195.249:443 o923049.ingest.sentry.io tcp
US 8.8.8.8:53 249.195.120.34.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 137.71.91.104.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\INetC.dll

MD5 38caa11a462b16538e0a3daeb2fc0eaf
SHA1 c22a190b83f4b6dc0d6a44b98eac1a89a78de55c
SHA256 ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a
SHA512 777135e05e908ac26bfce0a9c425b57f7132c1cdb0969bbb6ef625748c868860602bacc633c61cab36d0375b94b6bcfbd8bd8c7fa781495ef7332e362f8d44d1

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Programs\launcher\chrome_100_percent.pak

MD5 443c58245eeb233d319abf7150b99c31
SHA1 f889ce6302bd8cfbb68ee9a6d8252e58b63e492d
SHA256 99ca6947d97df212e45782bbd5d97bfb42112872e1c42bab4209ceedf66dc760
SHA512 081f3ee4a5e40fdc8bb6f16f2cfd47edde2bd8f3b5349775526092a770b090c05308d4289ecdda3d541cf7f0579ac64b529930fd128edad9b0991dfa00b0e9bc

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\chrome_200_percent.pak

MD5 81b5b74fe16c7c81870f539d5c263397
SHA1 27526cc2b68a6d2b539bd75317a20c9c5e43c889
SHA256 cb4fd141a5c4d188a3ecb203e9d41a3afca648724160e212289adcac666fbff4
SHA512 b2670e2dfa495ccc7874c21d0413cfbebfd4a2f14fc0217e823ec6a16ac1181f8e06bfe7c2d32543167bc3a2e929c7f0af1a5f90182e95913ba2292fa7cadb80

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\d3dcompiler_47.dll

MD5 13d396df7f6218beaa406d7ab1106be0
SHA1 5af4c3374b034fb8c7fa31d979b074ed2bcdaf96
SHA256 4b932e17d0daffc99a926fffe819b2328f385ac65468a161ccbbbf491b7a1e57
SHA512 f3d2b1fa28919b06b50000af1776789afb10a76172022b6c05109311d56723cfdebb207d84694099217a5c52d2c4ee5b97a25dd6891fb37dd8144fa7363a4b39

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\ffmpeg.dll

MD5 15ec6ae9fd8cdd826be307ad126445d5
SHA1 633d243224f2f9804fb8ed725df837eaa021bbb4
SHA256 4901b952bef7c4d30b002a90cbef233413a3fab344b0dfefa16c53f5d134461b
SHA512 0cc2376084f8e616626c809fec4faade593dfc21484c72e443b01a7de1b4528695ad0ea5f7efb36cf763d32fb811dbf4f03fc75b4823c5c3b0faf3a9ce714eb2

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\icudtl.dat

MD5 51426d9e113646b34ad1011e5b0b9591
SHA1 7ca596d8453e39f91d5915ea3d5e2888811eb392
SHA256 edc794e36f0d0633a1315fb079bb0249748a3605dccc2a767b21c63ef6d8c989
SHA512 1da11d6190cb68a58ad3f36110c2d3efbe3412e232f37db1f088f50cbf35aec5f40a7256017771bc535fdcd67fb1231bd8c155aeeeb43f1fb0ecd5722bd3b076

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\libEGL.dll

MD5 dd78b86b3c92d61c37b44ef5b157cfe0
SHA1 4dcf9ebc3ff5ca552c0e83469b921153b29aea1f
SHA256 e142752e073c0051a0beb963981af70263ed673959515545521a7941d3230838
SHA512 9d071568dc56db2ab93d034d07a11a477aab8ac50d9ea3c4db3ac4866fcd3c2f3002ba7a3f2c55589a9d68463181fc7a03327dc164310d7e80e30cc6f6bf2423

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\libGLESv2.dll

MD5 5f23ceefc7d5259946b77956ed37328b
SHA1 a86f3551ee590278227c40f7fca13c5962eef533
SHA256 b6020d3f47699b713341159938a205431518d8c8a28230dc5c94ef31357e5281
SHA512 939af700ba81036db8365d649cdb74b4e35bb27b77bcfde2e0ba2b6e33249b38a8678aaacd9d1056ed067bdebd64942efa567783270ea183364fa61c1953c448

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\LICENSES.chromium.html

MD5 0eaf8c5ec488620ec025bf606c1891df
SHA1 568e311dcb6c9ad12e567d45750b2592751be76b
SHA256 c9416f078c677a034fe0f938cf16f75ab9f509233e6ad013b02d93b8ddc9e52a
SHA512 10459ea815c5418ef5148d759252396a2297f46e83232f8dda763e8844e2e6c45ce5455da6bfed3a516ee0006fe89601d175701403cd4709f6cbb7f30d59d417

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\Lunar Client.exe

MD5 5cc913f62a3aef9e2eb734460c8234e0
SHA1 fbcebd8677d674d6c515fb924e783a5bd2d1b7d2
SHA256 0bb046ce3fde3c31e8f8667d0c72520b5980c50e8c3973cab63a262bcb48d5b3
SHA512 eb6328239a55585b0de7e5ccbda49e2096ac4264fc52fa48e340d579c8ef90c275adca7b5907cabbbfd6ef8ef7d887def404892887aa5b4cbf5cfd102f94932e

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\resources.pak

MD5 a6f9fe9b317227795e33c2aca9cd4277
SHA1 d506f3faf4cd19eebb02103e2564b457f0595a46
SHA256 82c570ef6b3a22715cf5c3322a43a742e7063eabede97a9382773afb6a8221cc
SHA512 5abf7e8b52f32e8cbf12ff0d4c860d0f9c06ca771ba75dbb087666254cd12e70bcd079393b42bbb0cacf456d8c8031c37f1b2f4d53f60fe4aa53577b9f4c398f

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\vulkan-1.dll

MD5 d562628f9df56ae61770ffdef79c8d05
SHA1 2423105a960fe0ceb038ca36d6a37638ebd32b6f
SHA256 5789ca1822f3a5a67cd2c24e6ff0307e688b76a2e99831050bdcf8b8d155956d
SHA512 739f9f41d8e3e48dbd20bfecfc5679f38e59b3fc8cb406a77c384fd5146f19efafa1e4f23f15071dbeaa1d0dc71e125966e19fb757fc39e6abe953159669c096

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\vk_swiftshader.dll

MD5 9ac6276c2d0e371478c21b6afabef263
SHA1 c9936898a9b9238b1e0b9d84ec96272ef674e3b0
SHA256 29c82a9b128326df01efed766fcd9038fc472df687824a48ba18634d9b11a6b9
SHA512 4572f9592fc589df85db76385ae15563e447dfdc632f51eadda63bb7e4af7de2c1a4fff5bd353932f8b1682986511552b213cad9fe6904124684a687a6618a2b

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\v8_context_snapshot.bin

MD5 5db8a5bb87c7999343f30128979057a1
SHA1 c4177c2fe973a495db59b6228ac26264eec46a4d
SHA256 5b1f69f39f3d5865dce13ee3bdbc1af2938f5cc4c056dc9f9e213e9af346ad4b
SHA512 da2d516251376952729a33de2cd23764290d400fafc49642f2ccd799e3f989cce4d5561a76d380a950b77b53b50148dec9089c30de6c3dc38666237e196e569b

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\am.pak

MD5 4cb4b30911e9fbfe6c1de688cca821ab
SHA1 58cc2d8e954b5c74a902f13c522d1f6836769623
SHA256 685ecdff01d4ae92be1d900ef00fd8632616bc41f18a56e682528f312d4a5167
SHA512 6629af841c52463c46dbeb03e3b4b1cad550c2db790c75365d63512e039b3369cdd9f18316e9c50dcf3aa77aa4d2becb6a87570f3b538b456af3041d60393434

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\af.pak

MD5 b293cc5ea7db02649bd7d386b8fa0624
SHA1 32169b9d009b7a0fb7ecdaf650c989e956291772
SHA256 7bb75adef02d28819f1bd3b42fa46ed56d6dfbeae072341997b09b8c1f52d8dc
SHA512 496bc72e7b798d02e453eb96d20566b91405bab774521527ef882c1fcb58f25e2d0718013ddc0d23f7fad883f4cde93b57c6caaeba8cd18a09665c9f6245f557

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\snapshot_blob.bin

MD5 3a4095538e021b84396b3ce25affafc3
SHA1 cfc20771227b3c1f3197ff6a91cee68555afb247
SHA256 c1c9145735032bff20b2fff50a4b92ae9cf47290f433e3f3b32e3b232d610c59
SHA512 7b71083180f237f5f37cbe7a9755f6606708b959986562f9c5880cccea17b80a5187649fc0cb6965a8b40526bcb2cb6d980d364be528465290658b4d9084348e

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\bn.pak

MD5 bea57ab3921250ff4dadc9f42f8202d9
SHA1 ace7fc0579a946d32419e8c5ff9bc64d40e53364
SHA256 2bb70dc94361267e755169dde430ea31aa21b4daf31b5eed78901b27bc596a2e
SHA512 164f5c081bf23def7378450dfaf4db1ceb49595351de5d933375d9b1b409f7bc2dc96c4f228a7f024b7ac891a27603ec174ee8b3a7937bf678d61fdcd3e4c7a8

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\bg.pak

MD5 080cffa1d4032b7d4bfa217aa00c4f47
SHA1 525cf2baf62ec4c90e3a1d89cce37c9f433c61e1
SHA256 3fd27d562e32f1a052e924b6c468486acf0b2af42dd1ad2270e83d115d4b3f65
SHA512 9470ea433a7c08331ff26df00170c81309e72145e6f32c16e7c2c1e53c54b3974b991ea128e636138f8212e276a2fdf94c344d9ab7fcee35ec231543e08196b0

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\ar.pak

MD5 7294148ba219909a4909613381ea45ac
SHA1 a8a70e589760b5eaeae1a95fe51723cce48fca87
SHA256 acc1b352ea206c25afe88a614346b468f4f78bf23f886883a38dae905d121dc0
SHA512 cabf320e827067ef8efb7c021ff098430054d125fb50540c06d12167c7d1c6d08449e6a1b33fa4a092ce6c81a600415711005e100b1b756a199e05ca18dbf3b7

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\de.pak

MD5 46a45fb8e7880802e1624df86d254973
SHA1 13778b3bf0101c3894fcb228080c25ebd47dc046
SHA256 6283ec48cddd08c387a36ec71fff87c2ab0ef27449e8971eba2d76a6136b1708
SHA512 ffa8ebaebb3f057440176f123442b13b6f96842b9688efe6633c0014f0dcde982e667b0f2dc84a1f6450e310a8e05a13e35ddc24b1de8d25ba5a711d8b07d357

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\da.pak

MD5 ba54e3345d61d5cf431db6a0d649f792
SHA1 32b2edc19df7e14e6567e0faf671c038f78a65da
SHA256 dab543bcc1a8abf057f720f9f448e45ca5cfd1c424826bce8933174bb2eccad7
SHA512 5f858c4c876e1d15d4929464b7d9bc2cc497eea93d887c3cf0cc1c651a0f5a81d75f04f7a0b4277dc43bd9deb148d147d35fa1aa2dd218d404fa2c8c389ecb5d

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\cs.pak

MD5 6d43974c98037eecee8691520de4d63e
SHA1 e15672b3ab22a059b976d245ea3f59d35c3387d1
SHA256 c1020222b90558a6a8a07f24756b183594641ef77562d35e7899e1489d0ebd8e
SHA512 64e76499d56c3e32cc013bd05e2d3eaf5618527b8035bd5a37f5018a1e6072cde4a06f7c66921b9b087e60ff686ed63b7321f0295a34451443797ffa8e5cea35

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\ca.pak

MD5 2cddd012546caf0aed6775cdf5cfdee9
SHA1 cacce951770feefd1bcf89de5be97bb39606e7ee
SHA256 02d60b97f70c31f5c5003108321fc3ac3c79bf39a36392c3adaf7735b9cc1c1d
SHA512 b75d9b2946b11b9fc7430c5773835422aae6e716504d7841c1b08413ec18d454d9d6faa5ed63e19c59ab2e1ee919822283fd7e21a97f54482685d541e4dd2519

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\es.pak

MD5 c9e0b58f2d9e087b2e8e92d31be2a3e6
SHA1 59a43b7021860db2d2a7fe8ced8fd1a4b0c8322c
SHA256 468e0143c978a948c62d4a3dc743099a4147d39773a6112b303692d0e335810e
SHA512 16160e6375fdde1ec2e17ba8622c9c953a46372143d0b09a33ee55852b2b9f037c1c16dd5bb6bd1f2454559dcb172c8317aa8b6c6b26d44e8da706eb16ec5f07

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\es-419.pak

MD5 c753cb5296cc411ae72964735ce0de78
SHA1 4151545bc2cb9fe4330f3b238aeb28e9ff0dbd6c
SHA256 5fcf21564ceec93eb64d2002de165a55c1875859975e0bf9035cbe96f258b50d
SHA512 5688e1f406125f939840e8308d950a741a02ef24a006fd3619f3e943595630ce32010b51bb7a37768f1c595f4c77b104bb7483ca24ff599eb04434974d894c1d

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\en-US.pak

MD5 06d28839ea0b3aab4597ba8646a53a96
SHA1 9c6a74aae8c783546d613c6f38cbfc8f5e3736f1
SHA256 69c1a2e1b30d83612decf1a8dd7b124a04f58e9f2465876726f02f7f7d5eb54a
SHA512 a432542dc98795ce0ea6fa4a6bbcbae8ba126f1fda025a9ad6ff3fa67eee85dcf7afc6678f5100bb1543c4d00ac75043ea92e64b65c9ef6bd946ce3dc4d5ae71

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\en-GB.pak

MD5 a32f3f357725ff256be9026398a1cd06
SHA1 cf492e3e5c18e9e8c8cdd6b964e987541cc46505
SHA256 914b7bec10c1e8c2a9e461edaa498b2b344aadc130a30321d4116ce0c4c99ad3
SHA512 a96b2b00ad6883c205224770bc2cfcc93a5cf29b41bc8169117771f36264a8a89ad4e5bddc0c50f85c0979f3355188ba86c915f0b3b1013b3ecac9383fa8b192

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\et.pak

MD5 ccd361017778964de23bf1d741cb888a
SHA1 5b0305538762987901b7a8332635f3d7996c09dd
SHA256 41883af1e49cc180fb48e02659e75b0169d974d77373cf7bb2a4ea02dd654e26
SHA512 a9d7c99c07229d382e8ba7cc3199bc66fc39df5fd9b58e6a76e423b865f8c05f53398125a17a20c27462b2db595f3d778b4d94b1853121d8447b771f9284e5c5

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\el.pak

MD5 7f92f844b9d8bef68dadbdb85a084bd6
SHA1 96c508fc2b624fe9c2945e2d673a645fe39ad3f2
SHA256 87f0a26d73fea2ebb5017a95e937e08d7c347baecbe93514c1b866c1e28dea32
SHA512 d47eb475f9ca60bc1e7ec33fe2e2a395bb8ef3f109bc4b769fc2e03e2ddc04bb3391b10f1b382b7497555e36ef02fca31cd47f67c03de43d275bbddc3bd8e7ac

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\fi.pak

MD5 f87a1ccbcf3db6988e95e94333bc5a4f
SHA1 e85f8446eb74d8bd4318354ec98135c17afe3248
SHA256 052a72c9d6f2bb55f02fb1c5c4c68525a32b8cc9120c270d07d7b813d604f7dc
SHA512 c4a7ee0552b343010fce8ceeef70620acf672c9ab56fc24ccfb88abdbad23aac4cee65c8b241c594b7ec92d0841087485aeda583d2e887cf4c823a10b2e7cd3c

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\fa.pak

MD5 87a2305436bad7556fe7abb68767802a
SHA1 0edad3677b0872321a1f8f3d391c17ab373aba17
SHA256 9068dc6c71fd8bbc1a4f3b2009689472d1fd2c096b7e8afb3e089a46b98d8b38
SHA512 6c32b1c83e03b553843faabb5a9c1b63c769b13de60841d2bc81f2c9514b30ebf16551acf33262ef8abaa4a5aa3955600a35a045b0fd446964109c58a2734969

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\fil.pak

MD5 2e6a6728bd5a09339ac01a38bf686310
SHA1 619e27f30c99eff8f2df3ba2287c6f7fe0b5b063
SHA256 e8f03c2e9c88adb04648ef93f9ea3cff87641638ac97c9a6752b751e7f7a8a20
SHA512 0452ac74eafcf971265de92041659c006b5e559919b895b41795bb1307ee7c302e873440b006485b7cffcdab0f6b908a119683fab40a664d5bf3591239427c00

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\fr.pak

MD5 8e21cec6cb5732fd2baa28f3e572ef7d
SHA1 778228dee97f5475b9982375740d6f90e8e5fe0c
SHA256 cd21cae54eb6cb115771d1afe14d17822e13332759f8710d6386a6e4277c11c8
SHA512 07726afa312f6104e3d92c6be13fc4b0e728a4a21f643c9552a961784063d3c8a9c52e5649ffaa9fd6a083dc5de37316e0d2cc10cd1a6fbeb83789c385ae990b

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\gu.pak

MD5 0c33e2a35eaaed3572f31e7b24d4493b
SHA1 278498568109ea7d6cb34c634316f95b04155b64
SHA256 0f0fee8a2f22f80a0c4a758e7f4fd90d40be4048dcab0d824135caa5e92efd5d
SHA512 4eebf9be5a8c317d2d2e8e9b1e607774f5c7c35af7d8bd6c80326fe3c6e2e05089f04485eedde8be8c7b71a7b49e407289f361361d86802c0463c5b6b296f2a4

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\he.pak

MD5 8b3957dda3c9fd903d2c4b8a5f686475
SHA1 36e45b4d30fd1e59ecafe095f405e0722a814a17
SHA256 ad20b3d634130c247f4ff954f1a5c56687523e5610f2ec6085e257126c4513a4
SHA512 1dd54ce0a1f30ba087a9d09b9aa2928dec3070788d7db3dc2bbd27fa6126f70fa1e05106a1503602b203fa76be914210a38d5dc9c6bb56c56857ef08c528c4f2

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\hi.pak

MD5 4eb5c501aecb647fa81fb4b65b0cb6d6
SHA1 5154741cceb272352f0814850e75b517f7f8a023
SHA256 71830814b8c7028a114a53a4e715ffa8da12f01d920455242a0cbc35fef48e6b
SHA512 2bf32962d4f018959281f6f09d149aadd901c21131ef25aa1199ecd73dc16e2377eeeb67352e030198aa280ac1fd5962eb226fc6481c654d8d332751a20329d8

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\hu.pak

MD5 2fef83993a62f73f8e4b40a6e28a085c
SHA1 8bae181f3eed8d5ea8fb0f912c679e608ee7c008
SHA256 ca4b4c7c7be45ea0871abf7d5668ab948f712a02facdc1d6bbc189b1b3522446
SHA512 6eed29acd38b662f62381a5c00ebfb254915a57de6fde8e6da77f60dffd13d4846b26b1897d710ef852bcec5728a4460becaed2367f1a06a066da77521701324

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\hr.pak

MD5 23fdde99818ba28131a6ba81decf2c1b
SHA1 c1a87661f80c7dde9a08a360d2f5b72f58042076
SHA256 08fc2b1e6b9652d809a7550f1343b3ee54ebcbad0fe74b009aab6ef926c0279b
SHA512 0f53b131d142c7b88081afa59f10e17be489c342f2e328d0e7bcaa18b5dcfa599b37ca09317aa9ae564e52a3cea06d79021eac6ab5ab38a9c0ec99bdce797e9e

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\it.pak

MD5 47c89f9ba4993e7cb6640c23f444e9cd
SHA1 0e3755d2835742b7aa4e1d5245454f7cf22a2d47
SHA256 95bbf94625cf0476124763cebedcf5ee46148bb6b5c006f86540a02e8d8c883c
SHA512 948e4da235cf7d0272fd7a99e7238596e5d50913886fc73fe35f9af17d1087f550a3cc3251ee6595f9872ef0b88e75725405382e6aea4850088e068d5b80922d

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\ja.pak

MD5 afd423713e28b3980392443f31dbda7b
SHA1 926560b21af422f22e1cca1a4a2948ff988bc6d9
SHA256 88383ddccacb53f3ce5918cd80b5dafb16b3cf1fab295e230cc15490600615e4
SHA512 1544f7a91b4b63bb80f651833a931204e44745bb0bccfb5564ee9af3149218f140b6adfb6d4ebb5ce5e82f5c345c098cae8a0637b274c42f6711aa53877b0bd4

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\id.pak

MD5 0dcb56f6b196199f7ed802c06b774037
SHA1 f62edd5e814d05cc4aeb5574fc63acfdeffb6010
SHA256 bd512e36a88f0d7e6fecc0b559adb2761589947fef9c253dc350cd8d6ea889f2
SHA512 e03474255bce20004788475ee1f546ee7830e9b9960023b15210d88347032b5376848aeadef3e953ec654d3905baee37279bfaa287af7669ca66e382a4b1344c

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\kn.pak

MD5 74f0e9c7c670a981d3651e0d189dfc47
SHA1 a2fd3037311f36aaa348805d57172f9e9b0680c6
SHA256 0c8e0b6a8398d7b9ab9cac634e4a7ce4453540358e79ac6e9c5633efb4182fe9
SHA512 2c555439f7de3902b2b1a940cd43977558c4d9239c449105fc24777952af8de592ba86a7476567d190719c66d38f7a7982c9b94278c0594de1b427dc546f2d89

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\ko.pak

MD5 c90a42bb27bcbf1bd345dc998f9e410e
SHA1 66f8bb72db6b38e2d288959bcee3c43caefdc59a
SHA256 56100d20a59fe6cb333f57ffdef90157324ae1b90194e852478daa8c46d29de9
SHA512 b5912c895a6a3b391555efc10b15d45fe9a84473c8687327b7d2fa033711e437e2f160345daefd554374357e0afbaeda4a25f4f69ca74e498d7081062f299b46

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\lv.pak

MD5 f8a5403bd91f231db58e77c9d4514e2f
SHA1 7d29e2d8459af6fc3082cec0d9638daf5275bf3d
SHA256 dfb9b5ee446977dc0435cff4d66402d3a9426edb106effdbb7d86379527c5956
SHA512 f491cffdc5cc588f7ec70f87be84615aaf5b39e9c990cd9c835e65beb27f26334517abac1af7419f2b7b18f94c369037c8df4c1c8e26a5fed4288d477dc0874e

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\ml.pak

MD5 fb1a6e31dfb4f4c78a50b4dbece0e1c1
SHA1 367c506478380f8bab411747a906f8f8c60df30a
SHA256 a7afb3ebfa8f4d2e35dfdd5554ff2702182e73dad0fd82f8b4207a61563ed134
SHA512 18afb816e974c9f0d669af7cb6a5d8761e1c5af69317e6ea293559876549692baf1567657b356ba9d52ecdf4d117b7ee7fe003d1820286470d43af89321e3f6d

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\ms.pak

MD5 2c4056d84b980267faadd69d52c17086
SHA1 3b3c5fcf182d86a170c8f35c041bf3869a82b362
SHA256 163eb7ba5f0c61acb6443709c24e38ca6370a33f89a12e13d0a57c258a87ca16
SHA512 47285ab42b46cf7d6556eac2a8f7afb9a9c9abe8cb026fe847b2504e4dbddd481a98c1ea959c74e31f195ecdbb618a3d93df8f20b797411a8bf2b3856fc9b963

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\nb.pak

MD5 23ecce10db7753622fd7cd956aa55212
SHA1 52affc68e91448d8aecf2396f02ede77d4ea664f
SHA256 29f38d3720c948fd261a2aea7d195e861a73a1313071bd2cbf1ebcbba77c63e6
SHA512 553543bef496052995e33e2f3e8bd66ac845351cd292623479a303261900c393cec35af3e0ecd57db84197e6f7653ffa4eeaf4950647ae2d5304f961890deba1

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\mr.pak

MD5 1675668911fd3063e092fe34579c210c
SHA1 d1d09041778599002d07a89848ddd79cf5f4f4db
SHA256 436efbdbce605c23f855644a9ff1b04d9a3eca37de3b18de8c3e589930d54096
SHA512 61c7aabb00700773bb55522e7ae9482d1d97ace936c9bbfeaef3215a976c411a51f41a2d5aa05f2b286b0d112b5616215b9fa3632eaee38b1ec090dfb29391b1

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\lt.pak

MD5 06d8db8aab68c565af14bfe408ae4daf
SHA1 0898fd0ee4d7380b93b8fb3d4a1816eb810ea9a7
SHA256 ecb4ecbd96575f6f984f60e85ab1ebb0067e73174ff9912941ee1aaa28516d93
SHA512 1ebc04cca7e3bf005f9befad5a81736fc572383a636c7237e4206e75b05befe49f967427f912c97758aa392f9cc2dcbdf07c471562cb4ccc90f7d8e951c3ab9f

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\ru.pak

MD5 6092ff0430736682e24595b37b3c018d
SHA1 9d2b9822556ab1f33861c45b2f7f4236b3ea5f05
SHA256 c5264fa2b485326e91d4df7a6e39122554ed632c0c17fa1f130205ed50e2d6b9
SHA512 fdd960f3295c280cc57915f7cabd7ffde0c0cdf4cf6b671748a6f5b8b39376141f2a552afce3e2a428ba18057fb9890da9b95fc6b8367dbda5430e1b205a08cf

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\sw.pak

MD5 bc771a0e8398e14653d9a4373a73496a
SHA1 6e844c7daa666640ac3093d5e51276886a0f5a66
SHA256 7a5d056fd317b7b60a4fbf0df39dfdd21829f2245393a21e1ddccf1a4e3b61fe
SHA512 79b916c737bc44051e6b4c0a9afdfba26928536034c5a5149586594454855b7074f6f8fdaeb98f0b7bde5c3da36d66988f683de8961e13c9c82301676f942998

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\sv.pak

MD5 094d69544816535e4d040ef0ce923100
SHA1 5891cdc73bc4c112855d099ee112da0c3e9cea81
SHA256 110112c2f7ff5d3c8599036669d156e96ec19e70515fbba3bbcb2043ab994680
SHA512 023037077a3482a3bf2ac076b5c00922d7039bfc2098797275465138142fea0f97c1e003f77de71b9ab88f786b7401182618603610c51f634ad17a123faf5bd4

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\sr.pak

MD5 4d1ee9487f4ddfdc4471366d3965293f
SHA1 4e53084fe0d4bf4f46ea980f7423787084152ff2
SHA256 b75a222db70c3f5734a75042718da599881d5e84cc52b332e9162f78b32f4819
SHA512 a44a448203cc9388d8df4c39be9db5436546fa17add0975c18ce01ea0a5cba142692660ce6efbf00699793ca98af8e392e41a07dcd9c183fe03414574389609c

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\sl.pak

MD5 1b02b0834b8bbd12a77f7fff09e1d81a
SHA1 1898cfedde55aae307f7578b88cb0bcaf61e1d52
SHA256 b36e1fe2405cc4b9f34587e30da2feadaa6f03124769b02f79333adacaddb49b
SHA512 b1006053ace6f8842e9436c94934b2e7d1b502e3df9ecd1fe59ab39ae35e69e8f0dcff8728aee2c35a3a1eb7a27f0146d6113b4de0632dbab20eb0a37942bc4c

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\sk.pak

MD5 b88ec1f7bbdcf1b6690f2698b3dff738
SHA1 c5975de1d66827087bbf8cf0f4b3bda816a723e1
SHA256 04b179b5c3a5468f495a0620a2dbc6e312ebd76ba32b98d8cc7daafb46edc21e
SHA512 ef30ac14b17b71f5659f33778d8c4b017127c3c5bfb593dca919a80320a66dcf5e0a3f228dcf62b05df5d4d6929eb5401ba9c369affe89cf541633bb743553f0

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\ro.pak

MD5 e66343d1af0b8f483116ad7689e7faba
SHA1 a245b6aa9309a7c10aca8502cbd10d9dcbd5d8de
SHA256 b7b56396806412ac1721d2648fa98a89a069d1f58d359d8e90dd1c6b8473b9a2
SHA512 9f6517aae57f3d8a65d4f9b354b7ed9923c1bab8a414b78347f4dc375707907d16d458d9d458d8fbd28f065e268e092770fbc198833315ce14e6eecfc0d3f0aa

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\pt-PT.pak

MD5 7074036013be3839e218ec7b15d49215
SHA1 7711ae4e96efd4f4676a3c0281a92af56329deee
SHA256 342381f89058bedd809991a0b416f48642df3c71aea10bb13e13bc15eaaf46c8
SHA512 8a1e9cefb8a64b3664d9496e2d2f76e2281b3c427fe24ecb70ee74f78778d94def66787a7e35ccde6037ec061e29a6ac7fd8b4010f77b13945780e1316bb16e0

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\pt-BR.pak

MD5 4f3f65f6639ae1905fa37b9b6ee2e4d4
SHA1 07553f41c4f8f3d105eb92b65497c4976449a6b4
SHA256 b4e0a6064dcfe876c819ec4b00f9857b84ff52cd3e845bd0c48e31ad43a23db9
SHA512 85cfcaed8fa2026c13735e7d4b6852bf794dd4a8ac078889d5ef46ec2ff7173ae443addcb0b0c711f6a31f80469fc1df5af1a78da6397d9df5e33cabb354fba2

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\pl.pak

MD5 41cb68de75d011281c7936194ef8457f
SHA1 6bd3efbf5142769c6fbe8478185edf89f471716a
SHA256 d52358b8fd70f1f18b3f8ecc4aa9c791591dbb698ef8d8670312e50f024db451
SHA512 ceb90fa9f723c3d8d522a401cb46545c72a2ddd1d04f091e9d7ca5212cedcc641c54cb8fe19595e9c823b2ed374757e5ba7d1813cd763bbd8d726b1e2ebe0407

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\nl.pak

MD5 54817be286dbfd9de461f42304eb72cc
SHA1 79386881a11e6c7d49f2d117822c29d7631f3830
SHA256 3c682e37df71cc036c2b5e91064407fed8091c0306a856121e28c19e7110e1e4
SHA512 d8f922b028b03c6379911308cf240d104b40a9c46f67a6ddbbfcd20110c287e8106376cd6e8295915d054e05b2a8a045b3ab8d98932c1be97b1f258525db1a68

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\uk.pak

MD5 0ed34d4a274d21d3376ca37df97b3017
SHA1 3db12dcc6d1e85d4a497e4cb1cc8103f4a9565be
SHA256 0523b68c3320674d1565dedaf0436ec821a7175a34ac673338d6447aab20fd7a
SHA512 6a5f4c02a23cabc79ec69738778a6c62685cdbe0d8cbeccd830cd75911e00caac4e1d0a1a2165f4cec070e7c417d0ad13e03fe5d7e89c3352e6f2d25cb6e2f06

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\tr.pak

MD5 418dc1cdd7ccc10679523665e1626280
SHA1 d4407ba9bc55153963150e6e30f23cc5b2304e30
SHA256 26fd3317bedd4080038d7a0003d73923fc0edd40283ef11b5ba80bb27f946c13
SHA512 4a907bf14dc9cd8ecb2f17152ff5ea0a6dc37034c95ed31a445395bcb9ad6fc23d4117e81f94ac82d767869b0b828738eacd33b810df87dd41cc3ec2d5b92e94

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\resources\app-update.yml

MD5 9fafe2931214f36d81e3632b0be80774
SHA1 cac08ef88b787dfea0acc0d18e559fd9180819ba
SHA256 9161bcc9763091ff3670ef98eff99d004c0f67f13b5dd94715c661fae274cf33
SHA512 a671cec02c8957864797cad7657b4d2165b40980410db0696cb6dbd05b9485f0491065f1249461fb7777d73cba601f8d1035c9c2718a52a56a217da859c03217

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\zh-TW.pak

MD5 c1c8f601f2d0bb06b49d870c80904907
SHA1 6237df5d4580afccaa6a07f35729f9e2737c82a8
SHA256 69d888be9d5affc6086e901cf52936477101374abd8186f8e8f6cc38af826691
SHA512 2d68f116cbfc77a17b9fb550addbde95ca09f10ce1745d5aacbb9e76dd4d041d6de8e423844266711c64fc6733bb805311a5c8838f576d049340f32d4e0eccb2

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\zh-CN.pak

MD5 d15fa5c75a835983af2663466b5a8494
SHA1 6580f7c91e31491a296a039f681c93810281717c
SHA256 b33b23552f8f76aa43671556676298c0af54641e9f1de27a8208750148e737ca
SHA512 39a63db44e1e2b67b1937af803336b221bbe94d3bb31b2117530886fb9e66131efd0eb3969c251d2ee264a7c07bdaecac330c97b1cbe74b3988cac6ff86f3be5

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\vi.pak

MD5 7b2cbb79992021e2fa2714ae9cdf0728
SHA1 a543c9b6d4dabd48c6b5d995cfa3c915a2b76433
SHA256 326e44c27579796e4b55cc281c3e4c9bf5ad7aa87156530709cd6296350758af
SHA512 5c77c2dd9e5ee9d381a2524c733d3ffb55146160393bf919ed8855781d1e8ed0c4d707bd71554d7868ff53bc546344a415e846dc15f68f0e7630d49a94f14049

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\ur.pak

MD5 8d6fa97205a1d2b371a54144aea453ca
SHA1 11a77318f571d15daf7ad047b06e1ec8a51c8f8c
SHA256 578aef61fc8b5c2e0f3765b1487f8af9f72f6506050d501fec9edcbf93c7a3e4
SHA512 9c8dbf1126b97bca195c801b81afdbd8f68e8f44ebd57c563d63f6c1a3f7fa08b1abc76e25a28d1eb2cd8bc47c9438f23b72063f081f0bce6b8f48bd90a56433

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\th.pak

MD5 2376dc182234c3f1188dc0d6e1840453
SHA1 2dd35d89e79512e37b721fa697cb2e9e07a1d1cf
SHA256 610a440605110f1aa18b1134d116c66cd2050da53e0360924a3171d0850c27fc
SHA512 7c81fe0c2172ff49b6ad9236762fe81e0a786991ca6c6e3549bd66f9cba3c14d96f8560e01bf3681355d6155a0b1b9cb5fa0177137f71ba3d8a1fb6fded29e38

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\te.pak

MD5 51356402af92c1912f185b6bc9aa9026
SHA1 60ccd65d7ef35e5219f2bd1eced66e1ba984a8cb
SHA256 11df9eaa9216b091fab01f66fd77bcb17c0bea0db3ea7a803bdf5dc6c6e18322
SHA512 8ddc7946a9445a832b4b3b254d24e12d66c42af8cf7dc13add4cd3a9ae50b83e5178830300c0b08aa145d55d79b868efa9d95a116623044d7df8eac1a6556632

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\locales\ta.pak

MD5 abf95e05d798043abf4f2f514c0517a9
SHA1 b8c6c1cdcbfea03fb106c7a44385a3a8e6806aa6
SHA256 9cd624a97493282afed3b9b1e848b12639234fa54c04b22128169924f9c92777
SHA512 aacd7439df84ec76a3d0c69c39341b51031b66b24be53c87f3ffbced989b38fee416b19db2c3b36904eaf88f98b24e1e26f070bcc8dfb4ecc99dc7bb6f6b911f

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\resources\elevate.exe

MD5 b33d236ff8fb7aca592b9e1e12c9da4c
SHA1 df6e78e4127f7e3060547b8ad17b2d49362e2421
SHA256 e439b50cdf14e2e9fe147a0d819ab8e675151f60f91c5c356cccd42edf4b22aa
SHA512 07439e198fe7c8ba96f9983202c1a7ce3f4f84b7a77ee8b8001771f74da595e8d11b7ffc76a4ae690d43aad158a3441ba65a82568441753ff7e8b72086c19838

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\7z-out\resources\app.asar

MD5 f175866d7a270742089961f6e2477d02
SHA1 4efdeb3d9b18b039da713e497558cc9920d2b053
SHA256 5afd68a72b9a4b335f0692f7f440a0212e0832bd3ef45e1e641d1f0b07598dfa
SHA512 7bb2f2210cc52e2836e3eeedce34e6fa3ddb9a165ed57addee6e0aff41c900b0da836ceacc2e108b55a1a88972482224d0c906111adf869ac992c921480295ff

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\package.7z

MD5 6be6562a018e1e4e9be77116544aff4c
SHA1 fc68b67af43262c040b94103c7d1488f2644be85
SHA256 e655429edb1369dfdd8d4646134fe6d78f0cca81120f06365672358c34d2e95a
SHA512 325dfca17783713a4e6fa9051c6e0f15d06c828ebfbdf7844d46c97a3747ca880178fe8bf4738fa8624bb685ffec49b5a068052d574d99481ed839764a21ecce

C:\Users\Admin\AppData\Local\Temp\nse38E3.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

MD5 afde2f7fafe7146ec1888531af74b0e1
SHA1 53a4bd8a0400891962a56adc78ff4e2aaf171e44
SHA256 b125cc6bb7c7aacd5a83d5f2e79e85ca879da736a6780d9f622c5304fde6206c
SHA512 bde467de3e6257e25560b966b84b2581ed50f5912d0e123ba223ccdf876396b85775d44837a80dc57527fe12e7acbcd49eb5d0dddf4008f2102a4309f178bbdd

C:\Users\Admin\AppData\Local\Programs\launcher\ffmpeg.dll

MD5 d5e1f1e9d0ccfe7f21b5c3750b202b4d
SHA1 74144ac93c0c58a9b9288bce5d06814c9a1b1dc2
SHA256 e1ab367644f72ebcdc8eb3fcfe829ff51719559ac2a43a1600e712b16871ad65
SHA512 dcf70d43f1a83c424be99c38e33e520c72115c3d30945980e5e394d460462251bde309e543213b2b08dcbe9769d11d46792e1cc99aa42777fcc34d6f3361a3d2

C:\Users\Admin\AppData\Local\Programs\launcher\icudtl.dat

MD5 755cdf21724db9a0e40559f07d1df649
SHA1 dd862f29db377cb808d661e259d9cd47c3af5e99
SHA256 ce43a2c4eb37ea0797efb96239f9145c4231ff7e41c88612420d87f123fd4780
SHA512 deacc7d4f2936e682f72197a6422d027f72f35bb5f0fa9e2d229a18800d173c01fcf6d88e9eba482f2609094d9bcb1bdd0140c4c4b9a26a8e36955b6fad0ab2a

C:\Users\Admin\AppData\Local\Programs\launcher\resources\app.asar

MD5 538262d7ffbeb4985f08971b540b877a
SHA1 2765d0d9ffb8e397575750878cf33dd77e22d014
SHA256 6836b93581b62c1ffb49ec3eb59c1ef9f478b1fc35fcb1e27eb1da3b2230d3e3
SHA512 a07ba2aa2c24c1dea43bbf5a0111a6f9b91fc0b47efcd0ff80b08c922b6cc99f6565a745642a7d921b90d58a18d452a9f43449bb0421e3b914fd8767c65388fe

C:\Users\Admin\AppData\Local\Temp\ccd5a261-ce2e-4a88-bda6-e6f2c4ff7724.tmp.node

MD5 21b516d2f425d6a7e0a70ecca543028c
SHA1 732cbba5aecab1b52486817261ee2618843afff1
SHA256 7031bf1b506c31245a6505722a4be79684bca41ea65b271b314d4466032530b9
SHA512 2367692e74a2c2aba5cfd2b94504bf4e661c41431a06025010794b133a3d6d9cad38fbbf356ff32db228746a37034c69fde3e9efb8f13a11d8643f1aa88fc358

C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

MD5 1eb4914a6db3ed0b653225496be0de42
SHA1 69af8c78646e3366d6e33cfe49ba92476c814bcc
SHA256 dbb7bc1019e7ee37bc69099aa94668fda4355b6c56059cdef020e910ead0731d
SHA512 ef700ccaf958b7bd20bd676b1fd0f06c8ac385fb71e5c226c32455907df3397c845d19edf54e0867e1af0587ce47631eac9029a4fa558a8e4a7fb9ebf4ec81b9

C:\Users\Admin\AppData\Local\Programs\launcher\ffmpeg.dll

MD5 cbab6d426d8df82685478eab4366eec5
SHA1 f5f212a96b431f055f47461f139af13e3eb46502
SHA256 c808d1a6005dbe1151d7a9d2f1c0b21067e04c8d928cdef096a6a762ceccfc35
SHA512 9c8c2e7f9bf43211a1ac821492f75e46d6048df7a72d584c79bc81bd66a487ebe6fc423e72604ca5fc46d1b6653a5759eda1a16b7daddb2fe70849de0954246a

C:\Users\Admin\.lunarclient\logs\launcher\main.log

MD5 74494330665942a1f86f3f614738f250
SHA1 ae1c8f0f5afbf5a8fc14ff3e5e491dabba955bd4
SHA256 e296710ec1d0e4c69120c00b9db6863b008f35ecf81f621dfc5598df80760b56
SHA512 37eba8d75674b8a43c96abbfc3d00d26f5429d526acd7c4ce762c08e857b61c878e70300074eee943de4c0a5aa9f1f99dcda4d7d93b65db443d86d61a333d0c4

C:\Users\Admin\.lunarclient\settings\launcher.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Programs\launcher\resources.pak

MD5 02092dbf7c03418515509f13598324e7
SHA1 49aee23647fdaba2ed7cc91eacbe2d8bfb4a765f
SHA256 3fa1fd9a7dd38796af6c4581a988b0d81abb55376691ceb7ba410203d669aa1c
SHA512 2c17e6c408f9f06f77406e47d27bd9624f0942d53926beb8ccf72f0a4de01bf618e2d1ad5076110b97b7cccaa0aeb3c1b6d96f6535ce5e510358a3a9307df40d

C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

MD5 ff4cb69c091be0fe4b64822ab1113479
SHA1 1d851e5e0dc2fbb98c7e2786d5634947e919a21a
SHA256 9b85715e93416c8971c10bb8fba53120a66fdfb8af8627d03bf18c28aca9308a
SHA512 c2be39513061276c91d966b5d8d1b2b47ab9bfc0a034d36c939443ae6936b736ef78ee779628a7dc16e5c74e3739792188d4215c5df779c0ae6528f11103757a

C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

MD5 cc6f5b3f1681d555b2ba67d5b9dbb7fa
SHA1 59c2f25e8a211893ec050ba1006189ba6a651e2c
SHA256 f6802bbb00b97d1eaba1568543d4b282f45285e128e650002a082489a6f22cc5
SHA512 87758c626971e1d9b4c0accc2eb21c4e85ca11ddcc1f57df8c0014128280302981ff400834593d03fc00e6d43a12297bc9615b8ec86a07ff414bed3ae712af0c

C:\Users\Admin\AppData\Local\Programs\launcher\ffmpeg.dll

MD5 07a8b9f58b622f0b4748d75c80656eb0
SHA1 8d014e8798592fd26ac3407917c95bf5ecae6a31
SHA256 53633673858ed35b8c8830e94c97f624ee95219ff3eea011688df823c7816527
SHA512 9fd2e5d8c80cf4b17c9778e7de644499428f6426b43fd045f3172d80dacbf48aefbe7dc4f5d2a5c70a9acaa52e49ab98cf35cd8183087d2855e6e916f43b979b

C:\Users\Admin\AppData\Local\Programs\launcher\ffmpeg.dll

MD5 ba8ff4505ad97367d8011080e406fdbb
SHA1 6e49eadaf921158d93a23727ca06da7e10094094
SHA256 3c1cbcd58fceb41064e2f60791763071289d3590fdcdae42ccbe57046b9e8180
SHA512 31b88892d960adadce86a5f837d470001df085cd63f5d6549ce50eb74912bb389380bb5dcc11a46ecfb623d34432e17a4bed96ae6eca9c9aa60be5a7631bc983

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

MD5 4cb3b7fc5fd6c4398bf78f7f62686233
SHA1 bb625e0cca3f8f249a47823bab6c49a9ab27e2ee
SHA256 96be210634d2813fda4259c010447480ff3952ef01a6982506d1cb2365cc0d02
SHA512 b850b22f0879daeb7b55b333c236d8d843e9ef4017045bcebf89eab97562241a80dd89c1c5e95a5a2d6bb9edf87a646ac33aade853e3bc826816d8cbc80f106d

\??\pipe\crashpad_4416_QKXMMASVQMMMYPTI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Programs\launcher\vk_swiftshader.dll

MD5 cd9763a282379e6afe63051715ba0b1f
SHA1 beb6081e7111297b81b8d8a0c54b03c3f040d587
SHA256 da5e72be3dfe416cc9cf5eb7a5e55a31f4ccb337cf4cf00d56a12c20fc390679
SHA512 74bbc6c98ceed734bd9770529871758f8657c3727e8904c5e6c93336937658720b5056c25e86b8f541d58e3a8f306cde8f78975e421442fc1b20ba68e9c01f0b

C:\Users\Admin\AppData\Local\Programs\launcher\vk_swiftshader.dll

MD5 e0fe38322713a0d2d47a479f52869364
SHA1 6d52a16d11084bcaf5c3ae77eca0f28a8f2c87ff
SHA256 50fd07c044a1ebc8d9b88c22887a83279ca3c03d9265117d4f427b441c803753
SHA512 5e34e194929a908d6b64f2ec624e0db6b6bed5328fee24916f3f720852dde92d7b782b993a250bb4ecf92766ff790159d734450a9f4f6163b77d3c62acbfb267

C:\Users\Admin\AppData\Local\Programs\launcher\libGLESv2.dll

MD5 9c9fa8d9f592e5a6453f47ffbd2758a5
SHA1 4d4fe9b1b13e44342766644de14a27ec7d76b3be
SHA256 2528646008d1deee2affd8a3a807253a3e67ca3ed974d603efe291d6d7559189
SHA512 88e2f33a7acf97a18bd763c7e40c06a1f7a64590149becbe5591fb5cf6cc4423004291dc84f4cdb986fc530402eeeee5edfc9a7bcf6f83ba0466b6573a2e1059

C:\Users\Admin\AppData\Local\Programs\launcher\libglesv2.dll

MD5 37a3eb2043e1d79e4969ca5006775b6c
SHA1 5fd67d1fd00af0a265429f6beeaa3695f5487850
SHA256 b4dfd6eabf596a67493a2700247e65384ffae205adb951804fe4cdca39c0af16
SHA512 28609ba3dd0e5da98e64470dc55d78f755ae458158b386dc3ab5a7d47f0727088f331bde190ebf2e6fcd79cd1746ce8d2ee406d177fe0d64ad59cfeb32901f28

C:\Users\Admin\AppData\Local\Programs\launcher\d3dcompiler_47.dll

MD5 6807b320ea9ffa83398eb17201aadf07
SHA1 b9c6d9fa228ffd56127093963a7c471e3c252b58
SHA256 c9d1a82eefefcb735e0063ae31209ea787df847ac4b7a985e2260c3742c5207d
SHA512 44e12a98a4f5418ed2cf6015b9c4e0d95b0309cc5a3cedce0ea8e93ad3389de8300d1fdb523d059a7da53534f170cf41e5863d7e632583d378e11abcaf98b2ca

C:\Users\Admin\AppData\Local\Programs\launcher\D3DCompiler_47.dll

MD5 2f5400f6892f05831660e2e5a40a2385
SHA1 6a58e1406d4285dc7f6ad240b0f31e6dbbd262dc
SHA256 6a73da25055efe207cf93cb38b4174aa0d5763bb8b3efb84a22b073d149a088b
SHA512 952e0f6f6657028b19045e34408d229f556d0ce396875cbd8d20bda81daaf7c02b7925b80324fb594a536784b654887d45f51fcfe11d9e293efc1fa3462bbf7e

C:\Users\Admin\AppData\Local\Programs\launcher\ffmpeg.dll

MD5 d689664b92b6b1aea5896d4312a2658d
SHA1 91fd680b6b1ea45801d18b42af215977ac7662d9
SHA256 c41cdf91059c7c463ecb5404ff433f9a8665b12c6f6264ce13a5dd27be5e7fa1
SHA512 cb58b5be99fdb1c80bbdbdbe9abc7cbe555f1ee20b7070f1c90192c7d871b4c93274db2baf50d53b76367813044d69b4b4fec855cb11ae359926ae6e0a61513c

C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

MD5 a3199e6d926039c98d95c31e3ad9f957
SHA1 c809c8bf24782902dbaa8d2ff612a795c1dc0e02
SHA256 f1cbee1ce9c2cce12ecb8518ae3198d7aa000b42af57e9ed3a4e35f128a0aee0
SHA512 d9974909e07b8a99bc8ca295bf301c1b1354d6c291b0b11d6e6ca8c8ce5994c1d0399c0b0b120827f75cff346c42a0c9305a870852de04811c5d1f7ac31011a5

C:\Users\Admin\AppData\Local\Temp\2de11f1e-7e1c-47b4-8947-655503637285.tmp.node

MD5 61569790bdb081c429495ab7f673132e
SHA1 70221eae0e7694829a8ed7b48a008570ac1cf396
SHA256 1e572b31a51b42ded07c3cfde7e5832136bf9dd4aad4c0956ac1294f672ac08a
SHA512 b4b1acb5228b3882b839d409bb290c3eb9921896b12e59026ee8425d22d39480bce5fb5de33c3e8be7ef509ab001a3d09e1f6a76286acb0304b699a96315956f

C:\Users\Admin\.lunarclient\logs\launcher\main.log

MD5 875e58cfa789d9abfc7f3f5a142fabd7
SHA1 0dc2697ec229db30ccde419b65bf2c17c71594b1
SHA256 7dd7205ef567d86311a3d7bdc1c3d1a799f6c57d5960749397ccc8688ba014fd
SHA512 b593c2b773807bed29a07347e2f7655fd9ca6da3c418cb3c25beb6a1b018d6607eb72f24cdaa26fe55914cbfe8b3445698cb6ebc7b917b277c3dad7a646969fa