Analysis

  • max time kernel
    65s
  • max time network
    66s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-02-2024 00:07

General

  • Target

    Lunar Client v3.2.3.exe

  • Size

    1.0MB

  • MD5

    0814a485d44ded97e275e8e80f6c17ca

  • SHA1

    69862f6fb82651f3a097fe7554440537ea0f1a90

  • SHA256

    560b03c4ba18e5a443f74a69727db0eabac6f455bb836757d620cc51615a92ea

  • SHA512

    bd9abe5bd35d21bb57be9e757a6e7293f9e71738045fff6b53788e36bd442d1b8af21ea38a528ea0910434cc32ac610fbaf4200a6faf615828f47d8b74987dbd

  • SSDEEP

    24576:s2Oawk0MDhozjDu173pG1szLSvJwnHNiTWQC:MkPDhEjK73pfqvCHH

Score
4/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe
    "C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Lunar Client.exe" | %SYSTEMROOT%\System32\find.exe "Lunar Client.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Windows\SysWOW64\find.exe
        C:\Windows\System32\find.exe "Lunar Client.exe"
        3⤵
          PID:2736
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Lunar Client.exe"
          3⤵
          • Enumerates processes with tasklist
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2488
    • C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe
      "C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2600
    • C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe
      "C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1816

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

      Filesize

      4.0MB

      MD5

      38ff54990cb882f8ade612b5e40982c0

      SHA1

      7302bb47e943b78bc1aabef39f0a4f78f87c8af8

      SHA256

      a4a7369e33273d37fb643cfadd70ffad936d7f76734ac38c0abc730fece542c6

      SHA512

      530e63682efaffd91536218caedc2a624173fdeee40d097ae4ae5114f4dbf057e6694faf886cf633c0ccd7f95899ea303c625d85328c30eb22daf8cc2ee3532d

    • C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

      Filesize

      2.5MB

      MD5

      50d8c0ed97c8a6b150ddfa980956b198

      SHA1

      c11fd246e81c71c037a0a271340cc1a472bf673d

      SHA256

      92c62d678fe22cb2416cd4d90383e860b58930927b57b2a1ef92887a8d83c197

      SHA512

      affe117b441975c689154fc0da43a4aad55b8397598d09151bf0b5ab84c85219a21ea623ee27fed91d928c913376d0953299a160abb5e78054dcb666875ef94f

    • C:\Users\Admin\AppData\Local\Temp\CabAFB4.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\TarAFC6.tmp

      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\LICENSE.electron.txt

      Filesize

      1KB

      MD5

      4d42118d35941e0f664dddbd83f633c5

      SHA1

      2b21ec5f20fe961d15f2b58efb1368e66d202e5c

      SHA256

      5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

      SHA512

      3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\LICENSES.chromium.html

      Filesize

      5.6MB

      MD5

      45a55589aaf60971b8e5a6e683f20078

      SHA1

      bc2a558988ab5c2ef137a9c5b7edbe8620a56b64

      SHA256

      e3f81353b2ccd13a80dd7acd3f4a2fbea3dbdea72baa3a21ab1e42f15a4e9091

      SHA512

      8b9a2a274b8405f171f538535e2db76c66e48695eda981193a46f79ebaad89e30982dea69d08a054ea676009dfb1712620db98e985cec0604d99317dc176432c

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\Lunar Client.exe

      Filesize

      29.1MB

      MD5

      dffe2c2aadd2cc5d8943790610b96552

      SHA1

      3c64a891ee3cb5b79c5dccb3e982d3d328c0b9b3

      SHA256

      c7d167530236b614af8b4ed555a99bb6848a45b890b360a622afdff4bdb33b98

      SHA512

      ea98feaec173f07705081216cfb0e5117749caeb98e21c94ca2a567f6dc9079ed3e9baeaf1ebf53ccd2c7584d70491537fbdf4cb246684823061ede9d11fe31b

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\chrome_100_percent.pak

      Filesize

      132KB

      MD5

      443c58245eeb233d319abf7150b99c31

      SHA1

      f889ce6302bd8cfbb68ee9a6d8252e58b63e492d

      SHA256

      99ca6947d97df212e45782bbd5d97bfb42112872e1c42bab4209ceedf66dc760

      SHA512

      081f3ee4a5e40fdc8bb6f16f2cfd47edde2bd8f3b5349775526092a770b090c05308d4289ecdda3d541cf7f0579ac64b529930fd128edad9b0991dfa00b0e9bc

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\chrome_200_percent.pak

      Filesize

      191KB

      MD5

      81b5b74fe16c7c81870f539d5c263397

      SHA1

      27526cc2b68a6d2b539bd75317a20c9c5e43c889

      SHA256

      cb4fd141a5c4d188a3ecb203e9d41a3afca648724160e212289adcac666fbff4

      SHA512

      b2670e2dfa495ccc7874c21d0413cfbebfd4a2f14fc0217e823ec6a16ac1181f8e06bfe7c2d32543167bc3a2e929c7f0af1a5f90182e95913ba2292fa7cadb80

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\d3dcompiler_47.dll

      Filesize

      4.7MB

      MD5

      2191e768cc2e19009dad20dc999135a3

      SHA1

      f49a46ba0e954e657aaed1c9019a53d194272b6a

      SHA256

      7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

      SHA512

      5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\ffmpeg.dll

      Filesize

      2.7MB

      MD5

      d5e1f1e9d0ccfe7f21b5c3750b202b4d

      SHA1

      74144ac93c0c58a9b9288bce5d06814c9a1b1dc2

      SHA256

      e1ab367644f72ebcdc8eb3fcfe829ff51719559ac2a43a1600e712b16871ad65

      SHA512

      dcf70d43f1a83c424be99c38e33e520c72115c3d30945980e5e394d460462251bde309e543213b2b08dcbe9769d11d46792e1cc99aa42777fcc34d6f3361a3d2

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\icudtl.dat

      Filesize

      10.1MB

      MD5

      2134e5dbc46fb1c46eac0fe1af710ec3

      SHA1

      dbecf2d193ae575aba4217194d4136bd9291d4db

      SHA256

      ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41

      SHA512

      b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\libEGL.dll

      Filesize

      469KB

      MD5

      dd78b86b3c92d61c37b44ef5b157cfe0

      SHA1

      4dcf9ebc3ff5ca552c0e83469b921153b29aea1f

      SHA256

      e142752e073c0051a0beb963981af70263ed673959515545521a7941d3230838

      SHA512

      9d071568dc56db2ab93d034d07a11a477aab8ac50d9ea3c4db3ac4866fcd3c2f3002ba7a3f2c55589a9d68463181fc7a03327dc164310d7e80e30cc6f6bf2423

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\libGLESv2.dll

      Filesize

      6.6MB

      MD5

      68b3557c62c20ced44bdf7a061e03dae

      SHA1

      1b41615550efcd77a6eea1b9bb942ca5fb76af6f

      SHA256

      58a8cd3024e36afe69a77730e5c4cef455b9589d1bee6cf8258e3cd8824c4779

      SHA512

      ddcfeb12b0fdf0e88351ae6459523647af07179d70ae471cc938e99f391b55753f5d216b2ce405eee37f5071f6a37d0c51c973aa28c9918cf70f5255b99544a0

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\af.pak

      Filesize

      381KB

      MD5

      b293cc5ea7db02649bd7d386b8fa0624

      SHA1

      32169b9d009b7a0fb7ecdaf650c989e956291772

      SHA256

      7bb75adef02d28819f1bd3b42fa46ed56d6dfbeae072341997b09b8c1f52d8dc

      SHA512

      496bc72e7b798d02e453eb96d20566b91405bab774521527ef882c1fcb58f25e2d0718013ddc0d23f7fad883f4cde93b57c6caaeba8cd18a09665c9f6245f557

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\am.pak

      Filesize

      619KB

      MD5

      4cb4b30911e9fbfe6c1de688cca821ab

      SHA1

      58cc2d8e954b5c74a902f13c522d1f6836769623

      SHA256

      685ecdff01d4ae92be1d900ef00fd8632616bc41f18a56e682528f312d4a5167

      SHA512

      6629af841c52463c46dbeb03e3b4b1cad550c2db790c75365d63512e039b3369cdd9f18316e9c50dcf3aa77aa4d2becb6a87570f3b538b456af3041d60393434

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\ar.pak

      Filesize

      680KB

      MD5

      7294148ba219909a4909613381ea45ac

      SHA1

      a8a70e589760b5eaeae1a95fe51723cce48fca87

      SHA256

      acc1b352ea206c25afe88a614346b468f4f78bf23f886883a38dae905d121dc0

      SHA512

      cabf320e827067ef8efb7c021ff098430054d125fb50540c06d12167c7d1c6d08449e6a1b33fa4a092ce6c81a600415711005e100b1b756a199e05ca18dbf3b7

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\bg.pak

      Filesize

      706KB

      MD5

      080cffa1d4032b7d4bfa217aa00c4f47

      SHA1

      525cf2baf62ec4c90e3a1d89cce37c9f433c61e1

      SHA256

      3fd27d562e32f1a052e924b6c468486acf0b2af42dd1ad2270e83d115d4b3f65

      SHA512

      9470ea433a7c08331ff26df00170c81309e72145e6f32c16e7c2c1e53c54b3974b991ea128e636138f8212e276a2fdf94c344d9ab7fcee35ec231543e08196b0

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\bn.pak

      Filesize

      911KB

      MD5

      bea57ab3921250ff4dadc9f42f8202d9

      SHA1

      ace7fc0579a946d32419e8c5ff9bc64d40e53364

      SHA256

      2bb70dc94361267e755169dde430ea31aa21b4daf31b5eed78901b27bc596a2e

      SHA512

      164f5c081bf23def7378450dfaf4db1ceb49595351de5d933375d9b1b409f7bc2dc96c4f228a7f024b7ac891a27603ec174ee8b3a7937bf678d61fdcd3e4c7a8

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\ca.pak

      Filesize

      430KB

      MD5

      2cddd012546caf0aed6775cdf5cfdee9

      SHA1

      cacce951770feefd1bcf89de5be97bb39606e7ee

      SHA256

      02d60b97f70c31f5c5003108321fc3ac3c79bf39a36392c3adaf7735b9cc1c1d

      SHA512

      b75d9b2946b11b9fc7430c5773835422aae6e716504d7841c1b08413ec18d454d9d6faa5ed63e19c59ab2e1ee919822283fd7e21a97f54482685d541e4dd2519

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\cs.pak

      Filesize

      441KB

      MD5

      6d43974c98037eecee8691520de4d63e

      SHA1

      e15672b3ab22a059b976d245ea3f59d35c3387d1

      SHA256

      c1020222b90558a6a8a07f24756b183594641ef77562d35e7899e1489d0ebd8e

      SHA512

      64e76499d56c3e32cc013bd05e2d3eaf5618527b8035bd5a37f5018a1e6072cde4a06f7c66921b9b087e60ff686ed63b7321f0295a34451443797ffa8e5cea35

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\da.pak

      Filesize

      400KB

      MD5

      ba54e3345d61d5cf431db6a0d649f792

      SHA1

      32b2edc19df7e14e6567e0faf671c038f78a65da

      SHA256

      dab543bcc1a8abf057f720f9f448e45ca5cfd1c424826bce8933174bb2eccad7

      SHA512

      5f858c4c876e1d15d4929464b7d9bc2cc497eea93d887c3cf0cc1c651a0f5a81d75f04f7a0b4277dc43bd9deb148d147d35fa1aa2dd218d404fa2c8c389ecb5d

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\de.pak

      Filesize

      427KB

      MD5

      46a45fb8e7880802e1624df86d254973

      SHA1

      13778b3bf0101c3894fcb228080c25ebd47dc046

      SHA256

      6283ec48cddd08c387a36ec71fff87c2ab0ef27449e8971eba2d76a6136b1708

      SHA512

      ffa8ebaebb3f057440176f123442b13b6f96842b9688efe6633c0014f0dcde982e667b0f2dc84a1f6450e310a8e05a13e35ddc24b1de8d25ba5a711d8b07d357

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\el.pak

      Filesize

      775KB

      MD5

      7f92f844b9d8bef68dadbdb85a084bd6

      SHA1

      96c508fc2b624fe9c2945e2d673a645fe39ad3f2

      SHA256

      87f0a26d73fea2ebb5017a95e937e08d7c347baecbe93514c1b866c1e28dea32

      SHA512

      d47eb475f9ca60bc1e7ec33fe2e2a395bb8ef3f109bc4b769fc2e03e2ddc04bb3391b10f1b382b7497555e36ef02fca31cd47f67c03de43d275bbddc3bd8e7ac

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\en-GB.pak

      Filesize

      8KB

      MD5

      f4f54d75ece484fe34c6278aa2727577

      SHA1

      0c2312f09db1e435158c69d28e3db04f4339e19e

      SHA256

      84f7446580c13fa5a10b8791b45981efb558ebfae1cc1ffef4174fa291a515b4

      SHA512

      477b406177764a7a06ed44c52eab49baea8f94e9dd6cb5a7b3ffa3b3257c3062e085241d6419024324008fe6e55ad78d9e691a90346a8e4c19e3d6f4bfb3117a

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\en-US.pak

      Filesize

      351KB

      MD5

      06d28839ea0b3aab4597ba8646a53a96

      SHA1

      9c6a74aae8c783546d613c6f38cbfc8f5e3736f1

      SHA256

      69c1a2e1b30d83612decf1a8dd7b124a04f58e9f2465876726f02f7f7d5eb54a

      SHA512

      a432542dc98795ce0ea6fa4a6bbcbae8ba126f1fda025a9ad6ff3fa67eee85dcf7afc6678f5100bb1543c4d00ac75043ea92e64b65c9ef6bd946ce3dc4d5ae71

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\es-419.pak

      Filesize

      425KB

      MD5

      c753cb5296cc411ae72964735ce0de78

      SHA1

      4151545bc2cb9fe4330f3b238aeb28e9ff0dbd6c

      SHA256

      5fcf21564ceec93eb64d2002de165a55c1875859975e0bf9035cbe96f258b50d

      SHA512

      5688e1f406125f939840e8308d950a741a02ef24a006fd3619f3e943595630ce32010b51bb7a37768f1c595f4c77b104bb7483ca24ff599eb04434974d894c1d

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\es.pak

      Filesize

      425KB

      MD5

      c9e0b58f2d9e087b2e8e92d31be2a3e6

      SHA1

      59a43b7021860db2d2a7fe8ced8fd1a4b0c8322c

      SHA256

      468e0143c978a948c62d4a3dc743099a4147d39773a6112b303692d0e335810e

      SHA512

      16160e6375fdde1ec2e17ba8622c9c953a46372143d0b09a33ee55852b2b9f037c1c16dd5bb6bd1f2454559dcb172c8317aa8b6c6b26d44e8da706eb16ec5f07

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\et.pak

      Filesize

      384KB

      MD5

      ccd361017778964de23bf1d741cb888a

      SHA1

      5b0305538762987901b7a8332635f3d7996c09dd

      SHA256

      41883af1e49cc180fb48e02659e75b0169d974d77373cf7bb2a4ea02dd654e26

      SHA512

      a9d7c99c07229d382e8ba7cc3199bc66fc39df5fd9b58e6a76e423b865f8c05f53398125a17a20c27462b2db595f3d778b4d94b1853121d8447b771f9284e5c5

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\fa.pak

      Filesize

      629KB

      MD5

      87a2305436bad7556fe7abb68767802a

      SHA1

      0edad3677b0872321a1f8f3d391c17ab373aba17

      SHA256

      9068dc6c71fd8bbc1a4f3b2009689472d1fd2c096b7e8afb3e089a46b98d8b38

      SHA512

      6c32b1c83e03b553843faabb5a9c1b63c769b13de60841d2bc81f2c9514b30ebf16551acf33262ef8abaa4a5aa3955600a35a045b0fd446964109c58a2734969

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\fi.pak

      Filesize

      392KB

      MD5

      f87a1ccbcf3db6988e95e94333bc5a4f

      SHA1

      e85f8446eb74d8bd4318354ec98135c17afe3248

      SHA256

      052a72c9d6f2bb55f02fb1c5c4c68525a32b8cc9120c270d07d7b813d604f7dc

      SHA512

      c4a7ee0552b343010fce8ceeef70620acf672c9ab56fc24ccfb88abdbad23aac4cee65c8b241c594b7ec92d0841087485aeda583d2e887cf4c823a10b2e7cd3c

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\fil.pak

      Filesize

      442KB

      MD5

      2e6a6728bd5a09339ac01a38bf686310

      SHA1

      619e27f30c99eff8f2df3ba2287c6f7fe0b5b063

      SHA256

      e8f03c2e9c88adb04648ef93f9ea3cff87641638ac97c9a6752b751e7f7a8a20

      SHA512

      0452ac74eafcf971265de92041659c006b5e559919b895b41795bb1307ee7c302e873440b006485b7cffcdab0f6b908a119683fab40a664d5bf3591239427c00

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\fr.pak

      Filesize

      459KB

      MD5

      8e21cec6cb5732fd2baa28f3e572ef7d

      SHA1

      778228dee97f5475b9982375740d6f90e8e5fe0c

      SHA256

      cd21cae54eb6cb115771d1afe14d17822e13332759f8710d6386a6e4277c11c8

      SHA512

      07726afa312f6104e3d92c6be13fc4b0e728a4a21f643c9552a961784063d3c8a9c52e5649ffaa9fd6a083dc5de37316e0d2cc10cd1a6fbeb83789c385ae990b

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\gu.pak

      Filesize

      886KB

      MD5

      0c33e2a35eaaed3572f31e7b24d4493b

      SHA1

      278498568109ea7d6cb34c634316f95b04155b64

      SHA256

      0f0fee8a2f22f80a0c4a758e7f4fd90d40be4048dcab0d824135caa5e92efd5d

      SHA512

      4eebf9be5a8c317d2d2e8e9b1e607774f5c7c35af7d8bd6c80326fe3c6e2e05089f04485eedde8be8c7b71a7b49e407289f361361d86802c0463c5b6b296f2a4

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\he.pak

      Filesize

      549KB

      MD5

      8b3957dda3c9fd903d2c4b8a5f686475

      SHA1

      36e45b4d30fd1e59ecafe095f405e0722a814a17

      SHA256

      ad20b3d634130c247f4ff954f1a5c56687523e5610f2ec6085e257126c4513a4

      SHA512

      1dd54ce0a1f30ba087a9d09b9aa2928dec3070788d7db3dc2bbd27fa6126f70fa1e05106a1503602b203fa76be914210a38d5dc9c6bb56c56857ef08c528c4f2

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\hi.pak

      Filesize

      928KB

      MD5

      4eb5c501aecb647fa81fb4b65b0cb6d6

      SHA1

      5154741cceb272352f0814850e75b517f7f8a023

      SHA256

      71830814b8c7028a114a53a4e715ffa8da12f01d920455242a0cbc35fef48e6b

      SHA512

      2bf32962d4f018959281f6f09d149aadd901c21131ef25aa1199ecd73dc16e2377eeeb67352e030198aa280ac1fd5962eb226fc6481c654d8d332751a20329d8

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\hr.pak

      Filesize

      428KB

      MD5

      23fdde99818ba28131a6ba81decf2c1b

      SHA1

      c1a87661f80c7dde9a08a360d2f5b72f58042076

      SHA256

      08fc2b1e6b9652d809a7550f1343b3ee54ebcbad0fe74b009aab6ef926c0279b

      SHA512

      0f53b131d142c7b88081afa59f10e17be489c342f2e328d0e7bcaa18b5dcfa599b37ca09317aa9ae564e52a3cea06d79021eac6ab5ab38a9c0ec99bdce797e9e

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\hu.pak

      Filesize

      460KB

      MD5

      2fef83993a62f73f8e4b40a6e28a085c

      SHA1

      8bae181f3eed8d5ea8fb0f912c679e608ee7c008

      SHA256

      ca4b4c7c7be45ea0871abf7d5668ab948f712a02facdc1d6bbc189b1b3522446

      SHA512

      6eed29acd38b662f62381a5c00ebfb254915a57de6fde8e6da77f60dffd13d4846b26b1897d710ef852bcec5728a4460becaed2367f1a06a066da77521701324

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\id.pak

      Filesize

      377KB

      MD5

      0dcb56f6b196199f7ed802c06b774037

      SHA1

      f62edd5e814d05cc4aeb5574fc63acfdeffb6010

      SHA256

      bd512e36a88f0d7e6fecc0b559adb2761589947fef9c253dc350cd8d6ea889f2

      SHA512

      e03474255bce20004788475ee1f546ee7830e9b9960023b15210d88347032b5376848aeadef3e953ec654d3905baee37279bfaa287af7669ca66e382a4b1344c

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\it.pak

      Filesize

      417KB

      MD5

      47c89f9ba4993e7cb6640c23f444e9cd

      SHA1

      0e3755d2835742b7aa4e1d5245454f7cf22a2d47

      SHA256

      95bbf94625cf0476124763cebedcf5ee46148bb6b5c006f86540a02e8d8c883c

      SHA512

      948e4da235cf7d0272fd7a99e7238596e5d50913886fc73fe35f9af17d1087f550a3cc3251ee6595f9872ef0b88e75725405382e6aea4850088e068d5b80922d

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\ja.pak

      Filesize

      510KB

      MD5

      afd423713e28b3980392443f31dbda7b

      SHA1

      926560b21af422f22e1cca1a4a2948ff988bc6d9

      SHA256

      88383ddccacb53f3ce5918cd80b5dafb16b3cf1fab295e230cc15490600615e4

      SHA512

      1544f7a91b4b63bb80f651833a931204e44745bb0bccfb5564ee9af3149218f140b6adfb6d4ebb5ce5e82f5c345c098cae8a0637b274c42f6711aa53877b0bd4

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\kn.pak

      Filesize

      896KB

      MD5

      b783889d2bff30460591734c846e7133

      SHA1

      60777f9c7a3caa62acdd3c3c39f929a20fecb40f

      SHA256

      515752677b32f6aaae901555d5e6ba9c50e1589f73b1e635070e6ef32a91538c

      SHA512

      8bd98e467b490c7e7dfddc6341c6db99631d2bbf314ff0e01bad50ce323b84d82d7df532e56b4e3f4cf0893aedfcf2cdd3f067d711e6f7c74529b93b7f9daa29

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\ko.pak

      Filesize

      429KB

      MD5

      c90a42bb27bcbf1bd345dc998f9e410e

      SHA1

      66f8bb72db6b38e2d288959bcee3c43caefdc59a

      SHA256

      56100d20a59fe6cb333f57ffdef90157324ae1b90194e852478daa8c46d29de9

      SHA512

      b5912c895a6a3b391555efc10b15d45fe9a84473c8687327b7d2fa033711e437e2f160345daefd554374357e0afbaeda4a25f4f69ca74e498d7081062f299b46

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\lt.pak

      Filesize

      463KB

      MD5

      06d8db8aab68c565af14bfe408ae4daf

      SHA1

      0898fd0ee4d7380b93b8fb3d4a1816eb810ea9a7

      SHA256

      ecb4ecbd96575f6f984f60e85ab1ebb0067e73174ff9912941ee1aaa28516d93

      SHA512

      1ebc04cca7e3bf005f9befad5a81736fc572383a636c7237e4206e75b05befe49f967427f912c97758aa392f9cc2dcbdf07c471562cb4ccc90f7d8e951c3ab9f

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\lv.pak

      Filesize

      461KB

      MD5

      f8a5403bd91f231db58e77c9d4514e2f

      SHA1

      7d29e2d8459af6fc3082cec0d9638daf5275bf3d

      SHA256

      dfb9b5ee446977dc0435cff4d66402d3a9426edb106effdbb7d86379527c5956

      SHA512

      f491cffdc5cc588f7ec70f87be84615aaf5b39e9c990cd9c835e65beb27f26334517abac1af7419f2b7b18f94c369037c8df4c1c8e26a5fed4288d477dc0874e

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\ml.pak

      Filesize

      576KB

      MD5

      23845ac97b2fd0fb2532eb0114abbdf5

      SHA1

      7ffe38c8cae483282426e3f10b4c4418f765c013

      SHA256

      4abd25103a060c1b8dfc2ffe9549b5a5a4cb83b49b57fd11e5fc7a58f6eb4648

      SHA512

      e39eb2cdf9a2a525b74236be8cfd57c5217c34a5e6880f88435a5e37263dff6a711aee214843570d389a80ef232a8459618eaacef1cd712e67cf6b7f2666fb05

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\mr.pak

      Filesize

      846KB

      MD5

      11d005b5ec329b4ae8311d7040ec3e8f

      SHA1

      83f01d5ca21bbeadfc601516eb63275158af31fd

      SHA256

      fd9827131fe5dd12a905ed9b34b5f7b472ed5a9933f5014687a14ddeef502838

      SHA512

      2d3b74da8d1f6a190a43aef1674b24b9b4942b9732cd3e3883c63956a398bf7a459ddb786992a2973e4611ae28ee1262924b08d068496febfbf07f7165be65ec

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\ms.pak

      Filesize

      395KB

      MD5

      2c4056d84b980267faadd69d52c17086

      SHA1

      3b3c5fcf182d86a170c8f35c041bf3869a82b362

      SHA256

      163eb7ba5f0c61acb6443709c24e38ca6370a33f89a12e13d0a57c258a87ca16

      SHA512

      47285ab42b46cf7d6556eac2a8f7afb9a9c9abe8cb026fe847b2504e4dbddd481a98c1ea959c74e31f195ecdbb618a3d93df8f20b797411a8bf2b3856fc9b963

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\nb.pak

      Filesize

      386KB

      MD5

      23ecce10db7753622fd7cd956aa55212

      SHA1

      52affc68e91448d8aecf2396f02ede77d4ea664f

      SHA256

      29f38d3720c948fd261a2aea7d195e861a73a1313071bd2cbf1ebcbba77c63e6

      SHA512

      553543bef496052995e33e2f3e8bd66ac845351cd292623479a303261900c393cec35af3e0ecd57db84197e6f7653ffa4eeaf4950647ae2d5304f961890deba1

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\nl.pak

      Filesize

      398KB

      MD5

      54817be286dbfd9de461f42304eb72cc

      SHA1

      79386881a11e6c7d49f2d117822c29d7631f3830

      SHA256

      3c682e37df71cc036c2b5e91064407fed8091c0306a856121e28c19e7110e1e4

      SHA512

      d8f922b028b03c6379911308cf240d104b40a9c46f67a6ddbbfcd20110c287e8106376cd6e8295915d054e05b2a8a045b3ab8d98932c1be97b1f258525db1a68

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\pl.pak

      Filesize

      444KB

      MD5

      41cb68de75d011281c7936194ef8457f

      SHA1

      6bd3efbf5142769c6fbe8478185edf89f471716a

      SHA256

      d52358b8fd70f1f18b3f8ecc4aa9c791591dbb698ef8d8670312e50f024db451

      SHA512

      ceb90fa9f723c3d8d522a401cb46545c72a2ddd1d04f091e9d7ca5212cedcc641c54cb8fe19595e9c823b2ed374757e5ba7d1813cd763bbd8d726b1e2ebe0407

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\pt-BR.pak

      Filesize

      419KB

      MD5

      4f3f65f6639ae1905fa37b9b6ee2e4d4

      SHA1

      07553f41c4f8f3d105eb92b65497c4976449a6b4

      SHA256

      b4e0a6064dcfe876c819ec4b00f9857b84ff52cd3e845bd0c48e31ad43a23db9

      SHA512

      85cfcaed8fa2026c13735e7d4b6852bf794dd4a8ac078889d5ef46ec2ff7173ae443addcb0b0c711f6a31f80469fc1df5af1a78da6397d9df5e33cabb354fba2

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\pt-PT.pak

      Filesize

      420KB

      MD5

      7074036013be3839e218ec7b15d49215

      SHA1

      7711ae4e96efd4f4676a3c0281a92af56329deee

      SHA256

      342381f89058bedd809991a0b416f48642df3c71aea10bb13e13bc15eaaf46c8

      SHA512

      8a1e9cefb8a64b3664d9496e2d2f76e2281b3c427fe24ecb70ee74f78778d94def66787a7e35ccde6037ec061e29a6ac7fd8b4010f77b13945780e1316bb16e0

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\ro.pak

      Filesize

      434KB

      MD5

      e66343d1af0b8f483116ad7689e7faba

      SHA1

      a245b6aa9309a7c10aca8502cbd10d9dcbd5d8de

      SHA256

      b7b56396806412ac1721d2648fa98a89a069d1f58d359d8e90dd1c6b8473b9a2

      SHA512

      9f6517aae57f3d8a65d4f9b354b7ed9923c1bab8a414b78347f4dc375707907d16d458d9d458d8fbd28f065e268e092770fbc198833315ce14e6eecfc0d3f0aa

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\ru.pak

      Filesize

      704KB

      MD5

      79ada1cde278541a3c8d621c5f25e81e

      SHA1

      8bc77868547c22e3031591409e013f3a26b349aa

      SHA256

      1fe1b3efedbd4c00ebcb211b25e02664fea72cf45eb476fb82dd3c9d9e82dc20

      SHA512

      8e1220ba43ff2ea4ef0e02fb98eff6b487c849563bb507dd14c34796def36f134a340e1f3e7cfe64b3256ff2744d37a4045be7e4e69949cdc0ad644ba5a9d431

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\sk.pak

      Filesize

      448KB

      MD5

      f5dbbc48473d420fbd8c4cdda3eb9a41

      SHA1

      d7d871aa8ade01ff59a0a913493af12c88ce9283

      SHA256

      46c50c36b507449471f1bfbaadd4ce9ea8d5e4a67a22f217c9996a1e87749363

      SHA512

      026da918f5989c1d5b84673429c01d5c659e111d47c8a9e9264947f71bdd2da087f3beb1a4363349eb07631253a7d0fcb05fc6216eb1c15404e60c68f50d9764

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\sl.pak

      Filesize

      433KB

      MD5

      1b02b0834b8bbd12a77f7fff09e1d81a

      SHA1

      1898cfedde55aae307f7578b88cb0bcaf61e1d52

      SHA256

      b36e1fe2405cc4b9f34587e30da2feadaa6f03124769b02f79333adacaddb49b

      SHA512

      b1006053ace6f8842e9436c94934b2e7d1b502e3df9ecd1fe59ab39ae35e69e8f0dcff8728aee2c35a3a1eb7a27f0146d6113b4de0632dbab20eb0a37942bc4c

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\sr.pak

      Filesize

      640KB

      MD5

      1c0a354f31fda4542e8924b544b64db8

      SHA1

      f7d47dd49be940864db13e791a2f7658603ad2ad

      SHA256

      a7e9dffecabc28ec572b907b0aad633e61e8dce081f0d46df21a4a2d9bd31412

      SHA512

      fe68f2859b1c0419e0cbfd278d0dd75aebe348661aced690776687977f0c9d48206c05768f1472cb03ea1321267cd3c80102e555b8729c9f442eb9013563f8d7

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\sv.pak

      Filesize

      389KB

      MD5

      094d69544816535e4d040ef0ce923100

      SHA1

      5891cdc73bc4c112855d099ee112da0c3e9cea81

      SHA256

      110112c2f7ff5d3c8599036669d156e96ec19e70515fbba3bbcb2043ab994680

      SHA512

      023037077a3482a3bf2ac076b5c00922d7039bfc2098797275465138142fea0f97c1e003f77de71b9ab88f786b7401182618603610c51f634ad17a123faf5bd4

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\sw.pak

      Filesize

      408KB

      MD5

      bc771a0e8398e14653d9a4373a73496a

      SHA1

      6e844c7daa666640ac3093d5e51276886a0f5a66

      SHA256

      7a5d056fd317b7b60a4fbf0df39dfdd21829f2245393a21e1ddccf1a4e3b61fe

      SHA512

      79b916c737bc44051e6b4c0a9afdfba26928536034c5a5149586594454855b7074f6f8fdaeb98f0b7bde5c3da36d66988f683de8961e13c9c82301676f942998

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\ta.pak

      Filesize

      640KB

      MD5

      51ecbdeb9341a845e4aaa71c4b86eccb

      SHA1

      8c1fd1d150d38bf66bb8883639b3db54271be2a1

      SHA256

      1b99e941ec6ac55e8011deeca3d1509e7bceb7f3cee164d9c548ed8c86312954

      SHA512

      31191cd62d13bb042a1514e9a93db7282c7a72af6ae94d24b635207e9f2e4b9531485318a34eec19528287604280d54f9d88ebb4b4a810d3768695d646a8f294

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\te.pak

      Filesize

      320KB

      MD5

      d4b7d5c238e970fe830f30dcb93b5fb9

      SHA1

      13576e3ad29c191ed7d00e597ca18acad87ff241

      SHA256

      f52146cfa1554c67d8e122f39539ae4d2bce87b0324c82a526737412c794c062

      SHA512

      9109333d2b615741053bc5f5269e463531c5e85941c9005323ac373832db4b0d69cee6b1c4c469b19c2291b1c6ad53eb3e75681af2e96dc7cab488b069141dc7

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\th.pak

      Filesize

      640KB

      MD5

      2be161fbf156a5c49e31596105b9d7ea

      SHA1

      2109067e0b8c64382496a34f72215c0ea5517611

      SHA256

      1b2ee60574412c38151595db8cea38c286ad7bb01bfcd1bc4fa482611f99412a

      SHA512

      f9aaf482859f3480f8330ecaab95bb843c4dd747a3fc5995423d9a59ba95eca15c85763729aeaaa52a428bae9c40d27292ef1b2496d51fc5e7e4f4a9d99f41e3

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\tr.pak

      Filesize

      415KB

      MD5

      418dc1cdd7ccc10679523665e1626280

      SHA1

      d4407ba9bc55153963150e6e30f23cc5b2304e30

      SHA256

      26fd3317bedd4080038d7a0003d73923fc0edd40283ef11b5ba80bb27f946c13

      SHA512

      4a907bf14dc9cd8ecb2f17152ff5ea0a6dc37034c95ed31a445395bcb9ad6fc23d4117e81f94ac82d767869b0b828738eacd33b810df87dd41cc3ec2d5b92e94

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\uk.pak

      Filesize

      640KB

      MD5

      b358c785a69b8c94896d896fed9f6e64

      SHA1

      5349e9ec9376a872f72eb841a0861eacf8a8bfff

      SHA256

      32b355d6b384c63c423eb3e6cf918689e3e2d3d835874ef11cb68a3a62427be4

      SHA512

      3544efb1c935bf3a543a38ebf4ced67bc61d7c5075ca72eb2ad89f23c6a555310f9cc91207002d48a8e290f25e664d68e828cccfed248fea0d011df41c9603fd

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\ur.pak

      Filesize

      622KB

      MD5

      8d6fa97205a1d2b371a54144aea453ca

      SHA1

      11a77318f571d15daf7ad047b06e1ec8a51c8f8c

      SHA256

      578aef61fc8b5c2e0f3765b1487f8af9f72f6506050d501fec9edcbf93c7a3e4

      SHA512

      9c8dbf1126b97bca195c801b81afdbd8f68e8f44ebd57c563d63f6c1a3f7fa08b1abc76e25a28d1eb2cd8bc47c9438f23b72063f081f0bce6b8f48bd90a56433

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\vi.pak

      Filesize

      492KB

      MD5

      7b2cbb79992021e2fa2714ae9cdf0728

      SHA1

      a543c9b6d4dabd48c6b5d995cfa3c915a2b76433

      SHA256

      326e44c27579796e4b55cc281c3e4c9bf5ad7aa87156530709cd6296350758af

      SHA512

      5c77c2dd9e5ee9d381a2524c733d3ffb55146160393bf919ed8855781d1e8ed0c4d707bd71554d7868ff53bc546344a415e846dc15f68f0e7630d49a94f14049

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\zh-CN.pak

      Filesize

      357KB

      MD5

      d15fa5c75a835983af2663466b5a8494

      SHA1

      6580f7c91e31491a296a039f681c93810281717c

      SHA256

      b33b23552f8f76aa43671556676298c0af54641e9f1de27a8208750148e737ca

      SHA512

      39a63db44e1e2b67b1937af803336b221bbe94d3bb31b2117530886fb9e66131efd0eb3969c251d2ee264a7c07bdaecac330c97b1cbe74b3988cac6ff86f3be5

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\locales\zh-TW.pak

      Filesize

      256KB

      MD5

      8132ffdae303f6b47c8cced1e39f1545

      SHA1

      872d6e549f6c6f05c4c8c32ae0d3b4b807837f98

      SHA256

      f47a8c31422102fd4bd0937034e7c95d983fad3385162f53f5cf6991555899e2

      SHA512

      68d1e141164265e3835bfa517dfd3c14c261824aca9d0adbc9e6cc085a6b870dc516ccb4821d53fc7b35b24a85daacf9504d50d908ee39689f6b0bfdbed217e2

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\resources.pak

      Filesize

      5.0MB

      MD5

      043dbe3eaf0bde424185a3843e321f83

      SHA1

      580ac5fde14e6d177d6f45d2e40d435cc7edc8d0

      SHA256

      0c967cb604d5066f1ab609e81895c1271475a2e1b4b3d5930eea720fc218781b

      SHA512

      44814aaec681922594528d0ed1a4d2e935045220d09e065647b53455931eaeb3b737c87032b611d7ead621379ae653a9c5d6d87c828c1961c54129124234ebc3

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\resources\app-update.yml

      Filesize

      175B

      MD5

      9fafe2931214f36d81e3632b0be80774

      SHA1

      cac08ef88b787dfea0acc0d18e559fd9180819ba

      SHA256

      9161bcc9763091ff3670ef98eff99d004c0f67f13b5dd94715c661fae274cf33

      SHA512

      a671cec02c8957864797cad7657b4d2165b40980410db0696cb6dbd05b9485f0491065f1249461fb7777d73cba601f8d1035c9c2718a52a56a217da859c03217

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\resources\app.asar

      Filesize

      192KB

      MD5

      dbea42a8377834b335c9614d6fbf28a4

      SHA1

      1465bba2fef642a1680aefc406b3591e862bcc14

      SHA256

      f77fbae0a8fa431b96bcc80689c160bf4c380911bc58576f5a04f26b106978b2

      SHA512

      18dbaeb8b7325157e062abb169e949fc9aec4e0084d822fc63bed3dbc839690da73fd0a653b67cefe5fd2e67dd83a80b99a6da7e8f6296abe5c949c0bc8e263b

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\resources\elevate.exe

      Filesize

      115KB

      MD5

      b33d236ff8fb7aca592b9e1e12c9da4c

      SHA1

      df6e78e4127f7e3060547b8ad17b2d49362e2421

      SHA256

      e439b50cdf14e2e9fe147a0d819ab8e675151f60f91c5c356cccd42edf4b22aa

      SHA512

      07439e198fe7c8ba96f9983202c1a7ce3f4f84b7a77ee8b8001771f74da595e8d11b7ffc76a4ae690d43aad158a3441ba65a82568441753ff7e8b72086c19838

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\snapshot_blob.bin

      Filesize

      253KB

      MD5

      3a4095538e021b84396b3ce25affafc3

      SHA1

      cfc20771227b3c1f3197ff6a91cee68555afb247

      SHA256

      c1c9145735032bff20b2fff50a4b92ae9cf47290f433e3f3b32e3b232d610c59

      SHA512

      7b71083180f237f5f37cbe7a9755f6606708b959986562f9c5880cccea17b80a5187649fc0cb6965a8b40526bcb2cb6d980d364be528465290658b4d9084348e

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\v8_context_snapshot.bin

      Filesize

      564KB

      MD5

      5db8a5bb87c7999343f30128979057a1

      SHA1

      c4177c2fe973a495db59b6228ac26264eec46a4d

      SHA256

      5b1f69f39f3d5865dce13ee3bdbc1af2938f5cc4c056dc9f9e213e9af346ad4b

      SHA512

      da2d516251376952729a33de2cd23764290d400fafc49642f2ccd799e3f989cce4d5561a76d380a950b77b53b50148dec9089c30de6c3dc38666237e196e569b

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\vk_swiftshader.dll

      Filesize

      5.0MB

      MD5

      b06a97b925991eac3832437d7db078cd

      SHA1

      ca32356ba0938ada1233e13795860690712fbc14

      SHA256

      2df870c1719ab057ea37aa15e3e379360c1dd8eaea2eaa56cb7b026f5ee4f19f

      SHA512

      e1e61c28a28dfcf15d69e9ccc8e289dfe606b926e21756bbc0f21e15df18d27b1926277ffc2bd6549cdfb17f11d71c2a9353392e58c33557209b781ec32cef9e

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\vk_swiftshader_icd.json

      Filesize

      106B

      MD5

      8642dd3a87e2de6e991fae08458e302b

      SHA1

      9c06735c31cec00600fd763a92f8112d085bd12a

      SHA256

      32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

      SHA512

      f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\7z-out\vulkan-1.dll

      Filesize

      910KB

      MD5

      d562628f9df56ae61770ffdef79c8d05

      SHA1

      2423105a960fe0ceb038ca36d6a37638ebd32b6f

      SHA256

      5789ca1822f3a5a67cd2c24e6ff0307e688b76a2e99831050bdcf8b8d155956d

      SHA512

      739f9f41d8e3e48dbd20bfecfc5679f38e59b3fc8cb406a77c384fd5146f19efafa1e4f23f15071dbeaa1d0dc71e125966e19fb757fc39e6abe953159669c096

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\StdUtils.dll

      Filesize

      100KB

      MD5

      c6a6e03f77c313b267498515488c5740

      SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

      SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

      SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • C:\Users\Admin\AppData\Local\Temp\nsy2991.tmp\package.7z

      Filesize

      192KB

      MD5

      82c47046b3fcc279d672154911fbb33b

      SHA1

      558b35fde8d70c963380d787dc3030516cd4e394

      SHA256

      d719463d286c2331e683ea76f279329884daefd5a7c71b435bba3e1c17c91e00

      SHA512

      fa0e60f9df53512b0f6a83661dc60c70063a67edaf97b4c43c43a76d94b9d07ef38675b969a20d51cca6901f35049d7d6979cc47254c192063ac9ae7aebda9fa

    • \Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

      Filesize

      704KB

      MD5

      aeb3c990cb9b4c9a5f2c68a448c2316b

      SHA1

      5cd3d9aabff9c2ce86b59dec5eb42d31015b8e1c

      SHA256

      1b157e45847cfb519976471d55bcb4e36b5129e77cc5e1ddeb62750259a3a67d

      SHA512

      7d4bccd10ed03f4d54581a096d01a48225aa5b1200afdc27af80be5032fd6d7689b375e247cb9b39c8edc154b56b94e552fa5a013374ddc22b300a5c71882de2

    • \Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

      Filesize

      45.9MB

      MD5

      5e38a130e29886b28521fec594e3337f

      SHA1

      848a84d5ede39872a0b1516353ca1da80ecc966b

      SHA256

      cfccfc1039f60ddba619d71976f463feffa1f2bab102bd68dcd96ffb8a4a729e

      SHA512

      358262583991c3b47b20d54f95a0efdfa3dd323804ad8d2e18f7846c2a9e09d037f598cd85360a0fc91686d05ffe1ef509e97528daf1779bcd80377f22de7538

    • \Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

      Filesize

      8KB

      MD5

      c6a02d5d70a182478875e4cf6104b3b3

      SHA1

      a3359fc122de1c17237f8ca6d96219c03b867c3e

      SHA256

      244e908cd3c284de36a50e25b69f4f84be5a4c67a252cb51ef4f6dd97a76e790

      SHA512

      a81d64a575e30734cb22203901e8dfa89669ef32dc4f1a2c5f0c9955d6f0216f75d8cd575589c36e6b08c046ee68da0d0e7f81fbfb6dc6fecaaaf351676bcfa5

    • \Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

      Filesize

      1.7MB

      MD5

      5684f22ba8a5feddb8659fba23981a9f

      SHA1

      3a66daa57d588e268ef984ad75ec3a1cfb54993e

      SHA256

      e2a82bb077620334df1b82a43bd73ce0352b1d4a9cad0094e9bb20e491f92600

      SHA512

      718dc2e4a2d4ff50c49504400eafd8eba545aa4f8a0645376c57f23447925223c0cfe7e5ef5e1bf283e367adc3723bd950603bcd6e4618eaa9672f491bbd0550

    • \Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

      Filesize

      64KB

      MD5

      14a55c52e32ff085bd49242fcee54b85

      SHA1

      8aa74a3c1458ce59f949c60cac804a024203afdf

      SHA256

      16e3f213e6a7250ad3f070183ccc58a79b662022ff481226a9c912c2c52d4df1

      SHA512

      b29c0b854bee6270279dee83ce348b20ecc0d3adbe624e853223754b177d88bff5b3d91a5836db6da8ea9ec0c267b455bd7e2331cccccc082cb453dd21531463

    • \Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

      Filesize

      2.2MB

      MD5

      09525fc46ec6bb94c55a89bbe71b8dee

      SHA1

      a137d964d73c9b71e0d5fdca0b4c7ef28397afcb

      SHA256

      bc9453995c59ab431c06bb01c6cdf35b1c689c836887d72b144115fb8002ff9e

      SHA512

      d2cc6d8f7769326c5f7c0e584b44fa27bbc38cd199ec2129d56b769cd730a3b22826f4321cd612e5ad548b4b0a826c7b19f33c13fe7e2fdbb548328946b8ec0e

    • \Users\Admin\AppData\Local\Programs\launcher\ffmpeg.dll

      Filesize

      2.4MB

      MD5

      86ef3bb81219f639e31695a4519f7a73

      SHA1

      be672dd77cf4b28a5336c4390ac2d18a56fe5310

      SHA256

      5aadfa5e450ed66a3dadc601eff77682df6aea2d370531bdd5d124a970c60458

      SHA512

      17cf87e61de5efa33e96614a54443adb42daedba43dbdc4281e6dbb634a402c06d8e195cae011c12bc0a8b61b6039f100e6ef668c5757f629ae9e3220900e00a

    • \Users\Admin\AppData\Local\Temp\nsy2991.tmp\INetC.dll

      Filesize

      238KB

      MD5

      38caa11a462b16538e0a3daeb2fc0eaf

      SHA1

      c22a190b83f4b6dc0d6a44b98eac1a89a78de55c

      SHA256

      ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a

      SHA512

      777135e05e908ac26bfce0a9c425b57f7132c1cdb0969bbb6ef625748c868860602bacc633c61cab36d0375b94b6bcfbd8bd8c7fa781495ef7332e362f8d44d1

    • \Users\Admin\AppData\Local\Temp\nsy2991.tmp\SpiderBanner.dll

      Filesize

      9KB

      MD5

      17309e33b596ba3a5693b4d3e85cf8d7

      SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

      SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

      SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • \Users\Admin\AppData\Local\Temp\nsy2991.tmp\System.dll

      Filesize

      12KB

      MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

      SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

      SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

      SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • \Users\Admin\AppData\Local\Temp\nsy2991.tmp\WinShell.dll

      Filesize

      3KB

      MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

      SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

      SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

      SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    • \Users\Admin\AppData\Local\Temp\nsy2991.tmp\nsExec.dll

      Filesize

      6KB

      MD5

      ec0504e6b8a11d5aad43b296beeb84b2

      SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

      SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

      SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

    • \Users\Admin\AppData\Local\Temp\nsy2991.tmp\nsis7z.dll

      Filesize

      424KB

      MD5

      80e44ce4895304c6a3a831310fbf8cd0

      SHA1

      36bd49ae21c460be5753a904b4501f1abca53508

      SHA256

      b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

      SHA512

      c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

    • memory/2208-640-0x0000000003B20000-0x0000000003B22000-memory.dmp

      Filesize

      8KB